CSLB General Building (B) — All Questions

Which Windows edition is designed for large enterprises and is the only one that supports joining an on-premises Active Directory domain as well as BitLocker, but is licensed through volume agreements rather than retail?

• a.Windows Home
• b.Windows Education
• c.Windows Enterprise✓
• d.Windows Pro for Workstations

Windows Enterprise is aimed at large organizations and is distributed through volume licensing rather than retail. It supports domain join, BitLocker, and advanced management features. Home lacks domain join and BitLocker.

A technician needs to open an elevated Command Prompt to run a command that modifies system files. What is the correct way to do this?

• a.Right-click Command Prompt and choose 'Run as administrator'✓
• b.Double-click cmd.exe from the Windows folder
• c.Type the command into the Run dialog
• d.Open Command Prompt and press Ctrl+Shift+Enter after typing the command

Elevated privileges are obtained by right-clicking the app and selecting 'Run as administrator', which triggers a UAC prompt. A normal launch runs with standard user rights. Elevation must be granted before the command is typed.

In Windows, which command-line utility checks the integrity of protected system files and repairs them if corruption is found?

• a.chkdsk
• b.sfc /scannow✓
• c.diskpart
• d.gpupdate

System File Checker (sfc /scannow) scans protected operating system files and restores corrupted ones from a cached copy. chkdsk repairs file-system errors on a disk, not system files. diskpart manages partitions.

Which file system is required to format a volume that will host a Windows installation and take advantage of file permissions, encryption (EFS), and journaling?

• a.FAT32
• b.exFAT
• c.ext4
• d.NTFS✓

NTFS supports file-level permissions, EFS encryption, compression, and journaling, and is required for the Windows system volume. FAT32 lacks permissions and has a 4 GB file-size limit. ext4 is a Linux file system.

A user wants to remove a Windows application cleanly. Which built-in location lists installed programs and provides an uninstall option?

• a.Settings > Apps > Installed apps (or Programs and Features)✓
• b.Task Manager > Processes
• c.Disk Management
• d.Device Manager

Installed desktop and Store apps are managed under Settings > Apps, historically the Programs and Features Control Panel item, where uninstall is offered. Task Manager only stops running processes. Device Manager handles hardware drivers.

Which Windows tool lets an administrator create, shrink, extend, and delete disk partitions through a graphical interface?

• a.Resource Monitor
• b.Performance Monitor
• c.Disk Management✓
• d.Event Viewer

Disk Management (diskmgmt.msc) provides a GUI for creating, formatting, shrinking, extending, and deleting volumes. Event Viewer only shows logs. Performance and Resource Monitor report on system utilization.

A technician wants to see startup impact and disable programs that launch at boot on a modern Windows client. Which tool is most appropriate?

• a.msconfig Boot tab
• b.Task Manager Startup tab✓
• c.Registry Editor Run key only
• d.Services console

On Windows 10/11, the Startup tab in Task Manager lists auto-start apps with their startup impact and allows disabling them. msconfig no longer manages the startup app list. Editing the registry directly is riskier and less convenient.

Which macOS feature provides automated, incremental backups to an external or network drive and lets a user restore previous versions of files?

• a.Mission Control
• b.Spotlight
• c.Keychain
• d.Time Machine✓

Time Machine performs scheduled incremental backups and lets users browse and restore prior versions of files. Spotlight is search, Mission Control manages windows/spaces, and Keychain stores credentials.

On a Linux system, which command displays the current working directory's contents in a long listing that includes permissions and ownership?

• a.ls -l✓
• b.pwd
• c.cd
• d.chmod

ls -l produces a long listing showing permissions, owner, group, size, and modification time. pwd only prints the current path. cd changes directories and chmod changes permissions.

A Linux administrator must run a single command with superuser privileges without logging in as root. Which command should prefix the command?

• a.chown
• b.grep
• c.sudo✓
• d.apt

sudo executes a single command with elevated (root) privileges for authorized users, logging the action. chown changes file ownership. apt is a package manager and grep searches text.

Which macOS utility is used to install applications simply by dragging their bundle into a specific folder, and where are most applications stored?

• a.The Dock; /System
• b.Finder; the Applications folder✓
• c.Launchpad; /Users
• d.Terminal; /bin

In macOS, most apps are self-contained bundles installed by dragging them into the Applications folder using Finder. Launchpad only launches apps, and the Dock is a shortcut bar. System binaries live elsewhere.

Which Windows command releases and then requests a new IP address configuration from a DHCP server?

• a.ping then tracert
• b.netstat -a
• c.nslookup then ipconfig /all
• d.ipconfig /release then ipconfig /renew✓

ipconfig /release drops the current DHCP lease and ipconfig /renew requests a new one. ping and tracert test connectivity, netstat shows connections, and nslookup queries DNS.

A 32-bit version of Windows has a hard limit on how much system RAM it can address. What is that practical limit?

