mobile devices

A company policy requires that all printed documents containing sensitive customer data must be collected immediately from the printer. A technician observes that an employee printed a report containing customer Personally Identifiable Information (PII) and left it in the printer tray for over an hour. Which security principle has been violated?

A help desk technician has resolved a ticket for a remote user who could not connect to the company VPN. The technician updated the user's VPN client and configured the correct server address. According to IT best practices, which TWO actions should the technician perform after resolving the issue? (Choose TWO.)

A technician resolves a network connectivity issue for a user by resetting the TCP/IP stack. After confirming the issue is resolved, what should the technician do NEXT according to best practices for documentation and ticketing?

A technician is setting up a Windows 10 laptop for a remote worker who will connect to the office using a company VPN. Which Windows feature must be enabled to allow the user to establish this connection?

A technician has completed an approved standard change to replace a faulty network switch. After installing the new switch and verifying network connectivity, the technician updates the change request ticket. According to change management best practices, what should the technician do NEXT?

A company's multifactor authentication policy requires two different factors. Which of the following combinations satisfies this requirement?

A user reports that a Windows 10 application crashes immediately on launch. Event Viewer shows an error with code 0xc0000142. The technician has verified that the user has appropriate file permissions. Which built-in tool should the technician use FIRST to attempt to repair the issue?

A technician is troubleshooting a Windows 10 workstation that fails to install a cumulative update with error 0x800f081f. The technician has already run DISM /RestoreHealth and SFC /Scannow, both reporting no corruption. Which built-in tool or procedure should the technician try NEXT?

After a Windows update, a user reports that a 32-bit application displays a 'DLL not found' error for a DLL that the technician confirms is present in C:\Windows\System32. What is the most likely cause?

A technician is supporting a service-desk jump box. The immediate goal is to start Windows with minimal drivers to isolate a startup problem. Which tool, control, or procedure is the best fit?

A company's password policy requires complex passwords changed every 30 days. Users frequently write their passwords on sticky notes. Which security enhancement would BEST reduce the risk of password compromise?

Match each security threat to its description.

A user calls the help desk reporting that their workstation is displaying a full-screen message claiming all files are encrypted and demanding a payment in Bitcoin to unlock them. According to incident response best practices, what should the technician do FIRST?

A change management policy requires that all changes to production systems be approved by the Change Advisory Board (CAB) before implementation. A technician has discovered a critical security vulnerability on a file server that requires immediate patching to prevent a potential data breach. The technician has already obtained verbal approval from the IT manager. What should the technician do NEXT according to change management best practices?

A user is concerned about the security of sensitive files on their Windows 10 Pro laptop. They want to ensure that if the laptop is lost or stolen, the data on the hard drive cannot be accessed. Which built-in Windows feature should the technician enable to provide full disk encryption?

A user receives an email that appears to be from the company's Human Resources department. The email states that the user must click a link and log in to view an updated benefits package. The link leads to a website that closely resembles the company's internal portal but is actually a fake page. When the user enters their credentials, the information is captured by an attacker. Which type of social engineering attack is this?

A technician is troubleshooting a Windows 10 computer that fails to boot. The technician wants to access the Windows Recovery Environment (WinRE) to run startup repair. Which method can force the system to boot into WinRE?

A technician attempts to install a feature update on a Windows 10 computer, but the installation fails with error code 0x80070002 (file missing). Which step should the technician take FIRST to resolve the issue?

A technician needs to enforce a strong password policy on a standalone Windows 10 Pro workstation. The policy must require passwords to be at least 12 characters long and include uppercase letters, lowercase letters, numbers, and special characters. Which built-in tool should the technician use?

A user reports that a critical legacy application that was developed for Windows 7 no longer functions correctly after upgrading the workstation to Windows 10. The application displays an error about incompatible settings. Which built-in Windows tool should the technician use FIRST to attempt to resolve this issue?

The IT director wants to ensure that all HR workstations are consistently configured with the same security settings, such as password policies and firewall rules. The workstations are all running Windows 10 Pro and are part of an Active Directory domain. Which method should the technician use to enforce these settings automatically?

A technician is working on a reception PC and needs to view listening ports and active connections. Which two actions are appropriate? (Choose two.)

A technician is troubleshooting a Windows 10 workstation that randomly reboots with a blue screen error: 0x0000001A (MEMORY_MANAGEMENT). The technician runs the Windows Memory Diagnostic tool, which passes without errors. All device drivers and the system BIOS have been updated to the latest versions. Which of the following should the technician do NEXT to identify the root cause?

A technician is following the CompTIA A+ troubleshooting methodology to resolve a network connectivity issue. After testing the theory and determining a probable cause, what is the NEXT step the technician should perform?

A technician is creating a standard operating procedure (SOP) for help desk ticket handling. Which of the following BEST describes the purpose of a ticket escalation process within the SOP?

A user complains that their Windows 10 workstation takes a very long time to become usable after logging in. The technician wants to reduce the number of applications that launch automatically at startup. Which built-in Windows tool should the technician use to disable unnecessary startup programs?

A user reports that their computer displays a pop-up claiming their files are encrypted and demanding payment in Bitcoin to decrypt them. The user did not click on any suspicious links. The technician suspects ransomware. What is the FIRST step the technician should take?

A technician resolves a printer issue by clearing a paper jam. After confirming the printer is working correctly, what should the technician do NEXT according to best practices for documentation and ticketing?

A technician installed a Windows 10 cumulative update. After reboot, the system displays 'Configuring Windows updates' and has been stuck at 30% for over three hours. The technician suspects the update process has hung. Which of the following steps should the technician attempt FIRST to safely recover the system?

A security auditor discovers that an unauthorized individual gained access to a secure area by tailgating through a mantrap that requires two-factor authentication. The individual entered by closely following an authorized employee who scanned their badge and entered a PIN. Which additional security control would most effectively prevent this attack?

A user reports that a Windows 10 application crashes when trying to open a specific Word document. The application works correctly with other documents. What is the most likely cause?

A critical server experiences a hard drive failure, causing downtime. The technician has a compatible spare drive and can replace it immediately. According to change management best practices for emergency situations, what should the technician do?

A technician has been asked to determine whether a Windows 10 computer is running a 32-bit or 64-bit version of the operating system. The technician is logged in as a standard user without administrative privileges. Which built-in tool can the technician use to find this information?

A technician is configuring a Windows 10 Pro workstation for a remote user. The user needs to securely access files on the corporate network without installing a third-party VPN client. Which built-in Windows feature should the technician use?

A user reports that Microsoft Word 2019 crashes every time they attempt to open a specific .docx file. Other Word documents open without issue. The technician has already booted Word in Safe Mode and the crash still occurs when opening this file. Which of the following should the technician do NEXT to resolve the issue?

Match each command to its purpose in Windows.

A company wants to implement multi-factor authentication (MFA) for remote access to its VPN. Which of the following combinations represents a valid MFA setup?

Match each Windows command-line tool to its primary function.

After installing a new graphics card, a Windows 10 computer starts displaying a blue screen with the error 'SYSTEM_THREAD_EXCEPTION_NOT_HANDLED' during boot. The system worked normally before the installation. What should the technician do FIRST?

A company is decommissioning several SSDs from high-security laptops. The SSDs were encrypted with BitLocker. The organization must ensure data is unrecoverable while complying with environmental disposal regulations. Which method should be used?

A technician has completed a repair on a user's workstation, verified that the issue is resolved, and confirmed with the user that everything is working. According to best practices for documentation and ticketing, what should the technician do next?

A technician resolves a ticket where a user could not access the internet because the network connection was disabled. After enabling the connection, internet access is restored. According to documentation best practices, what should the technician include in the ticket?

A technician is supporting a finance laptop. The immediate goal is to identify where network path latency or failure begins. Which tool, control, or procedure is the best fit?

A technician is supporting a service-desk jump box. The immediate goal is to protect components during internal repair. Which tool, control, or procedure is the best fit?

A security analyst is reviewing logs from a user's workstation that show regular outbound connections to a known malicious IP address on port 443. Antivirus scans on the workstation report no threats. Which type of malware is most likely present?

A Windows 10 PC fails to boot with error 'Bootmgr is missing.' The technician boots from installation media and accesses the recovery environment. Which command should be used to repair the boot configuration?

A user accidentally deleted an important file on Windows 10 and emptied the Recycle Bin. The file is needed urgently. Which built-in feature should the technician attempt to use FIRST to recover the file?

A technician is asked to create a step-by-step guide for setting up new user accounts. Which type of documentation is this?

A technician is deploying a critical security patch to all company workstations. The patch has been approved by the Change Advisory Board (CAB) and tested in a lab environment. During the rollout, the technician discovers that several older workstations are not compatible with the patch and the installation fails. According to change management best practices, what should the technician do FIRST?

A user reports that after connecting a new printer, some documents print correctly while others print as garbled text. The technician checks the printer properties and sees the driver is listed as 'Generic / Text Only'. Which of the following should the technician do to resolve the issue?

A technician is working on a reception PC and needs to run an older application with legacy Windows settings. Which two actions are appropriate? (Choose two.)

A user reports that a Windows 10 application displays the error '0x80004005 Unspecified error' when trying to save a file to a network share. The technician has verified that the user has write permissions to the share and the network connection is stable. What should the technician check next?

Match each environmental or safety concept to its description.

A security auditor discovers that a Windows 10 workstation has the Guest account enabled and is a member of the Administrators group. Which security principle has been violated?

A user reports that a Windows 10 application crashes immediately on launch with the error 'The application was unable to start correctly (0xc000007b)'. The technician has verified that the system meets the application's minimum requirements and has run sfc /scannow, which found no issues. Which of the following is the MOST likely cause of this error?

A user reports that their workstation is displaying a pop-up message claiming to be from 'Microsoft Support' stating that the computer is infected and to call a toll-free number. The user called the number and allowed remote access, after which the computer began acting erratically. The technician has run an antivirus scan which removed some PUPs but the issue persists. Which additional step should the technician take to secure the system?

A technician is troubleshooting a Windows 10 workstation that fails to boot, displaying the error 'Bootmgr is missing'. The technician has booted from a Windows 10 installation USB and selected 'Repair your computer'. Which tool should the technician use to repair the boot manager?

A technician is supporting a finance laptop. The immediate goal is to support repeatable troubleshooting and handoff. Which tool, control, or procedure is the best fit?

A user reports receiving multiple emails that appear to be from a colleague asking the user to wire money urgently for a business deal. The emails have slight spelling errors, and the sender's email address is subtly different from the colleague's real address. Which type of social engineering attack is this?

A technician needs to configure a Windows 10 computer to automatically log on a specific user without requiring a password. Which tool should the technician use to configure this setting?

A technician needs to configure a Windows 10 workstation so that a standard user can run a specific legacy application that requires administrative privileges. Company policy prohibits granting admin rights to users. What is the BEST method to accomplish this?

A company wants to enforce stronger password policies on all domain-joined Windows 10 workstations. The IT administrator configures a Group Policy Object (GPO) in Active Directory that requires a minimum password length of 12 characters and a password history of 10. After applying the GPO, several users report they can still set passwords with only 8 characters. Which of the following is the MOST likely cause?

A technician is troubleshooting a Windows 10 workstation that is experiencing slow performance and high disk usage (100% active time for long periods). In Task Manager, the 'System' process is shown to be using a high amount of disk I/O. Which built-in tool should the technician use to identify which specific files the System process is accessing?

A user reports that a Windows 10 application displays the error message: "The application has failed to start because its side-by-side configuration is incorrect." Which of the following is the MOST likely cause?

A user reports that a Windows 10 application displays the error 'The application was unable to start correctly (0xc000007b)'. Which of the following is the MOST likely cause?

A technician needs to apply a critical security patch to a database server that runs a line-of-business application. The patch requires a 10-minute service restart. The change management board has approved a maintenance window from 2:00 AM to 3:00 AM. At 2:15 AM, the technician installs the patch and restarts the server. After the restart, the application fails to connect to the database. There are 45 minutes remaining in the window. Which of the following is the MOST appropriate next step according to change management best practices?

A technician needs to create a bootable USB installer for macOS High Sierra on a Mac computer. Which command-line utility should the technician use?

A security analyst confirms that a user's workstation is infected with a rootkit that is actively hiding malicious processes and network connections. The analyst has already isolated the system by disconnecting it from the network and has created a forensic image of the hard drive for evidence. According to industry best practices for incident response, what should the analyst do NEXT?

A technician discovers an unknown user account with administrative privileges on a Windows 10 workstation during a routine security audit. The account was created two days ago, but no one in the IT department authorized its creation. According to incident response best practices, what should the technician do FIRST?

A user receives an email that appears to be from the company's CEO. The email states that the CEO is in a meeting and urgently needs the user to purchase several gift cards and email the redemption codes to the CEO. The email address is slightly different from the CEO's actual email address (e.g., ceo@cornpany.com instead of ceo@company.com). The user suspects this is a social engineering attack. Which type of social engineering attack is this?

A technician is troubleshooting a Windows 10 Pro workstation that crashes intermittently with a blue screen error. The technician has updated all drivers, run antivirus scans, and checked Event Viewer, but cannot identify the root cause. Which TWO built-in tools should the technician use to gather information about the crashes and system stability? (Choose two.)

A user receives an email that appears to be from a known vendor, requesting payment for an invoice. The email includes a Microsoft Word document attachment. When the user opens the document, a macro runs and installs a backdoor on the system. Which type of malware is this?

A technician is supporting a remote worker laptop. The immediate goal is to escalate a ticket that exceeds agreed response time. Which tool, control, or procedure is the best fit?

An annual security audit reveals that multiple user accounts belonging to former employees who left the company over a year ago are still active. This oversight could allow unauthorized access. Which process failure is most directly responsible for this security risk?

A user reports that a 64-bit application on Windows 10 fails to start with error 'The application was unable to start correctly (0xc000007b)'. The technician runs sfc /scannow and DISM /RestoreHealth, which complete successfully. The technician also re-registers all DLLs in the application folder. The issue persists. What should the technician do NEXT?

A technician is supporting a warehouse desktop. The immediate goal is to protect unattended workstations. Which tool, control, or procedure is the best fit?

A macOS user reports that they cannot print to a shared network printer that other users on the same network can access. Other network functions on the Mac work correctly. The technician suspects a corrupt print system. Which of the following steps should the technician perform FIRST to reset the macOS printing system?

A technician upgrades a Windows 10 Professional workstation from legacy BIOS to UEFI mode. The technician converts the system disk from MBR to GPT using MBR2GPT.exe. After the conversion, the system displays 'Boot configuration data is missing. File: \EFI\Microsoft\Boot\BCD. Error code: 0x000000f'. The technician boots from a Windows 10 installation USB and opens a command prompt. Which command should the technician use to rebuild the BCD for the UEFI environment?

A technician is applying a critical security patch to a web server during a scheduled maintenance window. The patch was tested in a lab and approved by the Change Advisory Board. During the installation, the server becomes unresponsive and will not boot. The technician has a backup of the server configuration and a system state backup. According to change management best practices, what should the technician do FIRST?

A technician needs to repair the Master Boot Record (MBR) on a Windows 10 computer that fails to boot. Which command should the technician use from the Windows Recovery Environment command prompt?

A technician receives an email that appears to be from the company's Chief Financial Officer (CFO), requesting an urgent wire transfer to a new vendor. The email includes the CFO's correct name and signature, but the reply-to address is different. Which type of social engineering attack best describes this scenario?

A security auditor finds that a user's workstation has a scheduled task that runs a PowerShell script every hour. The script connects to an external IP address and downloads a file. The user claims no knowledge of the task. Which of the following is the most likely cause?

A security analyst discovers that a malicious actor has been exfiltrating data from a company's internal network by encoding the stolen data into DNS queries sent to an external domain. Which type of attack is this?

A technician is setting up a Windows 10 laptop for a new employee who will work both in the office and remotely. The technician wants to enable the user to sync their desktop, documents, and settings across multiple devices. Which type of user account should be configured?

A technician is attempting to install a Windows 10 cumulative update but the installation fails with error code 0x80070070. The system drive has over 50 GB of free space. Which of the following is the MOST likely cause?

A user's Windows 10 computer is running slowly and frequently displays 'Low Memory' errors. In Task Manager, a single svchost.exe process is using over 80% of memory. What is the best course of action?

A user needs to run a legacy Windows 7 application on a Windows 10 Pro workstation. The application fails to start and displays a compatibility error. Which built-in Windows 10 tool should the technician use FIRST to resolve this issue?

After applying a scheduled security patch to a server and verifying its functionality, which change management step should the technician perform next?

A user reports that after installing a new printer driver on a Windows 10 computer, the system blue screens whenever they attempt to print. The computer boots normally but crashes during the print job. Which of the following should the technician do FIRST to resolve the issue?

A company's security policy requires that no unauthorized removable storage devices be connected to company workstations. Which method should be used to enforce this policy on all Windows 10 computers?

A user reports that their Windows 10 computer freezes randomly and becomes unresponsive for several minutes. The problem began after installing a new graphics driver. Which boot mode should the technician use to roll back the driver?

A technician receives a report that several employees have received an email appearing to be from the company's IT department asking them to click a link and enter their login credentials. The technician suspects a phishing attack. What is the FIRST step the technician should take according to incident response procedures?

A user reports that a specific application crashes when they try to export a report to PDF. The technician reinstalls the application but the problem persists. The technician notices that the export works when the user logs into another computer. What is the most likely cause?

A technician is supporting a clinic workstation. The immediate goal is to reduce shoulder-surfing and information exposure. Which tool, control, or procedure is the best fit?

A user reports that a 64-bit business application on Windows 10 Pro crashes immediately after launch with error code 0xc0000005 (Access Violation). The technician has already reinstalled the application, applied all Windows updates, and run both System File Checker (SFC) and Deployment Imaging Service and Management Tool (DISM) with no issues found. Which of the following should the technician do NEXT to troubleshoot the crash?

A technician needs to apply a critical security patch to a server that hosts a legacy application. The patch is known to cause a brief service interruption during installation. According to change management best practices, which of the following should the technician do FIRST before installing the patch?

A technician needs to migrate a user's profile, including all files, settings, and installed applications, from an old Windows 10 workstation to a new one. The technician plans to perform this migration for multiple users as part of a hardware refresh. Which tool should the technician use to accomplish this?

A user reports that their workstation is infected with ransomware. The technician instructs the user to disconnect the network cable immediately. According to incident response best practices, what should the technician do NEXT?

A user's Windows 10 computer is BitLocker-encrypted and boots to a recovery screen asking for the 48-digit recovery key. The user cannot locate the key. The computer is domain-joined and BitLocker was configured with default Group Policy settings. Where should the technician look to retrieve the recovery key?

A technician enables '16-bit Application Support' in Windows Features on a 64-bit Windows 10 Pro workstation, but a legacy 16-bit application still fails to run. What is the most likely reason?

A company's security policy requires that all laptop hard drives be encrypted to protect data in case of theft. Which Windows 10 feature should a technician enable to meet this requirement?

A help desk technician receives a call from a user who says their computer is acting strangely. The user reports that they received a pop-up message from 'Windows Security' stating that their computer is infected and to call a number for support. The user called the number and gave the 'technician' remote access. Now the computer is asking for a payment to unlock files. Which type of social engineering attack is this, and what is the BEST immediate action for the technician to take?

A technician installs a second SSD with a new copy of Windows 10 on a computer that already has Windows 10 on the primary drive. After installation, the computer boots directly to the new drive, bypassing the boot menu. The technician wants to configure the system to display a boot menu allowing selection between the two Windows installations. Which command-line tool should the technician use to modify the boot configuration?

A technician needs to create a new partition on a secondary hard drive in Windows 10. Which tool should the technician use?

A technician is tasked with deploying Windows 10 to 50 new computers using network-based deployment via PXE boot. The technician has created a reference image using Sysprep and wants a tool that can manage the entire deployment process, including capturing the image, creating a task sequence, and deploying over the network. Which tool should the technician use?

A small business is upgrading its office equipment and needs to dispose of several old CRT monitors and LCD displays. Which of the following is the MOST environmentally responsible method of disposal for these electronic devices?

A technician is documenting a security incident involving a potential data breach. The technician has collected logs, taken screenshots, and created a forensic image of the affected hard drive. The company's incident response policy requires that a formal report be submitted to management. Which of the following is the MOST critical element to include in the report?

A technician needs to configure a Windows 10 computer to connect to a hidden Wi-Fi network (SSID not broadcast). Which additional configuration step is required compared to connecting to a visible network?

A Windows 10 workstation crashes with a blue screen error 'SYSTEM_SERVICE_EXCEPTION' every time a specific USB printer is connected. The technician has already updated the printer driver to the latest version from the manufacturer's website. Which of the following should the technician do NEXT to troubleshoot this issue?

A help desk technician receives two tickets simultaneously. The first ticket is from the company's CEO reporting that their laptop will not turn on. The second ticket is from a sales representative requesting a password reset. According to IT best practices, what should the technician use to determine which ticket to work on first?

A user reports that after installing a third-party antivirus suite, their web browser cannot connect to the internet. Other network-dependent applications such as email clients work correctly. The technician has confirmed that the network adapter is configured correctly and other devices on the same network can access the internet. Which built-in Windows tool should the technician use FIRST to investigate whether the antivirus software has created firewall rules that are blocking the browser?

A technician is preparing a change request to upgrade the RAM in five office workstations from 8 GB to 16 GB. Which of the following elements is MOST important to include in the change request to ensure it is properly evaluated and approved?

A technician has implemented an approved change to a server and verified that it works correctly. According to change management best practices, what should the technician do NEXT?

A technician is tasked with deploying a standard Windows 10 Pro image to multiple new laptops. The technician needs to ensure that each deployed system has a unique Security Identifier (SID) for proper network and security functionality. Which tool should the technician run on the reference computer before capturing the image?

A user calls the help desk stating that a pop-up message has appeared claiming all files on the computer have been encrypted and that a payment is required to unlock them. The user admits to opening an email attachment from an unknown sender earlier. What is the FIRST action the technician should take?

A security technician observes that a user's workstation is making numerous outbound connections to a known malicious IP address. The technician confirms the system is infected with a trojan. According to the incident response process, after isolating the system from the network, what should the technician do NEXT?

A user needs to use BitLocker To Go to encrypt a USB flash drive. Which editions of Windows 10 support BitLocker To Go?

A user reports that a Windows 10 application crashes with error '0xc0000142' when launched. The technician has already run SFC and DISM with no issues. The application worked previously. What should the technician try next?

A technician is following incident response procedures after a workstation was infected with malware. The technician has isolated the workstation from the network and created a forensic image of the hard drive. What should the technician do NEXT?

A user finds a USB drive labeled 'Employee Bonus Info' in the parking lot and plugs it into their workstation to view the contents. The workstation is immediately infected with malware that encrypts files and displays a ransom note. Which type of social engineering attack was this?

A technician needs to create a full system image backup of a Windows 10 computer to an external drive for disaster recovery. Which built-in tool should be used?

A technician finds a USB flash drive in the company parking lot with a label reading '2025 Bonus Information'. The technician plugs the drive into a workstation to view the contents. Immediately, the workstation begins to behave erratically, and security software alerts to a malware infection. Which type of social engineering attack does this describe?

A user reports that a legacy 16-bit application is not running on a Windows 10 64-bit system. The application was essential for the user's workflow. Which action should the technician take to attempt to run this application?

A Windows 10 workstation fails to boot and displays a 'Recovery' screen with no advanced options visible. The technician boots from installation media and opens a Command Prompt. Which command-line utility should be used to rebuild the Boot Configuration Data (BCD) store?

A technician needs to configure a Windows 10 Pro workstation to retrieve updates from a local WSUS server instead of directly from Microsoft Update. Which tool should the technician use to configure this setting?

A user reports that their computer is running very slowly and a security pop-up claims the system is infected. The technician runs an antivirus scan which detects a Trojan. The technician quarantines the Trojan. What is the NEXT step in the malware removal process?

A technician discovers that a user's workstation is infected with ransomware. Following the incident response plan, the technician isolates the system from the network. What should the technician do NEXT?

A company wants to ensure that users must provide two different types of authentication factors when accessing sensitive data. Which term describes this requirement?

A change request to update the firmware on a network switch has been approved by the Change Advisory Board (CAB) and is scheduled for a maintenance window. During the implementation, the technician discovers that the downloaded firmware file is corrupted. The technician has verified that a backup configuration file exists. According to change management best practices, what should the technician do FIRST?

Drag and drop the steps to troubleshoot a no-display issue on a desktop computer into the correct order.

A technician needs to apply a critical security patch to a production web server to stop an active exploit. The standard change window is not for another week, but the patch has already been approved by the Change Advisory Board (CAB). What should the technician do according to change management best practices?

A technician is preparing a change request to upgrade the operating system on a file server. Which element is MOST important to include in the change request to minimize the impact on users?

