A+ Core 2 Practice Exam

CRT Monitor A CRT monitor is an older-style computer monitor that contains large capacitors which retain high levels of electricity even after being disconnected. A CRT should be disposed of carefully. A technician should never open a CRT monitor or stick anything into its interior for fear of electrocution. Hard drives, LCD monitors, and laptop batteries do not contain high voltage levels.

Which of the following components presents the largest risk of electrical shock to a technician? ○ CRT monitor ○ LCD monitor ○ Laptop battery ○ Hard drive

cat The cat (short for "concatenate") command is one of the most frequently used commands in Linux/Unix. The cat command allows the creation of single or multiple files, view file contents, concatenate files, and redirect output in the terminal to a file.

Which Linux command is used to print the full contents of a file to the screen at once? ○ dig ○ cat ○ grep ○ ls

1GB For the Windows 10 (32-bit) operating system, the minimum requirements are a 1 GHz processor, 1 GB of RAM, and at least 16 GB of hard drive space.

What is the minimum amount of RAM needed to install Windows 10 on a 32-bit system? ○ 2 GB ○ 1 GB ○ 8 GB ○ 4 GB

Samba

Which of the following features allows a Linux server to provide file-sharing services to a company's Windows 10 workstations? ○ Keychain ○ Pathping ○ Samba ○ Yum

ip The ip command is used to display information about the current wired network connection on a Linux system, including its IP address, subnet mask, and MAC address. The nslookup command is used to display and troubleshoot DNS records. The netstat command is used to display the network statistics. The ipconfig tool displays all current TCP/IP network configuration values on a Windows system.

Which command would be used to display the network address and subnet mask for the wired network connection on a Linux system? ○ netstat ○ ip ○ ipconfig ○ nslookup

VNC VNC (virtual network computing) is a remote access tool and protocol. It is used for screen sharing on Linux and macOS. RDP is not open-source. SSH and telnet are text-based remote access tools.

Which of the following open-source remote access tools allows users to connect to their desktop remotely, see what is on their screen, and control it with their mouse and keyboard? ○ RDP ○ Telnet ○ SSH ○ VNC

SOP (Standard Operating Procedure) A standard operating procedure (SOP) is an inflexible, step-by-step listing of the actions that must be completed for any given task.

Which of the following would a technician use when trying to find the exact steps required to install a custom software package within their organization? ○ MSDS ○ AUP ○ SOP ○ SOW

LTS Release The LTS (Long-Term Support) release is well-supported and will be regularly updated by the Linux distribution to support new hardware, performance, and security improvements. These LTS releases are supported for a long time (approximately 10 years), so they are great to use in production systems like servers.

Which version should you use when installing a Linux operating system and are concerned with end-of-life support? ○ LTS release ○ Beta release ○ Developer release ○ Rolling release

sfc The system file checker (SFC) command is a utility in Windows that allows users to scan for and restore corrupted Windows system files from the command line. The gpupdate command-line tool is used to update the group policy settings on a Windows system. For an administrator to force a background update of all Group Policy settings regardless of whether they have changed, they need to run "gpupdate /force" from the command line.

A Windows laptop is malfunctioning, and you believe that some system files are missing or corrupted. Which of the following commands should you use to verify this and, if needed, repair the files? ○ sfc ○ chkdsk ○ xcopy ○ gpupdate

Constant A constant is a specific identifier that contains a value that cannot be changed within the program. For example, the value to convert a number from F to C is always 5/9 because the formula is C = (F -32) * 5/9. A comment is written into the code to help a human understand the initial programmer's logic.

A programmer is writing a script to calculate the temperature in Fahrenheit when it receives input in celsius. The conversion factor used is 5/9. Which of the following would be used to store this fixed conversion factor in the script? ○ Variable ○ Constant ○ Loop ○ Comment

Loop In a loop, the computer repeats the task until a condition is met (often implemented with For or While statements). For example, a short script like (For i=1 to 100, print I, next) would print the numbers from 1 to 100 to the screen.

A programmer is writing a script to display all the numbers from 1 to 100 to the screen. Which of the following should they use in their script? ○ Branch ○ Comment ○ Constant ○ Loop

msconfig.exe System configuration (msconfig.exe) is a system utility to troubleshoot the Microsoft Windows startup processes. MSConfig is used to disable or re-enable software, device drivers, and Windows services that run at startup, or to change boot parameters.

A workstation at Dion Training's office is taking a long time to boot up. Once it finishes booting to the Windows 10 desktop, which of the following tools can a technician use to diagnose and fix the boot issues? ○ resmon.exe ○ msinfo32.exe ○ msconfig.exe ○ perfmon.msc

Schedule scans and run updates The seven steps of the malware removal procedures are (1) Investigate and verify malware symptoms, (2) Quarantine the infected systems, (3) Disable System Restore in Windows, (4) Remediate the infected systems, update anti-malware software, scan the system, and use removal techniques (e.g., safe mode, pre-installation environment), (5) Schedule scans and run updates, (6) Enable System Restore and create a restore point in Windows, and (7) Educate the end user.

What is the FIFTH step of the seven-step malware removal process? ○ Remediate the infected systems ○ Investigate and verify malware symptoms ○ Schedule scans and run updates ○ Enable System Restore and create a restore point in Windows

Enterprise Education Pro A technician can connect to computers running Windows 10 Education, Pro, Pro for Workstations, or Enterprise editions. Remote Desktop is not supported on computers running Windows 10 Home edition and requires third-party software to provide remote assistance to these computers. Remote desktop services (RDS) is used to connect to a remote desktop session host servers or other remote computers, edit an existing remote desktop connection (.rdp) configuration file, and migrate legacy connection files that were created with the client connection manager to the newer .rdp connection file type.

Which editions of Windows 10 can you connect to using Remote Desktop? (Select any) ○ Enterprise ○ Home ○ Education ○ Pro

Administrative Tools The Administrative Tools section of the control panel is used to collect various tools on the computer that are commonly used by system administrators. These tools include computer management, disk defragmentation, disk cleanup, the event viewer, the performance monitor, print management, the registry editor, the resource monitor, services, system configuration, system information, the task scheduler, and others. The Device Manager is used to view and control the hardware attached to the computer. The device manager will highlight a piece of hardware that is not working so that a technician can repair or replace it.