• a.About 4 GB✓
• b.About 8 GB
• c.About 16 GB
• d.About 128 GB

A 32-bit operating system can address only about 4 GB of RAM because of the 32-bit memory address space. Installing more RAM provides no benefit under 32-bit Windows. A 64-bit OS is required to use larger amounts.

Which Windows feature encrypts an entire drive volume and can use a TPM chip to protect the encryption keys?

• a.EFS
• b.Windows Defender Firewall
• c.Credential Manager✓
• d.BitLocker

BitLocker provides full-volume encryption and can seal its keys to a TPM so the drive only unlocks on the trusted hardware. EFS encrypts individual files, not the whole volume. Credential Manager stores saved logons.

Which command-line tool applies updated Group Policy settings to a Windows client immediately rather than waiting for the next refresh interval?

• a.gpresult
• b.gpupdate /force✓
• c.secedit
• d.regedit

gpupdate /force reapplies all Group Policy settings right away. gpresult only reports the resultant set of policies. secedit configures security templates and regedit edits the registry.

A technician needs to view detailed hardware and software configuration, including the BIOS version and installed RAM, in a single Windows report. Which tool provides this?

• a.Notepad
• b.Calculator
• c.Snipping Tool
• d.System Information (msinfo32)✓

System Information (msinfo32) summarizes hardware resources, components, and the software environment, including BIOS version and installed memory. The other listed utilities are unrelated accessories.

Which mobile operating system is open source, developed primarily by Google, and allows apps to be installed from multiple stores and sideloaded APK files?

• a.Android✓
• b.iOS
• c.iPadOS
• d.watchOS

Android is open source and supports installation from Google Play, third-party stores, and sideloaded APK files. iOS and iPadOS are closed platforms that normally restrict installs to the App Store.

In Windows, which utility lets you start, stop, and set the startup type (Automatic, Manual, Disabled) of background services?

• a.Task Scheduler
• b.Device Manager
• c.Services (services.msc)✓
• d.Disk Cleanup

The Services console (services.msc) manages background services, including their state and startup type. Task Scheduler runs tasks on triggers, and Device Manager manages hardware drivers.

Which upgrade method preserves user files, settings, and installed applications when moving to a newer version of Windows?

• a.Clean install
• b.In-place upgrade✓
• c.Bare-metal reimage
• d.Factory reset

An in-place upgrade installs the new Windows version while keeping user files, settings, and most applications. A clean install and bare-metal reimage wipe the existing environment. A factory reset returns the device to its shipped state.

Which Windows command-line utility maps a network share to a drive letter?

• a.ipconfig
• b.tasklist
• c.format
• d.net use✓

net use maps a shared network folder to a drive letter and manages network connections. ipconfig shows IP configuration, tasklist lists processes, and format prepares a disk.

A macOS user wants to force an unresponsive application to close. Which method accomplishes this?

• a.Press Command+Option+Esc to open Force Quit✓
• b.Press Command+Q once
• c.Restart the router
• d.Delete the app from Applications

Command+Option+Esc opens the Force Quit Applications window, letting the user end a frozen app. Command+Q requests a normal quit that a hung app may ignore. Deleting the app is unnecessary for a temporary hang.

Which type of Windows installation partition style is required to boot from drives larger than 2 TB and supports more than four primary partitions?

• a.MBR
• b.FAT
• c.GPT✓
• d.EFS

GPT (GUID Partition Table) supports drives larger than 2 TB and many partitions, and pairs with UEFI. MBR is limited to 2 TB and four primary partitions. FAT and EFS are not partition styles.

Which Windows Control Panel or Settings area is used to configure how the system behaves when the power button is pressed and to enable or disable fast startup?

• a.Network and Sharing Center
• b.Power Options✓
• c.Programs and Features
• d.Ease of Access

Power Options controls power plans, button actions, sleep behavior, and fast startup. Network and Sharing Center handles connections, and Programs and Features manages installed software.

Which command in a Linux terminal changes the permissions of a file, for example granting the owner read/write/execute using numeric mode 700?

• a.mv
• b.cp
• c.ps
• d.chmod✓

chmod changes file and directory permission bits, and numeric mode 700 grants the owner full access while denying group and others. mv and cp move and copy files, and ps lists processes.

A user reports that Windows shows only 3.5 GB of usable RAM even though 8 GB is installed. Which is the most likely cause?

• a.A 32-bit version of Windows is installed✓
• b.The RAM is faulty
• c.The pagefile is disabled
• d.The GPU is integrated

A 32-bit Windows install can address only about 4 GB total, so much of 8 GB appears unusable. Upgrading to 64-bit Windows resolves it. Faulty RAM usually causes crashes rather than a clean address-space limit.

Which Windows tool schedules programs or scripts to run automatically at specific times or in response to events such as logon?

• a.Disk Management
• b.Registry Editor
• c.Task Scheduler✓
• d.Resource Monitor

Task Scheduler runs programs and scripts on time-based or event-based triggers, such as at logon or on a daily schedule. Disk Management handles volumes, and Resource Monitor reports utilization.

