C.2.3 CompTIA A+ 220-1102 (Core 2) Domain 3: Software Troubleshooting

Which of the following is a common malware symptom?

> Increase in pop-up ads Explanation: Some common malware symptoms include the following: Devices running slow Files being deleted, renamed, or altered Heavy network traffic Inability to access the internet Increased pop-up ads False antivirus ads None of the other options are common malware symptoms.

During the POST, you receive the following message: Keyboard not present. Press F1 to continue. What are the MOST likely causes of this error message? (Select two.)

> A stuck key on the keyboard > A poor keyboard connection Explanation: If the keyboard is not detected during the POST, the keyboard is probably not attached to the computer correctly. Check that the keyboard is securely connected to the keyboard port. While a bad keyboard will also result in this error, you should check the keyboard's connection to the computer before replacing the keyboard. This error is also commonly caused by a stuck key on the keyboard. An outdated BIOS does not normally impact keyboard functionality. The CMOS (and battery) does not normally impact the functionality of just the keyboard. If the CMOS battery is failing, other symptoms will occur. A broken F1 key only impacts the key itself, not the entire keyboard.

Which stage of a legacy BIOS startup loads the boot code in the Master Boot Record (MBR) and then uses the partition table to identify the active disk partition?

> Boot loader Explanation: On the boot device, the BIOS searches for and loads the boot code in the Master Boot Record (MBR). The MBR is on the first disk sector and uses the partition table to identify the active disk partition. The bootmgr.exe program looks for the BCD store in either the C:\ directory or the System Reserved partition. OS startup and Winload.exe occur after the boot loader.

Which of the following are likely symptoms of a malware infection? (Select two.)

> Changed file permissions. > Renamed system files. Explanation: Common symptoms of a malware infection include the following: Slow computer performance Internet connectivity issues Operating system lockups Windows update failures Renamed system files Disappearing files Changed file permissions Access denied errors Cookies are commonly placed by legitimate websites and aren't considered a major security threat. Windows automatically installs updates by default. Phishing emails don't necessarily indicate that a system is infected with malware. It is more likely that your email address has been picked up and included on a list.

You want to make sure that you always have the latest patches installed on your workstation for an order entry application created by the DataComLink corporation. What should you do to ensure this? (Select two.)

> Configure the application to automatically download and install updates as they are released. > Check the DataComLink website regularly for patches and updates to the software. Explanation: The best way to make sure that an application is up to date include the following actions: Manually check the manufacturer's website regularly for software updates. Configure the application to automatically download and install updates as they are released. Most software companies do not contact you directly when updates are released. Windows Update only works for Microsoft products and some critical driver files. It will not update third-party software.

Your system hangs immediately after the BIOS information is shown and displays an error loading operating system error message. What is the MOST likely source of the problem?

> Corrupt MBR or partition table Explanation: Symptoms of a corrupt MBR or partition table include the system hanging immediately after the BIOS information is shown and error messages such as missing operating system or MBR corrupt. A corrupt boot sector, inaccessible boot disk, or a missing or corrupt file are less likely to display this type of error message.

Nathan, a long-time Mac user, has been using his Mac computer for some time now with no issues. Recently, however, he reported that his cursor turns into a pinwheel and he can't do anything. Which of the following would be the BEST first step for troubleshooting this issue?

> Determine if the problem is caused by software or hardware. Explanation: When troubleshooting system lockups, a good place to start is to determine if the problem is being caused by software or hardware. Once you know that you can narrow your troubleshooting steps further. All of the other options are valid ways to troubleshoot and fix problems causing a system lockup, but isolating the issue as a software or hardware issue is the first path to explore.

You are an IT technician for your company. Vivian, an employee, has been receiving error messages, indicating that some of her Windows system files are corrupt or missing. To fix this issue, you ran the Windows System File Checker tool (SFC.exe). Shortly after the files were repaired, Vivian called again because she is still having the same issue. You now suspect that a corruption or a renaming of the system files is being caused by malware. Which of the following is the FIRST step you should take to remove any malware on the system?

