1. A technician is submitting a change request to migrate a company's email server to a new platform. Which of the following should be included in the request to properly evaluate the potential effects of the change before approval?
Operational Procedures
A.A risk analysis and impact assessment describing potential effects on users and systems
B.A purchase order number for the new server hardware
C.A marketing announcement schedule for the new email platform
D.A list of end-user passwords that will need to be reset
Show answerAnswer
A. A risk analysis and impact assessment describing potential effects on users and systems
A proper change request must include a risk analysis and impact assessment so decision-makers can weigh potential downtime, compatibility issues, and business effects before approving the change. Purchase orders, marketing schedules, and password lists are unrelated to evaluating the technical and operational risk of the change itself.
2. A user receives an urgent-looking email claiming to be from their bank, stating that their account has been compromised and they need to click a link to verify their details immediately. The email contains a generic greeting, several grammatical errors, and the link points to a suspicious-looking URL. Which social engineering technique is being employed?
Security
A.Whaling
B.Vishing
C.Smishing
D.Phishing
Show answerAnswer
D. Phishing
Phishing is a social engineering attack that uses fraudulent emails, messages, or websites to trick individuals into revealing sensitive information, often characterized by urgency, generic greetings, and suspicious links.
3. A user's Android smartphone can make and receive phone calls and SMS text messages normally, but picture messages (MMS) fail to send or download over cellular data. Wi-Fi calling and internet browsing work fine. Which of the following is the MOST likely cause?
Software Troubleshooting
A.Incorrect APN (Access Point Name) settings
B.The device has exceeded its app permission limits
C.A malware infection on the device
D.A corrupted mobile OS update
Show answerAnswer
A. Incorrect APN (Access Point Name) settings
MMS relies on carrier-specific APN settings for its message center (MMSC) address, proxy, and port, separate from general data browsing. Incorrect or missing MMS-related APN settings commonly cause calls/SMS/data to work while MMS fails.
4. A technician is troubleshooting a Windows 11 desktop that takes over five minutes to reach the login screen after a normal shutdown. Task Manager shows several third-party applications with a 'High' startup impact rating. Which action should the technician take FIRST to improve boot performance?
Software Troubleshooting
A.Increase the page file size
B.Disable the high-impact startup applications in Task Manager
C.Replace the hard drive with a solid-state drive
D.Reinstall the operating system
Show answerAnswer
B. Disable the high-impact startup applications in Task Manager
Disabling unnecessary startup applications is a quick, no-cost first step that directly reduces the number of programs loading at boot. Reinstalling the OS, replacing hardware, or adjusting virtual memory are more invasive and should only be considered if simpler fixes fail.
5. A user needs to encrypt an entire external hard drive on their Windows 10 Pro workstation to protect sensitive data. Which built-in Windows feature should the technician recommend for this purpose?
Operating Systems
A.Storage Spaces
B.Windows Defender Firewall
C.BitLocker
D.Encrypting File System (EFS)
Show answerAnswer
C. BitLocker
BitLocker is the full-disk encryption feature included in Windows Pro and Enterprise editions. It allows users to encrypt entire volumes, including external drives, providing strong data protection.
6. A network administrator configures domain user accounts to automatically lock for 30 minutes after five consecutive incorrect password attempts. Which security concept does this configuration implement?
Software Troubleshooting
A.Screen lock timeout
B.Account lockout policy
C.Password complexity requirements
D.Multifactor authentication
Show answerAnswer
B. Account lockout policy
An account lockout policy locks an account after a defined number of failed login attempts, mitigating brute-force password guessing attacks. Password complexity and MFA are separate controls, and screen lock timeout addresses idle device exposure, not repeated failed logins.
7. A technician needs to perform a clean installation of Windows 11 on a new solid-state drive (SSD) that will be used for a high-performance workstation. The drive is currently unallocated. What is the minimum number of partitions that Windows 11 typically creates during a clean installation on a UEFI-based system?