Which file system is best suited for a large external flash drive that must be read and written on both Windows and macOS without a 4 GB file-size limit?

• a.FAT32
• b.exFAT✓
• c.NTFS
• d.EFS

exFAT is cross-platform, supported natively by Windows and macOS, and has no practical 4 GB file-size limit. FAT32 caps files at 4 GB. NTFS is read-only by default on macOS.

A technician wants to verify whether a Windows installation is 32-bit or 64-bit and see the edition and version. Where is this shown most directly?

• a.Recycle Bin properties
• b.Network adapter properties
• c.Printer preferences
• d.Settings > System > About (or System Properties)✓

Settings > System > About (System Properties) reports the edition, version, and whether the system type is 32-bit or 64-bit. The other listed locations do not report OS architecture.

A user receives an email that appears to be from the company's bank, urging them to click a link and confirm their password immediately. What type of attack is this?

• a.Phishing✓
• b.DDoS
• c.SQL injection
• d.Zero-day exploit

Phishing uses fraudulent messages impersonating a trusted party to trick users into revealing credentials or clicking malicious links. A DDoS floods a service with traffic, and SQL injection targets databases, neither of which fits this scenario.

Which type of malware encrypts a victim's files and demands payment in exchange for the decryption key?

• a.Rootkit
• b.Ransomware✓
• c.Keylogger
• d.Adware

Ransomware encrypts data and extorts the victim for a decryption key, often with a deadline. A keylogger records keystrokes, a rootkit hides deep in the system, and adware displays unwanted ads.

An attacker follows an authorized employee through a secured door before it closes, without presenting their own badge. What is this physical technique called?

• a.Phishing
• b.Shoulder surfing
• c.Tailgating✓
• d.Whaling

Tailgating (piggybacking) is when an unauthorized person follows an authorized one through a controlled entrance. Shoulder surfing is watching someone enter credentials. Whaling is phishing that targets executives.

Which authentication approach requires two or more independent factors, such as a password plus a code from an authenticator app?

• a.Single sign-on
• b.Least privilege
• c.Access control list
• d.Multifactor authentication✓

Multifactor authentication (MFA) combines factors from different categories (something you know, have, or are), such as a password plus an app code. Single sign-on centralizes logins but is not inherently multifactor.

Which practice grants each user only the minimum permissions needed to perform their job, reducing the impact of a compromised account?

• a.Principle of least privilege✓
• b.Open sharing
• c.Default allow
• d.Full administrator access for all

The principle of least privilege limits users to the access their role requires, shrinking the attack surface if an account is compromised. Granting everyone administrator rights greatly increases risk.

Which type of malware disguises itself as legitimate software to trick a user into installing it, then performs malicious actions in the background?

• a.Worm
• b.Trojan horse✓
• c.Boot sector virus
• d.Logic bomb

A Trojan horse masquerades as a useful program to get installed, then carries a hidden malicious payload. A worm self-replicates across networks, and a logic bomb triggers on a condition rather than relying on disguise.

A technician wants to protect a laptop's data so it cannot be read if the device is lost or stolen. Which control best achieves this?

• a.A screen saver
• b.A stronger Wi-Fi password
• c.Full-disk encryption✓
• d.Disabling the firewall

Full-disk encryption renders stored data unreadable without the key, protecting it if the hardware is lost or stolen. A screen saver or Wi-Fi password does not protect data at rest on the drive.

Which social engineering tactic involves an attacker impersonating IT support over the phone to convince a user to reveal their password?

• a.Tailgating
• b.Evil twin
• c.Dumpster diving
• d.Vishing✓

Vishing is voice phishing, where the attacker uses a phone call and pretext (such as posing as IT) to extract sensitive information. Dumpster diving searches discarded materials, and an evil twin is a rogue Wi-Fi access point.

Which Windows security feature filters inbound and outbound network traffic based on configurable rules to help block unauthorized connections?

• a.Windows Defender Firewall✓
• b.Disk Cleanup
• c.Task Manager
• d.Snipping Tool

Windows Defender Firewall inspects network traffic and permits or blocks it according to rules, helping stop unauthorized connections. The other tools do not perform network filtering.

When disposing of drives that held sensitive data, which method most reliably prevents any data recovery from a hard disk drive?

• a.Quick formatting the drive
• b.Physical destruction (shredding or drilling)✓
• c.Moving files to the Recycle Bin
• d.Renaming the files

Physical destruction such as shredding or drilling reliably prevents recovery from a magnetic hard drive. A quick format and Recycle Bin deletion leave data recoverable, and renaming does nothing to remove data.

Which term describes a previously unknown software vulnerability that attackers exploit before the vendor has released a patch?

• a.Brute-force attack
• b.Man-in-the-middle
• c.Zero-day vulnerability✓
• d.Replay attack

A zero-day vulnerability is a flaw unknown to the vendor, giving defenders zero days to patch before exploitation. A brute-force attack guesses credentials and a replay attack reuses captured data.

