Master Deck

What is implied when a device has minimal running processes but fans are running hot and CPU utilization is high?

Malware.

Specifically crypto mining malware.

What is implied when a user has recently noticed unusually high network traffic with large data uploads on their device, despite no apps being used?

Malware.

Specifically data exfiltration.

What is Windows Setup?

The build in program that handles Windows OS installation.

WinPE vs Windows Setup

Windows Pre-execution Environment is a generic framework for deploying, imaging, and maintaining OSes.

Windows Setup is the process and user interface when installing an OS, and it is part of WinPE.

WinPE vs WinRE

Windows Pre-execution Environment is a generic frame work for deploying, imaging, and maintaining OSes.

Windows Recovery Environment is the built in tool on top of WinPE for diagnosing and troubleshooting an existing, unbootable, or broken OS.

What is DISM?

Deployment Image Servicing and Management

A tool used to service and prepare software (OS) disk images in Windows CLI.

What is a remote network installation?

An installation of a new OS over the network. Uses PXE.

How does remote installation work?

Using PXE (pre-boot execution environment) it boots from the network by pulling installation files from a shared folder.

What is an unattended installation?

An OS in which nobody needs to present for the installation, allowing them to be rolled out at scale.

Usually done with an installation file.

How does unattended installation work?

An installation file.

Windows supports using these with answer files, which are XML text files that contain instructions for Windows Setup to begin installation.

What is an in-place upgrade?

An installation of the new OS on top of an existing version of the OS.

Preserves all apps, data, and configurations.

What is a repair installation?

An OS installation that attempts to replace the existing version of the OS files with a new copy of the same version.

Used to fix issues.

What kinds of OS installations are mutually exclusive from a clean install?

In-place installation and repair installation.

• Because they preserve data and don’t wipe it.

Shutdown /s

Shutdown /r

Shutdown /l

Shutdown /h

/s will shut down.

/r will reboot.

/l will log off.

/h will hibernate.

What allows a user to leave programs running on their device while preventing others from accessing it without a password?

Lock.

What does sleep mode do to current system processes?

It suspends them.

What are the two main, less-invasive troubleshooting options for repairing OS files in-place?

• Running sfc /scannow

• Booting from Safe Mode

What are three examples of moderately complex troubleshooting options when you have an OS issue?

• Startup Repair

• Rolling back recently installed software

• Using System Restore (a fairly invasive option)

What are examples of invasive and escalating OS troubleshooting options?

• Repair installation

• In-place upgrade

• Clean install (the most extreme)

What is implied if an app doesn't work on a phone from one manufacturer, but it does on a phone from a different manufacturer?

An OS issue.

What is jailbreaking?

Removing software restrictions imposed by the OS on Apple devices, allowing users to freely install apps.

What is rooting a device?

Removing software restrictions imposed by the OS on Android devices, allowing users to freely install apps.

Android version of jailbreaking.

What is developer mode?

A setting on an Android device to show additional diagnostic information when using apps or making network connections.

What is a sideloading?

The installation of applications onto a device from unofficial sources outside of official, approved app stores.

.apk file vs .ipa file

The .apk file is used for software bing sideloaded on an Android device.

The .ipa file has the same utility but for Apple devices.

Both run in the background on Android/Apple respectively, but the the file extension is only handled by users when side loading.

What is a splash screen?

What does it contain?

The loading screen that appears when an OS boots up or an application is launching.

Can simply be a logo, but can also contain a disclaimer for access to the app.

What is a captive portal?

A web page that pops up when you join a public WiFi network.

Forces you to agree to terms and/or log in before access.

What is chain of custody?

A process used in legal contexts to maintain and document the handling of evidence to ensure its integrity and authenticity throughout an investigation or trial.

If one user has a software problem but other users don’t, what does this suggest?

An issue with the specific struggling user’s profile, permissions, or configuration.

Not the entire system.

Linux command to shut down a server 11 minutes after the command?

shutdown -h +11

Best way to filter out spam emails from a single suspicious domain (like all coming from @spmail)?

Create a domain-based email filter.

Best way to filter out spam emails from various email providers?

Mark each email as spam or junk.

What is Python?

A general-purpose and simple programming language that runs with an interpreter and is used to develop applications.

What is a .py file?

Python scripts.

What is a shell script?

A file that contains advanced commands to be executed by the CLI of macOS / Linux.