A technician is preparing a change request to update the firmware on a critical file server. The update is known to potentially cause incompatibility with a custom internal application. According to change management best practices, which of the following must the technician include in the change request?

A user reports that their Windows 10 workstation suddenly cannot access any network resources. A technician remotely views the system and notices a popup that mimics a Windows Security alert, stating the system is infected. The technician checks the IP configuration and sees the workstation has an APIPA address (169.254.x.x). The network adapter shows no physical link issues. Which of the following is the MOST likely cause of the issue?

A technician is troubleshooting a Windows 10 workstation that freezes intermittently. The technician has already updated drivers and run hardware diagnostics with no issues. The event logs show multiple occurrences of Event ID 1000 with application crashes. Which of the following tools should the technician use to get more detailed information about the crashing application?

A user reports that a legacy line-of-business application on a Windows 10 workstation displays 'Runtime error 429: ActiveX component can't create object' upon launch. The technician has already reinstalled the application and confirmed it works on other workstations. Which of the following should the technician do NEXT?

A technician needs to upgrade a Windows 10 Home workstation to Windows 10 Pro. The user has purchased a valid Windows 10 Pro product key. Which built-in method should the technician use to perform the edition upgrade?

A technician is decommissioning a server that contained confidential client data. The hard drives will be donated to a local school. Which of the following data destruction methods is the MOST appropriate to ensure the data is unrecoverable?

A technician is implementing a change to a firewall rule on a production server. After implementing the change, the technician documents the change in the change management system. Which step did the technician likely skip according to change management best practices?

A company's security policy mandates that all mobile devices be encrypted. A technician enables full-disk encryption on a user's company-issued Android smartphone. Later, the user reports that the phone now prompts for a password before booting and wants to remove this requirement without compromising security. What should the technician explain?

A security analyst is investigating a compromised workstation that is suspected of having a kernel-level rootkit. The workstation is currently running and the analyst needs to preserve evidence for forensic analysis. Which of the following actions should the analyst take FIRST?

A technician has submitted a change request to replace a failing power supply in a server. The Change Advisory Board (CAB) has approved the request. According to change management best practices, what should the technician do NEXT?

A user reports that a USB printer stopped working after upgrading their computer from Windows 10 to Windows 11. The printer is listed as compatible with Windows 11. What is the most likely cause?

A technician needs to capture a custom Windows 10 image from a reference computer that has been generalized with Sysprep. Which command-line tool should be used to capture the image into a single .wim file?

A user reports that a legitimate business application is being blocked by Windows Security (Windows Defender). The technician needs to add an exception for the application's executable file. Which section in Windows Security should the technician navigate to?

A user reports that a 32-bit application on Windows 10 Pro fails to launch, and the error message states that 'MSVCR120.dll is missing'. The technician has verified the application is compatible with Windows 10. Which action should the technician take FIRST to resolve this issue?

A technician needs to deploy Windows 10 to 50 identical computers. Which built-in Windows tool should be used to prepare a custom image for deployment?

A technician needs to deploy a custom logon banner that displays a legal notice before users log on to Windows 10 computers in a domain. Where should the technician configure this setting?

A company's IT department follows a strict change management process. A technician is implementing a planned change to update the firmware on a network switch. The change has been approved and the maintenance window has started. During the firmware update, the switch loses power due to a circuit breaker tripping. The technician has a backup configuration file. According to best practices, what should the technician do FIRST?

A technician needs to create a bootable USB drive to perform a clean installation of Windows 10 on a new SSD. Which Microsoft-provided tool is designed for this purpose and is included in Windows 10?

A technician is entering a secured server room using their badge. They notice an unfamiliar person slips in behind them before the door closes, without using any credentials. The person is wearing a lanyard with a generic company logo but no visible photo ID. Which of the following actions should the technician take FIRST?

Which Windows 10 feature allows a user to run a program with different permissions than the current user?

A technician installed Ubuntu Linux on a Windows 10 Pro computer configured for dual-boot. After the installation, the computer boots directly into Linux without showing the GRUB menu. The technician boots from a Linux live USB. Which command should the technician use to regenerate the GRUB configuration and detect the Windows boot loader?

A technician needs to upgrade a Windows 10 Pro workstation from version 1909 to version 22H2 while preserving all installed applications, user settings, and personal files. The technician has downloaded the Windows 10 22H2 ISO file and mounted it. Which option should the technician choose when running setup.exe from the mounted ISO?

A user wants to prevent several applications from automatically launching when Windows 10 starts. Which built-in tool can the technician use to manage startup programs?

A technician is scheduled to apply a firmware update to a storage array during a maintenance window. The change was approved by the Change Advisory Board (CAB). At the start of the window, the technician discovers that the latest firmware version is only available on the vendor's support portal, which requires an active support contract that has expired. According to change management best practices, what should the technician do NEXT?

A technician needs to determine the build version and edition of Windows 10 on a workstation. Which command should the technician use from the Command Prompt?

A user reports that a critical application crashes every time they attempt to save a file to a network drive. The application works fine when saving locally. The network drive is accessible and other users can save files to it without issues. Which of the following steps should the technician take FIRST?

A company's security policy requires that all laptops have full-disk encryption. A technician has enabled BitLocker on a Windows 10 laptop. To ensure the recovery key is accessible if the user forgets their PIN, which action should the technician take?

A technician needs to create a new partition on a hard drive in Windows 10. Which command-line tool should be used?

A user reports that a recently installed application crashes immediately after launch on a Windows 10 Pro workstation. The technician has verified the system meets the application's requirements and has reinstalled the application. Which built-in Windows tool should the technician use to view detailed error logs and identify the cause of the crash?

An employee finds a USB flash drive in the company parking lot and inserts it into their workstation out of curiosity. Immediately, the system begins exhibiting unusual behavior, including pop-ups and slowdowns. Which type of social engineering attack is this an example of?

A technician needs to apply a non-critical security patch to a production web server. According to change management best practices, what should the technician do FIRST?

A technician needs to configure a Windows 10 workstation so that whenever a specific USB flash drive is inserted, a custom script automatically runs to back up the user's documents. Which Windows tool should the technician use to create this automation?

A technician has identified a critical security vulnerability in a production web server that requires an immediate patch. The patch will cause a brief service interruption. According to change management best practices, which of the following is the BEST course of action?

A technician is troubleshooting a Windows 10 workstation where a user reports that a specific application displays an error: 'The application was unable to start correctly (0xc000007b).' The technician has already reinstalled the application and run SFC and DISM with no issues. Which step should the technician take NEXT?

A technician is troubleshooting a Windows 10 workstation that continues to exhibit malware symptoms—pop-ups, slow performance, and redirected web searches—even after a full antivirus scan removed several threats. The technician suspects a rootkit. Which of the following should the technician perform NEXT to address this specific type of malware?

A technician is troubleshooting a Windows 10 workstation that fails to boot, displaying the error 'Boot selection failed because a required device is inaccessible.' The technician suspects the Boot Configuration Data (BCD) is corrupted. The technician boots from a Windows 10 installation media and opens Command Prompt from the Repair options. Which command should the technician run to rebuild the BCD?

A user reports that a specific web page displays a '404 Not Found' error. The user can access other pages on the same website without issue. What is the most likely cause?

A technician is supporting a warehouse desktop. The immediate goal is to repair Windows component store corruption before file integrity repair. Which tool, control, or procedure is the best fit?

A company security policy requires that all laptops have full-disk encryption. A technician is configuring a laptop that has a TPM chip enabled. Which Windows feature should the technician use to meet this requirement?

A technician is troubleshooting a Windows 10 computer that randomly reboots without warning. Event Viewer shows event ID 41 (Kernel-Power) with no other critical errors. The technician has already updated drivers and verified the power supply. What should the technician do NEXT?

A user reports that a Windows 10 Pro workstation boots very slowly. The technician opens Task Manager and notices several startup programs are enabled, but one program that is known to cause boot delays does not appear in the Startup tab. The technician suspects the program is started via a scheduled task or service. Which built-in Windows tool should the technician use to check if the program is configured to start through a scheduled task?

A technician is tasked with implementing a change to update the antivirus software on all company workstations. The change has been approved by the CAB. The technician plans to deploy the update via a centralized management console. During the deployment, the technician notices that some older workstations are failing to install the update. Which of the following should the technician do FIRST?

A user reports that a legacy application designed for Windows 7 does not run correctly on a Windows 10 Pro workstation. The application installs successfully but fails to launch or displays errors. Which built-in Windows tool should the technician use FIRST to attempt to resolve the issue?

A user reports that they cannot print to a network printer. Other users can print to the same printer without issues. When the technician checks the printer queue on the user's workstation, they see 'Access Denied' errors. What is the most likely cause?

A technician needs to configure a Windows 10 computer to display detailed boot status messages during startup instead of the Windows logo. This is required for troubleshooting boot failures. Which tool should the technician use to modify this setting?

A technician is setting up a new computer for a user who wants to dual-boot Windows 10 and a Linux distribution on a single SSD. The technician has installed Windows 10 first on the entire drive. Which of the following is the MOST important step to perform BEFORE installing the Linux operating system?

A security auditor reports that several company laptops are missing critical security patches. The laptops are not connected to the corporate network for long periods. Which technology should the administrator use to ensure these laptops receive updates even when offline?

A user reports that they are unable to access a shared folder on the network. The technician verifies that the user's account has been locked out due to multiple failed login attempts. The technician unlocks the account and advises the user to change their password. The user changes the password successfully. Which of the following additional steps should the technician take to prevent future lockouts?

A user's Windows 10 computer will not boot normally after a failed driver installation. The technician can access the Windows Recovery Environment (WinRE). Which built-in tool should the technician use FIRST to attempt to restore the system to a point before the driver was installed?

A user reports that their web browser is repeatedly opening pop-up advertisements on every website visited. The technician has run a full antivirus scan which found no threats. Which of the following should the technician try NEXT?

A technician is documenting a change that replaced a failed hard drive in a server. The change was approved as an emergency change due to a critical data outage. After the replacement, the server is back online and data integrity is verified. According to change management best practices, what documentation step should the technician complete within a specified timeframe?

A user has a Windows 10 computer that is not joined to the corporate domain. The user needs to frequently access shared folders on a file server that requires domain credentials. Which Windows tool allows the user to securely store these domain credentials so they can be automatically used when mapping network drives?

A user reports that a legacy line-of-business application designed for Windows 7 is failing to run on a Windows 10 Pro workstation. The user receives the error message 'This app can't run on your PC'. The technician confirms the application is not digitally signed and is 32-bit. Which of the following is the BEST built-in method to allow this application to run without installing additional software?

A security audit reveals that a legacy application running on a Windows 10 workstation transmits sensitive data over an unencrypted protocol. The application is critical for business operations and cannot be updated or replaced. The workstation is located in a secured server room with restricted physical access. Which of the following would BEST mitigate the risk of data interception for this legacy application?

A technician receives approval from the Change Advisory Board (CAB) to update the password policy for all domain users. After implementing the change, the help desk is flooded with calls from users who cannot log in because the new policy requires more complex passwords that they were not told about. Which step of the change management process did the technician most likely omit?

A company implements a policy requiring employees to use smart cards for authentication. Which security principle does this primarily address?

A help desk technician receives a call from a user who states they clicked on a link in an email that appeared to be from the company's CEO requesting urgent action. The user entered their username and password on the resulting webpage. Which of the following is the FIRST step the technician should take according to incident response procedures?

A technician is supporting a finance laptop. The immediate goal is to replace business hardware with controlled risk. Which tool, control, or procedure is the best fit?

A technician is supporting a clinic workstation. The immediate goal is to reduce slow sign-in caused by unnecessary launch items. Which tool, control, or procedure is the best fit?

According to IT best practices, which of the following should be included in a change request form?

A security audit reveals that several employees have been using weak passwords that can be easily guessed. The company wants to enforce stronger password policies on all Windows 10 domain-joined computers. Which tool should the administrator use to configure and enforce password complexity requirements?

After successfully resolving a common printer issue that multiple users had experienced, a technician creates a step-by-step document explaining the solution. Which type of documentation does this represent?

A user needs to change the default program for opening PDF files on a Windows 10 Pro workstation from Adobe Acrobat to Microsoft Edge. The user right-clicked a PDF file, selected 'Open with', chose 'Microsoft Edge', and checked 'Always use this app'. However, the change does not persist for all PDF files. Which built-in Windows settings should the technician use to set this default association for all PDF files?

A technician is supporting a shared training-room workstation. The immediate goal is to track a replaced company device. Which tool, control, or procedure is the best fit?

Match each mobile OS feature to its description.

A user receives a phone call from someone claiming to be from the company's IT help desk. The caller states that the user's account has been compromised and they need the user to install a remote desktop application to perform emergency repairs. The user complies and grants the caller access. Which type of social engineering attack has occurred?

A technician is working on a reception PC and needs to start Windows with minimal drivers to isolate a startup problem. Which two actions are appropriate? (Choose two.)

A technician discovers that a user has installed a game application on their company workstation, which violates the company's acceptable use policy. What is the technician's first action according to standard operational procedures?

A technician resolves a printer issue for a user. According to best practices for documentation and ticketing, which step should the technician complete after resolving the issue?

A user reports that an application displays an error 'Runtime Error! Program: ... This application has requested the Runtime to terminate it in an unusual way.' The technician suspects a misconfigured compatibility setting. What should the technician check first?

A help desk technician is documenting the steps to resolve a recurring printer issue for the team's knowledge base. Which element is MOST important to include to ensure the documentation is useful for other technicians?

A technician is setting up a secure disposal plan for old laptops. Which of the following procedures BEST ensures that all sensitive data is irretrievable before disposal?

Drag and drop the steps to map a network drive in Windows 10 into the correct order.

A help desk technician has been unable to resolve a complex network connectivity issue for a remote user. The technician decides to escalate the issue to a senior technician. According to best practices, which of the following should the technician include in the escalation documentation?

A technician is troubleshooting a legacy 32-bit application on a 64-bit Windows 10 system. The application fails to run and Event Viewer shows a "Module not found" error for a 32-bit DLL. The technician confirms the DLL exists in the C:\Windows\SysWOW64 folder. Which command-line tool should the technician use to register this DLL?

A technician needs to configure a Windows 10 workstation to automatically install updates but allow the user to schedule the restart. Which Windows Update setting should the technician configure?

A technician installs a 32-bit application on a 64-bit version of Windows 10. In which default directory will the application files be placed?

A technician is creating a knowledge base article for common printer issues. Which of the following is the MOST important element to include to ensure the article is useful for other technicians?

A user reports that a 32-bit application will not start after a Windows update. The technician runs SFC and DISM with no issues. In the application's installation folder, the technician finds a .dll file that is not registered. What is the most likely cause?

A security analyst discovers that a user's workstation has been infected with a keylogger delivered via a phishing email. The keylogger has captured the user's login credentials for several corporate systems. According to incident response best practices, which of the following should the analyst do FIRST?

A technician has received approval from the Change Advisory Board (CAB) to upgrade the operating system on 100 company workstations from Windows 10 21H2 to 22H2. The technician first performs the upgrade on a pilot group of five workstations. After the pilot, two of the five workstations are experiencing application compatibility issues. According to change management best practices, what should the technician do NEXT?

After a recent Windows Update, a user's legacy application crashes immediately upon launch with the error 'The application was unable to start correctly (0xc0000005).' The technician has run System File Checker (sfc /scannow) and Deployment Imaging Service and Management (DISM) without finding any issues. Which of the following should the technician check NEXT to resolve the problem?

A user reports that a 32-bit application crashes immediately upon launch with error code '0xc000007b'. The application worked previously on the same Windows 10 64-bit system. What is the MOST likely cause?

A user reports that a Windows 10 application crashes immediately with the error 'The application was unable to start correctly (0xc0000142)'. The technician has already reinstalled the application, updated Windows, and run System File Checker (SFC) and Deployment Imaging Service and Management Tool (DISM) with no issues. Which of the following should the technician do NEXT?

A technician needs to remotely access a Windows 10 computer that is located on a different network subnet. The technician has administrative credentials. Which technology should be configured to allow this remote access without additional third-party software?

A technician is implementing a scheduled change to replace a server's power supply. The change was approved by the Change Advisory Board (CAB) with a 30-minute maintenance window. During the replacement, the technician discovers that the new power supply's connector is incompatible with the server motherboard. The technician has a compatible adapter available, but using the adapter was not part of the approved change plan. According to change management best practices, what should the technician do FIRST?

The company firewall logs show repeated connection attempts from a single external IP address to TCP port 3389 on several internal workstations over the past hour. The workstations all have Remote Desktop enabled for administrative purposes. Which of the following is the MOST effective immediate action to mitigate this threat?

A technician is troubleshooting a Windows 10 application that crashes with error 'The application was unable to start correctly (0xc0000005).' The technician has already run SFC and DISM without issues. What should the technician try next?

A technician is installing Windows 10 on a laptop that uses UEFI firmware with Secure Boot enabled. The installation media is created using Media Creation Tool. During installation, the technician selects custom installation and deletes all existing partitions on the GPT disk. After clicking Next, Windows displays 'Windows cannot be installed on this disk because the disk is offline.' What should the technician do?

A technician is working on a reception PC and needs to respond to possible MFA fatigue attack. Which two actions are appropriate? (Choose two.)

A technician discovers that a user's workstation has been compromised. Logs indicate that sensitive data has been exfiltrated. According to incident response best practices, which action should the technician take FIRST?

A user receives an email that appears to come from the company's payroll department. The email states that the user's salary has been updated and includes an attachment named 'Salary_Review_Q1.xlsx'. The user was not expecting this email and notices that the sender's email address is 'payroll@cornpany.com' instead of 'payroll@company.com'. The email content addresses the user by their full name and references the user's correct job title. Which type of social engineering attack is this?

A technician is configuring a Windows 10 workstation for a remote worker who will handle sensitive data. The company requires device encryption. The technician enables BitLocker, but it fails, stating 'The system cannot find the file specified.' The technician verifies the TPM is enabled and initialized. What is the most likely cause?

A technician observes an individual closely following an employee through a secured door that requires a badge swipe. The individual does not use a badge and enters behind the employee. Which social engineering technique is being exhibited?

A technician needs to update the firmware on a network switch that is not business-critical but will cause a brief loss of connectivity for a small workgroup. The technician has identified the correct firmware file and verified a rollback plan. According to change management best practices, what should the technician do FIRST?

A technician suspects that a Windows 10 computer is infected with malware that prevents the user from opening Task Manager and Command Prompt. Which tool should the technician use to run a virus scan from outside the operating system?

A user reports that a specific Windows Store app crashes immediately on launch with error code 0x80073CF0. The technician has run the Windows Store Apps troubleshooter, performed a wsreset, and used Settings to Reset the app. The problem persists. What should the technician do NEXT?

A user reports that after installing a Windows Update, the system blue screens with 'SYSTEM_SERVICE_EXCEPTION'. The user can boot into Safe Mode. Which step should the technician take first?

A technician is tasked with deploying a new software version to all company workstations. The change has been approved by the Change Advisory Board (CAB). During the rollout, the technician discovers that several workstations are not compatible. According to change management best practices, what should the technician do FIRST?

A user reports that Microsoft Word crashes whenever they try to open a specific document. Other documents work fine. The technician determines the document is located on a network share. Which of the following is the MOST likely cause of the crashes?

A change request to apply a critical security patch to a production web server has been approved by the Change Advisory Board (CAB) with a detailed implementation plan. During the scheduled maintenance window, the technician discovers that a required prerequisite patch is missing. The prerequisite patch is available for download and was tested in the lab, but it was not listed in the approved change plan. According to change management best practices, what should the technician do FIRST?

A technician needs to create a new partition on a Windows 10 computer that has unallocated space on the hard drive. Which built-in tool should the technician use?

A technician is following the CompTIA A+ troubleshooting methodology to resolve a computer issue. After establishing a theory of probable cause, which step should the technician perform NEXT?

A technician needs to create a bootable USB drive to install Windows 10 from an ISO file on a technician's computer. Which built-in Windows tool should be used?

A company is decommissioning old laptops that contained confidential client data. Which data disposal method ensures the data is completely unrecoverable?

A technician is supporting a remote worker laptop. The immediate goal is to find matching error entries in Linux logs. Which tool, control, or procedure is the best fit?

A technician is troubleshooting a Windows 10 workstation that is failing to boot normally. The technician wants to configure the system to boot into Safe Mode with Networking on the next restart. Which tool should the technician use to make this configuration change?

A technician needs to apply a critical security patch to a database server that hosts a production application. The patch is known to cause a 10-minute service disruption and cannot be applied during normal business hours. According to change management best practices, which document should the technician submit and have approved BEFORE performing the update?

After a Windows 10 feature update, a user reports that their default file associations keep resetting to Microsoft applications (e.g., PDFs open in Edge, photos open in Microsoft Photos) despite having previously set them to third-party applications. What is the MOST likely cause?

A company wants to allow employees to securely access internal resources from home via the internet. Which method provides the highest level of security for remote desktop connections?

A technician removes a ransomware popup from a user's Windows 10 workstation by booting into Safe Mode with Networking and running a malware scan. After a successful removal and reboot, the popup is gone, but the user's browser homepage has changed and several unwanted browser extensions are present. Which of the following should the technician do NEXT?

A user reports that after installing a new video editing application, their Windows 10 computer crashes with a blue screen shortly after boot. The technician can boot the system into Safe Mode without issues. Which tool should the technician use FIRST to help isolate the problematic driver or service?

A user reports that a line-of-business application crashes on startup with the error: 'Unable to find a version of the runtime to run this application.' The technician has verified that the latest .NET Framework version is installed. Which step should the technician take NEXT to resolve the issue?

A technician is replacing a critical server component in a data center when they encounter an unexpected issue that could cause significant downtime if not handled correctly. According to change management best practices, what should the technician do FIRST?

A technician needs to replace a hard drive in a server as part of a standard change. The technician has a backup of the data and a rollback plan. After replacing the drive and restoring data, the server is operational. What should the technician do NEXT?

A technician is setting up a new computer for a user who wants to dual-boot Windows 10 and a Linux distribution on a single SSD. The technician has a blank drive. Which of the following is the MOST important step to perform FIRST before installing Linux?

A user reports that a USB printer stopped working immediately after a Windows 10 update. The technician checks Device Manager and sees a yellow exclamation mark on the printer driver. The printer and cable are confirmed to be functional. What should the technician do FIRST?

A technician needs to add a new user account to a Windows 10 workstation. The user should have the ability to install applications and change system settings. Which account type should be assigned?

A user reports that Microsoft Outlook crashes when trying to open a specific email with an attachment. Other emails open fine. The technician has installed the latest Outlook updates. What should the technician try FIRST?

A user cannot log into their Windows 10 computer because they forgot their password. The computer is not part of a domain. Which method allows the technician to regain access without reinstalling the operating system?

A technician is troubleshooting a 32-bit application on a 64-bit version of Windows 10. The application fails to start and displays an error that a specific DLL file is missing. The technician confirms that the DLL exists in C:\Windows\System32. What is the most likely reason for this error?

A technician needs to back up a user's data before upgrading the operating system from Windows 10 to Windows 11. The user has a large folder with documents, photos, and saved games. The technician will use an external USB drive formatted as NTFS. The goal is to secure a single point-in-time copy quickly and completely. Which backup method should the technician choose?

A technician is troubleshooting a Windows 10 workstation that crashes with a blue screen error (0x0000003B) after running a specific graphics-intensive application. The technician has already updated the graphics driver, verified system files with SFC, and checked for overheating. The crashes continue. Which built-in tool should the technician use to analyze the crash dumps and identify the faulty component?

A technician finds a USB flash drive in the company parking lot. Out of curiosity, the technician plugs it into a workstation. Immediately, a program runs automatically and installs malware. Which security configuration could have prevented the automatic execution of the malware?

A technician needs to schedule a maintenance window to apply a critical security patch to a server. The update requires a reboot and will cause a brief service outage. Which of the following is the BEST way to communicate this change to affected stakeholders?

A user reports that their workstation displays a message demanding payment in Bitcoin to unlock files. The technician boots the computer into Safe Mode with Networking, but the ransom message still appears. What should the technician do next?

A technician needs to configure a Windows 10 computer to boot from a USB drive to run a diagnostic tool. Which key is typically pressed during POST to access the boot menu?

A user reports that a critical line-of-business application crashes intermittently with an exception code 0xc0000005 (Access Violation) in the Event Viewer. The technician has already updated all drivers, installed Windows updates, and ran System File Checker (SFC), which found no corruption. Which step should the technician take NEXT to resolve the issue?

Match each troubleshooting step to its correct order in the CompTIA A+ troubleshooting methodology.

A technician is deploying several new Windows 10 workstations. The company policy requires that all workstations be joined to the on-premises Active Directory domain. The technician successfully joins one workstation to the domain, but when trying to join a second workstation, the option to join a domain is missing. Which of the following is the MOST likely reason?