Which of the following Control Panel sections contains various tools like computer management, disk cleanup, print management, and the registry editor? ○ Device Manager ○ System ○ Devices and Printers ○ Administrative Tools

WPS The Wi-Fi Protected Setup (WPS) is a mechanism for auto-configuring a WLAN securely for home users. On compatible equipment, users push a button on the access point and connect adapters to associate them securely. WPS is subject to brute force attacks against the PIN used to secure them, making them vulnerable to attack.

Which of the following wireless technologies allows a wireless device to automatically be configured for a SOHO wireless network with the push of a button? ○ WPA ○ WPS ○ WPA2 ○ WEP

Files over 4 GB cannot be stored on a FAT32 formatted drive Since this file is 4.7 GB in size, it cannot be stored as a single file on the FAT32 hard drive. The file allocation table 32-bit (FAT32) is the 32-bit file system supported by Windows, macOS, and Linux computers. FAT32 can support maximum volume sizes of up to 2 TB and maximum file sizes of up to 4 GB.

You are trying to copy a 4.7 GB file from your Windows laptop to an external hard drive using USB 3. The external hard drive is formatted with FAT32. Every time you attempt this copy, you receive an error. What is MOST likely the issue? ○ Files over 4 GB cannot be stored on a FAT32 formatted drive ○ The laptop must be reformatted as FAT32 to support this transfer ○ USB 3 is too slow to transfer a file this large ○ The external hard drive must be formatted as APFS to support this transfer

RegEdit The registry editor (RegEdit) allows you to view and make changes to system files and programs that you wouldn't be able to access otherwise. The registry is a database made up of hives and keys that control various settings on a Windows system. Incorrectly editing the Registry can permanently damage your computer, so it is important to be very careful when modifying the registry using RegEdit.

Your company wants to ensure that users cannot access USB mass storage devices. You have conducted some research online and found that if you modify the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\UsbStor key, it will prevent USB storage devices from being used. Which of the following tools should you use to modify this key? ○ RDS ○ MSConfig ○ MMC ○ RegEdit

.ps1 If you want to save a series of PowerShell commands in a file to rerun them later, you effectively create a PowerShell script by creating a text file with a .ps1 extension. The file can contain a series of PowerShell commands, with each command appearing on a separate line.

Your coworker is creating a script to run on a Windows server using PowerShell. Which of the following file formats should the script use? ○ .sh ○ .ps1 ○ .bat ○ .py

Worm A worm is a standalone malware computer program that replicates itself to spread to other computers. Often, it uses a computer network to spread itself, relying on security failures on the target computer to access it. A worm can spread on its own, whereas a virus needs a host program or user interaction to propagate itself.

A computer was recently infected with a piece of malware. Without any user intervention, the malware is now spreading throughout the corporate network and infecting other computers that it finds. Which type of malware MOST likely infected these computers? ○ Ransomware ○ Worm ○ Virus ○ Trojan

.sh A shell script is a file that contains a list of commands to be read and executed by the shell in Linux and macOS. A .sh file is used for a shell script and its first line always begins with #!/bin/bash that designates the interpreter. This line instructs the operating system to execute the script. Shell scripts allow you to perform various functions. These functions include automation of commands and tasks of system administration and troubleshooting, creating simple applications, and manipulating text or files.

A coworker is creating a file containing a script. You look over their shoulder and see "#!/bin/bash" as the first line in the file. Based on this, what type of file extension should this script use? ○ .sh ○ .py ○ .bat ○ .vbs

chmod 544 filename The chmod command is used to change a file or directory's permissions from the command line or terminal. A technician can either use u+ to add user permission and g+ to add group permissions, or they can use the octal value. In this case, the octal value of r-wr--r-- is 544. In Linux, you can convert letter permissions to octal by giving 4 for each R, 2 for each W, and 1 for each X. R is for read-only, W is for write, and X is for execute. The permissions strings are written to represent the owner's permissions, the group's permissions, and the other user's permissions.

A file currently has permissions of 755. Which of the following commands would change file permission to r-xr--r--? ○ chmod u-rx,go-r filename ○ chmod u+w,go+x filename ○ chmod r-wr--r-- filename ○ chmod 544 filename

ipconfig /release | ipconfig /renew The ipconfig tool displays all current TCP/IP network configuration values on a given system. The ipconfig also can release and renew a DHCP-received IP on a workstation. The first thing to do is release the IP address using the command ipconfig /release. Next, the technician should dynamically assign another IP address using the command ipconfig /renew. These commands could be each entered individually or combined using the pipe (|) syntax as shown in this question. The ipconfig /all option would be used to display the assigned IP addresses. The ipconfig /renew option would be used to renew an existing DHCP lease and not request a new IP address.

A network technician determines that two dynamically assigned workstations have duplicate IP addresses. What command should the technician use to correct this issue? ○ ipconfig /all ○ ipconfig /release | ipconfig /renew ○ ipconfig /renew ○ ipconfig /dhcp

File Explorer Options The File Explorer Options section of the Control Panel allows technicians to customize the display of files and folders. For example, the File Explorer Options can enable or disable the ability to show hidden files, hide file extensions, and more. General options allow a technician to configure the folders to open in a new window or the same window, to use a single-click or double-click when opening a file or program using its icon, and the ability to show or hide recently used files and folders in the Quick Access pane of the File Explorer window.

A technician is trying to locate a protected .dll file to edit, but they cannot see it in the System32 folder. Which Control Panel utility should the technician use to find the file? ○ Indexing Options ○ Programs and Features ○ System ○ File Explorer Options

Dictionary A dictionary attack uses a list of common passwords to crack a user's password. These lists do not have just dictionary words, though. For example, the word Dr@g0nBr3@+h (dragon breath) may be one such word but rewritten by substituting symbols or numbers for various letters.

An attacker is using a word list that contains 1 million possible passwords as they attempt to crack your Windows password. What type of password attack is this? ○ Rainbow table ○ Brute-force ○ Dictionary ○ Hybrid

Security Groups A security group is a collection of user accounts that can be assigned permissions in the same way as a single user object. Security groups are used when assigning permissions and rights, as it is more efficient to assign permissions to a group than to assign them individually to each user. You can assign permissions to a user simply by adding the user to the appropriate group. In most corporate environments, security groups control access to share drives, mailing lists, and other network resources.

