hardMultiple ChoiceObjective-mapped
FC0-U71 Practice Question: The IT security administrator for a mid-sized law…
You are the IT security administrator for a mid-sized law firm that handles sensitive client data. The firm has a mix of Windows 10 workstations, a Windows Server 2019 domain controller, and a network printer. All users have standard user accounts. The senior partner recently received a phishing email that appeared to be from a known client, requesting that he click a link to review a document. He clicked the link and entered his domain credentials on a fake login page. Shortly after, the firm's file server began encrypting files and displaying a ransom note. The incident response team isolated the infected server and restored files from backup. However, the senior partner now reports that he cannot access the file server from his workstation. He receives an 'Access Denied' message. You check his account in Active Directory and find that his account is not locked out and the password is correct. The file server is back online and accessible by other users. You verify that the senior partner's workstation has network connectivity and can ping the file server. Which of the following is the MOST likely cause of the access issue?
⚠ Common exam trap
Many candidates assume ransomware or containment scripts directly caused the access issue, overlooking the subtle credential caching behavior that persists after a password change without a logoff/logon cycle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The senior partner's password was changed during incident response, and his workstation has cached old credentials
The senior partner's password was likely changed during the incident response process to prevent further unauthorized access using his compromised credentials. When a password is changed in Active Directory, the user's workstation still caches the old credentials (NTLM hash) until the user logs off and back on. Since the partner has not logged off, his workstation continues to present the old, invalid credentials to the file server, resulting in an 'Access Denied' error despite the account being active and the password being correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The senior partner's password was changed during incident response, and his workstation has cached old credentials
Why this is correct
After credential compromise, passwords are often reset. The workstation may be using cached old credentials, causing authentication failure despite network connectivity.
- ✗
The senior partner's account was disabled by the automatic containment script
Why it's wrong here
The scenario states the account is not locked out, so it is not disabled.
- ✗
The ransomware modified the file server's permissions to deny access to the senior partner's account
Why it's wrong here
Ransomware typically encrypts files but does not alter NTFS permissions to block specific users; it uses encryption to deny access.
- ✗
The senior partner's workstation IP address was blacklisted on the file server
Why it's wrong here
IP blacklisting would prevent all network communication, but the partner can ping the server, indicating the IP is not blocked.
Go deeper
Related to this question
About these practice questions
Courseiva writes every FC0-U71 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This FC0-U71 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the FC0-U71 exam.