A technician is supporting a warehouse desktop. The immediate goal is to grant users only the access needed for their job. Which tool, control, or procedure is the best fit?

A user reports that a Windows 10 computer displays the error 'A device which does not exist was specified' when trying to access a USB external hard drive. The drive works correctly on other computers. What should the technician check first?

A technician needs to boot a Windows 10 workstation into Safe Mode because the system is unstable and fails to start normally. The technician is currently in the Windows Recovery Environment (WinRE). Which option should the technician select to access Safe Mode?

A technician implemented a scheduled change to update the firmware on a network switch. After the update, the switch becomes unresponsive and the network segment goes down. The change plan includes a rollback procedure that requires re-flashing the original firmware, which will take 20 minutes. However, only 15 minutes remain in the maintenance window, after which normal operations are expected to resume. According to change management best practices, what should the technician do FIRST?

A technician is updating the firmware on a network switch during a scheduled maintenance window. The update fails and the switch becomes unresponsive. The technician had prepared a rollback plan and has a backup configuration file. According to change management best practices, what should the technician do NEXT?

A technician finds an unknown USB flash drive in the company parking lot. The drive is labeled 'Confidential Q4 Results'. According to operational procedures, what should the technician do?

A junior technician performed a configuration change on a critical server without following the change management process. As a result, the server went offline for two hours. Which of the following BEST describes the purpose of a change management policy?

A help desk technician has been unable to resolve a complex network connectivity issue for a remote user. The technician decides to escalate the issue to a senior technician. According to best practices, which information should the technician include in the escalation documentation?

A user reports that their Windows 10 workstation's screen flickers occasionally when watching videos. The technician updates the display driver to the latest version, but the problem persists. Which built-in Windows tool should the technician use to review a history of application and driver failures to help identify the cause?

A user reports that their workstation is displaying pop-up messages claiming to be from a federal law enforcement agency, stating that the computer has been locked due to illegal activity and demanding payment of a fine. The user cannot close the pop-up or access any programs. Which type of malware is this?

A Mac user reports that the computer stops responding during startup before the login screen appears. Which of the following is the most appropriate first troubleshooting step?

A user reports that Google Chrome crashes when trying to watch videos on a news website. Event Viewer shows the faulting module is 'Flash32_32_0_0_465.ocx' with exception code 0xc0000005. What is the most likely cause?

A help desk technician is creating a document that outlines the exact steps to follow when a user forgets their password and needs a reset. The document ensures all technicians follow the same verification process. What type of document is the technician creating?

A technician is troubleshooting a Windows 10 workstation that fails to boot normally but can boot into Safe Mode. The technician needs to identify which driver or service is causing the issue. Which built-in tool should the technician use to systematically disable startup items and services to isolate the problem?

A user receives a phone call from someone claiming to be from the company's IT help desk. The caller states there is a security breach and asks the user to confirm their login password and read back a multi-factor authentication code from their phone. The user complies. Which type of social engineering attack has occurred?

A technician needs to upgrade a Windows 10 32-bit installation to Windows 10 64-bit on a computer that meets the 64-bit hardware requirements. The user wants to keep their applications and data. Which installation method should the technician use?

A technician needs to configure a Windows 10 workstation to boot into Safe Mode with Networking on the next restart. The technician wants to make this change using a built-in graphical tool. Which tool should the technician use?

A technician needs to install Windows 10 on a computer that currently has Windows 7. The technician wants to keep the Windows 7 installation and have both operating systems available at boot. The technician has a second hard drive available. Which installation type should the technician select?

A user's Windows 10 computer displays the error 'Invalid system disk' after a power outage. The computer previously booted normally. Which of the following is the MOST likely cause of this error?

A user reports that a legacy application crashes on Windows 10. Event Viewer shows Event ID 1000 with faulting module 'ntdll.dll'. What should the technician do FIRST to identify potential system file corruption?

A user reports that a specific application crashes on Windows 10 with error '0xc0000005 (Access Violation)'. The technician has already updated the application and graphics drivers, tested memory with Windows Memory Diagnostic, and performed a clean boot to isolate software conflicts. The error still occurs. Which of the following should the technician do NEXT?

A Windows 10 workstation displays the error 'Boot configuration data for your PC is missing or contains errors' on startup. The technician boots from the Windows 10 installation media and opens a command prompt. Which command should the technician run FIRST to attempt to repair the boot configuration?

A user reports that a Windows 10 application has stopped responding and the window is frozen. The technician is on the phone with the user. What should the technician instruct the user to do FIRST?

A technician is installing Windows 10 on a new SSD. The motherboard supports UEFI and Secure Boot. Which partition style must be used on the disk to support these features?

A user reports that a Microsoft Office application crashes when attempting to open a specific document, but other documents open fine. The user has already tried restarting the computer. Which of the following should the technician try first?

A technician needs to deploy a custom Windows 10 image to several computers with identical hardware. The technician has configured the reference computer with all required applications and settings. Which built-in tool should be used to prepare the image for deployment by removing hardware-specific information?

A company follows a strict change management process. A technician is applying a critical security patch to a web server during a scheduled maintenance window. The patch was fully tested in a lab environment and approved by the Change Advisory Board (CAB). During the installation, the technician discovers that the patch requires a software dependency that is not installed on the server. According to change management best practices, what should the technician do FIRST?

A user receives an email with an attachment named 'Invoice_2024.pdf.exe'. When the user opens the attachment, it downloads and installs additional malicious software on the system without the user's knowledge. Which type of malware is this?

A user reports that their Windows 10 workstation is running slowly and displaying pop-up ads frequently. The technician runs a full antivirus scan, which removes several adware programs, but the symptoms persist. The technician also checks the browser extensions and removes suspicious ones. The pop-ups continue. Which step should the technician perform NEXT?

A technician needs to deploy Windows 10 to multiple computers with a preconfigured answer file that automates the installation process. Which tool should the technician use to create this answer file?

An organization requires full disk encryption on all laptops. One laptop does not have a TPM chip installed. Which method can still be used to encrypt the entire hard drive on Windows 10 Pro?

A user receives an email that appears to be from the company's IT department, stating that their email password will expire in 24 hours and asks them to click a link to renew it. The link goes to a page that looks exactly like the company's login portal, but the URL is slightly different. The user enters their credentials. Which type of social engineering attack has occurred?

A help desk technician receives a ticket from a user reporting that their computer is infected with ransomware. All files are encrypted, and a ransom note demands payment. According to the company's incident response policy, what is the FIRST action the technician should take?

A company's security policy requires that all data stored in the cloud be encrypted before upload to ensure the cloud provider cannot read it. Which encryption method satisfies this requirement?

A user reports receiving an email that appears to be from the company's HR department, asking employees to click a link to verify their login credentials for a new benefits portal. The email contains the company logo and the user's full name. The user clicked the link and entered their username and password. Which type of social engineering attack has occurred?

A technician installed Ubuntu Linux on a Windows 10 Pro computer configured for dual-boot. After installation, the computer boots directly into Windows without displaying the GRUB menu. The technician boots from a Linux live USB and opens a terminal. Which command should the technician use FIRST to reinstall GRUB for a UEFI-based system?

A user receives an email that appears to be from the company's HR department asking the user to click a link and enter their login credentials to view an updated benefits statement. The user suspects this is a phishing attempt. Which characteristic of the email most strongly indicates a phishing attack?

After installing a new printer driver on a Windows 10 workstation, a user reports that all print jobs produce garbled text. The technician suspects the new driver is incompatible. Which built-in Windows tool should the technician use to revert to the previous driver without uninstalling the printer?

A technician is troubleshooting a Windows 10 workstation that is experiencing frequent application crashes and system instability. The user wants to preserve personal files (documents, pictures) but remove all installed applications and revert system settings to default. Which built-in Windows 10 recovery option should the technician choose?

A security analyst notices that the CFO of the company received an email that appears to be from the company's external legal counsel. The email requests that the CFO click a link to review an urgent contract. The email address is spoofed to look similar to the real one. Which type of social engineering attack is this?

A technician is implementing a change to update the operating system on several servers. The change management plan includes a rollback plan. What should the rollback plan specify?

A help desk technician is documenting the steps for setting up a new employee workstation to ensure consistency across the team. Which type of document should the technician create to define the step-by-step process?

A technician is troubleshooting a Windows 10 computer that fails to boot with the error "Bootmgr is missing." The technician boots from Windows PE and opens a command prompt. Which command should be run first to restore the boot sector?

A technician suspects that a Windows 10 computer is infected with malware. The technician wants to use built-in and trusted third-party tools to clean the system. Which two of the following actions should the technician take? (Select TWO).

Drag and drop the steps to configure a static route on a Cisco IOS router into the correct order.

A technician is troubleshooting a Windows 10 workstation that crashes with a blue screen error 0x0000009F (DRIVER_POWER_STATE_FAILURE) every time the computer is put to sleep. The technician has updated all power-related drivers, disabled sleep in power options, and run SFC and DISM without finding issues. The crash still occurs when the user manually selects 'Sleep' from the Start menu. What is the most likely cause?

Match each Windows edition to its typical use case or feature.

A user receives an email that appears to be from the company's IT department, stating that their email password will expire in 24 hours and asks them to click a link to renew it. The link goes to a page that looks exactly like the company's login portal, but the URL is slightly different. The user enters their credentials and submits. Later, the user receives another email from their bank asking to confirm a large transaction. Which TWO types of attacks have occurred in this scenario? (Choose two.)

A technician is supporting a warehouse desktop. The immediate goal is to identify the faulting module after an application crash. Which tool, control, or procedure is the best fit?

A small business experiences a ransomware attack that encrypted all files on a single workstation. The technician isolates the workstation, removes the malware using a bootable antivirus scanner, and restores the encrypted files from a verified cloud backup. According to best practices for incident response, which step should the technician perform NEXT?

A technician needs to check the IP configuration of a Windows 10 computer, including its IP address, subnet mask, and default gateway. Which command-line utility should be used?

A user reports that their USB printer stopped working immediately after a Windows 10 update. The technician checks Device Manager and sees a yellow exclamation mark on the printer driver. The printer and USB cable are confirmed to be functional on another computer. What should the technician do FIRST?

A user receives a phone call from someone claiming to be from the company's help desk. The caller states that the user's computer has been sending suspicious network traffic and that the user must immediately install remote access software to allow the technician to fix it. The user complies. Which type of social engineering attack is this?

A technician needs to configure a Windows 10 computer to function as a public kiosk that automatically logs on to a single user account and runs a specific application, preventing users from accessing other parts of the operating system. Which Windows feature should the technician configure?

A Windows 10 workstation crashes intermittently with a blue screen error SYSTEM_SERVICE_EXCEPTION. The crashes often occur when using a specific third-party application. The technician has updated the application, run System File Checker and DISM with no issues. Which built-in tool should the technician use to analyze the memory dump files generated by the crashes?

A technician needs to configure a Windows 10 Pro workstation to automatically lock the screen and require a password after 10 minutes of inactivity. Which set of settings should the technician modify?

A technician needs to dispose of a hard drive that contained sensitive payroll data. The drive is still functional. Which method ensures complete data destruction?

A technician is troubleshooting a Windows 10 computer that displays a 'Blue Screen of Death' (BSOD) with error code 0x0000007B (INACCESSIBLE_BOOT_DEVICE) after a system restore. What is the most likely cause?

A technician has received approval from the Change Advisory Board (CAB) to apply a critical security patch to a file server. The patch requires a reboot. Which of the following should the technician do NEXT before beginning the installation?

A technician has completed an approved change to deploy a new printer driver to all workstations in a department. The deployment was successful, and all users can print. According to change management best practices, which of the following should the technician do NEXT?

A user reports that a line-of-business application crashes on startup with error 'The application was unable to start correctly (0xc0000142)'. The technician has verified that the application works on other workstations and has reinstalled it. The technician also ran SFC and DISM with no errors. Which of the following should the technician do NEXT?

A user reports that a critical line-of-business application fails to start with the error 'The application was unable to start correctly (0xc0000005).' The technician has already run System File Checker (SFC) and DISM, both reporting no corruption, and has reinstalled the application. The application was working before a recent Windows Update. Which built-in Windows tool or setting should the technician examine NEXT?

A technician needs to install Windows 10 on a new SSD. The computer currently has no operating system. The technician boots from a USB drive containing Windows 10 installation media. After the installation begins, the technician is prompted to select the type of installation. The technician wants to perform a clean installation on the empty SSD. Which installation option should be chosen?

A technician needs to quickly check the Windows 10 edition (e.g., Pro, Enterprise) and version number on a computer. Which command-line utility should be used?

A technician is attempting to install a legacy Windows 7 application on a Windows 10 Pro workstation. The installer fails with the error 'Error 1935. An error occurred during the installation of assembly component.' The technician has already run System File Checker (SFC) and Deployment Image Servicing and Management (DISM), both reporting no corruption. Which step should the technician take NEXT?

Drag and drop the steps to perform a clean installation of Windows 10 from a USB drive into the correct order.

A technician needs to verify that a Windows 10 system has the latest security updates installed. Which built-in tool should the technician use?

A technician is working on a reception PC and needs to troubleshoot a certificate warning for an internal site. Which two actions are appropriate? (Choose two.)

A junior technician receives a phone call from an angry user whose computer crashed and lost unsaved work. According to professional communication best practices, what should the technician do FIRST?

A company wants to ensure that sensitive data on laptops is protected in case the laptop is lost or stolen. Which technology provides full-disk encryption for Windows 10?

A technician needs to deploy Windows 10 Pro to several new computers that have different hardware configurations (different manufacturers, chipsets, etc.). The technician has built a reference Windows 10 installation on one computer and customized it with required applications and settings. Which built-in tool should the technician use to generalize the image so it can be captured and deployed to the other computers?

A technician is decommissioning several old magnetic hard disk drives (HDDs) that contain sensitive company data. The drives are no longer in use and will be physically destroyed. Which of the following methods will BEST ensure that the data on these HDDs is irretrievable before disposal?

A technician upgraded a Windows 10 workstation from 8 GB to 16 GB of RAM by installing two new matching DIMMs. After the upgrade, the workstation crashes intermittently with stop code MEMORY_MANAGEMENT (0x0000001A). The technician has reseated the RAM, updated the BIOS, and run Windows Memory Diagnostic, which passed without errors. What should the technician do NEXT?

A Windows 10 computer repeatedly crashes with a blue screen error that has the stop code "IRQL_NOT_LESS_OR_EQUAL". The technician suspects the issue is related to a device driver. What is the BEST next step to identify and resolve the problem?

A user receives an email from an unknown sender with an attachment labeled 'Invoice_2024.zip'. The user opens the attachment, which contains an executable file. The user runs the executable, and the workstation starts encrypting files. Which type of social engineering attack is this?

A technician needs to deploy a critical security patch to a production file server. The patch has already been tested successfully in a lab environment. According to standard change management best practices, what must the technician do before deploying the patch to production?

A Windows 10 workstation displays 'Bootmgr is missing' upon startup. Which of the following is the most likely cause of this error?

A user receives a phone call from an individual claiming to be a help desk technician. The caller says the user's computer is infected with a virus and asks the user to download remote access software so the caller can fix it. The user complies and grants access. Which type of social engineering attack is this?

A technician is documenting an acceptable use policy (AUP) for company-issued devices. Which of the following is a key component that should be included in the policy?

A user reports that a Windows 10 application displays the error 'This application could not be started. Please try reinstalling the application.' The technician runs a compatibility troubleshooter and it applies the Windows 8 compatibility mode. The application works after that. The technician wants to permanently apply this setting. What should the technician do?

A technician has resolved a support ticket for a user's printer issue. Which of the following should the technician include in the ticket documentation?

A technician needs to run a suspicious executable file in an isolated environment on a Windows 10 Pro workstation without using a third-party virtual machine. Which built-in Windows feature should the technician use?

A user reports that a Windows 10 application frequently crashes with an error indicating that a required DLL file is missing. The technician has verified that the application worked previously. Which of the following should the technician do FIRST?

A technician is investigating a potential security incident. A user reports that they clicked a link in an email and entered their corporate credentials on a website that appeared to be the company's VPN portal. The technician confirms the website is malicious and the credentials have been compromised. According to the company's incident response plan, what should the technician do FIRST?

A technician is implementing a change to install a new software update on all company workstations. The change has been approved by the CAB. During the installation, the technician discovers that the update is incompatible with one department's critical application. According to change management, what should the technician do?

A user's Windows 10 computer prompts for a BitLocker recovery key after a firmware update. The user does not remember the recovery key. The user's Microsoft account is linked to the device. What is the best action for the technician to take?

A technician needs to upgrade a computer from Windows 10 Home to Windows 10 Pro. The current installation is activated with a digital license. Which of the following is the MOST efficient method to perform this upgrade while preserving user data and installed applications?

A technician needs to create a bootable USB flash drive to install Windows 10 on a new computer. Which of the following tools is built into Windows 10 that can be used to create this bootable media?

An employee receives an email that appears to be from the company's HR department, requesting that they click a link to verify their login credentials for a new payroll system. The link leads to a fraudulent website that captures the employee's username and password. Which type of social engineering attack is this?

A Windows 10 workstation experiences frequent Blue Screen of Death (BSOD) errors with the stop code MEMORY_MANAGEMENT. Which hardware component is most likely the cause?

A user reports that a Windows 10 application crashes immediately on startup with error code 0xc0000142. The technician has already run System File Checker (SFC) and Deployment Image Servicing and Management (DISM), both reporting no corruption. The application was working before a recent Windows Update was installed. Which should the technician try NEXT?

A user needs to schedule a script to run automatically every day at 3:00 PM on a Windows 10 computer. Which built-in tool should the technician use?

A technician boots a Windows 10 workstation after a power outage and receives the error: "Boot configuration data is missing. File: \Boot\BCD Error code: 0x000000f". The technician has a Windows 10 installation USB drive. Which command-line utility and specific command should the technician use to rebuild the Boot Configuration Data (BCD)?

A security audit reveals that multiple workstations have unauthorized software installed despite a policy allowing only approved software. Users have local administrative rights. Which security control would best prevent this in the future?

A user's web browser frequently redirects to unfamiliar search engines and displays persistent pop-up ads. The technician runs a full antivirus scan, which removes several threats, but the behavior continues. Upon inspection, the technician finds that the browser's proxy settings have been altered. Which type of malware is most likely responsible?

A user reports that their workstation is infected with ransomware, and all files on the local drive as well as mapped network drives are encrypted. The technician has already isolated the workstation by unplugging the network cable and powering off the machine. According to incident response best practices, what should the technician do NEXT?

A technician needs to install Windows 10 on a new computer with an empty hard drive. The technician boots from the installation media. At the 'Where do you want to install Windows?' screen, the drive is listed as 'Unallocated Space'. Which action should the technician take to proceed with a standard installation?

A technician is troubleshooting a Windows 10 Pro workstation that crashes intermittently when running a specific business application. The technician has already reinstalled the application, updated all device drivers, run System File Checker (SFC) and DISM with no issues, and checked Event Viewer for errors. The application crashes without any error message. Which two built-in tools should the technician use NEXT to help identify the root cause? (Choose two.)

A user reports that a specific PDF file will not open in Adobe Acrobat Reader. When double-clicking the file, nothing happens. Other PDF files on the same computer open successfully. What is the most likely cause?

A technician needs to configure a Windows 10 workstation that will be used by multiple employees who share the same physical device. Each employee should have their own personalized settings and files, and must be able to log in with their own domain credentials. Which of the following should the technician implement?

A user reports that a 64-bit business application on Windows 10 Pro crashes immediately after launch with error code 0xc000007b. The technician has already reinstalled the application, verified that all Windows updates are current, and ran System File Checker (SFC) and Deployment Imaging Service and Management Tool (DISM) with no issues found. All required Visual C++ Redistributable packages are present. Which of the following should the technician do NEXT to identify the root cause?

A technician is supporting a field engineer tablet. The immediate goal is to respond to possible MFA fatigue attack. Which tool, control, or procedure is the best fit?

An employee is walking into the office building holding a coffee and their phone. A person in a uniform, carrying a clipboard, approaches and says they are from the HVAC company and need to check the thermostat on the third floor. The employee holds the door open and lets them in. This is an example of which type of social engineering attack?

A technician is supporting a shared training-room workstation. The immediate goal is to store unique complex passwords securely. Which tool, control, or procedure is the best fit?

A technician is troubleshooting a Windows 10 workstation that crashes with a blue screen error: IRQL_NOT_LESS_OR_EQUAL. The technician has updated all drivers and Windows, run memory diagnostics (no errors), and performed a clean boot. The crashes occur randomly but are more frequent when the system is performing heavy disk I/O operations. Which component should the technician suspect and test NEXT?

A technician is troubleshooting a Windows 10 Pro workstation that is experiencing slow boot times. The technician opens Task Manager and notices that a program called 'LegacyApp' is using a large amount of disk I/O at startup. The technician wants to prevent this program from launching automatically without uninstalling it. However, the program is not listed in the Startup tab of Task Manager. Which built-in Windows tool should the technician use NEXT to identify how the program is configured to start?

A technician is about to perform a firmware update on a critical server after receiving approval from the change advisory board. The technician has downloaded the correct firmware from the vendor and verified the hash. During the maintenance window, the technician begins the update but the server becomes unresponsive after the flash process starts. Which of the following documentation should the technician have prepared BEFORE the update?

A technician needs to dual-boot Windows 10 and a Linux distribution on a UEFI-based system. Which partition style is required for the boot drive?

A technician installed a new video driver on a Windows 10 workstation. After rebooting, the workstation displays a blue screen error with the message 'VIDEO_TDR_FAILURE' and will not start normally. The technician can boot into Safe Mode. Which built-in Windows tool should the technician use to verify if the new driver is causing the issue?

A security incident has occurred. A malware infection was detected on a server that stores encrypted customer PII. The server was immediately isolated from the network. According to the incident response plan, which step should the technician take NEXT after preserving evidence?

A technician is supporting a warehouse desktop. The immediate goal is to correct Linux file permissions. Which tool, control, or procedure is the best fit?

A technician is working on a reception PC and needs to reach websites by IP address but not hostname. Which two actions are appropriate? (Choose two.)

A user reports that a game crashes on launch with error 'DirectX function failed'. The technician has updated the graphics driver and installed the latest DirectX runtime. What should the technician do NEXT?

A sales representative reports that their company-enrolled personal smartphone was lost at an airport. The device contains both personal photos and corporate email. The IT department needs to protect corporate data without destroying personal content. Which action should the technician take FIRST?

A technician needs to gather system information from a remote Windows 10 computer without using a graphical interface. Which built-in command-line tool can be used to execute commands remotely?

A developer needs to run a native Linux command-line tool on a Windows 10 Pro workstation. The technician wants to enable the appropriate Windows feature to support this. Which feature should be installed?

A user's Windows 10 workstation fails to boot and displays a black screen with a spinning circle. The technician cannot access Safe Mode. The technician has access to another working Windows 10 computer. Which tool should the technician use to create a bootable recovery drive to attempt repair?

A small business owner wants to deploy Windows 10 on several new computers and needs to ensure all devices can be managed via Group Policy. Which edition of Windows 10 should they purchase?

A user tries to install a new application on a Windows 10 computer but receives the error: "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item." The technician has verified that the installation file is from a trusted source and is not blocked. Which of the following is the most likely cause?

A technician suspects a computer is infected with ransomware that has encrypted files and displays a ransom note. Which step should the technician take FIRST according to best practices for malware removal?

A technician is upgrading Windows 10 from version 20H2 to 22H2 on a user's workstation. The upgrade fails repeatedly with error code 0x80070002. The technician has verified that the system meets hardware requirements, ran System File Checker and DISM without finding corruption, and has ample disk space. Which of the following is the most likely cause of the failure?

A security audit reveals that an employee's laptop is infected with a rootkit that has been logging keystrokes for the past month. According to standard malware removal best practices, what should the technician do FIRST?

A help desk technician receives a call from a user who states they forgot their password and need it reset. The technician follows the company's standard operating procedure for password resets. After successfully resetting the password and confirming the user can log in, what should the technician do NEXT according to best practices?

A technician has received approval from the Change Advisory Board (CAB) to decommission an old server that hosts a legacy application. The decommissioning is completed successfully. The next day, users report that a critical monthly report no longer runs. The technician discovers that the report depended on a scheduled task on the old server that was not migrated. According to change management best practices, what should the technician have done to prevent this issue?

A user reports that a Windows 10 application crashes immediately after launch with the error: 'Application failed to initialize properly (0xc0000135)'. Event Viewer shows a .NET Framework error. The application worked previously. Which of the following is the MOST likely cause?

A company policy requires that all data on laptops be encrypted so that if a laptop is stolen, the data cannot be read even if the hard drive is removed. Which Windows 10 feature provides this?