An employee was recently moved from the Human Resources department into the Sales department. Which of the following should you check to ensure they no longer have access to the employee data stored in the Human Resource department share drives? ○ Security Groups ○ Home Folder ○ Credential Manager ○ Group Policy

Line conditioner Line conditioners are used to protect an entire power circuit from under-voltage events and power sags. Line conditioners raise a sag or under-voltage event back to normal levels, but it cannot protect the line from a complete power failure or power outage. These are also known as voltage regulators and power distribution units (PDUs).

Dion Training's offices are frequently experiencing brownouts and sags. Which of the following solutions would protect all of their workstations and servers from these under-voltage events? ○ Surge suppressor ○ Uninterruptible power supply ○ Line conditioner ○ Diesel generator

GPT GPT is a newer way to partition disks that allows partition sizes over the 2 TB limit imposed by MBR. The GUID partition table (GPT) is a modern disk partitioning system allowing large numbers of partitions and very large partition sizes. The GPT is used in modern computers that support the UEFI standard and can support a maximum capacity of up to 9.7 ZB and up to 128 partitions.

Gina just installed a 4 TB HDD into her Windows 10 computer and wants to assign the drive letter "M" to store her media files. Which type of partition should Gina use if she wants to mount the drive as a single partition? ○ ISO ○ GPT ○ FAT32 ○ MBR

Go Full Screen and keep track of how many questions you get wrong. Skip to next card when ready.

Good luck on your exam!

String A string stores a group of characters, such as Hello, PYTHON, or Jason Dion. A string data type usually consumes as much storage as necessary. Each character in the string usually requires 1 byte of storage.

Which of the following data types would be used to store a user's name? ○ Boolean ○ Floating point ○ Integers ○ String

Performance Monitor Windows Performance Monitor can be used to provide real-time charts of system resources or can be used to log information to a file for long-term analysis. By monitoring different resources at different times of the day, you can detect bottlenecks in a system that are causing problems.

You are troubleshooting a computer that is operating slowly. Which of the following tools should you use to troubleshoot this workstation? ○ DxDiag ○ Device manager ○ Task scheduler ○ Performance monitor

64GB For the Windows 11 (64-bit) operating system, the minimum requirements are a dual-core 1 GHz processor, 4 GB of RAM, and at least 64 GB of hard drive space.

What is the minimum amount of storage space required to install Windows 11 (x64) on a device? ○ 16 GB ○ 32 GB ○ 64 GB ○ 20 GB

1 GHz single-core processor For the Windows 10 (32-bit) operating system, the minimum requirements are a 1 GHz processor, 1 GB of RAM, and at least 16 GB of hard drive space. For the Windows 10 (64-bit) operating system, the minimum requirements are a 1 GHz processor, 2 GB of RAM, and at least 20 GB of hard drive space.

What is the minimum processor required to install Windows 10 (x86) on a device? ○ 2 GHz single-core processor ○ 1 GHz dual-core processor ○ 1 GHz single-core processor ○ 2 GHz dual-core processor

On-path attack An on-path attack (formerly known as a man-in-the-middle attack) intercepts communications between two systems. For example, in an HTTP transaction, the target is the TCP connection between client and server. Using different techniques, the attacker splits the original TCP connection into 2 new connections, one between the client and the attacker and the other between the attacker and the server. This often uses IP spoofing to trick a victim into connecting to the attack.

What kind of attack is an example of IP spoofing? ○ SQL injections ○ On-path attack ○ ARP poisoning ○ Cross-site scripting

r-x--xrwx R-X is 5, --X is 1, and RWX is 7. In Linux, you can convert letter permissions to octal by giving 4 for each R, 2 for each W, and 1 for each X. R is for read-only, W is for write, and X is for execute. The permissions strings are written to represent the owner's permissions, the group's permissions, and the other user's permissions.

What permissions would be represented by the octal 517? ○ rwx--xr-x ○ r-x--xrwx ○ r-xrwx--x ○ --xr-xrwx

Branch A branch is used to control the flow within a computer program or script, usually based on some logic condition. Often, these are implemented with IF THEN ELSE statements.

What type of structure is "IF THEN ELSE" in scripting? ○ Variable ○ Loop ○ Branch ○ Constant

Loop A loop deviates from the initial program path to some sort of logic condition. In a loop, the computer repeats the task until a condition is met. Often implemented with For, For Next, While, or Do While statements.

What type of structure is a "Do While" in scripting? ○ Loop ○ Constant ○ Branch ○ Variable

rwx------ RWX is 7 and --- is 0. In Linux, you can convert letter permissions to octal by giving 4 for each R, 2 for each W, and 1 for each X. R is for read-only, W is for write, and X is for execute. The permissions strings are written to represent the owner's permissions, the group's permissions, and the other user's permissions.

What umask should be set for a directory to have 700 as its octal permissions? ○ rwx------ ○ r--r--r-- ○ rwxrwxrwx ○ rwx---rwx

Key fob A key fob is a hardware token that generates a random number code synchronized to a code on the server. The code changes every 60 seconds or so. This is an example of a one-time password. A SecureID token is an example of a key fob that is produced by RSA.

When Jason needs to log in to his bank, he must use a hardware token to generate a random number code automatically synchronized to a code on the server for authentication. What type of device is Jason using to log in? ○ Smart card ○ PIV card ○ Key fob ○ Biometric lock

Primary Primary partitions are limited to only four primary partitions on a system using MBR (Master Boot Record).

When using an MBR, which of the following types of partitions can only have up to four partitions? ○ Swap ○ Logical ○ Extended ○ Primary

Evil twin An evil twin is meant to mimic a legitimate hotspot provided by a nearby business, such as a coffee shop that provides free Wi-Fi access to its patrons. An evil twin is a type of rogue wireless access point that masquerades as a legitimate Wi-Fi access point so that an attacker can gather personal or corporate information without the user's knowledge. This type of attack may be used to steal the passwords of unsuspecting users by monitoring their connections or phishing, which involves setting up a fraudulent website and luring people there.

Which attack utilizes a wireless access point made to look as if it belongs to the network by mimicking the corporate network's SSID to eavesdrop on the wireless traffic? ○ Rogue access point ○ Evil twin ○ Shoulder surfing ○ WEP attack

gpupdate /force The gpupdate command-line tool is used to update the group policy settings on a Windows system. For an administrator to force a background update of all Group Policy settings regardless of whether they have changed, they need to run "gpupdate /force" from the command line.