Operating Systems
A.3
B.1
C.2
D.4
Show answerAnswer
D. 4
On a UEFI-based system, a clean installation of Windows 11 typically creates four partitions: the Recovery Partition, the EFI System Partition (ESP), the Microsoft Reserved Partition (MSR), and the Windows (OS) Partition.
8. A system administrator needs to securely erase data from several solid-state drives (SSDs) that previously held highly confidential information. The company policy requires data destruction methods that make data unrecoverable, even with advanced forensic techniques. Which method is MOST appropriate for SSDs?
Security
A.Degaussing
B.Secure Erase (ATA Secure Erase)
C.Standard formatting
D.Physical destruction
Show answerAnswer
D. Physical destruction
For SSDs containing highly confidential data where unrecoverability is paramount, physical destruction is the most reliable method. While Secure Erase is effective, physical destruction guarantees data cannot be recovered, even if the Secure Erase process theoretically fails or is incomplete.
9. A small office manager wants to implement a physical security measure to prevent unauthorized individuals from entering the server room by simply following an authorized employee through a door that requires badge access. Which physical security control would be MOST effective in mitigating this specific threat?
Security
A.Security guard
B.Biometric scanner
C.Alarm system
D.Mantrap
Show answerAnswer
D. Mantrap
A mantrap (or access control vestibule) is specifically designed to prevent 'tailgating' or 'piggybacking,' where an unauthorized person follows an authorized person into a secure area. It consists of two doors, where one must close before the other can open, allowing only one person to pass at a time. This directly addresses the described threat.
10. A company policy requires that all confidential data stored on mobile devices must be securely erased if the device is lost or stolen. Additionally, the IT department needs to be able to enforce screen lock settings and manage application installations centrally. Which mobile device management (MDM) capability directly addresses these requirements?
Security
A.Device Provisioning
B.Application Management
C.Remote Wipe
D.Geolocation
Show answerAnswer
C. Remote Wipe
Remote Wipe is an MDM feature that allows an administrator to remotely erase all data from a lost or stolen device, fulfilling the requirement for secure data erasure. While application management and screen lock settings are also MDM capabilities, Remote Wipe specifically addresses the critical need for data destruction on a compromised device.
11. A system administrator is setting up a new Linux server that will act as a web server and file server. The administrator needs a file system that supports journaling, large file sizes, and is widely compatible with most Linux distributions. Which file system best meets these requirements?
Operating Systems
A.ext4
B.FAT32
C.APFS
D.NTFS
Show answerAnswer
A. ext4
ext4 is the default and most widely used journaling file system for Linux distributions. It supports large file sizes and volumes, providing robust data integrity suitable for servers.
12. A small business owner wants to secure their Wi-Fi network. They have several smart devices (IoT) that only support older Wi-Fi security protocols, but their new business laptops support the latest standards. To provide the best possible security for all devices while maintaining compatibility, which Wi-Fi security mode should be configured on their access point?
Security
A.WPA3-Personal
B.WPA2/WPA3-Personal Transition Mode
C.WPA2-PSK
D.WEP
Show answerAnswer
B. WPA2/WPA3-Personal Transition Mode
WPA2/WPA3-Personal Transition Mode (or Mixed Mode) allows an access point to simultaneously support both WPA2 and WPA3 clients. This enables older devices (like IoT) to connect using WPA2, while newer devices (laptops) can utilize the stronger WPA3 security, providing compatibility and enhanced security where possible.
13. A technician is troubleshooting a Windows 10 desktop that fails to boot, displaying the error message 'Invalid Partition Table'. The technician has confirmed that the physical drive is detected in the BIOS/UEFI. Which command-line utility should be used to attempt to resolve this specific boot error?
Software Troubleshooting
A.bootrec /fixmbr
B.sfc /scannow
C.format C:
D.chkdsk /r
Show answerAnswer
A. bootrec /fixmbr
The 'Invalid Partition Table' error usually indicates a problem with the Master Boot Record (MBR) on older BIOS-based systems or an issue with the partition table itself. The `bootrec /fixmbr` command can rewrite the MBR, which often resolves this specific boot error without affecting the partition table or data.