A technician needs to configure a Windows 10 workstation so that a specific application always runs with administrator privileges without prompting for credentials. The user is a standard user. Which of the following methods will achieve this with the LEAST security risk?

A user receives an email that appears to be from their bank, asking them to click a link and verify their account information due to suspicious activity. The email address is slightly misspelled (e.g., 'support@bankk.com' instead of 'support@bank.com'). Which type of social engineering attack is this?

A user reports that a Windows 10 application crashes with the error code '0xc000007b' when trying to launch. The application was working previously. The technician suspects a missing or corrupted Microsoft Visual C++ runtime component. Which built-in tool should the technician use FIRST to verify the installed runtime versions?

A user receives an email that appears to be from the company's HR department, asking the user to click a link and enter their login credentials to view a new benefits document. The technician notices the sender's domain is 'hr@cornpany.com' (with 'rn' instead of 'm'). The user did not click the link. According to best practices, what should the technician do FIRST?

A company is decommissioning several workstations that contain confidential client data on traditional HDDs. The company's data disposal policy requires that the data be completely unrecoverable. Which method should the technician use to achieve this?

A technician is decommissioning a server that contains confidential data stored on multiple SATA SSDs. The SSDs will be physically destroyed by a certified vendor. However, the technician must first render the data unrecoverable before handing over the drives. Which of the following methods is the MOST appropriate for SSDs prior to physical destruction?

A technician replaced a failed SATA hard drive in a Windows 10 desktop with a new SSD. After cloning the old drive to the new SSD, the computer fails to boot with the error 'Boot Device Not Found'. The technician checks BIOS settings and notices that the SATA controller mode is set to IDE. The old drive was configured as AHCI. Which of the following is the MOST likely cause of the boot failure, and what is the correct fix?

A company's security audit reveals that several employees are using weak passwords that can be easily guessed. The current password policy requires a minimum of 8 characters but does not enforce complexity. Which change to the password policy would be MOST effective in increasing security against brute-force attacks?

A technician is supporting a clinic workstation. The immediate goal is to recover after a newly installed device driver causes instability. Which tool, control, or procedure is the best fit?

A technician is configuring Windows Defender Firewall on a Windows 10 workstation. The technician needs to allow inbound Remote Desktop (RDP) connections only from a specific IP address, 192.168.1.100. All other inbound connections should be blocked. How should the technician configure the rules?

A technician is troubleshooting a Windows 10 application that fails to launch with error 'Unable to initialize the application. The required service 'AppHostSvc' is not running.' The technician checks Services.msc and finds the service is set to Manual. What command-line tool should the technician use to set the service to start automatically?

A technician is setting up a Windows Deployment Services (WDS) server to deploy Windows 10 images to multiple computers over the network. The technician has configured the WDS server and verified that the client computers have network connectivity. What technology must the client computers support to boot from the network and initiate the deployment process?

A technician is troubleshooting a user's Windows 10 workstation where a legacy business application fails to launch. The application was working yesterday, but after a recent Windows Update was installed automatically overnight, the application now displays an error indicating it is not compatible. The technician has already rolled back the update, but the application still will not launch. Which of the following should the technician try NEXT to resolve the issue?

A technician has implemented an approved change to a server. According to standard change management processes, what is the next step?

Which of the following scenarios best describes a tailgating attack?

A user reports that their Windows 10 computer is running slowly, and applications take a long time to open. The technician opens Task Manager. Which tab should the technician use to see which application is using the most CPU resources?

A technician needs to deploy a Windows 10 image to a new laptop that uses a different storage controller driver than the reference computer. The technician has preloaded the driver onto a USB drive. Which tool should the technician use to inject the driver into the offline Windows image (WIM file) before deploying?

A user reports that they cannot access a shared folder. The user is a member of the 'Sales' group. The NTFS permissions allow 'Sales' group 'Read', and the share permissions allow 'Everyone' 'Full Control'. What is the user's effective access?

A technician needs to protect a laptop's data so that it is unreadable if the laptop is stolen. The laptop has a TPM 2.0 chip. Which technology should the technician use to encrypt the entire operating system drive?

After upgrading a Windows 10 computer from Windows 7, a user reports that an older application no longer works correctly. Which tool should the technician use to check and adjust compatibility settings for the application?

A technician configured a dual-boot system with Windows 10 and Ubuntu Linux. After the installation, the computer boots directly into Windows without showing the GRUB menu. The technician boots from a Linux live USB and opens a terminal. Which command should the technician use to regenerate the GRUB configuration and detect the Windows boot loader?

A technician needs to open the System Configuration utility to modify boot options on a Windows 10 computer. Which command should be entered in the Run dialog box?

A user wants to use Windows Sandbox on their Windows 10 computer. Which edition of Windows 10 is the minimum required to support Windows Sandbox?

A user reports that their Windows 10 computer fails to boot with error '0xc0000225' after a failed Windows update. The technician boots from Windows PE and opens a command prompt. Running 'bootrec /scanos' shows no Windows installations found. What should the technician do NEXT?

A technician is implementing a scheduled change to replace the power supply in a server. The change was approved by the Change Advisory Board (CAB) with a 30-minute maintenance window. During the replacement, the technician discovers that the new power supply's connector is incompatible with the server's motherboard. The technician has an adapter that could work, but using the adapter was not included in the change plan. According to change management best practices, what should the technician do FIRST?

A technician has identified the need to update a critical server's operating system to meet new security compliance requirements. According to change management best practices, what is the NEXT step the technician should take after identifying the need?

A user reports that when printing a specific PDF file from Adobe Acrobat Reader, the output pages are completely blank. Other documents, including other PDFs, print correctly from the same application to the same printer. What should the technician do FIRST?

A security administrator is tasked with implementing application whitelisting on a fleet of Windows 10 Pro workstations that are not joined to a domain. The goal is to allow only approved applications to run and block all others. The administrator needs a solution that is built into Windows 10 Pro and can be configured locally. Which feature should the administrator use?

A technician needs to install Windows 10 on a computer with only 1 GB of RAM. The technician has a 64-bit installation ISO. Which action should the technician take?

A technician is documenting a change to replace a failed hard drive in a server. The change was approved as a standard change. After the replacement, the server reboots and is online. The technician tests connectivity and verifies data integrity. According to change management best practices, what should the technician do next?

A technician is supporting a shared training-room workstation. The immediate goal is to reverse a bad driver or system change without wiping user files. Which tool, control, or procedure is the best fit?

A technician is applying a critical security patch to a production database server during a scheduled maintenance window. The patch was tested in a lab environment and approved by the Change Advisory Board (CAB). The patch installs successfully, but after the server reboots, a core database service fails to start. A system state backup was taken before the change. According to change management best practices, what should the technician do FIRST?

A technician updates the graphics driver on a Windows 10 workstation. After restarting, the computer boots to a black screen with only a mouse cursor. The technician is able to boot into Safe Mode by pressing F8 during startup (assuming legacy boot). Which of the following should the technician do FIRST to resolve the issue?

A technician needs to configure a Windows 10 computer to automatically install optional updates, such as driver updates and feature updates, without manual intervention. Which setting should be configured in Windows Update Advanced Options?

A user reports that a specific Microsoft Office add-in causes Excel to crash when opening any spreadsheet. The technician disables the add-in and Excel works fine. However, the user needs the add-in. The technician checks the add-in's compatibility and finds it is designed for 32-bit Office but the user has 64-bit Office installed. What is the best solution?

A technician is planning to apply a critical security patch to a production file server. The patch has been fully tested in a lab environment and the Change Advisory Board (CAB) has approved the change. The maintenance window begins in one hour. According to change management best practices, which of the following should the technician do NEXT?

A user reports that a legacy 16-bit application created for Windows 3.1 fails to run on a 64-bit Windows 10 Pro workstation. The technician verifies that the application is compatible with 32-bit Windows 10 but not 64-bit. Which of the following is the most likely reason the application cannot run?

After updating the graphics driver on a Windows 10 workstation, the computer experiences intermittent blue screen errors with the stop code 'DRIVER_IRQL_NOT_LESS_OR_EQUAL' referencing nvlddmkm.sys. The technician boots into Safe Mode and the error does not occur. What is the MOST appropriate next step?

A technician is supporting a clinic workstation. The immediate goal is to unlock an encrypted Windows drive after security-state change. Which tool, control, or procedure is the best fit?

A technician observes that an employee printed a report containing customer Personally Identifiable Information (PII) and left it in the printer tray for over an hour. Which security principle has been violated?

A user's Windows 10 computer fails to boot normally after installing a recent Windows Update. The computer attempts startup repair but fails and presents a black screen. Which built-in Windows recovery environment tool should a technician use to revert the system to a previous state without losing personal files?

A technician is supporting a field engineer tablet. The immediate goal is to grant users only the access needed for their job. Which tool, control, or procedure is the best fit?

A technician needs to view the BIOS version, system model, and detailed hardware information on a Windows 10 computer. Which built-in utility provides this comprehensive system information?

A technician is supporting a shared training-room workstation. The immediate goal is to receives an APIPA address on one office port. Which tool, control, or procedure is the best fit?

A security analyst detects that an attacker is attempting to gain unauthorized access to a system by systematically trying every possible password for a user account. Which type of attack is this?

A security analyst is investigating a workstation that is suspected of being compromised. The analyst has disconnected the network cable and created a forensic image of the hard drive using a write-blocker. Which of the following should the analyst do NEXT to preserve evidence integrity?

A user reports that their Windows 10 computer's Bluetooth is not working. The technician checks Device Manager and sees the Bluetooth adapter has a yellow exclamation mark. The technician has already tried updating the driver, but the issue persists. Which should the technician do NEXT?

A Windows 10 application stops responding. The user cannot close the application normally. Which built-in tool should be used to force close the application?

A user reports that after installing a new graphics card driver, Windows 10 fails to boot and shows a blue screen with error STOP: 0x00000116 (VIDEO_TDR_FAILURE). The technician is unable to boot into Safe Mode. Which Windows Recovery Environment (WinRE) option should the technician use FIRST to restore the previous driver?

A technician is supporting a remote worker laptop. The immediate goal is to reverse a bad driver or system change without wiping user files. Which tool, control, or procedure is the best fit?

A company's security policy requires that all laptops have full disk encryption. A technician is configuring BitLocker on a Windows 10 Pro laptop. The laptop does not have a TPM chip. Which additional step must the technician take to enable BitLocker?

A technician is installing Windows 10 on a new computer that uses UEFI firmware and a 2TB SSD. The technician boots from the installation media and reaches the 'Where do you want to install Windows?' screen with unallocated space. When the technician clicks 'New' to create a partition, which additional partitions does Windows automatically create?

A user reports receiving multiple phishing emails that appear to come from the company's CEO. The emails ask the user to wire money to an account for a business acquisition. Which type of social engineering attack is this?

A technician is cleaning a workstation that was infected with a rootkit. The technician has booted into a trusted recovery environment and run anti-malware scans. After removing the rootkit, the technician wants to ensure no remnants remain. Which of the following is the BEST next step?

A user receives a phone call from someone claiming to be from the IT department. The caller says there is a security breach and asks the user to provide their username and password immediately. Which type of social engineering attack is this?

A user reports that their macOS Ventura system is running slower than usual after installing several applications. The technician suspects that some applications are configured to launch automatically at login, consuming system resources. Which built-in macOS tool should the technician use to view and manage login items?

A user reports that a Windows 10 application crashes with the error '0xc0000005 (Access Violation)'. The technician has already updated the application and graphics drivers. Which built-in Windows tool should the technician use to test the system memory for faults?

A user reports that Microsoft Edge displays 'This page is having a problem loading' for all websites. Other users on the same network can browse without issues. The technician has already cleared the browser cache and reset Edge settings to default. Which of the following should the technician try NEXT?

A technician is implementing a change to migrate a file server to new hardware. The change management plan requires a rollback plan. Which of the following BEST describes a rollback plan?

A company has a policy that all changes to network infrastructure must be approved by a supervisor before implementation. A technician notices a critical security vulnerability in a firewall that needs immediate patching. What should the technician do?

A company's change management policy requires all infrastructure changes to be approved by the Change Advisory Board (CAB). A technician discovers a critical security vulnerability that requires immediate patching before the next scheduled CAB meeting. What is the best course of action?

A technician needs to install Windows 10 on a computer that currently runs Windows 7 Professional. The technician wants to retain all applications, settings, and user data. The computer's processor supports SLAT and the system meets hardware requirements for Windows 10. Which installation method should the technician use?

A user receives an email that appears to be from the IT department asking them to verify their account by clicking a link and entering their password. The email has a sense of urgency, stating the account will be disabled within 24 hours. Which type of social engineering attack is this?

A technician has a change request approved by the Change Advisory Board (CAB) to upgrade the operating system on 50 company workstations. The technician has tested the upgrade on a pilot group of five workstations with no issues. According to change management best practices, what is the NEXT step the technician should take?

After installing a new application, a Windows 10 computer displays a 'Windows Script Host' pop-up error message every time the computer starts. The technician determines that a VBS script is launching from the startup folder. Which built-in tool should the technician use to disable this startup script?

A company implements a policy requiring employees to use a smart card and a PIN to log into their workstations. This security measure is an example of which of the following?

A user reports that their Windows 10 workstation is running very slowly, especially when opening applications. The technician opens Task Manager and notices that the disk usage is consistently at 100%. Which built-in Windows tool should the technician use to diagnose the cause of high disk usage?

A technician upgraded a Windows 10 workstation from 8GB to 16GB of RAM by installing two new matching DIMMs. After the upgrade, the workstation crashes intermittently with a stop code 'MEMORY_MANAGEMENT' (0x0000001A). The technician has run Windows Memory Diagnostic, which passed without errors, and the BIOS correctly reports 16GB of RAM. All other drivers and the OS are up to date. Which of the following should the technician do NEXT?

A Linux administrator needs to change the permissions of a script file named 'script.sh' so that the owner has read, write, and execute permissions; the group has read and execute permissions; and all other users have no permissions. Which of the following commands will achieve the desired permissions?

A user reports that their Windows 10 workstation's screen intermittently goes black for a few seconds and then recovers. The event log shows 'Display driver stopped responding and has recovered.' Which component is most likely causing this issue?

A small business owner wants to ensure that employees follow a consistent and documented process when handling sensitive customer data. Which type of document should the technician recommend to outline the step-by-step procedures?

A user receives a phone call from someone claiming to be from the IT department. The caller asks the user to provide their login credentials so a security update can be applied immediately. The user complies. Which type of social engineering attack has occurred?

A technician needs to view detailed hardware and software information on a Windows 10 Pro workstation, including the installed RAM, processor model, and BIOS version, to verify compatibility before deploying a new application. Which built-in system tool should the technician use?

A technician receives a Windows 10 workstation that boots to a black screen with a blinking cursor. The technician boots from a Windows 10 installation media and opens a command prompt. The technician runs 'bootrec /fixmbr' and 'bootrec /fixboot' but the issue persists. The system uses UEFI and GPT. Which command should the technician run NEXT?

A technician is investigating a Windows 10 computer that has experienced several application crashes and one system crash. The technician wants to see a graphical timeline of these events and the system's stability over time. Which tool should the technician use?

A user reports that their Windows 10 computer boots repeatedly into the Automatic Repair screen after a failed system update. The user has restarted several times. Which action should the technician take to boot into normal Windows and stop the repair loop?

A help desk technician is creating a standard operating procedure (SOP) for handling password reset requests. Which of the following components is MOST important to include in the SOP to ensure consistency and security?

A company performs daily backups of its critical database server. The backup logs show 'completed successfully' each day with no errors. However, during a disaster recovery drill, the database administrators discover that many backup files are corrupt and cannot be restored. What should the technician have done to prevent this situation?

A Windows 10 computer fails to boot after a power outage. The technician suspects file system corruption. The technician boots into the Windows Recovery Environment (WinRE). Which command-line tool should be used FIRST to check and repair the file system?

According to change management best practices, what is the primary purpose of a backout plan?

A technician is configuring a Windows 10 Pro workstation for a user who will be working remotely. The user needs to be able to access files on the corporate network securely without installing a separate VPN client. Which built-in Windows feature should the technician configure?

A user is able to access a shared folder containing financial reports that are not required for their job role. Which security principle is being violated?

A technician is supporting a shared training-room workstation. The immediate goal is to slow repeated password guessing. Which tool, control, or procedure is the best fit?

A technician is troubleshooting a Windows 10 workstation that displays a blue screen error 'SYSTEM_SERVICE_EXCEPTION' when launching a graphics-intensive application. The video driver and Windows updates are current, and memory diagnostics show no errors. Which built-in Windows tool should the technician use to view recent system crashes and identify the error code associated with the driver?

A technician is implementing a change to a server's network configuration. After making the change, he verifies that connectivity works, but a critical application on another server stops functioning. According to change management best practices, what should the technician have done first?

A user wants to create a bootable macOS installer on a USB flash drive to install macOS on another Mac. Which command-line utility is designed specifically for this purpose in macOS?

A security administrator needs to securely erase data from an SSD before repurposing it in another department. The company policy requires that data be completely unrecoverable. Which method should the administrator use?

A user reports that their Windows 10 workstation gets stuck at a blue screen with the error 'INACCESSIBLE_BOOT_DEVICE' after a power outage. The technician suspects file system corruption. Which command should the technician run from the Windows Recovery Environment to attempt to repair the file system?

A technician has received approval from the Change Advisory Board (CAB) to update the firmware on a critical database server. The change window is scheduled for 1:00 AM. At 12:45 AM, the technician begins the update, but mid-process the server loses power due to an electrical fault. Upon power restoration, the server fails to boot. The technician has a verified full backup. According to change management and incident response procedures, what should the technician do FIRST?

A user reports that their Windows 10 computer is running slowly and the disk activity light is constantly on. Which tab in Task Manager should the technician use to see which process is using the most disk resources?

A technician is supporting a remote worker laptop. The immediate goal is to handle suspicious email without clicking links. Which tool, control, or procedure is the best fit?

A technician needs to boot a Windows 10 workstation into Safe Mode with Networking because the system fails to start normally. The technician has booted from a Windows 10 installation media and opened the Command Prompt from the Repair options. Which command should the technician use to configure the boot to Safe Mode with Networking on the next restart?

A user wants to upgrade their Windows 10 Home workstation to Windows 10 Pro to join a domain. The user has purchased a valid Windows 10 Pro product key. Which method should the user use to perform the edition upgrade?

A technician is troubleshooting a Windows 10 workstation that blue screens with various stop codes. The technician suspects a device driver is causing the crashes but cannot identify which one. The crashes are intermittent. Which built-in tool should the technician enable to force the system to crash and create a dump file when a specific driver misbehaves, allowing the technician to identify the faulty driver?

A technician is troubleshooting a Windows 10 system that fails to boot with the error: 'STATUS_BAD_IMAGE_INFO'. The technician suspects the Boot Configuration Data (BCD) store is corrupted. The technician booted into the Windows Recovery Environment (WinRE). Which command should the technician use to rebuild the BCD store?

A technician needs to enable Remote Desktop on a Windows 10 Pro workstation to allow a remote user to access the machine. Which Control Panel or Settings path should the technician use to enable this feature?

A technician completes a repair of a workstation. According to best practices, what should the technician do before closing the ticket?

A user reports that a line-of-business application on Windows 10 Pro crashes immediately after launch with error code 0xc0000005 (Access Violation). The technician has already reinstalled the application, applied all Windows updates, and run both System File Checker (SFC) and the Deployment Imaging Service and Management Tool (DISM) with no issues found. Which of the following should the technician do NEXT to troubleshoot the crash?

A user receives an email that appears to be from a well-known shipping company, asking them to download an invoice attachment. The attachment contains a macro-enabled Word document. What type of malware is most likely being delivered?

A technician is installing Windows 10 on a new computer with a GPT disk and UEFI firmware. Which file system must be used for the EFI System Partition (ESP) that contains the boot loader?

A technician boots a Windows 10 workstation and sees a black screen with the error 'Bootmgr is missing'. The technician has a Windows 10 installation USB drive. Which tool should the technician use to repair the boot configuration?

A security administrator wants to prevent users from running unauthorized portable applications (e.g., a portable web browser on a USB drive) on their Windows 10 workstations. Which security policy implementation would be MOST effective?

A user reports that a custom database application on Windows 10 displays an error 'Cannot connect to database. Error: 0x80004005 Unspecified error' every time they try to run a complex report. Other users on the same network can run the report successfully. The technician has verified the application's firewall rules are correct and reinstalled the application. Which step should the technician take NEXT?

A help desk technician receives a call from a user who reports that they received an email asking them to click a link and enter their corporate credentials to 'verify their account.' The user clicked the link and entered their username and password. According to incident response best practices, what should the technician do FIRST?

An HR manager receives an email that appears to be from the CEO requesting that all employee W-2 forms be emailed directly to the sender. The email address is ce0@company.com (using a zero instead of the letter 'o'). Which type of social engineering attack is this?

A technician implemented a change to update a configuration file on a web server during a scheduled maintenance window. After the change, the web server experiences a 500% increase in error rates. The technician has a verified backup of the original configuration file. According to change management best practices, what should the technician do FIRST?

A technician notices that a Windows 10 machine is displaying an error message about a missing .DLL file when launching a specific application. The technician has already confirmed that the file is not in the system folder. Which built-in command should the technician use to attempt to repair the application installation?

A technician suspects that the Boot Configuration Data (BCD) on a Windows 10 computer is corrupt, preventing the system from booting. The technician boots from Windows 10 installation media and opens a command prompt. Which command should be used to rebuild the BCD?

A technician is preparing to upgrade a Windows 10 Pro workstation to Windows 11. The computer meets the RAM, storage, and TPM 2.0 requirements, but the CPU is a 7th generation Intel Core i7, which is not on Microsoft's officially supported processor list. What should the technician do?

A user needs to install Windows 10 on a new SSD that is currently empty. The computer uses UEFI firmware. The technician inserts the installation USB and boots. During installation, the user reaches the partition screen but sees only unallocated space. What partition scheme should the technician ensure is used when creating partitions?

A help desk technician is escalating a complex issue to a senior technician. According to best practices, which information should the technician include in the escalation documentation?

A technician is tasked with deploying Windows 10 to 50 new workstations. The technician wants to automate the installation process, including applying drivers and installing standard business applications, to ensure consistency and save time. Which tool is specifically designed for creating and managing customized Windows deployment images?

A technician needs to verify the exact edition, version, and system type (32-bit or 64-bit) of Windows 10 installed on a workstation to ensure compatibility with a new security software. Which built-in tool should the technician use to view this information?

A user has forgotten the login password for their macOS workstation. The technician needs to reset the password without reinstalling the operating system and without losing data. Which built-in tool or method should the technician use?

A company's security policy requires that all mobile devices be encrypted and capable of being wiped remotely if lost or stolen. Which mobile management solution should the organization implement?

A technician is supporting a field engineer tablet. The immediate goal is to handle a device that may contain evidence. Which tool, control, or procedure is the best fit?

A company policy requires that all data on decommissioned laptops be completely destroyed to prevent data breaches. The laptops have non-functional hard drives. Which method of data destruction is most appropriate?

A technician is supporting a finance laptop. The immediate goal is to identify Linux processes consuming CPU interactively. Which tool, control, or procedure is the best fit?

A company wants to prevent unauthorized personnel from entering a secured server room. Which of the following physical security controls is the MOST effective at preventing unauthorized access?

A user reports that a 64-bit application on Windows 10 Pro crashes immediately upon launch with the error '0xc000007b'. The technician has already reinstalled the application, verified that all required Visual C++ Redistributable packages are present, and run System File Checker (SFC) and DISM with no issues. What should the technician do NEXT?

A technician has completed an emergency change to restore a critical server after a security breach. The change was not pre-approved by the Change Advisory Board (CAB) due to the urgency. According to change management best practices, what should the technician do NEXT?

A technician needs to test a downloaded executable file from an untrusted source on a Windows 10 Pro workstation. The technician wants to run the file in an isolated environment without affecting the host operating system and without using a separate virtual machine. Which built-in Windows feature should the technician use?

A user reports that after installing a Windows Update last night, their Windows 10 workstation fails to boot and displays a blue screen with the error 'INACCESSIBLE_BOOT_DEVICE'. The technician has verified that the hard drive is detected in BIOS and that the SATA mode has not been changed. Which of the following is the MOST likely cause of this issue?

A security analyst is reviewing logs after a malware infection on a user's workstation. The logs show that the malware attempted to contact multiple external IP addresses on port 445 (SMB) and also made several attempts to write to files with extensions like .docx, .xlsx, .pdf. The antivirus prevented the malware from executing but the analyst wants to contain the threat. According to incident response best practices, what should the analyst do FIRST?

A technician is applying a security patch to a file server as part of an approved change. During the patch installation, the server fails to reboot and the technician is unable to start the server. According to change management best practices, what should the technician do FIRST?