Which command-line tool and option on a Windows system is used to force a background refresh of all group policy settings on a system? ○ dism /force ○ gpupdate /force ○ gpresult /force ○ sfc /force

net user There are several net command utilities that you can use to view and configure shared resources on a Windows network. The net user command allows system administrators to manage user accounts on Windows PCs. You can use the command to display account information or make changes to user accounts. It can be used, among other things, to enable the inactive administrator account of a Windows system.

Which command-line tool could you use on a Windows system to enable an inactive administrator account? ○ net user ○ gpresult ○ taskkill ○ robocopy

ls The ls command lists the files or directories in the current path on a Linux system. When invoked without any arguments, ls lists the files in the current working directory.

Which command-line tool is used on a Linux system to display a list of the files and directories within the current path? ○ pwd ○ chkdsk ○ sfc ○ ls

NFS The Network File System (NFS) is used to mount remote storage devices into the local file system on a Linux system. It allows you to mount your local file systems over a network and remote hosts to interact with them while mounted locally on the same system.

Which file system type is used to mount remote storage devices on a Linux system? ○ exFAT ○ APFS ○ NTFS ○ NFS

By matching a MAC address to an IP address within the DHCP scope When the client requests an IP address by sending a message on the network to the DHCP server, the DHCP server will assign an IP from its DHCP scope to the client and reserve it based on its MAC address.

Which of the following BEST describes how a DHCP reservation works? ○ By matching a MAC address to an IP address within the DHCP scope ○ By letting the network switches assign IP addresses from a reserved pool ○ By assigning options to the computers on the network by priority ○ By leasing a set of reserved IP addresses according to their category

Mission Control Mission Control is an application for facilitating multiple desktops in the macOS environment. This enables the user to set up one or more desktops with different sets of apps, backgrounds, and so on, which is an easy way of managing tasks more effectively.

Which of the following MacOS features allows you to use multiple desktops or spaces on a single system? ○ Boot Camp ○ Mission Control ○ Dock ○ Finder

USB selective suspend The USB selective suspend feature allows the hub driver to suspend an individual port without affecting the operation of the other ports on the hub. Selective suspension of USB devices is helpful when using a laptop computer as it helps to conserve battery power by powering off USB ports that are not needed at the time.

Which of the following Windows 10 power options will turn off individual devices connected to a laptop to save energy? ○ Hibernate ○ USB selective suspend ○ Fast startup ○ Sleep

resmon.exe Resource monitor (resmon.exe) is a utility used to display information about the use of hardware (CPU, memory, disk, and network) and software (file handles and modules) resources in real-time. The resource monitor helps check the performance counters of specific resources and decide a course of action to improve the performance.

Which of the following Windows tools can a technician use to display information about the performance of hardware and software resources in real-time? ○ msinfo32.exe ○ resmon.exe ○ devmgmt.msc ○ dxdiag.exe

Certificate manager The x.509 format is used to define a public key certificate used by TLS/SSL and other internet protocols. Certificate manager (certmgr.msc) is a utility used to manage digital certificates on a Windows system. The certificate manager can list, search, open, delete, import, and export digital certificates on a computer.

Which of the following Windows tools should a technician use to import and install data in the x.509 format? ○ Certificate manager ○ RDS ○ Device manager ○ Group policy editor

Swap partition The swap partition on a Linux system is a portion of the hard disk formatted with a minimal kind of file system and used in situations when the operating system runs out of physical memory and needs more of it. It can only be used by the memory manager and not for the storage of ordinary data files

Which of the following contains virtual memory that can supplement the physical system memory in a Linux system? ○ ext4 ○ Swap partition ○ NFS ○ ext3

TACACS+ TACACS+ is an extension to TACACS (Terminal Access Controller Access Control System) and was developed as a proprietary protocol by Cisco. The Remote Authentication Dial-In User Service (RADIUS) is a networking protocol that operates on port 1812 and provides centralized Authentication, Authorization, and Accounting management for users who connect and use a network service, but Cisco did not develop it. Kerberos is a network authentication protocol designed to provide strong mutual authentication for client/server applications using secret-key cryptography developed by MIT. Challenge-Handshake Authentication Protocol (CHAP) is used to authenticate a user or network host to an authenticating entity. CHAP is an authentication protocol but does not provide authorization or accounting services.

Which of the following authentication protocols was developed by Cisco to provide authentication, authorization, and accounting services? ○ TACACS+ ○ RADIUS ○ CHAP ○ Kerberos

FIFO Backup The First In First Out (FIFO) backup scheme uses a set number of tapes and overwrites the oldest tape with the newest information. For example, if there are 7 tapes in use, every evening a new backup is conducted over the previous week's daily backup. To have a longer amount of days of backups, a technician simply needs to increase the number of tapes from 7 to 14 or 21.

Which of the following backup rotation schemes overwrites the oldest media with the current backup being performed? ○ Grandfather-father-son ○ FIFO Backup ○ Tower of Hanoi ○ 3-2-1 backup

3-2-1 backup The 3-2-1 backup rule states that an organization should create (3) one primary backup and two copies of the data, (2) save the backups to two different types of media, and (1) keep at least one backup copy off-site.

Which of the following backup rotation schemes requires at least one monthly full backup to be stored safely off-site? ○ FIFO Backup ○ Tower of Hanoi ○ Grandfather-father-son ○ 3-2-1 backup

Tower of Hanoi The Tower of Hanoi is a backup rotation scheme that rotates backup media sets throughout the backup process to minimize wear and failure of tape backup media. For example, when using this method with four backup tapes labeled A, B, C, and D, a total of 16 days of backups can be maintained with just 4 tapes. Tape A is used every odd-numbered day for 16 days. Tape B is used on days 2, 6, 10, and 14. Tape C is used on days 4 and 12. Tape D is used on days 8 and 16. This allows Tape A to be overwritten every other day, while Tapes B is overwritten every four days and Tapes C and D are overwritten every 8 days.

Which of the following backup rotation schemes uses a complex mathematical puzzle to extend the number of unique days of backups stored with the least amount of tapes? ○ FIFO Backup ○ Grandfather-father-son ○ Tower of Hanoi ○ 3-2-1 backup

Grandfather-father-son The grandfather-father-son (GFS) backup rotation scheme is widely used to combine full and incremental backups to reduce backup time and enhance storage security. The grandfather is a full backup that is stored off-site once per month. The father is a weekly full backup that is conducted. The son is an incremental or differential backup conducted each day. For example, each Monday a full backup can be conducted which becomes the father. Then, each day of the week a son is created by performing an incremental or differential backup. Once per month, a full backup is conducted to become the grandfather.