14. A small business uses several macOS workstations. A user reports that their Mac is running extremely slowly, and applications frequently become unresponsive. The technician suspects a runaway process consuming excessive system resources. Which macOS utility should the technician use to identify and potentially terminate such a process?
Operating Systems
A.System Information
B.Console
C.Disk Utility
D.Activity Monitor
Show answerAnswer
D. Activity Monitor
Activity Monitor is the macOS equivalent of Windows Task Manager. It provides real-time information about CPU, memory, energy, disk, and network usage, allowing technicians to identify and terminate runaway processes.
15. A Windows 10 PC free of malware experiences frequent application crashes. A technician suspects a corrupted protected system file is the cause. Which command should the technician run FIRST to attempt an automatic repair?
Software Troubleshooting
A.dism /online /cleanup-image /restorehealth
B.bootrec /fixboot
C.chkdsk /f
D.sfc /scannow
Show answerAnswer
D. sfc /scannow
The System File Checker (sfc /scannow) scans and repairs corrupted protected system files using a locally cached copy. DISM is typically used afterward only if SFC cannot repair the files because the local component store is also damaged.
16. A technician needs to dispose of a container of used printer toner. Before disposing of it, the technician should consult which document to determine proper handling and disposal procedures?
Operational Procedures
A.Service level agreement
B.Safety data sheet
C.Incident response plan
D.Acceptable use policy
Show answerAnswer
B. Safety data sheet
A Safety Data Sheet (SDS) provides information about a hazardous material's properties, health hazards, and proper handling, storage, and disposal procedures, including for items like toner.
17. A technician confirms that a workstation is infected with malware after a user reported unusual pop-ups and slow performance. According to malware removal best practices, which of the following should the technician do immediately after investigating and verifying the malware symptoms?
Software Troubleshooting
A.Educate the end user
B.Disable System Restore
C.Quarantine the infected system by disconnecting it from the network
D.Schedule automatic scans
Show answerAnswer
C. Quarantine the infected system by disconnecting it from the network
After confirming an infection, the next best-practice step is to quarantine the system by isolating it from the network to prevent the malware from spreading to other devices before remediation begins.
18. A user is attempting to transfer a large number of files and directories, including empty subdirectories and NTFS permissions, from one network share to another. The transfer needs to be robust, capable of resuming interrupted transfers, and provide detailed logging. Which command-line utility is best suited for this task?
Operating Systems
A.copy
B.move
C.robocopy
D.xcopy
Show answerAnswer
C. robocopy
Robocopy (Robust File Copy) is specifically designed for robust file copying, including features like resuming interrupted transfers, copying NTFS permissions, and detailed logging, making it superior to xcopy or copy for complex scenarios.
19. A company's remote employees connect to internal file servers using RDP directly exposed to the internet on port 3389. A security audit recommends reducing this exposure while still allowing remote access. Which solution should be implemented?
Operational Procedures
A.Require employees to connect through a VPN to establish an encrypted tunnel before using RDP
B.Allow RDP access only during standard business hours
C.Change the RDP listening port to a random high-numbered port
D.Disable RDP authentication prompts to speed up login
Show answerAnswer
A. Require employees to connect through a VPN to establish an encrypted tunnel before using RDP
Requiring a VPN connection before RDP access ensures traffic is encrypted and authenticated at the network layer, greatly reducing the attack surface exposed directly to the internet. Simply changing ports or restricting hours does not eliminate the risk of direct exposure, and disabling authentication would make the system less secure.
20. A system administrator is configuring security for a new file server. They want to ensure that files stored on the server are protected at rest and that the entire volume is encrypted, even if the physical drive is removed from the server. Which Windows feature should the administrator implement to meet this requirement?
Security
A.Windows Defender
B.BitLocker
C.NTFS Permissions
D.Encrypting File System (EFS)
Show answerAnswer
B. BitLocker
BitLocker is Windows' full-disk encryption feature that encrypts an entire volume, protecting all data at rest. If the drive is removed from the server and placed into another system, the data remains encrypted and inaccessible without the correct decryption key, fulfilling the requirement for protection even if the physical drive is removed.