A user reports that after installing a new graphics card driver, their Windows 10 workstation crashes with a blue screen error IRQL_NOT_LESS_OR_EQUAL shortly after booting. The technician can boot into Safe Mode without issues. Which built-in tool should the technician use to help isolate the problematic driver?

A technician is configuring a dual-boot system with Windows 10 and Linux. After installing Linux, Windows no longer appears in the boot menu. The technician boots from a Linux live USB. Which command should the technician use to update the GRUB bootloader to include Windows?

A technician needs to upgrade a Windows 10 Home computer to Windows 10 Pro. The technician has a valid Windows 10 Pro product key. Which built-in method should be used to perform the edition upgrade?

A technician needs to boot a Windows 10 computer from a bootable USB flash drive to run a system recovery tool. Which key is most commonly used to access the boot menu on a typical PC?

A technician needs to ensure that all domain-joined Windows 10 computers in the company automatically install approved updates from a local Windows Server Update Services (WSUS) server instead of downloading them from Microsoft's update servers. Which configuration method should the technician use?

A user receives a phone call from someone claiming to be from the IT help desk. The caller states that they are conducting a security audit and need the user's domain password to verify the account. The caller sounds professional and uses the user's name and department. The user provides the password. Later, the user's account is used to access sensitive data. Which type of social engineering attack occurred?

A technician is documenting a standard operating procedure (SOP) for creating new user accounts. The SOP must include a step to verify the identity of the person requesting the account. Which of the following is the BEST method for identity verification?

A help desk technician needs to create a document that specifies the exact steps to follow when resetting a user's password, including verification of identity. Which type of document should be created?

A user reports that a Windows 10 Pro application crashes when attempting to save a file, displaying the error: '0x8007007B: The filename, directory name, or volume label syntax is incorrect.' The technician has verified that the file path is valid and that the user has write permissions to the destination folder. Which built-in Windows tool should the technician use FIRST to check for file system corruption?

A technician is supporting a remote worker laptop. The immediate goal is to slow repeated password guessing. Which tool, control, or procedure is the best fit?

A user reports that Microsoft Word crashes immediately when trying to open a specific document. The document was created on another computer and is critical. The technician has already repaired the Office installation and installed all updates. Which should the technician try NEXT to open the document?

A user needs to modify the boot order on a Windows 10 computer to boot from a USB drive. Which tool should the user access during the boot process?

A security audit reveals that several workstations have unauthorized applications installed. The users claim they did not install the software. Which security control would have been MOST effective in preventing this situation?

A technician is troubleshooting a Windows 10 computer that displays a blue screen error 'KMODE_EXCEPTION_NOT_HANDLED' when a USB device is plugged in. The technician updates the USB controller drivers, but the issue persists. What should the technician try next?

A company policy requires that all mobile devices used for work be managed via Microsoft Intune. An employee loses a company-issued smartphone. The IT administrator needs to remotely wipe the device to prevent data loss. Which prerequisite must have been completed on the device for this action to be possible?

A company's security policy requires that data on all decommissioned hard drives be completely destroyed to prevent any possibility of future data recovery. Which method is the MOST secure for destroying data on magnetic hard drives?

After installing a new software application on a Windows 10 computer, a user receives a 'DLL load failed' error when launching the program. The technician uses Process Monitor and finds that the application is trying to load a DLL from a path that does not exist. Which solution is most likely to resolve the issue?

A technician is troubleshooting a Windows 10 workstation that fails to boot with the error 'Bootmgr is missing'. The technician has booted from a Windows 10 installation media and opened a command prompt from the recovery environment. Which built-in command-line tool should the technician use to repair the Master Boot Record (MBR) for the system partition?

A user reports that a legacy application fails to install on Windows 10 with the error 'Installer encountered an error: 1603'. The technician has already verified that the user has local administrator privileges and that the installation media is not damaged. Which of the following should the technician do NEXT?

A user reports that a legacy 32-bit application crashes on a Windows 10 64-bit workstation with the error '0xc0000005 (Access Violation)'. The technician has already updated the application to the latest version, installed all Windows updates, and tested the system memory with Windows Memory Diagnostic (no errors). Which of the following should the technician do NEXT to troubleshoot the issue?

A technician needs to run a legacy Windows 7 application on a Windows 10 Pro workstation. The application requires direct access to hardware and does not work with compatibility mode. Which Windows feature should the technician enable to support this requirement?

A company policy requires that all laptops be encrypted to protect data in case of theft. A technician enables BitLocker Drive Encryption on a Windows 10 Pro laptop equipped with a TPM 2.0 chip. After encryption completes, which of the following is the MOST secure method to protect the BitLocker recovery key?

A user reports that a Windows 10 application crashes at startup with the error 'The program can't start because MSVCR120.dll is missing from your computer.' The technician has already reinstalled the application, but the error persists. Which of the following is the MOST likely cause?

Match each Windows feature to its purpose.

A user wants to prevent Windows 10 from automatically restarting during work hours to install updates. Which setting should the technician configure?

A technician has prepared a reference Windows 10 Pro installation on a computer and has run Sysprep to generalize the image. The technician now needs to capture the generalized image to a .wim file that can be deployed to other computers on the network. Which built-in command-line tool should the technician use?

A user reports that after upgrading from Windows 10 to Windows 11, a legacy 32-bit application displays an error 'Component 'MSCOMCTL.OCX' or one of its dependencies not correctly registered: a file is missing or invalid.' The technician re-registers the OCX file using regsvr32, but the application still fails. What is the most likely cause?

A technician is configuring a new Windows 10 workstation for a user who travels frequently. The user needs to be able to log in without an internet connection. The workstation is joined to Azure AD. Which sign-in option should the technician configure to provide offline access?

A technician discovers that a workstation is infected with ransomware. The technician has isolated the computer from the network. What should the technician do NEXT according to incident response procedures?

A company's change management policy requires all server changes to be approved by the Change Advisory Board (CAB). A technician discovers that a critical database server's operating system needs a security patch to comply with a new regulatory requirement that takes effect in one week. The patch has a known risk of causing service downtime. The next scheduled CAB meeting is in two weeks. What should the technician do FIRST?

A technician reinstalled a legacy line-of-business application on a Windows 10 Pro workstation, but the application still fails to start with an error stating that a specific ActiveX control (.ocx file) is missing or not registered. The technician has confirmed that the .ocx file exists in the C:\Windows\SysWOW64 folder. Which command should the technician run from an elevated command prompt to register this component?

A help desk technician receives a call from a panicked user who reports that they accidentally shared a confidential client list with an unauthorized person via email. According to the company's incident response plan, what should the technician do FIRST?

A user has a Windows 10 Home edition computer and needs to join it to a corporate domain. Which method can be used to upgrade to a domain-joinable edition?

A company requires employees to present both a smart card and a PIN to log into their workstations. Which authentication principle is being implemented?

A change request to upgrade the operating system on a database server has been approved by the Change Advisory Board (CAB). During the scheduled maintenance window, the technician completes the upgrade successfully. However, after rebooting, a critical business application fails to connect to the database. A full backup of the server was taken before the change. According to change management best practices, what should the technician do NEXT?

A technician needs to upgrade a Windows 10 Home workstation to Windows 10 Pro to join a domain. The user has a valid Windows 10 Pro license key. Which built-in Windows feature should the technician use to perform the upgrade without reinstalling applications?

A technician needs to troubleshoot a Windows 10 workstation that is experiencing random crashes. The technician wants to start the system with only essential drivers and services to isolate the issue. Which tool should the technician use to configure this boot mode from within Windows?

A technician is unable to establish a Remote Desktop Connection to a Windows 10 workstation on the same local network. The firewall is enabled on both systems. What is the most likely cause of the failure?

A user receives an email that appears to come from the company's CEO, asking the user to purchase several gift cards for a client appreciation event and to reply with the activation codes. The email address is similar to the CEO's but has an extra character. Which type of social engineering attack is this?

A user wants to set up a Windows Hello PIN on their Windows 10 Pro workstation to log in faster. However, when the user clicks 'Add' under 'PIN' in Sign-in options, the options are grayed out and unavailable. Which of the following is the MOST likely reason for this issue?

A technician receives a Windows 10 computer that fails to boot with the error '0xc000000e' and 'A required device isn't connected or can't be accessed.' The technician suspects the BCD is corrupted. Which command can be used to rebuild the BCD?

A user reports that a Windows 10 application crashes immediately upon launch. The technician opens Event Viewer and finds an error stating that a specific DLL file is missing. Which built-in command should the technician run FIRST to attempt to restore the missing system file?

A user reports that a 64-bit line-of-business application crashes immediately upon launch with error code '0xc000007b' on a Windows 10 Pro workstation. The technician has already reinstalled the application, run System File Checker (SFC) and DISM with no issues, and updated all device drivers. Which of the following should the technician do NEXT to resolve the issue?

A technician is part of a Change Advisory Board (CAB) meeting. The team is discussing a proposed change to update the antivirus software on all company servers. The change has a high risk of incompatibility. According to change management best practices, what should the technician recommend as a key part of the change request?

A user receives an email that appears to be from their bank, warning about a fraudulent transaction. The email contains an attachment named 'Statement.docm'. When the user attempts to open the attachment, Windows Defender detects and quarantines a Trojan. Which of the following BEST describes the attack vector that was prevented?

A technician is troubleshooting a Windows 10 workstation that fails to boot normally after an unsuccessful driver update. The technician can access the Windows Recovery Environment (WinRE). Which two tools available in WinRE can be used to restore the system to a previous working state? (Select two.)

A technician has completed a scheduled maintenance task to replace a failed hard drive in a server. The new drive is installed and the server is back online and functioning normally. According to best practices, what should the technician do NEXT?

A user in a Windows domain environment needs to remotely shut down another Windows 10 computer on the network. Which command-line tool should be used?

A user reports that a Windows 10 application crashes with the error 'The application was unable to start correctly (0xc000007b).' The technician has already run System File Checker (SFC) and Deployment Image Servicing and Management (DISM), both reporting no corruption. The application is a 32-bit game that uses DirectX. Which of the following should the technician do NEXT?

A user reports that a 64-bit application fails to launch on Windows 10 Pro with the error: 'The application has failed to start because its side-by-side configuration is incorrect. Please see the application event log or use the command-line sxstrace.exe tool for more detail.' The technician has already reinstalled the application and verified that all required Visual C++ Redistributable packages are installed. Which step should the technician take NEXT to identify the specific cause of the error?

A user reports that after installing a new third-party antivirus suite, their Windows 10 computer can no longer connect to the internet. Other computers on the same network are working fine. The technician confirms that the antivirus software is active and has its own firewall component. Which of the following should the technician do FIRST to restore internet connectivity?

A technician is installing a business application on a Windows 10 workstation. The installation fails with the error 'Fatal error during installation (Error 1603)'. The technician confirms there is sufficient disk space and the user has administrative privileges. What is the most likely cause of this error?

A technician is decommissioning a server that contained customer financial records. The server's hard drives will be recycled. Which of the following is the MOST secure method to ensure data is unrecoverable?

A security analyst suspects that a user's workstation is infected with a rootkit that has compromised the kernel. The workstation is still operational, and the analyst needs to capture forensic evidence. Which of the following actions should the analyst take FIRST to preserve the integrity of the evidence?

A company wants to ensure that all changes to network infrastructure are reviewed and approved. A technician finds a critical vulnerability that needs immediate patching. What should the technician do?

A user reports that after rebooting their Windows 10 workstation, a mapped network drive (Z:) is no longer accessible. The technician verifies that the network share is available from other computers and that the user can access it manually by typing the UNC path. Which of the following is the MOST likely cause?

A user reports that a 32-bit application crashes on a Windows 10 64-bit workstation with the error 'The application was unable to start correctly (0xc000007b).' The technician has already reinstalled the application and run SFC and DISM with no issues found. Which component should the technician check or reinstall NEXT?

A Windows 10 workstation boots to a black screen with only a mouse cursor visible. The technician can boot into Safe Mode without issues. Which built-in tool should the technician use to systematically identify the cause of the black screen?

A user reports that a legacy business application designed for Windows 7 fails to install on a Windows 10 Pro workstation. The installation process stops with the error 'MSI file is corrupt or incomplete.' The technician has verified the installation media is not damaged and has run the installer as Administrator. Which step should the technician take NEXT?

A technician is troubleshooting a Windows 10 application that crashes with the error 'This application could not be started. Side-by-side configuration is incorrect.' The technician runs sxstrace.exe and sees a manifest dependency on Microsoft.VC90.CRT with version 9.0.21022.8. Which action should the technician take?

A user reports that a Windows 10 application crashes with an error message when attempting to open a specific document. Other documents in the same application open without issue. Which built-in tool should the technician use FIRST to identify the cause of the crash?

A technician needs to prevent a standard user on a Windows 10 computer from installing unauthorized software without providing an administrator password. The user already has a standard user account. Which tool should the technician use to enforce this restriction?

A technician is decommissioning an old server that hosts a legacy application. The change has been approved by the Change Advisory Board (CAB). After decommissioning, users report that a critical report no longer runs. The technician discovers that the report depended on a scheduled task on the old server that was not migrated. According to change management best practices, what should the technician have done to prevent this issue?

A user reports receiving an email that appears to be from a well-known shipping company. The email states that a package delivery could not be completed and asks the user to click a link to reschedule. The user clicks the link, which opens a webpage that looks like the shipping company's login page, and enters their email address and password. Which type of social engineering attack has occurred?

Which encryption standard is used by BitLocker To Go to protect data on removable drives such as USB flash drives?

A technician is supporting a finance laptop. The immediate goal is to store unique complex passwords securely. Which tool, control, or procedure is the best fit?

A technician needs to replace a failed hard drive on a server that is under warranty. The replacement drive is an identical model and the procedure is documented and approved in advance. Which type of change is this?

A technician is troubleshooting a Windows 10 workstation that blue screens with various stop codes. The crashes occur randomly, often under heavy load. The technician has updated all drivers, run a memory test (Memtest86+) with no errors, and checked disk health with CHKDSK. The system crashes again. Which tool should the technician use to analyze the root cause of the crashes?

A user reports receiving a phone call from someone claiming to be from the company's help desk. The caller stated that there was a critical security issue and asked the user to provide their domain password to perform an emergency reset. The user complied. Which type of social engineering attack is this?

A technician is scheduled to apply security patches to a server during a maintenance window. The change was approved as a standard change. Midway through the patching, the technician discovers that one of the patches is causing a critical line-of-business application to fail. According to change management best practices, what should the technician do first?

A user receives an email from their bank stating that there has been suspicious activity on their account and they must click a link to verify their identity. The email address looks slightly off, and the user is suspicious. Which type of social engineering attack is this?

A change advisory board (CAB) has approved a standard change to update the firmware on a network switch. Before implementing the change, the technician creates a backup of the current configuration and prepares a rollback plan. After successfully applying the firmware update, what should the technician do NEXT according to change management best practices?

A technician is troubleshooting a Windows 10 application that crashes with error '0x80004005 - Unspecified error'. The technician has already reinstalled the application and updated Windows. Which tool should the technician use to check for system file corruption?

An employee receives a phone call from someone claiming to be a vendor's technical support representative. The caller says they need the employee's domain administrator password to 'apply a critical security patch'. The employee recognizes the vendor's name but is suspicious. Which type of social engineering attack is this?

A user receives an error stating that a DLL file is missing when launching an application on Windows 10. Which built-in utility can repair missing or corrupt system files?

A user reports that after a recent Windows Update, a business application crashes on startup. The technician has already run System File Checker (SFC) and DISM tools, which found no corruption. Which of the following tools should the technician use NEXT to help identify the cause of the crash?

A technician suspects that a Windows 10 computer is infected with a rootkit. The technician wants to use built-in and trusted tools to remove the malware. Which two actions should the technician take? (Select TWO).

A user reports that after a Windows Update, their Windows 10 workstation no longer connects to the internet. The technician runs ipconfig and sees an IP address of 169.254.x.x. Other devices on the network are working fine. Which step should the technician take FIRST?

A user receives a phone call from an individual claiming to be a member of the company's IT support team. The caller states that the user's email account has been compromised and requests the user's password to 'verify the account.' Which type of social engineering attack does this describe?

A technician has a change request approved by the CAB to apply a security patch to a critical file server. The scheduled maintenance window is from 2:00 AM to 4:00 AM. The technician arrives at 2:00 AM and finds that a user is still logged in and running a long data migration job that will not complete until 3:30 AM. The user is not responding to messages. Which of the following should the technician do FIRST?

A help desk technician receives a phone call from an individual who claims to be a representative from the company's primary software vendor. The caller states there is a critical security vulnerability in the software and requests the technician's administrative username and password to install an emergency patch immediately. The technician suspects social engineering. Which type of social engineering attack is being attempted?

Drag and drop the steps to restore a Windows 10 system from a system image backup into the correct order.

A technician needs to deploy Windows 10 to several new laptops with different hardware configurations. The technician wants to create a custom image that includes company software and settings. Which tool should be used on the reference computer before capturing the image to ensure it can be deployed to different hardware?

A user reports that Microsoft Word crashes every time they try to open a specific document. Other documents open normally. What should the technician try first?

A technician needs to apply a critical security patch to a production server that cannot be shut down during business hours. According to change management best practices, which step must be completed before implementing this emergency change?

A technician receives an email at work that appears to come from the company's payroll department. The email states that the recipient must verify their direct deposit information by clicking a link and logging in with their corporate credentials. The technician notices the sender's email address is 'payroll@cornpany.com' instead of 'payroll@company.com'. What is the BEST first action for the technician to take?

A Windows 10 Pro workstation is stuck in a boot loop: it powers on, attempts to start Windows, and then restarts repeatedly. The technician can interrupt the boot process and access the Windows Recovery Environment (WinRE). Which built-in tool should the technician use FIRST to automatically attempt to fix the startup issue?

A user needs to temporarily disable Windows Defender real-time protection while installing a legitimate application on Windows 10. Which location should the user navigate to in Windows Security?

A user receives an email with an attachment titled 'Invoice_4352.zip'. The sender's email address is 'support@amaz0n-billing.com', but the user recognizes this is not the legitimate Amazon domain. The email urges the user to open the attachment to view the invoice. Which type of social engineering attack does this describe?

A technician is tasked with deploying a critical security patch to all workstations in the organization. The patch addresses a remote code execution vulnerability. The technician has already tested the patch on a non-production machine and it installed successfully. According to standard change management procedures, what should the technician do BEFORE deploying the patch to production workstations?

A user receives a text message on their company-issued smartphone that appears to be from the CEO, asking the user to purchase gift cards and reply with the codes. The user notices the number is not the CEO's known number and reports it. Which type of social engineering attack is this?

A Windows 10 computer is stuck in a boot loop after a failed update. The technician has a Windows 10 installation USB. What is the most reliable method to access the Windows Recovery Environment (WinRE)?

A security analyst suspects that a workstation is infected with a kernel-level rootkit. The workstation is currently running and the analyst needs to preserve evidence for forensic analysis. Which of the following actions should the analyst take FIRST?

A Windows 10 computer fails to boot with the error 'Boot Configuration Data (BCD) file is missing.' The technician boots into the Windows Recovery Environment (WinRE). Which command should the technician use to rebuild the BCD?

A technician is setting up a Windows 10 laptop for a user who needs to keep personal documents separate from work files. The user wants to use both a local account and a Microsoft account to achieve this separation. Which configuration should the technician implement?

A user receives a phone call from someone claiming to be from the company's help desk, stating that their account has been compromised and they need to reset their password immediately. The caller asks for the user's current password to verify their identity. Which type of social engineering attack is this?

A user reports that their Windows 10 workstation began experiencing intermittent blue screen errors with the stop code IRQL_NOT_LESS_OR_EQUAL after a technician updated the network adapter driver. The technician needs to revert to the previous driver version. Which built-in tool should the technician use to roll back the driver?

A user reports that after installing a new application, their Windows 10 computer frequently crashes with a blue screen error 'IRQL_NOT_LESS_OR_EQUAL'. The technician uninstalls the application, but the crashes continue. What should the technician do next?

A user's Windows 10 computer fails to boot and displays the error "Bootmgr is missing". The technician boots from installation media and accesses the Windows Recovery Environment. Which command should be run to repair the Master Boot Record (MBR)?

A technician needs to deploy Windows 10 Pro to a new laptop that does not have an optical drive. The technician has a Windows 10 ISO file. Which tool should the technician use to create a bootable USB installation drive?

A Windows 10 Pro user needs to share a folder on their computer so specific domain users can only view the files without being able to modify or delete them. The technician sets share permissions to 'Read' for the domain users group. However, the users can still modify files. What should the technician do to enforce read-only access?

A user reports that a critical business application on Windows 10 crashes frequently with error code 0xc0000142. The application was working fine before a recent Windows update. What should the technician try FIRST?

A technician has an approved change request to deploy a new accounting software package to 20 workstations. During the rollout on the first workstation, the technician discovers that the software requires a newer version of a runtime library that is not installed. The technician checks the remaining workstations and finds that 15 of them already have the required runtime, but five older workstations do not. According to change management best practices, what should the technician do FIRST?

A user upgraded their Windows 10 Home workstation to Windows 10 Pro by entering a valid product key. After the upgrade, Windows shows 'Windows is not activated' in Settings. The technician verifies that the digital license is not linked to a Microsoft account. Which of the following should the technician do to resolve the activation issue?

A company security policy prohibits users from connecting unauthorized USB storage devices to their workstations. Which Group Policy setting should the administrator configure to enforce this policy?

A user reports that a custom line-of-business application fails to start on Windows 10 with the error: 'Cannot find '{0E59C9AF-9F0C-4A3A-A9E7-7F4CFF7C3F2D}'. The application attempted to load a component that is not available.' The technician confirms the application installation is complete and no files are missing. The application worked on the previous Windows 7 machine. What is the MOST likely cause of this error?

A technician is planning to update the BIOS on five company servers. The change management plan requires a backout plan. What does a backout plan typically include?

A technician is setting up a Windows 10 system to run as an informational kiosk in a hotel lobby. The computer must automatically log into a standard user account without requiring a password after any restart or power failure. Which of the following tools should the technician use to configure this behavior?

A security analyst discovers that an attacker has exploited a vulnerability to gain remote access to a file server. The analyst has identified active shell connections from the attacker's IP address. The server contains critical business data that cannot be lost, and there is a verified backup from the previous night. According to incident response best practices, what should the analyst do FIRST?

A user receives an email from an unknown external sender with an attachment named 'Invoice_0934.pdf'. The user is not expecting any invoices. The user reports this to the help desk technician. According to security best practices, what should the technician instruct the user to do?

A technician needs to upgrade a Windows 10 Pro workstation from version 1809 to 22H2 while preserving all installed applications, user settings, and personal files. The technician has downloaded the Windows 10 22H2 ISO file. Which method should the technician use to perform this upgrade?

A help desk technician receives a call from a user who received an email with an attachment labeled 'Invoice_2024.exe'. The user opened the attachment, but nothing appeared to happen. The email appeared to come from a known vendor, but the sender's email address contains misspellings. Which of the following BEST describes this type of attack, and what should the technician advise the user to do NEXT?

A technician is called to investigate a potential data breach involving client PII. The technician has identified the affected systems and has taken screenshots of the current state. According to proper incident response procedures, what should the technician do NEXT?

A user reports that a specific application freezes periodically on their Windows 10 workstation. The technician has already updated the video driver and performed a malware scan with no issues found. The technician needs to identify which system resource (CPU, memory, disk, or network) is being overutilized when the freeze occurs. Which built-in tool should the technician use to monitor resource usage over time?

A user receives an email that appears to be from the company's CEO, requesting that the user purchase several gift cards for a client and reply with the codes. The email address is 'ceo@cornpany.com' (note the 'rn') instead of the legitimate 'ceo@company.com'. The user follows the request and sends the gift card codes. Which type of social engineering attack has occurred?

A technician is implementing a planned change that has been approved by the CAB. The change management plan includes a backout plan. What should the backout plan specify?

A user reports that Windows Update is stuck at "Downloading updates" for over an hour and no progress is being made. The technician needs to reset the Windows Update components. Which sequence of commands should the technician run from an elevated command prompt?

A user receives a phone call from someone claiming to be from the IT help desk. The caller says there is a security problem with the user's account and asks the user to provide their password to resolve the issue. Which type of social engineering attack does this describe?

A technician is tasked with creating a master Windows 10 image for deployment to multiple identical computers in the company. After configuring the reference computer with all necessary applications and settings, which built-in tool must the technician run before capturing the image to ensure it can be deployed to different hardware?

A user reports that when they try to launch a specific application on Windows 10, they receive the error 'This application has been blocked by your system administrator'. The technician verifies that the user has local administrator rights and the application is installed in the default location. Which configuration should the technician check to resolve this issue?