Which of the following backup rotation schemes uses a three-tiered approach to ensure at least one monthly full backup is conducted? ○ Tower of Hanoi ○ FIFO Backup ○ 3-2-1 backup ○ Grandfather-father-son

dd The dd command is used to convert and copy files. On Unix and Unix-like operating systems like Linux, almost everything is treated as a file, even block devices like a hard disk drive. This makes dd useful to clone disks or wipe data from a drive.

Which of the following commands is used on a Linux system to convert and copy files from one hard disk to another? ○ cd ○ ls ○ dd ○ mv

cp The cp command is a command-line utility for copying files and directories. It supports moving one or more files or folders with options for taking backups and preserving attributes. Copies of files are independent of the original file, unlike the mv command. The mv command is a command-line utility that moves files or directories from one place to another. The mv command supports moving single files, multiple files, and directories. The mv command can prompt before overwriting files and will only move files that are newer than the destination. When the mv command is used, the file is copied to the new directory and removed from the old directory. The rm command is a command-line utility for removing files or directories. To remove a file, pass the name of a file or files to the rm command, and those files will be removed immediately from the file system. The ls command lists the files or directories in the current path of a Unix, Linux, or Mac operating system. When invoked without any arguments, ls lists the files in the current working directory.

Which of the following commands is used on a Linux system to copy a file from one directory to another directory? ○ ls ○ rm ○ mv ○ cp

mv The mv command is a command-line utility that moves files or directories from one place to another. The mv command supports moving single files, multiple files, and directories. The mv command can prompt before overwriting files and will only move files that are newer than the destination. When the mv command is used, the file is copied to the new directory and removed from the old directory.

Which of the following commands is used on a Linux system to copy a file to a new directory and then remove the original file from the previous directory? ○ cp ○ rm ○ mv ○ ls

grep The grep is a command-line utility for searching plain-text data sets for lines that match a regular expression. The grep command works on Unix, Linux, and macOS operating systems. Grep is an acronym that stands for Global Regular Expression Print.

Which of the following commands is used on a Linux system to search for lines that match a pattern within a file? ○ vi ○ grep ○ apt-get ○ pwd

su The su command, which stands for substitute user, is used by a computer user to execute commands with the privileges of another user account. When executed, it invokes a shell without changing the current working directory or the user environment. When the command is used without specifying the new user id as a command-line argument, it defaults to using the system's superuser account (user id 0). The command sudo is related and executes a command as another user but observes a set of constraints about which users can execute which other users can execute.

Which of the following commands is used on a Linux system to switch to another user's account? ○ passwd ○ chown ○ ps ○ su

Character A character stores a single character, such as J, D, or Z. A character data type usually consumes one byte (8 bits) of storage. A string stores a group of characters, such as Hello, PYTHON, or JasonDion. A string data type usually consumes as much storage as necessary. Each character in the string usually requires 1 byte of storage. A boolean stores a value of TRUE (1) or FALSE (0). It usually consumes only 1 bit of storage (a zero or a one). An integer stores a whole number, such as 21, 143, or 1024. An integer data type usually consumes 8 bytes of storage.

Which of the following data types would be used to store the user's middle initial? ○ String ○ Boolean ○ Character ○ Integers

TKIP Wi-Fi protected access (WPA) is an improved encryption scheme for protecting Wi-Fi communications designed to replace WEP. WPA uses the RC4 cipher and a temporal key integrity protocol (TKIP) to overcome the vulnerabilities in the older WEP protection scheme. Wired equivalent privacy (WEP) is an older mechanism for encrypting data sent over a wireless connection. WEP is considered vulnerable to attacks that can break its encryption. WEP relies on the use of a 24-bit initialization vector to secure its preshared key. Wi-Fi protected access version 2 (WPA2) replaced the original version of WPA after the completion of the 802.11i security standard

Which of the following encryption types was used by WPA to better secure wireless networks than WEP? ○ TKIP ○ CCMP ○ IV ○ AES

UDF The Universal Disk Format (UDF or ISO 13346) is an updated file system for optical media supporting multisession writing. It is the standard used by Windows, referred to as the Live File System, for CD and DVD recordable and rewritable discs. There are several different versions of UDF, with 2.01 being the default in Windows.

Which of the following file system formatting types should be used with a DVD? ○ CDFS ○ FAT32 ○ NTFS ○ UDF

.js JavaScript is a scripting language that is designed to create interactive web-based content and web apps. The scripts are executed automatically by placing the script in the HTML code for a web page so that when the HTML code for the page loads, the script is run. JavaScript is stored in a .js file or as part of an HTML file.

Which of the following file types are commonly used by scripts in a web page? ○ .sh ○ .js ○ .vbs ○ .ps1

.py Python is a general-purpose programming language that can develop many different kinds of applications. It is designed to be easy to read, and the programs use fewer lines of code compared to other programming languages.

Which of the following file types are commonly used to create applications that can be run on Linux, macOS, and Windows? ○ .ps1 ○ .sh ○ .vbs ○ .py

.bat Batch scripts run on the Windows operating system and, in their simplest form, contain a list of several commands that are executed in a sequence. A .bat file is used for a batch script. You can run the file by calling its name from the command line or double-clicking the file in File Explorer. Generally, batch file scripts run from end to end and are limited in branching and user input. A shell script is a file that contains a list of commands to be read and executed by the shell in Linux and macOS.

Which of the following file types are commonly used to create simple scripts in the Windows command-line environment? ○ .py ○ .sh ○ .js ○ .bat

Image deployment An image deployment is a type of installation that uses a clone of an existing installation stored in an image file to perform the installation. The image can contain the base OS and configuration settings, service packs and updates, applications software, and whatever else is required. An image can be stored on DVD or USB media or can be accessed over a network.

Which of the following installation types would allow a single technician to quickly install Windows 10 Enterprise on 50 workstations simultaneously? ○ Image deployment ○ Refresh install ○ In-place upgrade ○ Repair installation

TFTP The trivial file transfer protocol (TFTP) is a protocol used to get a file from a remote host or put a file onto a remote host. TFTP is commonly used with embedded devices or systems that retrieve firmware, configuration information, or a system image during the boot process. TFTP operates over UDP port 69.