> Disconnect Vivian's computer from the network. Explanation: When you suspect that a computer may be infected with malware, you should immediately disconnect (quarantine) the computer from the network to prevent propagation of the malware. After the computer is isolated, you can back up the computer and begin to remove the malware by using a virus removal program (anti-malware software) in Safe Mode. Disabling System Restore does not further any removal of malware. Backing up an infected computer and performing a clean install of Windows does not resolve any issues with Vivian's critical files, and it does not prevent any future issues with malware.

You've just connected a new USB device to your Windows system. You used the installation disc that came with the device to install the drivers needed to support the device. Since the installation, the system frequently crashes when you try to access the new device. Which of the following steps would MOST likely resolve this issue?

> Download and install the latest driver from the manufacturer's website. Explanation: The first step is to download and install the latest driver for the device from the manufacturer's website. Reinstalling or replacing the device should only be done as a last resort after you've performed other troubleshooting tasks. You would use the Add Hardware wizard to configure legacy (non-plug-and-play) devices.

Which of the following terms describes a Windows 11 operating system patch for a desktop that targets a specific problem and is released on a short-term, periodic basis?

> Hotfix Explanation: A hotfix is an operating system patch that targets a specific problem. A targeted software patch helps describe what a hotfix does, but it is not a type of Windows OS update. Service packs included a collection of hotfixes and other system updates, but were discontinued after Windows 7. Windows as a Service is the approach Microsoft introduced with Windows 10 to deploy, update, and service the operating system. However, it is not a type of update that targets a specific problem.

Which of the following are common symptoms of a compromised mobile device? (Select two.)

> Increased data usage > Connectivity issues Explanation: Two of the most common symptoms of a compromised mobile device are: Connectivity issues - If a device seems sluggish, it may be because an application is leaking data and using bandwidth to constantly transmit its own signal. Increased data usage - If you are experiencing an increased amount of data usage, this could be a telltale sign that there is an application broadcasting data without permission. While a flickering screen or an increase in junk email might be symptoms of a compromised device, they are more commonly associated with hardware failure (flickering screen) or your email account being more widely distributed among online businesses (increase in junk email). Wi-Fi spoofing occurs when someone sets up a wireless access point in a public area (such as a store) and broadcasts the same ID as the Wi-Fi that is being provided by the establishment. Wi-Fi spoofing is not a symptom of a compromised mobile device.

Which of the following should you do immediately after a malware infection is confirmed?

> Quarantine the infected system. Explanation: If a malware infection is confirmed, you should immediately quarantine the system to prevent the malware from spreading through the network. You should remove the device from the network and disconnect any shared drives or connections. Perform the other options after the malware infection is confirmed.

While running a presentation editor on your Windows 11 laptop, your computer locks up. When you try powering on your computer, Windows 11 will not start. Which of the following tools should you use FIRST to try and resolve the issue?

> Startup Repair Explanation: Startup Repair is the first step you should attempt when trying to repair your Windows 11 operating system. The utility will go through and look at all of your startup files, the files that are needed to get Windows up and running, see if there's a file that's missing, any files that are corrupt, files that have been altered by malware, or anything else like that. It will then replace the bad files with a known good copy. If you purchased your system from a major PC manufacturer, it might include a recovery partition (drive) on the hard drive. However, the recovery drive normally restores a Windows image, which erases the hard drive. While this approach can fix the issue with the operating system, it will also remove any user data or installed applications (which is not a good first step in resolving the issue). You can use Backup and Restore to create an image for a full backup of your drive. However, you may lose important user data or installed applications since the last image. The best first step in this scenario is to try and repair the operating system. Restoring files focuses on recovering previous versions of files. It does not perform any maintenance or repair on the operating system.