A company is implementing a bring-your-own-device (BYOD) policy and needs to ensure that corporate data on employee mobile devices is protected. Which of the following is the MOST important technical control to implement?

A change advisory board (CAB) has approved a plan to update firmware on 50 servers. During the implementation, two servers fail to update and become unbootable. According to change management best practices, what should the technician do FIRST?

A technician suspects that a malware infection on a Windows 10 workstation is communicating with a remote command-and-control server. The technician needs to identify which process is making outbound connections. Which built-in Windows tool is best suited for this task?

A user in a Windows 10 domain environment is unable to log in. Other users can log in successfully on the same computer. The technician confirms the user's account is not locked or disabled in Active Directory. Which command should the technician run on the workstation to troubleshoot a common cause of this issue?

A small business wants to ensure that all employees formally acknowledge the company's acceptable use policy (AUP) for computers and the internet. Which method provides the most reliable record of employee acknowledgment?

A user needs to encrypt individual files and folders on a Windows 10 Pro workstation using a per-user certificate. Which built-in Windows feature should be used?

A user reports that a custom line-of-business application in Windows 10 fails to start with an error stating 'The program can't start because a DLL is missing.' The technician has already run System File Checker (SFC) and DISM restores health, both reporting no corruption. The technician also reinstalled the application. Which built-in Windows tool should the technician use NEXT to check for missing dependencies such as Visual C++ redistributables?

A security administrator is evaluating authentication methods. Which of the following is NOT an example of multifactor authentication?

Match each backup method to its description.

A Windows 10 computer fails to install a cumulative update with error code 0x800f0988. The technician has already run System File Checker (SFC) and Deployment Image Servicing and Management (DISM) with no issues. What should the technician do next?

A security technician has reimaged a user's Windows 10 workstation twice using a standard company image, but the machine continues to exhibit symptoms of a rootkit infection after each reimage. The technician has verified that the removable media used to deploy the image is clean and that the network boot server is not compromised. Which of the following is the MOST likely reason the rootkit persists?

A security analyst is investigating a potential data breach. The analyst has identified that an employee's workstation was infected with a keylogger that captured credentials. The analyst has already isolated the workstation from the network and created a forensic image. The analyst needs to determine exactly what data was exfiltrated. Which of the following is the BEST next step?

A small business owner calls a technician after discovering that all files on their Windows 10 workstation have been renamed with a '.crypt' extension. A ransom note demands payment in Bitcoin within 72 hours or the files will be permanently lost. The business has no recent backups. Which action should the technician take FIRST?

A technician is deploying several Windows 10 Pro workstations. Each workstation needs to run a Windows 7 virtual machine for a legacy application that is not compatible with Windows 10. Which built-in Windows feature should the technician enable to support this requirement?

A user receives a phone call from someone claiming to be from the IT help desk. The caller asks for the user's domain password to perform a security audit. The user provides the password. Later, the user's account is used to access sensitive data. Which type of social engineering attack occurred?

A user reports that they received a phone call from someone claiming to be from the company's IT help desk. The caller stated there was a security issue and requested the user's login credentials and a multi-factor authentication (MFA) code. The user provided the information. Which of the following should the technician do FIRST as part of the incident response?

A Windows 10 system fails to boot and displays the stop error 0xc000021a (STATUS_SYSTEM_PROCESS_TERMINATED). The technician boots from Windows 10 installation media and opens a command prompt. Which command should be used to attempt repair of the system image?

A technician needs to install a legacy application designed for Windows 7 on a Windows 10 Pro workstation. The application installer fails with a compatibility error. The technician has already tried running the installer as administrator. Which built-in Windows feature should the technician use to enable the application to run?

A technician is performing a scheduled task to decommission an old server. The change was approved as a standard change. During the process, the technician accidentally unplugs a network cable from a different, active server. What should the technician do first?

A user reports receiving an email that appears to be from their bank asking them to verify their account by clicking a link. The user did not click the link. The technician investigates and confirms the email is a phishing attempt. According to incident response best practices, what should the technician do FIRST?

A user spills coffee on their company-issued laptop. The user quickly dries it with a cloth and tries to power it on, but the laptop does not start. The user calls the help desk. What should the technician advise the user to do FIRST?

A company's IT policy mandates that all employee smartphones used for work must be capable of being completely erased if the device is lost or stolen. The company uses a Mobile Device Management (MDM) solution. Which MDM feature should the administrator use to satisfy this requirement?

A technician needs to apply a critical security patch to a production web server. The patch is known to require a service restart, which will cause a brief outage. According to change management best practices, what is the FIRST step the technician should take?

Which of the following passwords is considered the strongest according to standard security best practices?

A technician is supporting a remote worker laptop. The immediate goal is to recover after a newly installed device driver causes instability. Which tool, control, or procedure is the best fit?

An organization requires that all laptops have full-disk encryption to protect data in case of theft. Which Windows 10 feature should be used to meet this requirement?

A help desk technician needs to create a document that provides step-by-step instructions for handling password reset requests, including identity verification and escalation procedures. Which type of document should the technician create?

A help desk technician receives a call from a user who claims their password is not working. The technician asks the user to verify their identity by providing their employee ID and date of birth. The user provides this information. According to best practices for password resets, what should the technician do NEXT?

An employee is working at their desk when a person wearing a visitor badge and carrying boxes asks the employee to hold the door open so they can enter the secured office area. The employee complies. Which type of security breach has occurred?

A security analyst reviews logs after a ransomware incident. The infection started on a user's workstation and spread to network shares using the user's credentials. The user had been granted local administrator rights on their workstation six months ago for a software installation, and the rights were never removed. Which security principle was most directly violated?

A help desk technician receives a call from a user reporting that their workstation is infected with ransomware. The technician has isolated the system from the network by unplugging the Ethernet cable. According to incident response best practices, what should the technician do NEXT?

A user reports that a Windows 10 computer crashes with a blue screen every time they connect an external USB hard drive. The drive works fine on other computers. Which of the following is the most likely cause?

A technician is following the CompTIA A+ troubleshooting methodology to resolve a user's issue with a non-booting computer. The technician asks the user, 'Did you change any hardware or software recently?' This action corresponds to which step of the methodology?

A user reports that a 32-bit application on a 64-bit Windows 10 Pro workstation crashes on startup with the error 'The program can't start because MSVCR120.dll is missing from your computer.' The technician has already reinstalled the application and run System File Checker (SFC), which found no integrity violations. Which action should the technician take NEXT?

A user reports that a Windows 10 application fails to start and displays "Side-by-side configuration is incorrect." Which built-in tool should a technician use to find detailed information about the error?

A technician notices a user has written their password on a sticky note attached to the edge of their monitor. According to IT security best practices, what should the technician do first?

A technician is supporting a remote worker laptop. The immediate goal is to change Linux file ownership. Which tool, control, or procedure is the best fit?

A user reports that a specific USB printer is not recognized when plugged into a Windows 10 workstation. Device Manager shows an exclamation mark next to the printer driver with error code 28 (driver not installed). The technician has already downloaded the latest driver from the manufacturer's website and attempted to install it, but the installation fails with 'This driver is not intended for this platform' error. Which of the following should the technician do NEXT to resolve the issue?

A user reports that a former employee's account can still access the company's cloud storage. Which security practice has been violated?

A user receives an email that appears to be from the company's payroll department. The email states that all employees must click a link and log in with their corporate credentials to verify their direct deposit information. The technician notices the sender's email address is 'payroll@cornpany.com' (with 'rn' instead of 'm'). Which type of social engineering attack is this?

A technician receives an unexpected email from the company's Human Resources department with an attachment named 'Employee_Salary_Review.xlsx'. The technician did not request this information and was not expecting any HR communications. According to security best practices, which of the following is the MOST appropriate action for the technician to take?

A Windows 10 workstation fails to install a critical security update. The update attempt fails with error code 0x800f024b. Which of the following is the MOST likely cause of this error?

A company wants to protect the data on its fleet of laptops. The security policy requires that if a laptop is stolen, the data on the internal hard drive must be unreadable even if the drive is removed and placed into another computer. Which technology, available on Windows 10 Pro, meets this requirement?

A user calls the help desk, very agitated, stating that a full-screen popup on their workstation says 'SYSTEM LOCKED' and demands $500 in Bitcoin to unlock. The user cannot perform any other actions because the popup covers the screen. The technician remotely views the screen and confirms it is a ransomware warning. The technician has already instructed the user to disconnect the network cable. According to best practices, what should the technician do NEXT?

A technician is installing Windows 10 on a new computer that uses UEFI firmware and a 2TB GPT disk. At the 'Where do you want to install Windows?' screen, the technician sees only unallocated space. When clicking 'New' to create a partition, which additional partitions does Windows automatically create?

A company's security policy requires that all USB storage devices be automatically blocked from being used on Windows 10 workstations. Which tool should an administrator use to enforce this setting across multiple computers?

A user receives an email that appears to be from their bank, warning of a security breach and asking them to click a link to verify their account. The link directs to a website that looks identical to the bank's login page but is a fraudulent site. The user enters their credentials, which are then stolen. Which type of social engineering attack is this?

A user needs to run a Linux command-line tool natively on a Windows 10 Pro workstation without using a virtual machine or dual boot. Which built-in Windows feature should the technician enable to allow this?

A junior technician discovers what appears to be a data breach involving sensitive customer information on a network server. According to standard incident response procedures, what is the FIRST step the technician should take?

A user receives a phone call from someone claiming to be from the IT security team. The caller states that the user's account has been compromised and asks the user to verify their password to confirm identity. The user provides the password. Which type of social engineering attack is this?

A security technician has confirmed that a user's workstation is infected with ransomware that has encrypted local files. The technician immediately isolated the system by disconnecting the network cable and then created a forensic image of the hard drive for evidence. According to standard incident response procedures, what should the technician do NEXT?

A company wants to prevent unauthorized individuals from entering the server room by following closely behind an authorized employee. Which of the following physical security controls would be MOST effective at preventing this type of breach?

A company's help desk receives a report that multiple users cannot access the internet. The technician quickly discovers that the main router has failed. The technician immediately swaps the router with a spare, which restores connectivity. According to change management best practices, what should the technician do NEXT?

A company's security policy prohibits the use of personal cloud storage services. An executive requests that the policy be waived for their department to improve collaboration. Which action should the technician take?

Drag and drop the steps to upgrade the RAM in a laptop into the correct order.

A technician is implementing a change to deploy new accounting software to 20 workstations. The change has been approved by the Change Advisory Board (CAB). During the deployment, the technician discovers that three workstations have incompatible hardware. According to change management best practices, what should the technician do FIRST?

A technician is informed that a critical vulnerability is being actively exploited against a production web server. The vendor has released an emergency security patch. The company's change management policy requires all changes to be approved by the Change Advisory Board (CAB), but the CAB is not scheduled to meet for two days. What should the technician do FIRST?

A technician needs to allow a specific user to connect remotely to a Windows 10 Pro workstation that is not part of a domain. The user will be using the built-in Remote Desktop client. Which steps must the technician take?

A user reports that Microsoft Edge crashes immediately upon launch. The technician has tried resetting Edge settings via Settings > Reset settings, but the issue persists. The technician suspects a corrupted user profile. What should the technician do NEXT?

A change advisory board (CAB) approves an emergency change to apply a critical security patch to a critical server. After the patch is applied and the server is verified operational, the technician completes the documentation. According to change management best practices, what post-implementation step is unique to emergency changes?

Drag and drop the steps to configure a Windows 10 firewall rule to block an application into the correct order.

A technician is troubleshooting a Windows 10 workstation that fails to boot with the error 'BOOTMGR is missing.' Which of the following tools should the technician use FIRST to attempt to repair the boot process?

A technician receives a report from a user that their workstation is displaying a ransomware note and files are being encrypted. The technician has already isolated the workstation from the network. According to incident response procedures, which of the following is the NEXT step the technician should take?

A security administrator notices that a user's workstation is sending outbound traffic to a known malicious IP address at regular intervals. The user reports no unusual activity. The technician has already run a full antivirus scan with no detections. Which of the following should the technician do NEXT to investigate the persistent network connection?

A Windows 10 user reports that a 64-bit application crashes on launch with error '0xc000007b'. The technician updates graphics drivers, runs SFC, and reinstalls the application. The error persists. What is the most likely cause?

A user reports that after a Windows Update, a line-of-business application crashes on startup. The technician has verified that the application was working before the update and that no other changes were made. Which built-in Windows tool should the technician use to identify the specific error or fault causing the crash?

A technician is troubleshooting a Windows 10 computer that experiences brief system freezes lasting several seconds, occurring multiple times per hour. Performance Monitor shows that disk usage spikes to 100% during the freezes. The technician has already run a full antivirus scan with no threats found. What should the technician do NEXT?

A technician is preparing a change request to upgrade the operating system on a file server that is currently running Windows Server 2016 to Windows Server 2022. Which of the following elements is MOST important to include in the change request to minimize the risk of a failed implementation?

A technician is applying a critical security patch to a production database server. The patch was fully tested in a lab environment and approved by the Change Advisory Board (CAB). During the scheduled maintenance window, the technician begins the installation. Halfway through, the server becomes unresponsive and fails to restart. Which of the following should the technician do FIRST according to change management best practices?

A user needs to run a Linux command-line tool on a Windows 10 Pro workstation. Which built-in Windows feature should the technician enable to allow the user to run Linux tools natively?

A user requests local administrator access on their workstation to install a software program. The company follows the principle of least privilege. What should the technician do?

A technician needs to deploy the same Windows 10 image to multiple new computers. The image was prepared on a reference computer with all required applications and settings. Which built-in tool must the technician run on the reference computer BEFORE capturing the image to ensure that the image can be deployed to different hardware models?

A technician is troubleshooting a Windows 10 workstation that displays a 'You need to format the disk in drive D: before you can use it' error when trying to access an external USB hard drive. The drive contains important project files. The technician has verified the drive appears in Disk Management but the file system shows as RAW. Which tool should the technician use FIRST to attempt to recover the data without formatting?

A technician receives an email that appears to come from the company's HR department, stating that all employees must update their direct deposit information immediately by clicking a link and authenticating with their corporate credentials. The sender's email address is 'hr@cornpany.com' (note the 'rn' instead of 'm'). The technician suspects a phishing attack. What should the technician do FIRST?

A technician is documenting an incident response plan. According to industry best practices, which step should occur FIRST after a security incident is detected?

A technician needs to create a document that provides step-by-step instructions for setting up a new user account on Windows 10. This document should be used by all help desk staff to ensure consistency. Which type of document does this BEST describe?

A technician is preparing to deploy a critical security patch to all company servers. The patch has been tested in a lab environment and approved by the Change Advisory Board (CAB). According to change management best practices, what is the NEXT step the technician should take?

A user logs into Windows 10 but the Start menu and taskbar are not responding. What should the technician do first?

A technician is asked to upgrade an old computer from Windows 7 to Windows 10. The computer has a 32-bit processor and 2 GB of RAM. Which action should the technician take?

A company's file server was infected with ransomware, and all files were encrypted. The IT team has daily backups stored on a separate network-attached storage (NAS) appliance. However, the backups were also encrypted because the backup service account had full write permissions to the NAS share. The backup account was a domain administrator account. Which of the following should the organization implement to BEST prevent this scenario from recurring?

A technician needs to replace a faulty keyboard on a user's workstation. The technician has a spare keyboard in inventory. The replacement is a standard procedure that has been performed many times and is considered low risk. According to change management best practices, which type of change should this be classified as?

A user reports that a line-of-business application crashes immediately after launch with an 'Access Violation' error. The technician has reinstalled the application, run antivirus scans, and checked Event Viewer. The error log points to a corrupted user profile. Which built-in tool should the technician use to create a new user profile for the user?

A technician discovers that a junior colleague has been using a domain administrator account to perform routine user tasks such as resetting passwords and installing software. Which security principle is being violated?

A change advisory board (CAB) approved an emergency change to apply a critical security patch to a web server. After applying the patch, the technician documents the change. What documentation step is uniquely required for an emergency change?

A user needs to run a Linux command-line tool that is not available on their Windows 10 Pro workstation. The user does not want to install a separate hypervisor or dual-boot. Which built-in Windows feature should the technician enable to allow the user to run Linux tools natively?

A user reports that they can access the internet and ping external IP addresses (e.g., 8.8.8.8) successfully, but web pages do not load in the browser. The technician checks the browser's proxy settings and finds they are configured to use a specific IP address and port. Other browsers on the same workstation exhibit the same behavior. Which of the following is the MOST likely cause of the issue?

A user reports that a Windows 10 application crashes when trying to save a file to a network drive. The application works fine when saving locally. Which of the following is the MOST likely cause?

A technician completes an approved firmware update on a network switch. After the update, the switch functions correctly, but the management interface now requires HTTPS instead of HTTP. The change plan only mentioned updating firmware to patch a security vulnerability. According to change management best practices, what should the technician do NEXT?

A Windows 10 workstation repeatedly blue screens with the error DRIVER_IRQL_NOT_LESS_OR_EQUAL. The technician suspects a faulty driver. Which tool should be used to prevent the problematic driver from loading during the next boot so that the technician can safely uninstall or update it?

A security analyst reviews logs and discovers that a user's account was used to log into the corporate VPN from a foreign country at 3 AM, even though the user was at home in the US and claims they were asleep. Which security control is best designed to detect and alert on this type of anomalous activity?

A technician is setting up a Windows 10 laptop for a sales representative who frequently travels and may not always have access to the corporate network. The user needs to be able to log in to the laptop and access local files while offline. Which type of user account should the technician configure?

After reinstalling Windows 10, a user reports that they cannot open several files that were previously accessible. The files are stored on the local drive and appear with a yellow lock icon. What is the most likely cause?

A technician has completed a repair on a user's workstation. According to best practices for documentation and ticketing, what should the technician include in the ticket documentation?

A user receives a phone call from an individual claiming to be from the company's IT security team. The caller states there is a breach and asks the user to verify their account by providing their username and password. Which social engineering technique is being used?

A technician is troubleshooting a Windows 10 application that crashes with error '0xc0000005 (Access Violation)' only when the user prints to a specific network printer. Other applications print fine to the same printer. What should the technician do FIRST?

A technician needs to configure a Windows 10 workstation so that a specific legacy application always runs with administrator privileges without prompting for credentials. The user is a standard user. Which of the following methods will achieve this with the LEAST security risk?

A user receives an email that appears to be from the company's CEO, requesting an urgent wire transfer. The email address is slightly different from the CEO's actual address. Which type of social engineering attack is this?

A change advisory board (CAB) approved a standard change to update antivirus definitions on all servers. The technician completes the update on a file server and verifies the server is functioning normally. According to change management best practices, what documentation should the technician complete?

A user reports that a Windows 10 application crashes immediately after launch with the error '0xc0000005 (Access Violation)'. The technician has already run System File Checker (SFC) and DISM, both reporting no corruption, and reinstalled the application. The technician also updated the video driver, but the issue persists. The technician now suspects a hardware problem, specifically faulty RAM. Which built-in Windows tool should the technician use to test the system memory?

A user reports that a legacy application designed for Windows 7 does not run correctly on a Windows 10 workstation. The application installs but fails to launch. Which built-in Windows tool should the technician use FIRST to attempt to resolve this issue?

A change to replace a network switch has been approved by the Change Advisory Board (CAB). During the replacement, the technician discovers that the new switch requires a different type of power cable than was expected. The old switch is already disconnected. According to change management best practices, what should the technician do FIRST?

A user's Windows 10 computer was infected with a virus that prevented the antivirus software from running. The technician booted into Safe Mode, ran a full antivirus scan, and successfully removed the virus. However, the user continues to see pop-up advertisements. Which of the following should the technician do NEXT?

A technician is troubleshooting a Windows 10 computer that fails to boot with error 0xc000000f. The technician boots from Windows PE and runs bootrec /scanos, which finds the Windows installation. Which command should the technician run next to fix the boot configuration data?

A user reports that double-clicking a .jpg file opens Notepad instead of the Photos app. The technician wants to restore the default file association for .jpg files. Which tool in Windows 10 should the technician use?

A technician is troubleshooting a Windows 10 workstation where a specific application freezes intermittently. The technician has already run a full antivirus scan and updated the application to the latest version. The issue only occurs when the workstation is running on battery power. Which Windows power setting should the technician adjust to resolve the issue?

A user reports that their email account is sending spam to contacts. The technician identifies that the user's credentials were phished. What is the FIRST step the technician should take?

A company's security policy requires all employees to use multi-factor authentication (MFA) when accessing the corporate VPN. An employee uses a smart card (something you have) and a PIN (something you know). Which of the following is true about this MFA implementation?

A user's Windows 10 computer with a 256GB SSD is running low on disk space. The user wants to free up space by removing temporary files, previous Windows installations, and system restore points. Which built-in tool should the technician use?

A security administrator notices that several employees have plugged in USB drives they received in the mail into their work computers, resulting in malware infections. The USB drives were labeled "Employee Bonus Information." What type of social engineering attack does this describe?

A user reports receiving several emails from an external vendor with malicious attachments. The technician has already removed the offending emails from the user's mailbox and performed a full antivirus scan on the workstation with no detections. Which of the following should the technician do NEXT to prevent future incidents of this nature?

A technician is documenting a recurring issue where users lose network connectivity after a specific software update is installed. The technician has identified the root cause and implemented a temporary workaround. According to change management best practices, what is the NEXT step the technician should take?

Drag and drop the steps to configure SMB file sharing on a Windows 10 computer into the correct order.

A technician is trying to run a legacy 16-bit accounting application on a 64-bit version of Windows 10 Pro. The application fails to start with a 'This app can't run on your PC' error. The application is critical and there is no 64-bit version available. Which of the following is the BEST solution to allow this application to run?

A technician is implementing a scheduled change to upgrade a critical application server. The change was approved by the Change Advisory Board (CAB) expecting a 30-minute outage. During the implementation, the technician realizes the actual outage will be closer to two hours due to unexpected data migration steps. According to change management best practices, what should the technician do FIRST?

A technician has been granted approval from the Change Advisory Board (CAB) to apply a critical security patch to a web server. The patch requires a reboot, causing a brief outage. The technician has backed up the system and verified the backup is valid. What is the NEXT step the technician should take according to change management best practices?

A company is decommissioning several old workstations that contain sensitive client data. The hard drives will be disposed of. The company's data security policy requires that data be rendered unrecoverable. Which of the following methods would BEST achieve this goal?

A technician identifies that a workstation is actively infected with a worm that is spreading to other computers on the network. What is the technician's FIRST step according to incident response procedures?

A user reports that their web browser frequently redirects to unwanted advertisement pages and pop-ups appear even when browsing trusted websites. The technician runs antivirus and anti-malware scans, removing several potentially unwanted programs (PUPs). After a reboot, the redirects continue. Which of the following should the technician check NEXT?

A user reports that their Windows 10 workstation is running slowly. The technician opens Task Manager and notices that CPU usage is consistently at 90-100%, with multiple instances of the 'svchost.exe' process consuming the most CPU. Which built-in tool should the technician use to identify the specific services responsible for the high CPU usage?

A technician is installing Windows 10 on a new computer with an empty SSD. The technician boots from the USB installation media. At the 'Where do you want to install Windows?' screen, the SSD appears as 'Unallocated Space'. Which action should the technician take to proceed with a standard installation?

A user reports that a legacy application crashes on Windows 10 with an access violation error (exception code 0xc0000005). The application worked on Windows 7. Event Viewer shows DEP (Data Execution Prevention) related events. What is the most likely cause?

A user receives an email that appears to be from their bank, stating that their account has been compromised and they must click a link to verify their identity. The user notices the sender's email address does not match the bank's official domain. What is the BEST immediate action for the user to take?

A user's Windows 10 application crashes with error 'The application was unable to start correctly (0xc000007b)'. The application is 32-bit and the OS is 64-bit. The technician checks that required DLLs are present. What is the most likely cause?

An employee receives an email that appears to be from the company's CEO, asking the employee to urgently purchase gift cards for a client and reply with the redemption codes. The email address is slightly misspelled (e.g., ceo@cornpany.com instead of ceo@company.com). The employee complies. Which type of social engineering attack is this?

A user reports that their Windows 10 workstation shows 'Preparing Automatic Repair' on boot, then loops back to the same message. The technician needs to access the Advanced Startup Options to troubleshoot. Which key combination should the technician press during the boot process to trigger the recovery environment?

A user reports that their Windows 10 computer will not connect to any Wi-Fi networks. The technician checks Device Manager and sees that the Wi-Fi adapter is not listed under Network adapters, but there is an unknown device with a yellow exclamation mark. What should the technician do FIRST?

A technician has completed a standard change to replace a failed hard drive in a server. After confirming the server is operational, the technician updates the change request ticket with the completion time and status. According to change management best practices, what documentation step should the technician ensure is completed within 24 hours?

A help desk technician has successfully resolved a user's issue with a slow computer. According to IT best practices, which information should the technician include in the ticket documentation?