Which of the following is a connectionless protocol that utilizes on UDP? ○ FTP ○ TFTP ○ HTTP ○ HTTPS

PII The four forms of regulated data covered by the exam are PII (Personally Identifiable Information), PCI (Payment Card Industry), GDPR (General Data Protection Regulation), and PHI (Protected Health Information). Personally identifiable information (PII) is data used to identify, contact, or locate an individual. Information such as social security number (SSN), name, date of birth, email address, telephone number, street address, and biometric data is considered PII.

Which of the following is considered a form of regulated data? ○ AUP ○ PII ○ DRM ○ DMCA

Environmental variables Shell scripts and batch files use environment variables to communicate data and preferences to child processes. They can also be used to store temporary values for reference later in a shell script.

Which of the following is used to communicate data and preferences to child processes within a script or batch file? ○ Constants ○ Comments ○ Variables ○ Environmental variables

Subnet mask The subnet mask is used to identify the host identifier and the network identifier uniquely in combination with the IP address. The subnet mask is used by the TCP/IP protocol to determine whether a host is on the local subnet or a remote network.

Which of the following network configurations is used to identify your computer's individual host identifier and your computer's network identifier? ○ WINS ○ DNS ○ Gateway ○ Subnet mask

Thumbprint and password Multi-factor authentication (MFA) requires a user to provide at least two different forms of authentication: something you know (username, password, pin), something you have (token, key fob, smartphone), something you are (fingerprint, retina scan), something you do (the way you speak a phrase or sign your name), or somewhere you are (location factor based on IP address or geolocation).

Which of the following pairs of authentication factors should you choose to meet the requirements associated with MFA? ○ Username and password ○ Username and pin ○ Thumbprint and password ○ Thumbprint and retina scan

TACACS+ TACACS+ is a AAA (accounting, authorization, and authentication) protocol to provide AAA services for access to routers, network access points, and other networking devices. TACACS+ is a remote authentication protocol, which allows a remote access server to communicate with an authentication server to validate user access onto the network. TACACS+ allows a client to accept a username and password, and pass a query to a TACACS+ authentication server.

Which of the following provides accounting, authorization, and authentication via a centralized privileged database, as well as challenge/response and password encryption? ○ Network access control ○ Multi-factor authentication ○ ISAKMP ○ TACACS+

GPO Microsoft's Group Policy Object (GPO) is a collection of Group Policy settings that defines what a system will look like and how it will behave for a defined group of users. A Group Policy is the primary administrative tool for defining and controlling how programs, network resources, and the operating system operate for users and computers in an organization. In an active directory environment, Group Policy is applied to users or computers based on their membership in sites, domains, or organizational units. *HIPS stands for Host-based Intrusion Prevention System*

Which of the following security controls provides Windows system administrators with an efficient way to deploy system configuration settings across many devices? ○ Patch management ○ HIPS ○ GPO ○ Anti-malware

MMC The Microsoft management console (MMC) is a utility that uses snap-ins for various Windows tools such as disk management, computer management, performance monitor, print management, and others to perform operations on a local or networked computer.

Which of the following tools in Windows 10 allows a technician to add different utilities, such as disk management, computer management, performance monitor, print management, and others to create a modular and customized tool kit for the technician to utilize? ○ PerfMon ○ UAC ○ RDS ○ MMC

xcopy The xcopy tool copies all of the files from one directory to another.

Which of the following tools is used to duplicate all of the files in one directory to another in the Windows command line? ○ xcopy ○ netstat ○ format ○ dir

Notepad Browser redirection usually occurs if the browser's proxy is modified or the hosts.ini file is modified. If the redirection occurs only for a small number of sites or occurs in all web browsers on a system, it is most likely a maliciously modified hosts.ini file. The hosts.ini file is a local text file that allows a user to specify specific domain names to map to particular addresses. It can be edited using any basic text editor, such as notepad. It works as an elementary DNS server and can redirect a system's internet connection.

Which of the following tools should a technician use to modify the HOSTS file on a Windows 10 system to solve a website address resolution issue? ○ MMC ○ Services ○ Notepad ○ Regedit

Spoofing Spoofing is often used to inject the attacker into the conversation path between the two parties. Spoofing is the act of disguising a communication from an unknown source as being from a known, trusted source. An on-path attack is an attack where the attacker secretly relays and possibly alters the communications between two parties who believe they are directly communicating with each other. The attacker makes independent connections with the victims and relays messages between them to make them believe they are talking directly to each other over a private connection. The attacker will intercept all relevant messages passing between the two victims and inject new ones.

Which of the following types of attacks are usually used as part of an on-path attack? ○ Spoofing ○ Tailgating ○ DDOS ○ Brute force

Differential A differential backup only creates a copy of the selected data that has been modified since the last full backup.

Which of the following types of backups only copies data modified since the last full backup? ○ Full ○ Differential ○ Synthetic ○ Incremental

Open An "open" wireless network is one in which no password or encryption is being used. If you have a public hotspot, such as in a library or coffee shop, then you may wish to configure it as "open."

Which of the following types of encryption should be selected on a SOHO access point if you are running a coffee shop and want all of your customers to be able to join it by default? ○ WPA ○ Open ○ WEP ○ WPA2

Firmware Updates The Windows Update program can download critical fixes, security patches, and driver updates. The Windows Update program cannot download and install firmware updates because the firmware must be updated before the Windows operating system begins running during the boot process.

Which of the following types of software CANNOT be updated via the Windows Update program? ○ Critical fixes ○ Driver updates ○ Firmware updates ○ Security patches

Unattended An unattended installation is a traditional method of deploying a Windows operating system in a large enterprise environment. Unattended installations use an answer file that contains user input to various GUI dialog boxes that would otherwise appear during the installation process. Unattended installation is the most practical way to install Windows when the client computers have different hardware components, and an image file cannot be used. Unattended installations save deployment time and can be used either for clean installs or in-place upgrades.

Which type of installation would require an answer file to install the operating system? ○ Clean ○ Repair ○ Unattended ○ Upgrade

sfc The system file checker (SFC) command is a utility in Windows that allows users to scan for and restore corrupted Windows system files from the command line. System files (and shared program files) are maintained and version-controlled in the WINSxS system folder. Since the File Explorer is part of the Windows 10 operating system files, it would be repaired or replaced by running the system file checker (SFC).