Which of the following is the strongest wireless encryption standard a technician should select when configuring a modern home or small-office router?

• a.WEP
• b.WPA
• c.WPS
• d.WPA3✓

WPA3 is the newest and strongest Wi-Fi security standard, improving on WPA2 with better key exchange. WEP and the original WPA are outdated and insecure, and WPS is a convenience feature that can weaken security.

Which best practice reduces the risk that a stolen password alone can compromise an account?

• a.Requiring multifactor authentication✓
• b.Reusing one password everywhere
• c.Disabling account lockout
• d.Writing passwords on a sticky note

Requiring MFA means a stolen password is not enough because an additional factor is needed. Reusing passwords and disabling lockout increase exposure, and writing passwords down risks disclosure.

A pop-up claims the computer is infected and urges the user to call a phone number for paid removal help. What is this most likely an example of?

• a.A legitimate antivirus alert
• b.A rogue/fake security alert (scareware)✓
• c.A Windows Update notice
• d.A driver installation prompt

Scareware displays alarming fake alerts to pressure users into calling scammers or buying useless software. Legitimate antivirus tools do not ask users to call an unknown number. Treat such pop-ups as social engineering.

Which access-control concept assigns permissions to users based on their job function or group rather than individually?

• a.Full disk encryption
• b.Port forwarding
• c.Role-based access control✓
• d.MAC address filtering

Role-based access control (RBAC) grants permissions according to a user's role or group, simplifying administration and enforcing consistency. The other options relate to encryption or networking, not permission assignment.

A user wants to prevent unauthorized people from reading over their shoulder as they type a password in a public place. Which countermeasure is most directly relevant?

• a.Enabling a firewall
• b.Updating antivirus
• c.Using a longer Wi-Fi key
• d.Using a privacy screen filter and shielding the keyboard✓

A privacy screen filter narrows viewing angles and shielding the keyboard defeats shoulder surfing in public. Firewalls, antivirus, and Wi-Fi keys do not stop someone physically observing the screen or keystrokes.

Which characteristic makes a password policy stronger against brute-force and dictionary attacks?

• a.Increased length and complexity✓
• b.Using the username as the password
• c.Never expiring shared passwords
• d.Disabling case sensitivity

Longer, more complex passwords dramatically increase the number of combinations an attacker must try. Using the username or a shared, never-expiring credential makes guessing trivial and weakens security.

Which type of malware is specifically designed to hide its presence and maintain privileged access, often loading before the operating system fully starts?

• a.Adware
• b.Rootkit✓
• c.Spyware
• d.Ransomware

A rootkit conceals itself and other malware while retaining privileged control, sometimes hooking into the boot process. Adware merely shows ads and spyware collects data, but neither is defined primarily by deep stealth.

Which authentication factor category does a fingerprint or facial scan belong to?

• a.Something you know
• b.Something you have
• c.Something you are✓
• d.Somewhere you are

Biometrics such as fingerprints and facial scans are 'something you are'. Passwords are 'something you know' and a token or phone is 'something you have'. Combining categories yields multifactor authentication.

A company wants to make sure former employees can no longer access systems the moment they leave. Which practice addresses this?

• a.Sharing one admin account
• b.Ignoring account audits
• c.Leaving accounts enabled indefinitely
• d.Promptly disabling accounts during offboarding✓

Disabling accounts immediately during offboarding removes access when an employee departs. Shared admin accounts and dormant enabled accounts create lingering, hard-to-attribute access that attackers can exploit.

Which term describes an attacker setting up a rogue Wi-Fi access point with the same name as a legitimate network to intercept traffic?

• a.Evil twin✓
• b.Tailgating
• c.Watering hole
• d.SQL injection

An evil twin is a malicious access point impersonating a trusted SSID so victims connect and expose their traffic. Tailgating is a physical intrusion and SQL injection targets databases, not wireless clients.

What is the primary security benefit of keeping operating systems and applications patched and up to date?

• a.It increases screen brightness
• b.It closes known vulnerabilities before they can be exploited✓
• c.It removes the need for backups
• d.It disables all user accounts

Patching remediates known vulnerabilities, reducing the window in which attackers can exploit them. It does not replace backups, alter brightness, or disable accounts.

Which practice helps protect users from entering credentials on a fraudulent website that mimics a real one?

• a.Disabling the firewall
• b.Turning off automatic updates
• c.Verifying the site's URL and valid HTTPS certificate✓
• d.Reusing the same password everywhere

Checking the exact domain and confirming a valid HTTPS certificate helps users detect lookalike phishing sites before entering credentials. Disabling the firewall or reusing passwords increases risk rather than reducing it.

Which control ensures that a mobile device's data can be erased remotely if the device is lost or stolen?

• a.A louder ringtone
• b.Disabling encryption
• c.Turning off the passcode
• d.Remote wipe capability✓

Remote wipe lets an administrator or user erase a lost or stolen device's data over the network. Disabling encryption or the passcode would weaken protection, and ringtones are irrelevant to data safety.