A user receives a phone call from someone claiming to be from the company's IT support desk. The caller states there is a critical security issue with the user's account and requests the user's login credentials and a verification code sent to their phone. The user provides the information. Which type of social engineering attack has occurred?

A security audit reveals that an employee's workstation has software installed that was not approved. The employee claims they downloaded it from the internet. Which principle of least privilege or security policy should prevent unauthorized software installation?

A company has several Windows 7 Professional workstations that need to be upgraded to Windows 10. Which of the following is the minimum edition of Windows 10 that supports an in-place upgrade from Windows 7 Professional?

A user reports that a legacy line-of-business application stops responding shortly after launch on a Windows 10 Pro workstation. The application worked fine on the previous Windows 7 machine. Which built-in Windows feature should the technician use to mitigate this issue?

A technician needs to configure a Windows 10 system to allow a remote user to connect using Remote Desktop Protocol. Which Windows feature must be enabled?

A user receives an email claiming there is a suspicious login attempt on their account. The email asks the user to click a link immediately to verify their identity. The link leads to a website that looks identical to the company's login page but has a slightly different URL. Which type of social engineering attack is this?

A company has a policy that requires all workstations to have antivirus software installed and keep it up to date. A technician finds that several computers have disabled their antivirus services. Which security control would have MOST effectively prevented users from disabling the antivirus?

A technician is documenting a security incident in which a user's company-issued laptop was stolen. The technician has already reported the theft to the security team and initiated a remote wipe of the device. According to incident response best practices, what should the technician do NEXT?

A user reports that after installing a Windows 10 cumulative update last night, their workstation now displays a black screen for several minutes before the login screen appears. All other system functions seem normal once logged in. The technician suspects the update caused a driver conflict. Which built-in tool should the technician use to remove the problematic update without affecting other system settings?

A remote user's Windows 10 laptop is encrypted with BitLocker and joined to Azure Active Directory (Azure AD). The laptop fails to boot and displays the BitLocker recovery screen, asking for the recovery key. The user does not have the recovery key and is not available to check email. The technician has access to the Azure AD portal with Global Administrator privileges. Which of the following is the MOST appropriate method to retrieve the BitLocker recovery key?

A user reports that a specific application crashes frequently on their Windows 10 workstation. The technician wants to see a history of application crashes and identify any common faulting modules. Which built-in Windows tool should the technician use?

A Windows 10 workstation consistently displays a stop error: SYSTEM_SERVICE_EXCEPTION (win32kbase.sys). The crash occurs when the user logs off. The technician has updated all graphics and chipset drivers and run SFC /scannow without finding any issues. What is the most likely cause?

A technician receives an email that appears to be from the company's CEO. The email asks for the social security numbers of all employees, claiming it is needed for a compliance audit. The recipient knows the CEO is currently on vacation. Which type of social engineering attack is this?

A company's current password policy requires a minimum of 14 characters with complexity (uppercase, lowercase, numbers, and special characters). Users frequently forget these complex passwords and submit help desk reset requests. Which alternative approach would BEST enhance security while reducing the burden on users?

A user reports that a critical business application crashes immediately after launch on Windows 10. The technician has already run System File Checker (SFC) and DISM, both of which reported no corruption. The application was working before a recent Windows Update. Which tool should the technician use NEXT to identify the cause of the crash?

A user reports that their workstation is infected with ransomware. The technician isolates the computer from the network by disconnecting the network cable. What should the technician do NEXT according to incident response procedures?

A user reports that their Windows 10 computer shows a ransomware message demanding payment to decrypt files. According to standard incident response procedures, what should the technician do FIRST?

A technician is troubleshooting a Windows 10 application that crashes with the error '0xc000007b'. The application is a 32-bit application running on a 64-bit system. The technician has already reinstalled the application and run System File Checker (SFC), which found no errors. Which should the technician check NEXT?

A technician is configuring a public kiosk computer in a library. The technician needs to assign a single Windows 10 user account that will automatically log on and launch a specific application, preventing users from accessing other parts of the operating system. Which Windows feature should the technician configure?

A technician is implementing a change to deploy a new software update to all workstations. The change has been approved by the Change Advisory Board (CAB). During the rollout, the technician discovers that several workstations are not compatible and the update fails. According to change management best practices, what should the technician do NEXT?

A user receives a text message on their company-issued smartphone. The message appears to be from the IT department and states that the user's email password will expire in 24 hours and they must click a link to renew it. The link leads to a website that looks identical to the company's login page. The user is suspicious and reports it. Which type of social engineering attack is this?

A company's security policy requires that all data on laptops be encrypted. A technician has enabled BitLocker on a laptop and saved the recovery key to the user's Microsoft account. After a motherboard failure, the laptop is replaced and the technician tries to access the old drive via a USB enclosure. The recovery key is not available because the user's Microsoft account was deleted. What could have been done to prevent this situation?

A company policy requires that all laptops be configured to lock and require a password after 15 minutes of inactivity. Which Windows feature should the technician configure to enforce this policy?

A technician is responding to a security incident where malware has been detected on several workstations. According to industry best practices (such as NIST or SANS), which step should the technician perform FIRST after confirming the incident?

A user is unable to launch a legacy application after upgrading to Windows 10. The application was working fine in Windows 7. The technician has set the compatibility mode to Windows 7, but the application still fails to start. Which additional step should the technician try to resolve the issue?

A user receives a text message on their company-issued smartphone that appears to be from the IT department. The message states that the user's email account will be suspended unless they click a link and enter their credentials to verify the account. The user clicks the link, enters their username and password, and later discovers that their account has been compromised. Which type of social engineering attack is this?

A technician is working on a reception PC and needs to remove storage devices from service safely. Which two actions are appropriate? (Choose two.)

A technician is creating documentation to help new employees find solutions for common software problems. Which type of documentation is MOST appropriate for this purpose?

A technician upgraded a Windows 10 Pro workstation from 8 GB to 16 GB of RAM by installing two matching 8 GB DIMMs. The BIOS correctly reports 16 GB of memory, but Windows System Information shows only 8 GB available. Which of the following should the technician check FIRST?

A user reports that they received a pop-up warning that their computer is infected with a virus and to call a number for assistance. The pop-up will not close. Which type of malware is this?

A technician needs to determine the build number and edition of Windows 10 installed on a remote computer. Which built-in command-line tool should the technician use?

A technician upgrades a Windows 10 workstation's RAM from 8 GB to 16 GB. After the upgrade, the system boots but applications frequently crash with errors such as 'The instruction at 0x... referenced memory at 0x... The memory could not be read.' The technician has verified that the new RAM is compatible and has reseated the modules. Which of the following should the technician try NEXT?

A technician needs to configure a Windows 10 Pro workstation so that only a specific IP address (192.168.1.100) can establish Remote Desktop (RDP) connections to it. The technician has already enabled Remote Desktop in System Properties. Which built-in tool should the technician use to restrict the IP address allowed to connect?

A technician is tasked with disposing of several old hard drives that contained confidential client data. Which of the following disposal methods provides the HIGHEST level of data security?

A helpdesk technician receives a call from a user who reports that their antivirus software is disabled and cannot be re-enabled. Additionally, the user's files have been renamed with a '.encrypted' extension. Which type of malware is most likely responsible?

A technician needs to create a bootable USB drive that can be used to repair a Windows 10 installation that fails to boot. Which built-in Windows 10 tool should the technician use to create this drive?

A technician is performing a scheduled maintenance task to apply security patches to a server. The change was approved as a standard change with a predefined backout plan. During the patching, the server fails to reboot and becomes unresponsive. According to change management best practices, what should the technician do FIRST?

After successfully replacing a failed hard drive and restoring data from backup, a technician verifies that the system is functioning normally. According to change management best practices, what should the technician do next?

A security administrator notices that multiple user workstations are infected with the same strain of ransomware. The administrator isolates the infected systems from the network. Which of the following should the administrator do NEXT according to incident response procedures?

After installing a Windows 10 cumulative update, a user reports that the computer is running very slowly and certain applications crash. The technician wants to remove only the recently installed update while preserving all other settings and data. Which built-in method should the technician use?

A critical security vulnerability has been discovered in the company's web server software. The vendor has released a patch, and the IT security team has verified it in a test environment. The change requires a server reboot, causing a 30-minute outage. The company's change management policy requires all changes to be pre-approved by the Change Advisory Board (CAB), which meets weekly on Fridays. The vulnerability is actively being exploited in the wild. What should the technician do NEXT?

A user reports that a 32-bit application on a 64-bit Windows 10 system fails to start with an error indicating a missing DLL. The technician confirms the DLL is present in C:\Windows\System32. What should the technician do to resolve the issue?

A technician has received approval from the Change Advisory Board (CAB) to apply a critical security patch to a file server. The patch requires a reboot, and a maintenance window of 2:00 AM to 3:00 AM has been scheduled. The technician successfully installs the patch, reboots the server, and verifies that the server is functioning normally. According to change management best practices, what should the technician do NEXT?

A security administrator needs to enforce a policy that prevents users from running unauthorized applications on their Windows 10 workstations. Which of the following is the most effective method?

A technician wants to configure Windows 10 to automatically download and install updates, but allow users to choose when to restart. Which Windows Update setting should be selected?

A technician is implementing a change to update the firmware on all network switches in a data center. The change has been approved by the Change Advisory Board (CAB). During the implementation on the first switch, the firmware update fails, and the switch becomes unresponsive. According to change management best practices, what should the technician do FIRST?

A technician needs to boot a Windows 10 PC from a USB flash drive to run a diagnostics tool. The USB drive is already inserted. Which key is commonly pressed during POST to access the boot menu?

A user notices an unknown person following closely behind them through a secured door that requires a badge. The person does not badge in but gains entry. Which type of social engineering attack is this?

A technician is supporting a service-desk jump box. The immediate goal is to respond to browser hijacking or suspected infection. Which tool, control, or procedure is the best fit?

A technician has received approval from the Change Advisory Board (CAB) to apply a critical security patch to a production database server. The patch requires a reboot and will cause a 15-minute outage during the approved maintenance window. The technician has successfully installed the patch and rebooted the server. The server is back online and appears to be functioning normally. According to change management best practices, what should the technician do NEXT?

A technician has completed a standard change to replace a faulty power supply in a desktop computer. After installation, the computer powers on and all components are recognized. According to change management best practices, what should the technician do NEXT?

A user reports that their Microsoft Office application crashes when opening a specific document, but other documents work fine. The user has rebooted. What should the technician try first?

A user receives a text message claiming to be from their bank, asking them to click a link to verify their account due to suspicious activity. Which type of social engineering attack is this?

After resetting a user's forgotten password, what is the most appropriate next step for a help desk technician?

A technician is upgrading a Windows 10 Pro workstation to Windows 11. The computer meets all hardware requirements except that Secure Boot was disabled. The technician enables Secure Boot in the UEFI firmware settings. After the change, the computer fails to boot and displays an error. Which of the following is the MOST likely cause?

A technician is supporting a shared training-room workstation. The immediate goal is to find matching error entries in Linux logs. Which tool, control, or procedure is the best fit?

A technician needs to enable Windows Sandbox on a Windows 10 Pro workstation. The technician has already verified that virtualization is enabled in the BIOS/UEFI. Which Windows feature must be turned on in the 'Turn Windows features on or off' dialog to activate Windows Sandbox?

A technician is walking through the office and sees a person without a visible ID badge following closely behind an employee who just swiped their badge to enter a secured area. The person does not have a badge and is not recognized by the employee. Which type of social engineering attack is likely occurring?

A technician is configuring a new Windows 10 workstation for a user who needs to run a legacy 32-bit business application. The workstation has a 64-bit processor. Which of the following is true about running a 32-bit application on a 64-bit version of Windows 10?

A network administrator discovers a critical security vulnerability in a production firewall that could allow external attackers to bypass authentication. The administrator applies a configuration change to fix the vulnerability immediately, without waiting for the next Change Advisory Board (CAB) meeting. After the change is applied and verified to be successful, what should the administrator do NEXT according to change management best practices?

A technician is supporting a finance laptop. The immediate goal is to reduce slow sign-in caused by unnecessary launch items. Which tool, control, or procedure is the best fit?

A Windows 10 computer fails to boot and displays the error: 'Bootmgr is missing'. The technician boots from a Windows installation media. Which command should the technician use to repair the boot configuration data (BCD)?

A user reports that Microsoft Word crashes every time they try to save a document. Other Office applications work fine. The technician has run Office repair and updated Office. What should the technician try FIRST?

A technician needs to add a network printer to a Windows 10 computer using the command line. Which command should be used?

A user reports that their Windows 10 workstation is displaying a full-screen message claiming to be from the Federal Bureau of Investigation (FBI), stating that the computer has been locked due to illegal activity and demanding a $500 fine paid via cryptocurrency. The user cannot close the message or access any programs. Which type of malware is this?

A user has forgotten the BitLocker recovery key for their Windows 10 laptop and is unable to boot after a BIOS update. The laptop is protected by BitLocker Drive Encryption. The user stored the recovery key in a safe, but the safe is inaccessible during a disaster. What is the BEST first step for the technician to attempt?

A technician is supporting a service-desk jump box. The immediate goal is to view listening ports and active connections. Which tool, control, or procedure is the best fit?

A technician has completed a software update on a user's workstation and verified with the user that everything is working correctly. According to best practices for ticketing and documentation, what should the technician do BEFORE closing the ticket?

A technician is supporting a field engineer tablet. The immediate goal is to list Linux processes and owners for review. Which tool, control, or procedure is the best fit?

A technician is supporting a service-desk jump box. The immediate goal is to correct Linux file permissions. Which tool, control, or procedure is the best fit?

A user reports that their Windows 10 workstation has been displaying a warning message stating that all files have been encrypted by the IT department due to a security breach. The message instructs the user to call a premium-rate phone number to receive the decryption key. The user reports that they cannot open any documents, and file extensions have been changed to .encrypted. Which type of malware is this?

A technician is documenting a change that replaced a failed network switch. The change was approved as an emergency change due to critical network outage. After the replacement, the network is restored. According to change management best practices, what documentation step should the technician complete within a specified timeframe?

After installing a Windows 10 feature update, a user reports that an accounting application fails to start with the error 'Failed to initialize (0xc0000142)'. The application is known to require the .NET Framework 3.5. Which step should the technician take FIRST?

A help desk technician receives a call from an employee who says they just received a phone call from someone claiming to be from the company's IT department. The caller stated there was a security breach and needed the employee's password to 'verify their account.' The employee did not provide the password but is now concerned. Which of the following BEST describes this type of social engineering attack, and what should the technician advise the employee to do NEXT?

A user's MacBook Pro running macOS Ventura is experiencing random freezes. The technician has already booted into Safe Mode and the issue still occurs. The technician suspects a faulty third-party kernel extension. Which built-in macOS tool should the technician use to view kernel panic logs and identify the problematic extension?

A user reports that a Windows 10 application fails to launch and displays the error: 'The program can't start because MSVCR120.dll is missing from your computer.' Which of the following is the MOST likely fix?

A technician has completed a standard change to replace a failed power supply in a server. After verifying that the server is online and all services are running, what should the technician do NEXT according to change management best practices?

A technician is preparing to replace a failed hard drive in a file server that is still under warranty. The company's change management policy requires all hardware replacements to follow a formal process. Which step must the technician complete BEFORE implementing the replacement?

A technician is supporting a field engineer tablet. The immediate goal is to run an older application with legacy Windows settings. Which tool, control, or procedure is the best fit?

A Windows 10 application crashes on startup with error '0xc000007b'. The application is a 32-bit game. What is the most likely cause?

A company requires all changes to production systems to be approved by the Change Advisory Board (CAB). A technician receives an urgent request from a manager to apply a critical security patch that fixes a zero-day vulnerability. The patch requires a reboot, and the server is currently in use. The CAB is not scheduled to meet for another week. Which of the following is the BEST course of action?

A user receives a phone call from an individual claiming to be from the company's IT help desk. The caller states that there is a critical security update and asks the user for their login credentials to apply the update. Which type of social engineering attack is this?

A user on Windows 10 reports that a 64-bit application crashes immediately after launch with the error 'The procedure entry point could not be located in the dynamic link library'. The technician has already reinstalled the application and run System File Checker (SFC) with no issues. Which of the following should the technician do NEXT?

A user receives an email that appears to be from a regular vendor, containing an invoice attachment. The user opens the attachment, but nothing seems to happen. The user reports the incident to the help desk. The technician confirms the email is a phishing attempt and that the attachment likely contained malware. No immediate signs of infection are visible. According to incident response best practices, what should the technician do FIRST?

A technician has completed the implementation of an approved change to replace all network switches in a branch office with new models. The deployment was successful, and all switches are functioning correctly. According to change management best practices, what is the NEXT step the technician should take?

A technician needs to verify which Windows hotfixes have been installed on a remote Windows 10 computer. Which PowerShell cmdlet should the technician use?

A technician is implementing a change to deploy a critical security patch to all company workstations. The change has been approved by the Change Advisory Board (CAB). The technician has successfully tested the patch on a pilot group of ten workstations. According to change management best practices, what should the technician do NEXT?

A security auditor discovers that a user's workstation has a scheduled task that runs a PowerShell script every hour connecting to an external IP and downloading a file. The user denies knowledge. Which is the most likely cause?

A technician needs to apply a critical security patch to a file server that requires a reboot, causing a brief outage. The server is used during business hours. According to change management best practices, what should the technician do FIRST?

A help desk technician receives a call from a user who claims that their computer is infected with a virus. The user has already run an antivirus scan and deleted some files. The technician follows the incident response plan. What should the technician do FIRST?

A user reports that a third-party application crashes immediately with the error: 'The code execution cannot proceed because VCRUNTIME140.dll was not found. Reinstalling the program may fix this problem.' The technician has already reinstalled the application and run System File Checker (SFC) and Deployment Image Servicing and Management (DISM), both reporting no corruption. Which of the following should the technician do NEXT?

An organization must dispose of several hard disk drives (HDDs) that contain highly sensitive data. Which method of data destruction is most appropriate to ensure the data cannot be recovered?

A user reports that when trying to install an add-in for Microsoft Office on a Windows 10 Pro workstation, they receive the error: 'There is a problem with the Windows Installer package. A program required for this install to complete could not be run.' The technician has verified that the add-in is compatible with the installed Office version and that the user has local administrator rights. Which of the following should the technician do NEXT to resolve the issue?

A technician is troubleshooting a Windows 10 workstation that is running extremely slowly. Upon opening Task Manager, the technician notices a process named 'wscript.exe' consuming 99% CPU. The process path is 'C:\Users\Public\Documents\script.vbs'. The technician suspects malware. Which of the following actions should the technician take FIRST to address the issue?

A company's security policy mandates that all workstations must have full disk encryption. Which Windows feature provides full disk encryption?

A technician has created a reference Windows 10 Pro installation on a workstation with all required applications and settings. The technician now needs to prepare this workstation for disk imaging so that the image can be deployed to multiple identical computers. Which tool should the technician run on the reference workstation BEFORE capturing the image?

A technician needs to view a list of all running processes and their CPU and memory usage on a Windows 10 computer. Which built-in tool should the technician use?

A technician performs a test restore of a critical database from a backup tape as part of the company's disaster recovery plan. The restore process completes without errors, but when the database is checked for integrity, several errors are found. What is the NEXT step the technician should take?

A technician needs to view the boot configuration data store on a Windows 10 computer to identify current boot parameters. Which command-line tool should the technician use?

A help desk technician resolves a user's printer connectivity issue by following a procedure found in the company's internal knowledge base. After completing the resolution, what should the technician do to support the continuous improvement of the knowledge base?

During a security review, it is discovered that an employee's credentials were used to log into the company's webmail system from an unrecognized IP address. The employee insists they did not log in from that location. The help desk finds that the employee had recently clicked a link in an email that led to a fake login page. Which security control would have best mitigated the impact of this credential theft?

A company is disposing of several old desktop computers that are still in working condition. The hard drives have been sanitized using a degausser, and the computers will be sold to a refurbisher. Which of the following should the technician do with the original Windows 10 license stickers attached to the cases before releasing the equipment?

A technician is creating a checklist for responding to a ransomware incident. According to best practices, which step should be performed FIRST after the ransomware is detected?

A user reports that while working on a spreadsheet, the Windows 10 workstation suddenly displays a User Account Control (UAC) prompt requesting permission for an application named 'svch0st.exe' to make changes. The user did not launch any application. Which of the following is the MOST likely scenario?

A technician is disposing of several old magnetic hard drives that contain confidential client data. The company policy mandates that the data must be completely destroyed and the drives must be rendered unusable. Which method should the technician use?

Drag and drop the steps to perform a factory reset on an Android smartphone into the correct order.

A technician is configuring a new Windows 10 Pro workstation that is not part of a domain. The company's security policy requires that user passwords must be at least 8 characters and expire every 90 days. Which built-in tool should the technician use to enforce these requirements on this local workstation?

A user reports that a 64-bit application fails to launch on Windows 10 Pro with error '0xc000007b (STATUS_BAD_IMAGE_FORMAT)'. The technician has reinstalled the application, run SFC and DISM, and installed all Visual C++ redistributables. The application works on other identical computers. What is the most likely remaining cause?

A user receives a text message on their company-issued smartphone claiming they won a gift card and must click a link to claim it. The link leads to a fake login page that harvests credentials. Which type of social engineering attack is this?

A user reports that their Windows 10 Pro workstation's Start menu is not working and they cannot open most applications. The technician wants to perform a repair installation while keeping personal files and applications. The technician has mounted a Windows 10 ISO and runs setup.exe. Which option should the technician select to accomplish this?

A technician needs to provide remote assistance to a user who is not on the corporate network. The technician wants to ensure a secure connection. Which of the following should the technician require the user to do first?

A user reports that a legacy 32-bit application on a Windows 10 64-bit system displays an error: 'The application has failed to start because its side-by-side configuration is incorrect.' The technician verifies that the application was working previously. What is the most likely cause?

A user receives a phone call from someone claiming to be from the company's IT help desk. The caller says they are performing a security audit and need the user's login credentials to verify their account access. Which type of social engineering attack is this?

A technician is troubleshooting a Windows 10 workstation that crashes due to a driver conflict. The technician wants the system to automatically boot into Safe Mode with Networking on every startup until the problem is resolved. Which built-in tool should the technician use to configure this?

A technician is dispatched to replace a faulty power supply in a desktop computer. According to change management best practices for standard repairs, what should the technician do BEFORE replacing the power supply?

A company has a standard operating procedure (SOP) for handling password reset requests. Why is it MOST important for help desk technicians to follow this SOP?

A technician receives a phone call from someone who claims to be from the company's IT security team. The caller states that there is an urgent audit and asks the technician to provide their domain password to verify their identity. The technician provides the password. Which type of social engineering attack is this?

A company uses a policy of least privilege. A user needs to install a software application that requires administrative privileges. The technician has verified the software is approved and safe. What is the BEST way to provide the necessary access?

A Windows 10 computer fails to boot with the error message 'The boot selection failed because a required device is inaccessible.' The technician suspects a problem with the Boot Configuration Data (BCD). Which command should the technician use from the Windows Recovery Environment command prompt to repair the BCD?

A technician is supporting a warehouse desktop. The immediate goal is to confirm restore capability before reinstalling an OS. Which tool, control, or procedure is the best fit?

A user reports that Windows Update on a Windows 10 Pro workstation has been stuck on 'Downloading updates 0%' for several hours. The technician has already run the Windows Update Troubleshooter, which reported no issues. Which command-line tool should the technician use NEXT to attempt to resolve the problem by repairing potential system file corruption affecting the update process?

A user receives a text message on their company-issued smartphone. The message appears to be from the IT department and states that the user's email account will be deactivated unless they click a link to verify their credentials. The user clicks the link and enters their username and password. Which type of social engineering attack is this?

A company's security policy requires that all laptops used by field employees have the entire operating system drive encrypted to protect data in case of theft. Which Windows feature should be enabled to meet this requirement?

A technician is supporting a warehouse desktop. The immediate goal is to list Linux processes and owners for review. Which tool, control, or procedure is the best fit?

A user reports that after installing a Windows Update, an external monitor connected to a Windows 10 workstation is no longer detected. The technician suspects the update installed an incorrect display driver. Which built-in Windows tool should the technician use to revert the driver?

A user runs a 32-bit legacy application on a 64-bit Windows 10 workstation with 16 GB of RAM. The application frequently crashes with an 'Out of memory' error even when the system shows plenty of free RAM. Which of the following is the most likely cause?

A user reports that a critical line-of-business application displays an 'application failed to initialize' error immediately after launching. The application worked correctly before a recent Windows 10 cumulative update was installed. The technician has run System File Checker (SFC) and DISM, both reporting no integrity violations. Which of the following should the technician do NEXT to resolve the issue?