While troubleshooting the reason that the File Explorer is crashing on a Windows 10 machine, you determine that some of its files may have become corrupt. Which of the following utilities should you use to correct this? ○ sfc ○ regedit ○ dxdiag ○ gpupdate

Missing patches Missing patches are the most common vulnerability found on both Windows and Linux systems. When a security patch is released, attackers begin to reverse engineer the security patch to exploit the vulnerability. If your servers are not patched against the vulnerability, they can become victims of the exploit, and the server's data can become compromised. Cross-Site Scripting (XSS) attacks are a type of injection in which malicious scripts are injected into otherwise benign and trusted websites. Cross-site scripting focuses on exploiting a user's workstation, not a server. CRLF injection is a software application coding vulnerability that occurs when an attacker injects a CRLF character sequence where it is not expected. SQL injection is the placement of malicious code in SQL statements via web page input. SQL is commonly used against databases, but they are not useful when attacking file servers.

Windows file servers commonly hold sensitive files, databases, passwords, and more. What common vulnerability is usually used against a Windows file server to expose sensitive files, databases, and passwords? ○ CRLF injection ○ Cross-site scripting ○ SQL injection ○ Missing patches

tracert The tracert (trace route) diagnostic utility determines the route to a destination by sending Internet Control Message Protocol (ICMP) echo packets to the destination. In these packets, tracert uses varying IP Time-To-Live (TTL) values. When the TTL on a packet reaches zero (0), the router sends an ICMP "Time Exceeded" message back to the source computer. The ICMP "Time Exceeded" messages that intermediate routers send back show the route.

You are troubleshooting a network connectivity issue and need to determine the packet's flow path from your system to the remote server. Which of the following tools would best help you identify the path between the two systems? ○ tracert ○ ipconfig ○ netstat ○ nbtstat

MSDS The Material Safety Data Sheet (MSDS) is a document that contains information on the potential hazards (health, fire, reactivity, and environmental) and how to work safely with the chemical product. The MSDS is an essential starting point for the development of a complete health and safety program that includes the directions for proper handling and disposal of the chemicals.

You are cleaning out the closet in your office and find several bottles of cleaner that need to be disposed of. Which of the following should you consult to determine the proper method of disposal? ○ SOW ○ MOU ○ UPS ○ MSDS

NAT Network address translation (NAT) is a network service provided by a router or proxy server to map private local addresses to one or more publicly accessible IP addresses. NAT can use static mappings but is commonly implemented as network port address translation (PAT) or NAT overloading, where a few public IP addresses are mapped to multiple LAN hosts using port allocations.

You are configuring a SOHO network that will contain 7 devices, but you only have a single public IP address. Which of the following concepts should be configured to allow the 7 devices to share that single IP when connecting to the internet? ○ NAT ○ UPnP ○ DHCP ○ Perimeter network

exFAT The only file system format that would work for this situation is exFAT. A macOS system can format a hard drive as APFS, HFS+, HFS, exFAT, or FAT32. The Windows system would only be able to read exFAT or FAT32. Unfortunately, FAT32 only supports drive sizes up to 32 GB, and file sizes up to 4 GB. Therefore, exFAT should be used as it supports sizes up to 128 petabytes.

You are formatting a 4 TB external hard drive on your MacBook. The drive will be used to share files large video files between your MacBook and your friend's Windows 10 desktop. Which file format should you use? ○ NTFS ○ exFAT ○ HFS ○ FAT32

Network topology diagrams A network topology is the shape or structure of a network in a physical or logical format as depicted in a network diagram. Physical network topologies include the actual appearance of the network layout. Logical network topologies include the flow of data across the network.

You are installing a new firewall for a corporate network. Which of the following documents should you update FIRST? ○ Incident database ○ Network topology diagrams ○ Knowledge base articles ○ Password policy

4 Partitioning is the act of dividing a physical disk into logically separate storage areas, often referred to as drives. Each partition can be formatted with any file system type. Since there are 4 distinct partitions on this single hard drive, it can support up to 4 different file systems.

You are partitioning a 1 TB hard drive on a new workstation. The hard disk has been partitioned into four different partitions with 100 GB, 150 GB, 250 GB, and 500 GB. How many different file system types could you support on this 1 TB hard drive? ○ 1 ○ 4 ○ 2 ○ 3

- Disconnect the laptop from the network - Disable System Restore in Windows - Update the anti-malware software The seven steps of the malware removal procedures are (1) Investigate and verify malware symptoms, (2) Quarantine the infected systems, (3) Disable System Restore in Windows, (4) Remediate the infected systems, update anti-malware software, scan the system, and use removal techniques (e.g., safe mode, pre-installation environment), (5) Schedule scans and run updates, (6) Enable System Restore and create a restore point in Windows, and (7) Educate the end user.

You are troubleshooting a Windows 10 laptop that is infected with malware. You have already identified the type of malware on the laptop. What should you do NEXT? (Select THREE) ○ Disconnect the laptop from the network ○ Schedule scans and run system updates ○ Disable System Restore in Windows ○ Enable System Restore in Windows ○ Educate the end user ○ Update the anti-malware software

netstat The netstat command is used to display active TCP connections, ports on which the computer is listening, Ethernet statistics, the IP routing table, IPv4 statistics (for the IP, ICMP, TCP, and UDP protocols), and IPv6 statistics (for the IPv6, ICMPv6, TCP over IPv6, and UDP over IPv6 protocols) on a Windows machine. This is a useful command when determining if any malware has been installed on the system and maybe maintaining a remote connection with a command and control server.

You are troubleshooting an issue with a Windows desktop and need to display the machine's active TCP connections. Which of the following commands should you use? ○ netstat ○ ipconfig ○ ping ○ net use

Degaussing of the HDDs The best option is to use degaussing on the hard drives. Degaussing exposes the disk to a powerful electromagnet that disrupts the magnetic pattern that stores the data on the disk surface. This renders the data on the disk inaccessible, but the disk will become unusable for other purposes. If the drive needs to be reused, repurposed, or recycled, you should not use degaussing. If the drive contains sensitive or classified information, then it should be degaussed or shredded.