21. A user receives an email that appears to be from their bank, stating there's a security alert on their account and asking them to click a link to verify their details. The email contains the bank's logo and a seemingly legitimate sender address. However, the technician notices a slight misspelling in the domain name of the link provided. What type of social engineering attack is this?
Security
A.Pretexting
B.Baiting
C.Phishing
D.Vishing
Show answerAnswer
C. Phishing
Phishing is a social engineering attack that attempts to trick users into revealing sensitive information, usually via email, by impersonating a trustworthy entity. The scenario describes an email impersonating a bank, asking for credentials via a malicious link with a misspelled domain, which is a classic phishing tactic.
22. A technician is preparing a bootable USB drive to install a custom Linux distribution on multiple identical systems. The distribution image needs to be copied to the USB drive in a way that makes it bootable and preserves the exact disk image structure, including partitions and bootloader. Which command-line utility in Linux is best suited for this task?
Operating Systems
A.dd
B.tar
C.mv
D.cp
Show answerAnswer
A. dd
The 'dd' command (disk duplicator) is a powerful low-level utility in Linux used for converting and copying files, often block-by-block. It is ideal for creating bootable USB drives from disk images (like .iso or .img files) because it copies the image directly to the raw device, preserving partition tables, boot sectors, and file system structures exactly as they are in the source image.
23. A user reports that their Windows 11 computer is frequently displaying a blue screen of death (BSOD) and restarting unexpectedly. The technician suspects a driver issue. Which command-line tool would be most appropriate to analyze the crash dump files for diagnostic information?
Operating Systems
A.mdsched.exe
B.dumpchk
C.verifier
D.chkdsk
Show answerAnswer
B. dumpchk
The dumpchk command is specifically designed to verify the integrity of a crash dump file. Analyzing these files is crucial for diagnosing the root cause of BSODs, often pointing to problematic drivers or hardware.
24. A network administrator wants to upgrade the firmware on a critical firewall during business hours. According to standard change management practices, which of the following should occur BEFORE the change is implemented?
Operational Procedures
A.The change should be approved by the change advisory board (CAB)
B.The technician should proceed immediately since firmware updates are considered low risk
C.The vendor should be notified only after the update finishes
D.The change should be documented after it has been completed
Show answerAnswer
A. The change should be approved by the change advisory board (CAB)
Formal change management requires review and approval by a change advisory board (or designated authority) before implementation to assess risk, scheduling, and impact. Documenting after the fact or acting without approval bypasses the control process meant to prevent outages.
25. A server's data must be restored after a failure. Backups were performed as follows: a full backup every Sunday, and an incremental backup every other day of the week. The server failed on Thursday morning before that day's backup ran. In what order should the technician restore the backups?
Operational Procedures
A.Restore only Wednesday's incremental backup
B.Restore Wednesday's incremental backup, then Sunday's full backup
C.Restore Sunday's full backup, then Monday, Tuesday, and Wednesday incrementals in chronological order
D.Restore Sunday's full backup, then Wednesday's incremental backup only
Show answerAnswer
C. Restore Sunday's full backup, then Monday, Tuesday, and Wednesday incrementals in chronological order
Incremental backups only contain data changed since the last backup (full or incremental). To fully restore, you must apply the full backup first, then each subsequent incremental in chronological order (Mon, Tue, Wed) to rebuild all changes.
A required component of a change request that identifies potential risks, impacts, and mitigation plans associated with a proposed change before it is approved.
Helps decision-makers weigh benefits vs. risks
Should address scope, affected systems, and downtime
Works alongside rollback/backout plans in change documentation
Phishing is a type of social engineering attack where an attacker attempts to trick individuals into revealing sensitive information, such as usernames, passwords, or credit card details, by disguising as a trustworthy entity in electronic communication.
Most commonly delivered via email.