A Windows PC repeatedly shows a blue screen (stop error) shortly after installing a new device driver. What is the best first troubleshooting step?

• a.Boot into Safe Mode and roll back or update the driver✓
• b.Immediately replace the motherboard
• c.Reinstall all applications
• d.Disable the antivirus permanently

Because the crashes began right after a driver install, booting into Safe Mode and rolling back or updating that driver directly targets the likely cause. Replacing hardware or reinstalling all apps is premature and disproportionate.

An application launches but immediately closes without an error message. Which tool can reveal a logged reason for the crash?

• a.Disk Cleanup
• b.Event Viewer✓
• c.Character Map
• d.Magnifier

Event Viewer records application and system errors, often capturing the faulting module or error code behind a silent crash. Disk Cleanup, Character Map, and Magnifier do not provide diagnostic crash logs.

A smartphone's battery drains unusually fast and the device runs hot even when idle. Which is a likely software-related cause to investigate first?

• a.The charger cable color
• b.The phone case brand
• c.A misbehaving or malicious app running in the background✓
• d.The screen resolution setting

A rogue or poorly optimized background app can consume CPU and radios continuously, draining the battery and generating heat. Checking battery usage stats to find the offending app is the logical first step.

Windows fails to reach the desktop and boots into automatic repair loops. Which recovery option lets a technician restore the system to an earlier known-good configuration without deleting personal files?

• a.Format the drive
• b.Reinstall Windows from scratch
• c.Replace the CPU
• d.System Restore✓

System Restore reverts system files, drivers, and registry settings to an earlier restore point while leaving personal files intact. A full reinstall or format would be more destructive and time-consuming.

A user reports that their web browser constantly redirects to unwanted sites and shows new toolbars they did not install. What is the most likely cause?

• a.A browser hijacker or adware infection✓
• b.A failing power supply
• c.An incorrect monitor refresh rate
• d.A dead CMOS battery

Unwanted redirects and unfamiliar toolbars are classic signs of a browser hijacker or adware. Hardware issues like a power supply, refresh rate, or CMOS battery would not cause browser redirection behavior.

A Windows computer is extremely slow, and Task Manager shows an unknown process using nearly 100% CPU. What should the technician do first?

• a.Add more RAM immediately
• b.Research the process, then end it and run a malware scan✓
• c.Reinstall Windows
• d.Replace the hard drive

Identifying the process and confirming whether it is legitimate, then ending it and scanning for malware, addresses the actual cause of high CPU use. Hardware changes or a reinstall are premature before diagnosing the process.

After a Windows update, a specific application no longer opens. Which approach best isolates whether the update caused the problem?

• a.Buy a new computer
• b.Reset the BIOS
• c.Uninstall the recent update or use System Restore, then test the app✓
• d.Replace the RAM

Removing the recent update or rolling back with System Restore and retesting directly tests the hypothesis that the update broke the app. This targeted change isolates the cause without unnecessary hardware work.

A mobile app repeatedly crashes on launch after the user has plenty of storage and a good connection. Which sequence of steps is most appropriate first?

• a.Factory reset the phone right away
• b.Replace the battery
• c.Root the device
• d.Force stop the app, clear its cache, then update or reinstall it✓

Force stopping, clearing the app cache, and updating or reinstalling resolves most single-app crashes with minimal disruption. A factory reset or rooting is far more drastic and should not be the first response.

A user cannot install updates and sees low-disk-space warnings on the Windows system drive. Which action most directly addresses the root cause?

• a.Free up space with Disk Cleanup and remove unneeded files✓
• b.Increase the monitor brightness
• c.Disable the network adapter
• d.Change the desktop wallpaper

Update failures tied to low disk space are resolved by freeing storage, for example with Disk Cleanup or by removing unneeded files. The other actions do not affect available disk space.

Several pop-ups appear even when no browser is open, and the antivirus has been mysteriously disabled. What is the most likely explanation?

• a.The keyboard is failing
• b.The system is infected with malware✓
• c.The monitor cable is loose
• d.The BIOS date is wrong

Pop-ups without a browser and a disabled antivirus strongly indicate a malware infection actively defending itself. Hardware or BIOS issues would not disable security software or generate advertising pop-ups.

When following best practices to remediate a malware infection, which step should be performed to prevent the malware from spreading or communicating while it is being removed?

• a.Increase the screen resolution
• b.Reinstall Microsoft Office
• c.Quarantine/disconnect the infected system from the network✓
• d.Defragment the drive

Isolating the machine from the network (quarantine) stops the malware from spreading or contacting command-and-control servers during remediation. Reinstalling Office or changing resolution does nothing to contain an infection.

A user's files suddenly have a strange extension and a note demands payment to restore them. What has most likely happened, and what is the safest recovery path?

• a.A driver conflict; update the driver
• b.A failed update; reinstall the update
• c.A dead battery; replace it
• d.A ransomware infection; isolate the system and restore data from clean backups✓

Renamed files plus a ransom note indicate ransomware. The safest recovery is to isolate the machine and restore from known-clean backups rather than pay. Driver or battery explanations do not match these symptoms.

