Hard Difficulty Questions

Store the password in a plain text file and have the script read it.

Why wrong: Storing a password in a plain text file is a severe security vulnerability. Any user or process with read access to the file system location where the password file resides can easily view the credentials without any decryption. This method completely bypasses secure credential management practices and poses a significant risk of unauthorized access to the target systems.

Embed the password in the script using a variable and run it from a hidden share.

Why wrong: Embedding a password directly within a script, even when run from a hidden share, does not provide adequate security. A hidden share (e.g., \\server\share$) only prevents casual browsing; it does not restrict access for users who know the path or have appropriate permissions. The script file itself, containing the password in plain sight within a variable, remains a major vulnerability once accessed, allowing the credential to be easily compromised.

Use a scheduled task that runs the script as SYSTEM.

Why wrong: Running a script as the SYSTEM account grants it maximum local privileges to execute commands on the machine. However, this elevated execution context does not secure the *contents* of the script itself. The password, if embedded directly within the script file, remains visible in plain text to anyone with read access to that script, regardless of the account used for execution, leaving the credential exposed.

Degauss all drives and then recycle them.

Why wrong: Degaussing does not physically destroy SSDs, and it does not render drives physically unusable as required.

Overwrite all drives with a three-pass wipe.

Why wrong: Overwriting 1200 drives would be extremely time-consuming and does not physically destroy the drives.

Use a degausser for HDDs and a secure erase for SSDs.

Why wrong: This method does not physically destroy the drives; it only destroys data, and degaussing does not work on SSDs.

Install a surveillance camera in the storage area.

Why wrong: Cameras can deter theft but do not protect the data if drives are taken; the data is still readable.

Require a smart card to access the storage area.

Why wrong: Access control limits who can enter but does not address the vulnerability of readable drives.

Apply tamper-evident seals to the server chassis.

Why wrong: Seals show if the server was opened but do not protect data on drives that are removed.

Attempt to roll back the update using the server’s built-in recovery options.

Why wrong: Attempting a rollback without a pre-approved, documented plan, often part of a formal Change Management process, introduces significant risks. The technician might lack the necessary permissions, tools, or understanding of system dependencies to execute a safe rollback, potentially corrupting data or violating established change control procedures. This action could worsen the situation, increase downtime, and should only be performed after proper escalation and approval.

Continue troubleshooting until the maintenance window ends, then document the failure.

Why wrong: Continuing to troubleshoot without a clear resolution path or defined escalation trigger risks exceeding the allocated maintenance window, directly impacting business operations and user availability. This approach delays critical escalation to management or specialized teams who might possess the necessary expertise or authority to make informed decisions, such as initiating a formal incident response or extending the maintenance window. It also prevents timely communication to stakeholders about the service disruption.

Reboot the server to clear the error and retry the update.

Why wrong: Rebooting a server without first understanding the root cause of the update failure is a high-risk action that can exacerbate the problem. It could lead to data corruption, an unbootable system state, or further complicate troubleshooting by clearing critical error logs or temporary states. This action does not address the underlying issue, nor does it provide a structured approach to recovery, potentially bypassing proper change control and incident management procedures.

The RAM is faulty.

Why wrong: Faulty RAM typically manifests as Stop errors (Blue Screen of Death - BSOD) with specific memory management error codes, application crashes, or system instability during memory-intensive operations. While severe RAM issues could lead to restarts, the absence of a BSOD and the presence of Kernel-Power 41 events strongly point away from RAM as the primary cause, as Kernel-Power 41 indicates an unexpected power loss.

The motherboard is failing.

Why wrong: A failing motherboard, particularly issues with its voltage regulator modules (VRMs), power delivery circuitry, or integrated components, can lead to intermittent and unstable power supply to the CPU, RAM, or other critical components. This instability can cause the system to unexpectedly lose power and restart, generating Kernel-Power 41 events in the Event Viewer, especially when under load, as the failing components struggle to maintain stable voltage.

The Windows installation is corrupt.

Why wrong: A corrupt Windows installation or critical system files usually results in specific Stop errors (BSODs), boot loops, application failures, or an inability to load the operating system entirely. The Kernel-Power 41 event, however, is a critical hardware event logged when the system loses power unexpectedly and then restarts, indicating a power-related hardware fault rather than a software-level operating system corruption.

Fault tolerance

Why wrong: Fault tolerance provides continuous uptime by running a duplicate VM, but it requires significant resources and is not just a restart mechanism.

Live migration

Why wrong: Live migration moves a running VM to another host manually, not automatically in response to a failure.

Snapshots

Why wrong: Snapshots capture a VM's state for backup, but they do not provide automatic restart after a host failure.

Samsung Knox

Why wrong: Samsung Knox is a hardware-level security platform for enterprise, but it is not a standard Android feature on all devices.

Android Device Manager

Why wrong: This tool is for locating or wiping lost devices, not for scanning app permissions.

Verified Boot

Why wrong: Verified Boot checks system integrity at startup, not app-level permissions or behavior.

Tell the employee that their router is probably cheap and needs replacement.

Why wrong: This is insulting and will increase defensiveness.

Ask the employee to run a command prompt command without explanation.