Marcus was attempting to edit some registry settings on his Windows 11 system. Now, when he tries to boot his system, it hangs after the Windows splash screen is displayed. Because he cannot boot to Safe Mode, he boots the system from the Windows installation disc and accesses the Recovery Environment. Which Recovery option should Marcus use FIRST to help resolve his boot issue?

> System Restore Explanation: The most common cause of the system hanging after the Windows splash screen is displayed is a bad driver or corrupt registry settings. If you cannot boot to Safe Mode, boot into the Recovery Environment and use System Restore. Resetting the PC or going back to a previous build might also work, but these are more drastic options. You should try simpler recovery options first before moving on to more drastic ones. BOOTMGR is the boot loader program. It is not a recovery option.

Which of the following can an overheated hard drive cause?

> System instability Explanation: System instability occurs when a hard drive is overheated. USB controller warnings are related to the USB port's capability. Incorrect boot order is not caused by an overheating hard drive. Time drift is not caused by an overheating hard drive.

You are troubleshooting a malware infection. As part of the remediation process, you have used a USB drive to boot into a lightweight version of Windows. Which of the following did you MOST likely boot into?

> WinPE Explanation: In this scenario, you have most likely booted into a WinPE environment. A Windows Pre-Installation environment (WinPE) is a lightweight version of Windows that boots from a USB drive and is typically used to help deploy Windows in an enterprise environment or to troubleshoot Windows issues. Safe Mode boots Windows with the minimal drivers and applications. Safe Mode is not what was described in this scenario. System Restore is used to roll Windows back to a previous image. System Restore is not what was described in this scenario. A sheep dip computer is a special computer that is used for malware analysis and remediation. A sheep dip computer is not what was described in this scenario.

Which programs run during the startup process to allow user logon? (Select two.)

> Winlogon > Wininit Explanation: The wininit and winlogon programs run to allow user logon. At this point, the Welcome or user logon screen is displayed. NToskrnl.exe, Bootmgr.exe, and Winload.exe occur before the logon and user configuration stage of startup.

In which of the following situations would driver rollback be the BEST option to use?

> You recently installed a new video driver, and now the system behaves erratically. Explanation: Driver rollback would be best suited to a situation where you've installed a misbehaving driver and need to revert to an older version. Driver rollback preserves the old driver every time you install a newer driver. So, you could use driver rollback to uninstall the current driver and restore the previous version. Restoring several driver files that were accidentally deleted is not a function of driver rollback. It simply attempts to restore the previously selected driver. If you need to uninstall a new application that's causing erratic behavior, you should use the Uninstall feature (accessed through Control Panel). Restoring emails is not a feature of driver rollback, which focuses on restoring the previously installed device driver.

You have just received a call from one of your customers. She informs you that after turning her computer on, she received the following error: Error loading operating system BOOTMGR is missing Press Ctrl+Alt+Del to restart Every time she restarts her computer, the same error appears. Which of the following tools will work BEST to fix this issue?

> bootrec Explanation: To fix a Master Boot Record (MBR) error, run the bootrec /fixmbr command. You could include other switches as well to further repair the boot sector or rebuild the entire boot configuration data. diskpart is a disk partition utility. format is a command that formats a drive, which erases all data on that drive. chkdsk can identify and correct file system errors and make sure that you can continue to load and write data from the hard disk. However, this command will not fix a problem with the MBR.

You are troubleshooting a Windows 11 system that won't boot. The system appears to initialize just fine, and POST completes correctly. However, Windows does not load, and an error message is displayed on the screen, indicating that the operating system is not found. You determine that the Master Boot Record (MBR) is corrupt. To fix the issue, you perform the following steps: 1. Boot the system from the Windows 11 installation DVD. 2. Access the Recovery Environment. 3. Open a Command Prompt window. Enter the command that you should run at the Command Prompt to address this issue.

> bootrec /fixmbr Explanation: The bootrec /fixmbr command writes a Windows-compatible MBR to the system partition. This command does not overwrite the existing partition table. Use this method when you need to resolve MBR corruption issues or when you have to remove non-standard code from the MBR.