A laptop touchscreen registers phantom touches and inputs the user did not make. After a reboot the issue persists in every app. What is a reasonable early software step before assuming hardware failure?

• a.Update or reinstall the touchscreen/digitizer driver and check for OS updates✓
• b.Immediately replace the display panel
• c.Reinstall all user applications
• d.Reset the router

Updating or reinstalling the digitizer driver and applying OS updates can resolve ghost-touch issues caused by software or firmware bugs. Only after software steps fail should hardware replacement be considered.

Which log-based Windows tool would best help a technician correlate a recurring application error with the exact time and error code each time it happens?

• a.Paint
• b.Event Viewer✓
• c.Calculator
• d.Sticky Notes

Event Viewer timestamps application and system events with error codes, allowing a technician to correlate a recurring crash with its cause. The other listed tools are simple accessories with no logging capability.

A Windows PC boots to a black screen with only a cursor after login. Which troubleshooting environment lets the technician load a minimal set of drivers to diagnose the issue?

• a.UEFI firmware setup
• b.BIOS beep codes
• c.Safe Mode✓
• d.Screen saver settings

Safe Mode starts Windows with a minimal set of drivers and services, helping determine whether a third-party driver or startup program causes the black screen. Firmware setup and beep codes address hardware, not this OS-level issue.

A user complains that the system time keeps resetting and secure websites report certificate errors. While often hardware-related, which quick check can rule out a simple software/setting cause?

• a.Reinstall the OS
• b.Replace the hard drive
• c.Replace the RAM
• d.Verify the correct date, time, and time zone settings and enable automatic time sync✓

Certificate errors frequently stem from an incorrect clock, so verifying date/time/time zone and enabling automatic synchronization is a fast software check. If the clock still resets after reboots, a dead CMOS battery may be the hardware cause.

An Android user side-loaded an app and now sees excessive ads and unexpected charges. What is the recommended remediation?

• a.Uninstall the suspicious app, run a mobile security scan, and review app permissions✓
• b.Buy a new phone
• c.Replace the SIM card
• d.Upgrade the data plan

Removing the side-loaded app, scanning for malware, and reviewing permissions targets the likely malicious source of ads and charges. Buying new hardware or changing the SIM does not remove the offending software.

A desktop application freezes frequently only when a specific large file is opened, while smaller files work fine. What is a sensible first hypothesis to test?

• a.The power supply is failing
• b.The specific file may be corrupt or too large for available memory✓
• c.The monitor is defective
• d.The keyboard driver is missing

Because only one large file triggers the freeze, testing whether that file is corrupt or exceeds available memory is a logical first step, such as opening a copy or checking resource usage. General hardware failures would affect all files.

During malware remediation best practices, when should the technician re-enable System Restore and create a fresh restore point?

• a.Before scanning, so restore points are preserved
• b.Never, System Restore must stay off
• c.After the system is verified clean, to establish a new known-good point✓
• d.Only if the antivirus fails

Best practice is to disable System Restore during cleanup so infected restore points are purged, then re-enable it and create a new restore point once the system is confirmed clean. Preserving infected restore points risks reinfection.

A user reports their phone's data usage spiked dramatically with no change in habits, and unfamiliar apps appeared. What is the most appropriate investigation?

• a.Replace the charging port
• b.Increase screen timeout
• c.Turn off Bluetooth permanently
• d.Check data-usage per app, remove unknown apps, and scan for malware✓

Reviewing per-app data usage, removing unrecognized apps, and scanning for malware targets a likely compromise causing the spike. Charging-port or Bluetooth changes are unrelated to unexplained data consumption.

A Windows system shows the message 'No boot device found' after being powered off normally. Which is the most appropriate first diagnostic step?

• a.Check boot order in firmware and verify the drive is detected✓
• b.Reinstall Microsoft Office
• c.Update the web browser
• d.Change the desktop theme

Verifying the firmware boot order and confirming the drive is detected isolates whether the boot device is missing or misordered before assuming corruption or hardware failure. Application or theme changes are irrelevant to booting.

Why is it important to maintain accurate, up-to-date documentation such as network diagrams and asset inventories?

• a.It speeds troubleshooting and supports consistent, informed decisions✓
• b.It increases the monitor refresh rate
• c.It encrypts all network traffic
• d.It replaces the need for backups

Accurate documentation helps technicians understand the environment quickly, reducing troubleshooting time and supporting good decisions. It does not encrypt traffic, change hardware behavior, or substitute for backups.

In a formal change-management process, what should be prepared in case a change causes unexpected problems in production?

• a.A louder alarm
• b.A rollback (back-out) plan✓
• c.A brighter display
• d.A faster CPU

A rollback or back-out plan defines how to revert a change safely if it fails, minimizing downtime. It is a core part of responsible change management and unrelated to hardware upgrades or alarms.