You are working as a military defense contractor and have been asked to dispose of 5 laptop hard drives used in systems that processed classified information. Which of the following physical data destruction and disposal methods is MOST appropriate to ensure the data cannot be recovered? ○ Low-level formatting of the HDDs ○ Degaussing of the HDDs ○ Drill/hammer the HDD platters ○ Standard formatting of the HDDs

Smart card A smart card is used in applications that need to protect personal information and/or deliver fast, secure transactions, such as transit fare payment cards, government, and corporate identification cards, documents such as electronic passports and visas, and financial payment cards. Often, smart cards are used as part of a multifactor authentication system in which the smart card and a PIN need to be entered for system authentication to occur.

You are working for a government contractor who requires all users to use a PIV device when sending digitally signed and encrypted emails. Which of the following physical security measures is being implemented? ○ Cable lock ○ Smart card ○ Key fob ○ Biometric reader

chkdsk The chkdsk command is used to check the file system and file system metadata of a volume for logical and physical errors. If used without parameters, chkdsk displays only the status of the volume and does not fix any errors. If used with the /f, /r, /x, or /b parameters, it fixes errors on the volume. The format command creates a new root directory and file system for the disk. It can check for bad areas on the disk, and it can delete all data on the disk. To use a new disk, you must first use the format command to format the disk. The diskpart command is a command-line disk-partitioning utility available for Windows that is used to view, create, delete, and modify a computer's disk partitions. The ipconfig tool displays all current TCP/IP network configuration values on a given system.

You are working on a Windows 10 workstation with a 1 TB HDD and 16 GB of memory that is operating slowly when reading large files from its storage device. Which of the following commands should you use to speed up this workstation? ○ format ○ ipconfig ○ diskpart ○ chkdsk

String A string stores a group of characters, such as Hello, PYTHON, or JasonDion. A string data type usually consumes as much storage as necessary. Each character in the string usually requires 1 byte of storage.

You are writing a script that will take an employee's name as the input. Which of the following data types would the employee's name be stored in? ○ Integer ○ Boolean ○ String ○ Float

bootrec /fixboot To repair the drive's boot sector, you should use the command "bootrec /fixboot" and reboot the computer.

You attempt to boot a Windows 10 laptop and receive an "Operating System Not Found" error on the screen. You can see the hard disk listed in the UEFI/BIOS of the system. Which of the following commands should you use to repair the boot sector of the hard disk? ○ diskpart list ○ bootrec /fixmbr ○ bootrec /fixboot ○ bootrec /rebuildbcd

bootrec /fixmbr The master boot record (MBR) is the first 512-byte sector on a hard disk. It contains the partitioning information for a drive. To repair the master boot record (MBR), you should use the command "bootrec /fixmbr" and reboot the computer. If the disk cannot be detected, enter the system setup and try modifying settings (or even resetting the default settings). If the system firmware reports the disk's presence, but Windows still will not boot, use a startup repair tool to open a recovery mode command prompt and use the bootrec tool to repair the drive's boot information.

You attempt to boot a Windows 10 laptop and receive an "Operating System Not Found" error on the screen. You can see the hard disk listed in the UEFI/BIOS of the system. Which of the following commands should you use to repair the first 512-byte sector on the hard disk? ○ bootrec /rebuildbcd ○ diskpart list ○ bootrec /fixboot ○ bootrec /fixmbr

Disk Management The disk management tool is used to display the drive status, mount the drive, initialize the drive, and create/split/extend/shrink drive partitions. The DxDiag (DirectX Diagnostic) utility is used to collect info about devices to help troubleshoot problems with DirectX sound and video. It is a diagnostics tool used to test DirectX functionality and troubleshoot video-related or sound-related hardware problems. DirectX Diagnostic can save text files with the scan results. The disk defragmenter utility is used to rearrange fragmented data so that disks and drives can operate more efficiently. Disk defragmenter runs on a schedule, but can also analyze and defragment disks and drives manually. The dd command is a Linux utility that is used to copy and convert raw data from one source to another such as a hard disk to an image file.

You have been asked to install a new hard drive in a Windows 10 system. You have already installed the hard drive and booted the system up. Which tool should you use to create the new partitions on the hard drive? ○ dd ○ Disk Defragmenter ○ Disk Management ○ DxDiag

PHI Protected health information (PHI) refers to medical and insurance records, plus associated hospital and laboratory test results. Data collected by genetic mapping and heredity companies include the subject's DNA, making it PHI. Personally identifiable information (PII) is data that can be used to identify, contact, or locate an individual.

You have decided to have DNA genetic testing and analysis performed to determine your exact ancestry composition and possibly find some lost relatives through their database. Which of the following types of data should this be classified? ○ CUI ○ PII ○ PHI ○ IP

Maintain the chain of custody The chain of custody is the chronological documentation or paper trail that records the sequence of custody, control, transfer, analysis, and disposition of physical or electronic evidence. The chain of custody must be maintained from when you arrived at the laptop until you turn it over to law enforcement officials. As first responders, our job is to collect the evidence and maintain the chain of custody.

You have discovered that an employee has been conducting illegal activities using his workplace computer. You have taken possession of the employee's laptop according to your company's procedures and are waiting to give it to law enforcement authorities. What should you do when turning over the laptop to the police? ○ Document the changes ○ Preserve the evidence ○ Maintain the chain of custody ○ Quarantine the system

GDPR The General Data Protection Regulation (GDPR) is a regulation created in the European Union that creates provisions and requirements to protect the personal data of European Union (EU) citizens. Transfers of personal data outside the EU Single Market are restricted unless protected by like-for-like regulations, such as the US's Privacy Shield requirements.

Your company is expanding its operations in the European Union and is concerned about additional governmental regulations that may apply. Which of the following regulations applies when processing personal data within the European Union? ○ PHI ○ PCI ○ PII ○ GDPR

RADIUS With RADIUS and SSO configured, users on the network can provide their user credentials one time when they initially connect to the wireless access point or another RADIUS client and are then automatically authenticated to all of the network's resources. The Remote Authentication Dial-in User Service (RADIUS) is used to manage remote and wireless authentication infrastructure. Users supply authentication information to RADIUS client devices, such as wireless access points. The client device then passes the authentication data to an AAA (Authentication, Authorization, and Accounting) server that processes the request.

Your company wants to provide a secure SSO solution for accessing both the corporate wireless network and its network resources. Which of the following technologies should be used? ○ WPA2 ○ RADIUS ○ WPS ○ WEP