Why wrong: This may confuse the employee and feels like a test, increasing frustration.

Escalate the issue to a senior technician without further attempts.

Why wrong: This avoids the problem and doesn't develop the technician's communication skills.

fuser /path/to/script

Why wrong: fuser also shows processes using a file, but it is less commonly used than lsof; it is correct but not the most standard.

ps aux | grep script

Why wrong: This shows running processes with 'script' in the name, but does not specifically show if the file is open.

strace -p $(pgrep script)

Why wrong: strace traces system calls, not a quick check for open files.

Enable Boot Logging

Why wrong: Boot logging creates a log of drivers loaded during boot, but does not prevent malware from loading.

Last Known Good Configuration

Why wrong: Last Known Good Configuration reverts to the last successful boot, but does not prevent malware from running.

Debugging Mode

Why wrong: Debugging Mode is for advanced troubleshooting, not for malware removal.

Windows Defender Firewall

Why wrong: Firewall can block port 3389, but does not disable the Remote Desktop service itself; the user could still enable it.

User Accounts > Manage another account

Why wrong: User Accounts manages user permissions, not system services like Remote Desktop.

Administrative Tools > Services

Why wrong: Services can stop the Remote Desktop service, but the user could restart it; disabling via System is more permanent.

Review the VPN logs to determine the extent of the breach

Why wrong: Reviewing logs is important for forensics, but the immediate action should be to stop the ongoing access.

Change the VPN server's shared secret

Why wrong: Changing the shared secret affects the VPN server authentication, but the attacker is using a valid user account, so this would not stop them.

Notify the former employee about the security incident

Why wrong: Notifying the former employee is not a security action and could alert the attacker if they are monitoring communications.

ipconfig /setaddress 192.168.1.100

Why wrong: ipconfig does not have a /setaddress switch.

netstat -r

Why wrong: Displays the routing table, does not set IP.

ping 192.168.1.1

Why wrong: Tests connectivity, does not configure IP.

The antivirus subscription has expired; renew it

Why wrong: While possible, the question states no prompts were seen; a disabled update service is a common cause that also explains the lack of prompts.

The user has manually set the antivirus to manual update mode

Why wrong: Manual mode would still show prompts or notifications; the lack of any prompts points to a service-level issue.

The computer is infected with a virus that blocks updates

Why wrong: A virus that blocks antivirus updates is a known threat, but it would typically prevent the user from manually initiating updates or accessing security settings, not suppress the operating system’s own update notifications. The scenario describes a user who never saw prompts, which points to a misconfigured Windows Update or notification setting, not an active infection. This option is tempting because malware like ransomware often disables security software; it would be correct if the technician observed that update attempts failed silently or the antivirus service was forcibly stopped.

Perform a single overwrite with zeros.

Why wrong: A single overwrite does not meet the DoD 5220.22-M standard for top-secret data, which requires three passes.

Use a degausser and then reformat the drive.

Why wrong: Degaussing destroys data but also renders the drive unusable, so it cannot be reused.

Physically destroy the drive with a hammer.

Why wrong: Physical destruction prevents reuse, which is not the goal since the drives are to be reused.

Use the Terminal command 'fs_usage' to locate the deleted files

Why wrong: fs_usage monitors file system activity in real time; it cannot recover deleted files.

Run Disk Utility First Aid on the SSD

Why wrong: First Aid repairs file system structure but does not recover deleted files.

Use a third-party file recovery tool immediately

Why wrong: While possible, attempting recovery without checking Time Machine first could overwrite data; Time Machine is the safer first step.

find /usr/bin -user root -perm -6000

Why wrong: This matches files with both SUID and SGID bits set (6000), not either one, so it would miss files with only SUID or only SGID.

find /usr/bin -user root -perm 4000 -o -perm 2000

Why wrong: This is syntactically incorrect; the -o operator needs to be properly grouped with parentheses, and it does not combine the conditions correctly.

ls -la /usr/bin | grep '^...s'

Why wrong: This uses grep to find SUID files but does not filter by owner root, and it does not capture SGID files correctly.

System Information

Why wrong: System Information provides hardware and software inventory but does not display crash logs.

Activity Monitor

Why wrong: Activity Monitor shows live system performance, not historical crash logs.

Terminal with 'sudo dmesg' command

Why wrong: dmesg shows kernel ring buffer messages but is less user-friendly for filtering specific panic logs; Console is the recommended tool.

chown datagroup: /srv/data

Why wrong: This changes the group of only the top-level directory, not its contents.

chmod -R g+rw /srv/data

Why wrong: This changes permissions, not group ownership.

groupmod -R datagroup /srv/data

Why wrong: groupmod modifies group properties, not file ownership.

ls -laR --time-style=full-iso | grep '2025-03-21'

Why wrong: This approach is inefficient and relies on grepping a specific date, which may not work if the date format differs or if files were modified today but not yesterday.

stat * .* | grep Modify

Why wrong: The stat command shows modification time but does not filter by time range; it also may not handle hidden files correctly with the wildcard.

find . -newer /tmp/ref -ls

Why wrong: This requires creating a reference file with a specific timestamp, which is an extra step and not as direct as -mtime.