Which safety practice protects sensitive electronic components from static discharge while a technician works inside a computer?

• a.Wearing rubber-soled shoes only
• b.Working on a carpet
• c.Using an anti-static (ESD) wrist strap connected to ground✓
• d.Turning up the room heat

An ESD wrist strap connected to ground equalizes charge and prevents static from damaging components. Carpet actually increases static risk, and shoe type or room temperature does not provide reliable ESD protection.

According to standard change management, what must typically happen before a significant change is implemented in a production environment?

• a.Nothing; changes are made immediately
• b.Only the technician's verbal note
• c.A social media post
• d.Documented request, risk analysis, and approval by the change board✓

Significant changes generally require a documented request, risk assessment, and formal approval before implementation to control impact. Making changes without review or approval undermines stability and accountability.

Which document defines the acceptable ways employees may use company computers, networks, and internet access?

• a.Acceptable Use Policy (AUP)✓
• b.Bill of materials
• c.Network diagram
• d.Purchase order

An Acceptable Use Policy specifies permitted and prohibited uses of company IT resources. A network diagram maps topology and a bill of materials lists parts, neither of which governs user behavior.

When handling a customer's confidential data during a repair, which behavior best respects privacy and professional conduct?

• a.Sharing interesting files with coworkers
• b.Accessing only what is necessary and keeping the data confidential✓
• c.Posting screenshots online
• d.Copying personal photos for yourself

Professionals should access only the data required for the task and keep customer information confidential. Sharing, posting, or copying personal data violates privacy expectations and ethical standards.

Which fire extinguisher class is appropriate for electrical fires involving energized equipment?

• a.Class A (ordinary combustibles)
• b.Class B (flammable liquids)
• c.Class C (electrical)✓
• d.Class K (cooking oils)

Class C extinguishers are rated for fires in energized electrical equipment and use a non-conductive agent. Class A is for ordinary combustibles and Class B for flammable liquids, which are unsafe on live electrical fires.

Which scripting file type is native to Windows and commonly used to automate administrative tasks with cmdlets?

• a..sh (Bash)
• b..py (Python) only
• c.VBScript only
• d..ps1 (PowerShell)✓

PowerShell scripts (.ps1) use cmdlets and are the native automation language for Windows administration. Bash (.sh) is native to Linux/Unix. Python and VBScript can be used but .ps1 is the Windows-native choice described.

What is the primary purpose of a knowledge base or ticketing system in an IT support environment?

• a.To track issues and share documented solutions for consistency✓
• b.To overclock the CPU
• c.To replace the firewall
• d.To encrypt hard drives

A knowledge base and ticketing system record incidents and proven solutions, enabling consistent, efficient support and knowledge sharing. They do not perform encryption, overclocking, or firewall functions.

When lifting a heavy piece of equipment such as a large UPS or printer, which technique reduces the risk of injury?

• a.Bend at the waist and twist while lifting
• b.Lift with your legs, keep your back straight, and hold the load close✓
• c.Lift as quickly as possible
• d.Carry it one-handed

Proper lifting means bending the knees, keeping the back straight, using the leg muscles, and holding the load close to the body. Bending at the waist and twisting greatly increases the chance of back injury.

Which document is typically required before disposing of batteries, toner cartridges, or other chemicals to ensure proper handling?

• a.A network diagram
• b.An acceptable use policy
• c.A Safety Data Sheet (SDS)✓
• d.A change request form

A Safety Data Sheet (SDS) provides handling, storage, and disposal guidance for hazardous materials like batteries and toner. Network diagrams and change requests do not address chemical safety or disposal.

Which regulated data type requires special handling under privacy rules and should never be exposed carelessly during support work?

• a.Public marketing brochures
• b.Open-source code
• c.Press releases
• d.Personally identifiable information (PII) and healthcare data (PHI)✓

PII and PHI are protected categories subject to privacy regulations and must be safeguarded from unauthorized disclosure. Public brochures, open-source code, and press releases are not confidential regulated data.

In change management, what is the purpose of documenting the 'scope' of a proposed change?

• a.To define exactly what will and will not be affected✓
• b.To increase the clock speed
• c.To disable the firewall
• d.To brighten the display

Defining scope clarifies which systems, users, and processes the change affects and which it does not, guiding testing and communication. It has nothing to do with clock speed, firewalls, or display brightness.

Which environmental control helps protect data-center equipment from damage caused by static electricity and overheating?

• a.Storing equipment in direct sunlight
• b.Maintaining proper temperature and humidity levels✓
• c.Removing all air filtration
• d.Increasing dust accumulation

Controlled temperature and humidity reduce both overheating and static-discharge risk, protecting equipment. Excess heat, sunlight, dust, or overly dry air all increase the likelihood of hardware damage.

What is a key reason to use a change board or approval step rather than letting any technician change production systems freely?

