220-1202

VNC uses the platform-independent RFB protocol, which works at the framebuffer level on X11, Windows and macOS, and can share the user's existing graphical session so the technician sees and controls what the user sees. SSH gives a command-line session, not a view of the user's desktop. RDP is Windows-centric and normally opens a separate session rather than shadowing a Linux user's display. A VPN only provides a network tunnel, not remote control.

Domain join locates the domain controller through DNS (SRV records), and the workstation is using public resolvers 8.8.8.8 and 1.1.1.1 that know nothing about the internal domain. Pointing DNS at the internal server (192.168.1.10) fixes the lookup. The IP address, subnet mask and gateway are already correct, which is why the server can be pinged and the internet reached.

In change management the process starts with a request or proposal describing the change, its purpose and scope. The change board then reviews and approves it, after which it is scheduled and implemented. A technician cannot approve, schedule or implement a change that has not yet been proposed.

Time-based one-time passwords are computed from the current time, so the phone and the server must agree on the clock within a small tolerance. Travelling across time zones, or a manually set clock, can push the phone's time outside that window and every code is rejected. Checking date, time and time zone is quick and non-destructive, so it comes before patching, reinstalling or escalating.

A material safety data sheet (now called a safety data sheet) describes the hazards of the materials in a product, such as battery chemicals, along with first aid, firefighting, spill and disposal procedures. Installation instructions, configuration steps and voltage specifications belong in the product manual or datasheet, not the MSDS.

A connected USB drive often causes the firmware to try booting from it first, producing an OS Not Found error even though the internal disk is fine. Checking the boot options (boot order, or removing the USB drive) is the quick, non-destructive first step. Repartitioning destroys data, switching firmware mode can stop a working install from booting, and data recovery is premature.

BitLocker To Go is the BitLocker feature for removable data drives such as USB flash drives, encrypting them and unlocking with a password or smart card, so data stays protected if the drive is lost or stolen. Secure Boot and BIOS passwords are firmware settings, VPN encryption is unrelated, and TPM-based encryption applies to the internal operating system drive rather than removable media.

Video surveillance (CCTV) both detects who enters a restricted area and keeps a recording that can be reviewed later as evidence. Badge readers control entry and log badge use, but they record only that a badge was presented, not who actually walked in or whether someone tailgated. Bollards and fences are physical barriers that deter or block access; they neither detect nor record it.

When a vendor stops issuing security updates and patches for an OS, that OS has reached end of life (end of support). Running it afterward leaves new vulnerabilities unpatched, so it should be upgraded or replaced. Manufacturer hardware support expiring, removal of built-in security software or an upcoming release do not by themselves end the OS's security updates.

A network-based remote installation tool (for example PXE boot with an image deployment server such as Microsoft Configuration Manager) lets one administrator push the right custom image to hundreds of devices over the network, with separate images or task sequences per vendor class and user group. Robocopy and xcopy only copy files and folders; they cannot deploy a bootable OS image or install drivers. A local image deployment tool run at each device would work but does not scale to 800 machines.

Smishing (SMS phishing) uses unsolicited text messages to trick the user into clicking a link, calling a number or revealing information. Vishing uses voice calls, spear phishing is a targeted attack usually sent by email, and impersonation is pretending to be someone else in person or by phone.

The user can sign in to the portal, so the SSO identity and MFA are working; a failure to reach one SaaS app often comes from stale cookies, cached tokens or a conflicting session in the browser. Opening a private browsing window starts a clean session without cached data and is a quick, low-impact next step. Reenrolling MFA is unnecessary because sign-in works, bypassing SSO defeats the organisation's authentication controls, and a factory reset is far too drastic.

CompTIA's malware removal procedure is: investigate and verify symptoms, quarantine infected systems, disable System Restore in Windows, remediate (update anti-malware and scan/remove), schedule scans and updates, enable System Restore and create a restore point, then educate the end user. Since the infection is already verified, the next step is to quarantine the infected systems so the malware cannot spread. Disabling System Restore, updating and scanning, and educating users all come later.

su (substitute user) is a Linux command that runs a shell or command as another user, root by default, so it is used for administrative tasks. runas is the Windows equivalent, and net user is a Windows command for managing user accounts. cmcl is not a standard Linux administration command.

The application gets its data from a database on a local server, so the technician should check whether the client actually has a connection to the database server's port. netstat shows active TCP connections, listening ports and their states (for example ESTABLISHED or SYN_SENT), which reveals whether the app is connecting. ipconfig only shows the local IP configuration, nslookup tests DNS name resolution, and curl tests URL-based (HTTP) transfers rather than a database connection.

The infection has been remediated, endpoints are updated and the affected machine was reimaged, so the remaining step in the CompTIA malware removal process is to educate the end user. Because the infection started with a phishing email, discussing the cause and teaching security hygiene addresses the root cause. Flashing router firmware has no link to a phishing-borne endpoint infection, and installing new network tools or suggesting more advanced software is unnecessary when the existing EDR already detected and quarantined the malware.

A zero-day is a vulnerability that attackers exploit before the vendor has released a patch or other remediation, so defenders have had zero days to fix it. Spoofing is impersonating a trusted source, brute force is guessing credentials by trying many combinations, and DoS is an attack that makes a service unavailable; none of these describes the timing of exploitation relative to a patch.

In Windows 10, the switch to turn on Windows Speech Recognition is in Settings > Ease of Access > Speech (Windows key+U opens Ease of Access), and Windows 11 calls this area Accessibility, where voice access is set up. Time and Language > Speech is where the microphone and speech language are configured, which makes it a tempting choice, but the speech recognition feature itself is an accessibility feature. Personalization controls the appearance of the desktop, and System covers display, sound and power settings.

On Windows 10 and Windows 11, .NET Framework 3.5 ships as an optional Windows component: open Turn Windows features on or off, select .NET Framework 3.5 (includes .NET 2.0 and 3.0), and Windows downloads it through Windows Update. Installing .NET Framework 4.x does not help because version 4 cannot run apps built for 1.1 through 3.5. Third-party repositories are an unsafe source, and a missing runtime is not a security incident for the SOC.

Features that are locked behind a sign-in indicate that the application is running unlicensed or in a trial mode; assigning the employee a license for the software unlocks them. A VPN connection does not grant product entitlements, and repairing or reinstalling the program does not help because the program is working correctly but the user has no licensed account.