Often uses urgency, fear, or curiosity to manipulate victims.
Indicators include generic greetings, grammatical errors, and suspicious URLs.
A full-disk encryption feature available in Microsoft Windows Pro, Enterprise, and Education editions, designed to protect data by encrypting entire volumes.
Encrypts entire hard drives or removable drives.
Requires a Trusted Platform Module (TPM) for seamless boot protection, but can be used without TPM via USB startup key or password.
Provides protection against unauthorized data access if a device is lost or stolen.
A security setting that disables sign-in to an account for a period (or until admin reset) after a specified number of consecutive failed password attempts, mitigating brute-force attacks.
Configured via Group Policy on domains
Includes lockout threshold and duration
Reduces effectiveness of automated password guessing
Physical destruction for SSDs involves rendering the storage media unusable by methods such as shredding, crushing, or incineration, ensuring that data is absolutely unrecoverable.
The most secure method for data destruction on SSDs, especially for highly sensitive data.
Prevents any possibility of data recovery, even with advanced forensic tools.
Methods include shredding, pulverizing, or melting the drive.
A physical security control consisting of a small room with two interlocking doors, where one door must close and lock before the other can be opened, ensuring only one person can pass through at a time.
Primarily used to prevent tailgating/piggybacking.
Often found in high-security areas like data centers or server rooms.
Can be integrated with biometric or badge access systems.
A mobile device management (MDM) feature that allows an administrator or device owner to remotely delete all data from a lost or stolen mobile device, ensuring that sensitive information does not fall into the wrong hands.
Deletes all data from a mobile device remotely
Used for lost or stolen devices
Prevents unauthorized access to sensitive information
A Wi-Fi security mode that allows an access point to simultaneously support both WPA2-Personal and WPA3-Personal clients. This enables backward compatibility for older devices while providing enhanced security for newer, WPA3-capable devices.
Supports both WPA2 and WPA3 clients
Ideal for mixed environments with old and new devices
Maintains compatibility while improving security for WPA3-capable devices
The `bootrec` command-line utility, specifically `/fixmbr`, is used to repair issues with the Master Boot Record (MBR) or boot sector, which can prevent a system from booting.
Accessed from Windows Recovery Environment (WinRE).
`/fixmbr` rewrites the MBR without overwriting partition table information.
`/fixboot` writes a new boot sector to the system partition.
A utility in macOS that displays real-time information about all processes running on the system, including CPU, memory, energy, disk, and network usage.
Similar to Windows Task Manager.
Allows users to identify resource-intensive processes.
Can be used to quit or force quit unresponsive applications and processes.
A document that provides detailed information about a hazardous material, including handling, storage, and disposal procedures, formerly known as an MSDS.
Required for hazardous materials like toner and batteries
Provides first aid and spill response information
Should be kept accessible where hazardous materials are used
A powerful command-line utility for copying files and directories in Windows, known for its robustness, advanced features, and ability to handle complex transfer scenarios.
Can mirror directory trees.
Copies NTFS permissions, timestamps, and attributes.
Supports resuming interrupted transfers and detailed logging.
A VPN creates an encrypted tunnel between a remote user and the internal network, reducing the risk of exposing remote access protocols like RDP directly to the internet.
VPN should be established before RDP session begins
Direct internet-exposed RDP is a common attack vector
A low-level, powerful command-line utility in Unix-like operating systems used for converting and copying files, often block-by-block, making it ideal for creating bootable media or backing up entire disks.
Performs a raw, bit-for-bit copy of data.
Used for creating bootable USB drives from .iso or .img files.
Can be used for disk imaging, cloning, and wiping drives.
A restore process for incremental backups that requires restoring the last full backup first, followed by every incremental backup taken since, in chronological order.
Incremental backups only capture changes since the last backup of any type
Restore order: full backup, then each incremental in sequence
Faster to back up, but slower/more complex to restore than differential
Questions are original practice items written to match the published exam objectives. Step2Study is not affiliated with or endorsed by any certification body.