What is a .sh file?

What syntax identifies it?

A shell script.

The first line of the script begins with #!/bin/bash and designates the interpreter.

This line instructs the OS to execute it.

What is a batch script?

Scripts that contain a list of several commands that are executed in a sequence.

Used by Windows.

What is a .bat file?

What syntax identifies it?

A file used for a batch script.

You can run the file by calling its name from the command line or double-clicking the file in File Explorer.

Uses CLI commands.

Batch vs Shell Script use cases

Batch is for Windows CLI, Shell Scripts are for macOS/Linux.

Shell Scripts are more sophisticated.

What is JavaScript?

A scripting language that is designed to create interactive web-based content/applications.

JavaScript scripts are placed into the HTML code of a web page.

What is a .js file?

JavaScript file.

JavaScript scripts can also be part of an HTML file.

What is PowerShell?

A powerful, Microsoft-developed tool designed for task automation and configuration management.

It is both a command-line and a scripting language.

What is PowerShell syntax?

Verb-noun cmdlets.

“Get-ChildItem”, “Stop-Service.”

Uses # for comments and $ to designate variables.

What is a .ps1 file?

A file that can contain a series of PowerShell commands, with each command appearing on a separate line.

Will contain commands you can rerun at any time.

What is VBScript?

Microsoft-developed scripting language used to automate tasks and manage functions in a Windows environment.

More advanced than Batch, less advanced than PowerShell.

What is a .vbs file?

How are they ran?

A VBScript file.

They run using the Windows Script Host (WScript.exe or CScript.exe).

What is implied if you see “limited” or “no” network connectivity after a Windows Update?

How do you fix and prevent this?

The driver for the NIC was updated and is now incompatible with the physical NIC.

Roll it back to fix.

Set driver updates to manual to prevent.

Windows and Linux standard vs large scale file systems?

For Windows, the standard is NTFS, and the massive one is ReFS.

For Linux, the standard is ext4, while the large-scale option is XFS.

robocopy/MT

Multi-Threading.

Transfers multiple files simultaneously.

robocopy/MIR

Mirroring.

The destination directory becomes an exact copy of the source directory.

It also overwrites the destination.

Copying file vs transferring file

Both duplicate data.

But copying is local, and transferring can be between devices.

robocopy vs xcopy

• Robocopy supports mirroring (/MIR), multi-threading (/MT), and resumes after network drops.

• Xcopy does not support those features, and fails on drops.

gpedit.msc vs lusrmgr.msc

• gpedit.msc configures policies for users and computers, defining how they access OS features and network resources.

• lusrmgr.msc manages user accounts and groups on a local machine.

What is a surge suppressor?

A device that defends equipment against unexpected voltage spikes.

What is electrical grounding?

A safety mechanism that redirects excess electrical current safely away from equipment and into the earth.

What is a line conditioner?

A device that makes electrical connections stables and smooths out fluctuations.

What is a UPS?

Any kind of near-instantaneous battery backup power.

It allows for a safe system shutdown during backup.

What are the two ways to protect against an over-voltage event?

Surge suppressor and electrical grounding.

What two power supply options can protect against both under-voltage and over-voltage?

Line conditioner and UPS.

UPS features?

Instantly switched to when main power fails.

Connects to devices via USB / serial.

Power failure can be a blackout or a brownout/sag.

Standby UPS?

A UPS that is off by default, then switches on when main power fails.

Tiny delay. Cheaper option.

Line-Interactive UPS?

A UPS that also functions as a line conditioner once it’s activated.

Online UPS?

(Also called Double Conversion)

A UPS that also acts as the main power.

Equipment is always powered by the battery, and the wall just charges the battery.

Zero delay. Expensive.

Which kind of UPS offers maximum line conditioning?

Online UPS.

Because the battery is the middle man and provides input to devices, no outside blackout or surge will actually effect the input.

What is the first step to protect yourself from ESD when working on a device’s power supply?

Remove jewelry.

A file currently has permissions 755. What commands changes permissions to r-xr—r—?

Enter chmod 544 filename.

5 for read + execute, 4 for just read.

If a new OS update makes a device unresponsive, what should you do?

Use the rollback plan.

If there isn’t one (Apple OSes don’t have rollback), uninstall and downgrade to the previous version of the OS.

What does factory reset of a smartphone do to the OS?