A help desk technician has documented a complex issue that required escalation to a senior technician. Which information is MOST important to include in the documentation for future reference?

A technician is troubleshooting a Windows 10 application that fails to install with error code 0x80070005. The user has local administrator rights. The technician runs Process Monitor and sees 'ACCESS DENIED' for registry key 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData'. What is the most likely cause?

A technician needs to boot a Windows 10 computer into Safe Mode to troubleshoot a driver conflict. The computer is currently running normally. Which method can the technician use to configure the system to start in Safe Mode on the next reboot?

A technician is updating the company's standard operating procedure (SOP) for handling phishing emails. Which of the following should be included in the SOP to ensure consistent response?

A technician implemented a change to a firewall rule on a production server. Shortly after, a critical business application stopped functioning. The technician reverted the change and restored service. According to change management best practices, which of the following should the technician have done BEFORE implementing the change?

A technician is applying a critical security patch to a production database server during a scheduled maintenance window. The patch was tested in a lab environment and approved by the Change Advisory Board (CAB). During installation, the server prompts for an unexpected reboot. The change plan did not include a reboot, and the maintenance window is only 30 minutes long. According to change management best practices, what should the technician do FIRST?

A user reports that a 64-bit application on Windows 10 Pro fails to launch with the error 'The application was unable to start correctly (0xc000007b).' The technician has already reinstalled the application and verified all Windows updates are current. Which built-in tool should the technician use NEXT to check for possible file corruption?

Drag and drop the steps to set up a SOHO wireless router for the first time into the correct order.

A technician wants to upgrade a Windows 10 desktop to Windows 11. The PC has a 64-bit Intel Core i7 processor, 16 GB of RAM, and a 512 GB SSD. The upgrade assistant reports the device is not compatible. Which of the following is the MOST likely reason?

A technician is supporting a clinic workstation. The immediate goal is to change Linux file ownership. Which tool, control, or procedure is the best fit?

A company wants to prevent unauthorized devices from connecting to the wired network. The network switches support 802.1X. What additional component is required to implement 802.1X authentication?

A technician has just applied a critical security patch to a file server during an approved maintenance window. The patch was installed successfully and the server is functioning correctly. According to change management best practices, what should the technician do NEXT?

A technician is attempting to perform an in-place upgrade of a Windows 10 Pro 32-bit system to Windows 11 Pro 64-bit. The hardware meets all Windows 11 requirements including TPM 2.0 and a supported CPU. When running the Windows 11 installation media, the upgrade option is grayed out. What is the most likely cause?

A technician is installing a 32-bit legacy application on a 64-bit Windows 10 Pro workstation. The technician enables .NET Framework 3.5 via Windows Features, but the installation still fails with the error 'This program might not have installed correctly'. Which of the following should the technician try FIRST?

A technician needs to configure a Windows 10 workstation to use a proxy server for internet access. Which Control Panel applet should be used?

A technician is scheduled to apply a critical security patch to a file server during a maintenance window. The technician has already tested the patch in a lab environment and has received approval from the change advisory board. During the deployment, a conflict arises with an existing application, causing the server to become unstable. According to change management best practices, what should the technician do NEXT?

A user's Windows 10 workstation fails to boot and displays the error 'Bootmgr is missing'. The technician boots from Windows recovery media and opens a command prompt. Which command should the technician run first to rebuild the Boot Configuration Data (BCD) store?

A technician is supporting a service-desk jump box. The immediate goal is to repair Windows component store corruption before file integrity repair. Which tool, control, or procedure is the best fit?

A company enforces BitLocker full disk encryption on all laptops. A user forgets their BitLocker password and is unable to provide the recovery key. The laptop is domain-joined and the user has administrative credentials. Which of the following is the BEST action for the technician to take to regain access to the data?

A technician is removing malware from a Windows 10 workstation. After isolating the system from the network, what is the next recommended step in the malware removal process?

A technician is supporting a field engineer tablet. The immediate goal is to reach websites by IP address but not hostname. Which tool, control, or procedure is the best fit?

A technician needs to replace a failed power supply unit (PSU) in a server that has dual redundant PSUs. The server is in production and is currently running on the remaining functioning PSU. According to change management best practices, which of the following should the technician do FIRST?

A user is attempting to install a legacy business application on a Windows 10 Pro workstation. The installation fails with an error stating that the .NET Framework version 3.5 is required. The technician checks the 'Turn Windows features on or off' dialog. Which feature should the technician enable to satisfy this requirement?

A user reports that a custom business application crashes when opening large files but works fine with small files. The technician checks Event Viewer and finds an error related to insufficient virtual memory. What should the technician do first?

A technician needs to upgrade a Windows 10 Pro workstation from version 1909 to version 21H2 while preserving all installed applications and user settings. The technician has downloaded the Windows 10 21H2 ISO file. Which of the following methods should the technician use to perform the upgrade?

A technician needs to apply a critical security patch to a file server that requires a reboot, causing a service outage of approximately 10 minutes. According to change management best practices, which document should the technician complete and obtain approval for BEFORE performing the update?

A technician has completed an approved change to replace a failed hard drive in a server. The server is back online and all services are working. According to change management best practices, which of the following is the NEXT step the technician should take?

A user running Windows 11 reports that the system becomes very slow when multiple applications are open. The technician opens Task Manager and notices that the system is using 80% of its 8 GB RAM and the disk is at 100% activity. The system has a traditional HDD. Which built-in Windows tool should the technician use to improve performance by reducing disk usage?

Match each error code or message to its meaning in Windows.

A company's password policy requires a minimum length of 14 characters with complexity (uppercase, lowercase, numbers, and special characters). Users find these passwords difficult to remember and frequently reset them. Which alternative approach would BEST enhance security while reducing the user burden?

A user reports that their Windows 10 computer is very slow to boot up and has a lot of programs launching automatically. A technician opens Task Manager and sees numerous startup applications enabled. Which of the following should the technician do first to address the boot performance issue?

A user reports that a 32-bit application on a 64-bit Windows 10 system fails to open with the error "The application was unable to start correctly (0xc0000005)". The technician has already run SFC and DISM with no issues. The application works on other computers. What should the technician try next?

A technician needs to check the IP configuration of a Windows 10 workstation, including the IP address, subnet mask, and default gateway. Which command-line tool should the technician use?

A user reports that a custom line-of-business application fails to launch on Windows 10 Pro with the error 'This application could not be started. Application Error: 0xc0000142'. The application worked correctly on Windows 7. The technician has verified the application is compatible with Windows 10 per the vendor, and has run System File Checker (SFC) and Deployment Image Servicing and Management (DISM) with no issues found. The application requires administrative privileges and is already configured to 'Run as administrator' in the compatibility settings. Which of the following should the technician do NEXT?

A user receives an email that appears to be from the company's IT department, requesting that the user click a link to verify their account password due to a security breach. The user notices the email address is from "it-support@company-update.com". Which type of social engineering attack is this?

A user needs to run Hyper-V virtual machines on their Windows 10 workstation. Which edition of Windows 10 is the minimum required to support the Hyper-V feature?

After a Windows 10 update, a user reports that a legacy business application displays the error 'This app can't run on your PC' when launched. The technician has already run System File Checker (sfc) and DISM without issues. Which of the following should the technician try FIRST to resolve the compatibility issue?

A technician has just completed a scheduled change that involved updating the operating system on ten company workstations. The update was successful on all workstations. According to change management best practices, which of the following should the technician do to properly close the change?

A user reports that after upgrading from Windows 10 20H2 to Windows 10 22H2, a legacy application displays the error 'This app can't run on your PC' when launched. The technician has already run System File Checker (SFC) and DISM without finding any issues. Which of the following should the technician try FIRST to resolve the compatibility issue?

A user reports that a legacy 32-bit application designed for Windows XP fails to launch on a Windows 10 Pro workstation with the error 'This app can't run on your PC.' The technician has verified the application is 32-bit and has no 64-bit version available. Which of the following is the BEST built-in method to allow this application to run?

A company policy requires that all sensitive data stored on laptops must be encrypted. A technician enables BitLocker on a laptop, but after a reboot, the system prompts for a recovery key. The technician suspects the TPM is not being recognized. Which pre-operating system security feature should the technician check in the BIOS/UEFI?

A company has a policy requiring that all employees use multi-factor authentication (MFA) when accessing the corporate VPN. An employee is setting up MFA on their smartphone and is presented with several options. Which of the following MFA methods provides the HIGHEST level of security?

A technician is preparing to replace a failed hard drive in a server. According to change management best practices, which step should be completed BEFORE implementing the change?

A company's receptionist receives a phone call from someone claiming to be from the IT help desk. The caller states there is a critical security issue with the receptionist's computer and requests the receptionist's username and password to fix it remotely. Which type of social engineering attack is this?

A technician is training a new help desk employee on best practices for handling difficult users. Which behavior should the technician emphasize as MOST important?

A technician is documenting a standard procedure for resetting user passwords that all help desk staff should follow. This document is best classified as which type of documentation?

A technician needs to configure a Windows 10 Pro workstation to allow a user to connect to the company's Remote Desktop services from home without using a VPN. Which built-in Windows feature should the technician enable on the workstation?

A technician is supporting a clinic workstation. The immediate goal is to identify where network path latency or failure begins. Which tool, control, or procedure is the best fit?

A security audit reveals that sensitive customer data was emailed to a third-party vendor without encryption. The company policy mandates that all sensitive data must be encrypted at rest and in transit. Which security control should be implemented to prevent such incidents in the future?

A security technician confirms that a user's workstation is infected with malware that is making outbound connections to a known command-and-control server. The technician has already isolated the workstation from the network. According to standard incident response procedures, what should the technician do NEXT?

A company drafts a policy that defines acceptable use of company-provided devices, including internet browsing, email etiquette, and prohibited software. Which type of policy is this?

A newly deployed Windows 10 workstation experiences a blue screen error with stop code 'PAGE_FAULT_IN_NONPAGED_AREA' shortly after booting. The technician recently installed a new RAM module. Which of the following should the technician do FIRST to isolate the issue?

A technician is supporting a finance laptop. The immediate goal is to receives an APIPA address on one office port. Which tool, control, or procedure is the best fit?

An employee holds the door for a person who claims to have forgotten their badge. The person does not present any identification but is allowed into the secure area. Later, it is discovered that the person was an unauthorized individual. Which type of social engineering attack occurred?

A company policy requires that all company-issued smartphones can be remotely wiped in case of loss or theft. Which of the following should a technician enable on the devices to meet this requirement?

A technician detects that an attacker has gained unauthorized access to a file server using a stolen user account. The technician can see active connections from the attacker in the server logs. According to incident response best practices, which action should the technician take FIRST?

A technician is setting up a new computer for a user who wants to dual-boot Windows 10 and Linux. The technician has a single SSD and plans to install both operating systems. Which of the following is the MOST important step to perform FIRST before installing Linux?

A technician is configuring a new Windows 10 workstation to join a corporate Active Directory domain. The technician opens System Properties and clicks 'Change settings' next to 'Computer name, domain, and workgroup settings', but the option to join a domain is not available. Which of the following is the MOST likely reason?

A user reports that a Windows 10 application crashes immediately upon launch with the error code 0xc0000005 (Access Violation). The application worked fine yesterday. Which of the following is the MOST likely cause?

A technician is securing a small office network. The technician wants to ensure that only authorized devices can connect to the wired network ports. Which security control should the technician implement?

According to IT best practices, which of the following is a key component of an incident response plan?

A user reports that their Windows 10 computer is running slowly and they notice many background processes running. The technician wants to identify which process is consuming the most CPU resources. Which tool should the technician use?

A company requires all Windows 10 workstations to be able to join an Active Directory domain. Which edition of Windows 10 must be installed on these workstations?

A user receives an unsolicited phone call from a person claiming to be from a software vendor. The caller says the user's computer is infected and requests remote access to fix it. The user provides remote access. Which type of social engineering attack is this?

A technician is configuring a shared Windows 10 Pro workstation that will be used by multiple employees. The company policy requires that unauthorized changes to system settings be prevented. Which built-in Windows security feature should the technician ensure is enabled?

An employee receives a phone call from someone claiming to be from the IT department. The caller states there has been a security breach and asks the employee to provide their domain password to verify the account. What type of social engineering attack is this?

A user is unable to connect to any network shares from a Windows 10 computer. Other computers on the same network can access the shares. The technician confirms the computer has an IP address and can ping other devices. Which Windows feature should the technician check first?

A junior technician accidentally assigns a help desk ticket to the wrong category in the ticketing system. This causes a delay in resolution because the ticket is not routed to the appropriate team. According to IT best practices, what should the technician do to help prevent similar incidents in the future?

A help desk technician has identified a malware infection on a user's workstation. The technician has disconnected the computer from the network to contain the infection. According to the company's incident response plan, what should the technician do NEXT?

A technician is troubleshooting a legacy 32-bit application on a 64-bit Windows 10 workstation. The application displays an error: 'The ordinal 1234 could not be located in the dynamic link library C:\Windows\System32\msvcr100.dll.' The technician installs the latest Visual C++ 2010 Redistributable package for both x86 and x64, but the error persists. What is the most likely cause?

A technician is replacing a server's power supply under an approved change. After removing the old power supply, the technician discovers the new unit has a different connector type and cannot be installed. What should the technician do first?

A change to apply a critical security patch to a production application server has been approved by the Change Advisory Board (CAB) with a detailed implementation plan. During the scheduled maintenance window, the technician begins the patching process and discovers that a required prerequisite update is not installed on the server. The prerequisite update is available for download but was not included in the approved change plan. According to change management best practices, what should the technician do FIRST?

A user reports that after installing a new third-party firewall suite, their Windows 10 workstation can no longer connect to the internet. Other computers on the same network are working fine. The technician confirms the third-party firewall is active and has its own filtering. Which of the following should the technician do FIRST to restore internet connectivity?

A technician needs to remotely manage a Windows 10 computer that is on the same local network. Which of the following built-in tools allows the technician to view and control the user's desktop?

A user reports that their Windows 10 computer is running slowly and they see a 'Low memory' message when opening applications. What should the technician check first to diagnose the issue?

A technician is dispatched to replace a faulty motherboard in a desktop computer. The technician has the required replacement part, which is an exact match. The computer is currently in use by an employee. The technician checks the ticketing system and sees the request was approved by the employee's manager. What should the technician do FIRST?

A technician is supporting a field engineer tablet. The immediate goal is to identify the faulting module after an application crash. Which tool, control, or procedure is the best fit?

A technician needs to configure a Windows 10 computer so that updates are automatically downloaded but the user is allowed to decide when to install them. Which Windows Update setting should the technician select?

A user reports that their Windows 10 Pro workstation takes a very long time to boot. The technician wants to disable unnecessary startup programs to improve boot time. Which built-in tool should the technician use to manage startup programs?

A help desk technician assists a user who cannot log into their workstation because they forgot their password. The technician follows the company's standard operating procedure for password resets. After successfully resetting the password and confirming the user can log in, what is the NEXT step according to best practices?

A technician needs to determine whether a Windows 10 workstation is running a 32-bit or 64-bit version to download the correct driver. Which command-line tool will display the system type (x86 or x64)?

A technician needs to deploy Windows 11 to multiple computers and wants to automate the installation by providing answers to setup questions. Which tool should the technician use?

A technician is decommissioning several hard drives that contained sensitive client data. The drives are still functional but need to be disposed of securely. Which method ensures the data cannot be recovered?

A company's security policy requires that all laptops with sensitive data use full disk encryption. Which technology is built into Windows 10 Pro to meet this requirement?

A user reports that a 64-bit application on Windows 10 Pro crashes immediately upon launch with the error '0x80004005 - Unspecified error'. The technician has already reinstalled the application and verified that all Windows updates are current. Which built-in tool should the technician use NEXT to check for system file corruption?

A technician is supporting a shared training-room workstation. The immediate goal is to identify Linux processes consuming CPU interactively. Which tool, control, or procedure is the best fit?

A technician has received approval from the Change Advisory Board (CAB) to apply a critical security patch to a production file server. What is the MOST important step the technician should take before applying the patch?

A technician follows a defined process to ensure all IT infrastructure changes are authorized and documented. Which process is being followed?

A technician is decommissioning several old laptop batteries that are no longer holding a charge. Which of the following is the MOST appropriate method of disposal for these batteries?

A developer reports that a custom application crashes immediately on launch with the error 'The application was unable to start correctly (0xc0000005)'. The application works on other Windows 10 computers. The technician has verified the application is compatible and has installed all required runtimes. Event Viewer shows a faulting module with description 'Access violation reading location 0x00000000'. What is the most likely cause?

A Windows 10 computer fails to boot and displays the error: 'File: \Windows\System32\drivers\acpi.sys Status: 0xc0000359'. The technician boots into Windows Recovery Environment (WinRE). What is the most likely cause of this error?

A technician is documenting a troubleshooting process for future reference. According to best practices, which of the following should be included in the documentation?

A company has a data retention policy that requires all security logs to be retained for 90 days. A security incident occurred 60 days ago, but when the incident response team tries to retrieve logs from that period, they find that the logs have been overwritten due to insufficient storage capacity. Which security principle has been most directly compromised?

A technician needs to ensure that a laptop's data is protected in case the laptop is stolen. The laptop has a TPM 2.0 chip and runs Windows 10 Pro. Which Windows feature should be configured to provide full-disk encryption?

A technician sees a person wearing a visitor badge wandering alone in a secure server room. According to security best practices, which of the following should the technician do first?

A technician has a Windows 10 Pro workstation that fails to boot with the error 'Inaccessible boot device' after a driver update. The technician boots from a Windows 10 installation USB and selects 'Repair your computer'. Which built-in recovery tool should the technician use to attempt to restore the system to a previous working state?

A user reports that a 64-bit application on Windows 10 Pro crashes immediately with the error '0xc000007b'. The technician has already run System File Checker (SFC) and Deployment Image Servicing and Management (DISM) with no issues found, and has reinstalled the application multiple times. The error started after a recent Windows Update. Which of the following should the technician do NEXT to resolve the issue?

According to incident response best practices, which step should be performed after containment, eradication, and recovery activities have been completed?

A security audit reveals that many user passwords are being cracked using offline brute-force attacks. The current password policy requires a minimum of 8 characters with uppercase, lowercase, and numbers. Which configuration change would MOST significantly increase resistance to brute-force password cracking?

A technician needs to configure a Windows 10 workstation so that only signed drivers can be installed. Which security feature should be enabled?

On a Windows 10 computer, the Start menu and several system settings pages are not responding. The technician suspects system file corruption. Which built-in command-line tool should the technician run FIRST to restore corrupted system files?

A help desk technician needs to create a document that defines the step-by-step process for escalating a security incident within the IT department. Which type of document should be created?

A 32-bit application on a 64-bit Windows 10 system fails to run with a missing DLL error. A technician finds the required DLL file in the application's installation folder and copies it to C:\Windows\System32, then registers it with regsvr32. The application still fails. What is the MOST likely reason the DLL registration did not resolve the issue?

A workstation in a corporate environment has been infected with ransomware. The user reports that files are being encrypted and a ransom note is displayed. The technician arrives at the workstation. Which of the following is the FIRST action the technician should take to minimize further damage?

A small business needs to join all its Windows 10 computers to a centralized Active Directory domain for centralized management. Which edition of Windows 10 is the minimum required for domain join capability?

A user reports that their Windows 10 workstation is running slowly and they see a notification that Windows is low on disk space on the C: drive. The technician runs Disk Cleanup, but it only frees a small amount of space. Which additional step should the technician take to reclaim the most space?

A user reports that Microsoft Edge crashes immediately upon opening. The technician determines the issue began after the user installed a new browser extension. The user is unable to access Edge settings because the browser crashes. What should the technician do FIRST?

A technician needs to capture a custom Windows 10 image from a reference computer and deploy it to multiple identical machines. Which tool is designed to capture and apply Windows images?

A user reports that they received a phishing email and clicked a link that downloaded a file. The user ran the file and now the computer is sluggish and displaying pop-up ads. The technician has already disconnected the network cable from the workstation. According to the incident response procedure, what should the technician do NEXT after containing the incident?

A user reports that their Windows 10 workstation is unable to connect to shared network drives after a recent update. The technician checks network status and confirms the computer is connected to the network. Which built-in Windows tool should the technician use to verify that the necessary network services (e.g., Workstation service) are running and set to start automatically?

A technician needs to configure a Windows 10 computer to automatically run a maintenance script every Tuesday at 2 AM. Which tool should be used?

A technician discovers that a user's workstation is infected with a Trojan that is logging keystrokes and capturing login credentials. The technician has already disconnected the computer from the network. According to standard incident response procedures, what should the technician do NEXT?

A user reports that their Windows 10 workstation freezes intermittently. The technician suspects a third-party service is causing the issue. The technician wants to start the computer with only Microsoft services and drivers to isolate the problem. Which built-in tool should the technician use to perform this action?

A technician has completed a repair on a user's computer. The user confirms the issue is resolved. According to best practices, what should the technician do to properly close the ticket?

A technician receives a phone call from someone claiming to be from the company's help desk. The caller states there is a problem with the technician's account and asks for the technician's username and password to 'run a test'. Which type of social engineering attack is this?

A standard user tries to run a legacy application that requires administrator privileges on Windows 10. Which prompt will the user see?

A user receives an email that appears to be from their bank, asking them to verify their account by clicking a link that leads to a fake login page. The user enters their credentials, which are then stolen. What type of attack is this?

A technician needs to deploy a customized Windows 10 image to multiple new laptops. The image must include specific device drivers and a line-of-business application. After installing the OS, drivers, and application on a reference computer, which built-in Windows tool should the technician use to capture the image for deployment?

A user reports that a 32-bit application on a 64-bit Windows 10 Pro workstation crashes immediately with error code 0xc000007b. The technician has already reinstalled the application and run System File Checker (SFC), which found no integrity violations. Which action should the technician take NEXT?

A user reports receiving a phone call from someone claiming to be from the IT department. The caller asks the user to install a remote access tool to help fix a network issue. The user complies. Later, the technician discovers that the remote access tool was used to install malware. Which type of social engineering attack is this?

A technician needs to configure a Windows 10 Pro workstation so that a user can sign in and access local files while the computer is not connected to the corporate network. The user does not have a Microsoft account and the company does not use a Microsoft account for workstations. Which account type should the technician create?

A user reports that their Windows 10 workstation displays a blue screen error containing the text 'PAGE_FAULT_IN_NONPAGED_AREA' after upgrading the RAM from 8GB to 16GB. The technician has already verified that the new RAM modules are compatible and seated correctly. Which of the following should the technician do NEXT to resolve the issue?

A user reports that a line-of-business application on Windows 10 crashes immediately after launch. The technician has already run System File Checker (SFC) and DISM, which found no corruption. The application was working correctly before a recent Windows Update. Which built-in tool should the technician use NEXT to identify the cause of the crash?

A technician has completed a scheduled firmware update on a network switch. The update was successful, but the technician notices that the switch's configuration was reset to factory defaults. The technician restores the configuration from a known-good backup. According to change management best practices, what should the technician do NEXT?

A technician copies a missing 32-bit DLL file into C:\Windows\System32 on a 64-bit Windows 10 system and registers it with regsvr32. The 32-bit application still fails with a missing DLL error. What is the MOST likely reason?

A technician is troubleshooting a Windows 10 workstation that experiences intermittent blue screen errors with the stop code 'DRIVER_IRQL_NOT_LESS_OR_EQUAL'. The technician has updated all drivers, run memory diagnostics with no errors, and verified system files are intact. The errors occur randomly when the computer is idle, but never when it is under heavy load. Which of the following is the MOST likely cause of the issue?

A technician has been asked to create a policy for the proper disposal of old hard drives that contain sensitive client data. The policy must ensure that data cannot be recovered even with advanced forensic tools. Which of the following methods should the technician recommend?

A security analyst discovers that an employee's workstation is infected with a rootkit. The technician has attempted to remove the rootkit using standard antivirus and anti-malware tools, but the rootkit persists after each reboot. Which of the following is the MOST effective next step to eradicate the rootkit?

A user reports that a Windows 10 Pro workstation crashes with a blue screen error 'MEMORY_MANAGEMENT' shortly after logging in. The technician has already run System File Checker (SFC) and DISM, both reporting no corruption, and has updated all drivers. The technician now suspects faulty RAM. Which built-in Windows tool should the technician use to check for memory problems?

A technician is creating a new standard operating procedure for resetting user passwords in a Windows domain. Which element is MOST important to include to ensure the procedure is effective and follows security best practices?

A user wants to quickly see which processes are consuming the most CPU and memory on a Windows 10 computer. Which keyboard shortcut opens the Task Manager directly?

A user installed a new application on a Windows 10 computer. When attempting to launch it, the user receives the error: 'The program can't start because VCRUNTIME140.dll is missing from your computer.' Which action should the technician take to resolve this issue?