• a.It makes the CPU faster
• b.It removes the need for backups
• c.It reviews risk and reduces unplanned outages✓
• d.It encrypts the network

A review or approval step evaluates risk, dependencies, and timing, reducing the chance of unplanned outages from uncoordinated changes. It does not affect CPU speed, backups, or encryption directly.

Which basic scripting construct repeats a block of instructions until a condition is met, and is fundamental to automation?

• a.A comment
• b.A variable
• c.A file path
• d.A loop✓

A loop repeats instructions until a condition is satisfied, letting a script automate repetitive work. A variable stores a value and a comment documents code, but neither performs repetition on its own.

When a customer becomes upset during a support interaction, which professional communication practice is most appropriate?

• a.Listen actively, stay calm, and avoid arguing or being defensive✓
• b.Interrupt and raise your voice
• c.Blame the customer
• d.Walk away without explanation

Active listening, staying calm, and not arguing help de-escalate tension and maintain professionalism. Interrupting, blaming, or abandoning the customer damages trust and violates good conduct standards.

Which purpose does a 'bill of materials' (BOM) or asset inventory serve in IT operations?

• a.It measures Wi-Fi signal strength
• b.It lists components or assets and their details for tracking and procurement✓
• c.It encrypts the hard drive
• d.It configures the firewall

A bill of materials or asset inventory itemizes components or devices with relevant details, supporting tracking, procurement, and lifecycle management. It does not measure signal strength or configure security controls.

Under change management, why should a change include a documented 'end-user acceptance' or verification step after implementation?

• a.To increase RAM automatically
• b.To disable logging
• c.To confirm the change works as intended and the issue is resolved✓
• d.To overclock the GPU

Verifying end-user acceptance confirms the change achieved its goal and did not introduce new problems before the change is closed. It does not alter hardware or logging by itself.

Which environmental and safety consideration applies when using compressed air to clean dust from a computer?

• a.Shake and heat the can first
• b.Spray directly into spinning fans at full speed
• c.Use it while the unit is powered on and open
• d.Use short bursts, keep the can upright, and hold fans still to avoid over-spinning✓

Compressed air should be used in short bursts with the can upright, and fans should be held still so they do not over-spin and get damaged. Powering on the unit or forcing fans to spin can cause damage or injury.

What is the main benefit of following a standardized incident-response and documentation procedure during a security event?

• a.Consistent handling, proper evidence preservation, and clear communication✓
• b.Faster internet speeds
• c.Brighter monitors
• d.Lower electricity bills

A standardized procedure ensures incidents are handled consistently, evidence is preserved for possible investigation, and stakeholders are informed. It is unrelated to internet speed, display brightness, or utility costs.

When disposing of old electronics, which approach aligns with environmental regulations and responsible practice?

• a.Throw them in regular household trash
• b.Recycle through certified e-waste programs and follow local regulations✓
• c.Bury them in a backyard
• d.Burn them to save space

Certified e-waste recycling handles hazardous components properly and complies with regulations. Household trash, burying, or burning electronics can release toxic materials and violate environmental laws.

Which practice best supports accountability when multiple technicians manage the same systems over time?

• a.Using one shared, undocumented login
• b.Skipping all records
• c.Keeping a change log and updated documentation of who changed what and when✓
• d.Deleting logs weekly

A change log and current documentation record who made each change and when, supporting accountability and troubleshooting. Shared undocumented logins and deleted logs destroy the audit trail and hinder accountability.

Before performing maintenance that may cause downtime, what professional step should a technician take regarding affected users?

• a.Say nothing and hope no one notices
• b.Change the wallpaper first
• c.Disable their accounts permanently
• d.Communicate the planned maintenance window and expected impact in advance✓

Notifying affected users of the maintenance window and expected impact sets expectations and reduces disruption complaints. Staying silent or disabling accounts is unprofessional and harms trust.

Which practice ensures that a critical account remains protected even if its password is exposed in a data breach elsewhere?

• a.Reusing the same password across sites
• b.Enabling multifactor authentication and using a unique password✓
• c.Writing the password in a shared document
• d.Disabling the login screen

A unique password combined with multifactor authentication means a password leaked from another site cannot alone unlock the account. Reusing passwords or sharing them in documents spreads the risk of a single breach.

A Windows PC intermittently loses its network connection only over Wi-Fi, while wired devices stay online. Which is a reasonable early software step?

• a.Replace the motherboard
• b.Reinstall the operating system
• c.Update the wireless adapter driver and check power-management settings for the adapter✓
• d.Replace the monitor

Updating the wireless driver and disabling aggressive power-saving on the adapter often resolves intermittent Wi-Fi drops caused by software or firmware. Reinstalling the OS or replacing hardware is premature before these checks.

Which practice best protects customer privacy when a technician must step away from a workstation that displays sensitive information?

• a.Leave it unlocked for convenience
• b.Increase the brightness
• c.Post the password nearby
• d.Lock the screen so credentials are required to resume✓

Locking the screen prevents unauthorized viewing or use of sensitive data while the technician is away. Leaving it unlocked or posting the password exposes confidential information and violates privacy best practices.