It reverts the phone to the initial OS it was purchased with. Almost never a viable troubleshooting step.

What is the Windows Services application?

Built-in application that lets you view and control background services on Windows.

What is the next best troubleshooting step if Windows service is failing to start, but you know for a fact from checking your tools that it is properly configured?

Reboot into Safe Mode- which runs bare minimum drivers- allowing you to identify and fix the issue.

What is the most reliable protection for data if a device is lost or stolen?

Full disk encryption.

It encrypts all user and system data in your internal storage.

Even perfect password protection does not protect your stored data- FDE does.

Remote wipe advantages and limitations?

Remote wipe can delete data from a lost or stolen device to guarantee it is safe.

But a remote wipe requires the device to be powered on, connected the internet, and have connection enabled. Thieves often know this and work around it.

When to trust SDS vs when to trust manufacturer recommendations?

Manufacturer guidelines are for normal procedures.

• Loose toner and ink, cracked screens, swollen batteries.

SDS is for more hazardous situations.

• Chemical fires, injury, toxic fumes, cleaning solvents, acid or alcohol spills.

What happens if you join a private network as public?

Your device willl not trust the network.

It will hide your computer from other devices and prevent file and MFD sharing.

What happens if you join a private network as private?

Your device trusts it a lot more.

What would happen if DNS was not properly set up, your default gateway was not properly configured, or you had an IP conflict?

You would have no internet access at all.

There wouldn’t be “slow connection”. There would be zero connection.

Proper configuration of DNS, router, and IP address are mandatory for accessing the internet.

Pagefile (pagefile.sys) vs Swapfile ( swapfile.sys)

Pagefile holds temporary data for Windows apps and processes when RAM runs out.

Swapfile handles suspending and resuming built-in Windows apps- like when you minimize them.

When should you increase the pagefile size?

If large files and programs will not open, and RAM is limited or maxed out (as in you get the warning “Memory is running low”)

Malware vs Virus vs Worm

Malware broadly refers to harmful software.

Virus- malware on a local device that spreads from an executable file.

Worm- malware that spreads automatically between devices on a network.

Which command on Windows CLI shows you the current of Windows OS patch level?

winver

It shows the version of Windows.

Best way to deal with an electrical fire?

Chemical-based fire extinguisher.

Any dry chemical (CO2, FM-200) works.

Water and foam-based extinguisher are bad.

What does the employee handbook contain?

AUP (acceptable use policy) and SOP (standard operating procedures).

What is a USB controller?

Hardware chip on the motherboard that manages data / power between connected USB peripherals and the computer's CPU and RAM.

It limits how many resources are available to a USB port.

What is the easiest way to access a shared folder?

Map a drive letter to the share.

When installing an OS, where do the installation files need to be?

Directly on your computer.

They need to be on a bootable drive, remote access isn’t enough.

What is power cycling?

When is it a good troubleshooting step?

Turning it off and turning it back on.

It is a good troubleshooting step when dealing with sluggish performance.

What can cause slow profile load for Windows?

A roaming user profile using a new device.

Because their profile / desktop get downloaded to the new computer.

Which Windows utility is good for troubleshooting a slow startup?

Task Manager.

It has a Startup tab.

What are the first two things to do when working inside of a computer?

Remove all power sources,

Remove jewelry.

Both come before applying any ESD precautions.

Which methods of drive formatting delete pre-existing data?

Full format and regular format.

Quick format does not.

MBR vs GPT

Both are styles of partitioning file system.

MBR has max of 4 partitions, GPT has max of 128.

What to do if a new OS update/installation does not recognize driver(s)?

Load third party drivers that are compatible.

Don’t just give up on the OS.

What is rotation lock?

Keeping the phone in portrait or landscape mode.

Fucking idiot.

Why would a device block installation/upgrade of an OS?

Not enough storage space.

What is the built-in macOS utility enabling backups and restores?

Time Machine

What would cause your organization to remove software you installed on their system, even if the software itself is allowed?

The software has a personal license and not a business one.

What is one allowed feature of NTFS share permissions, and what is one thing NTFS permissions can’t do?

They can restrict access from remote devices.

But they cannot restrict access based on user groups.

Can NTFS permissions be synchronized across devices/systems?

No.

What is adware?

Malware that forces advertisements to appear on a user's desktop.

When a security incident has occurred, what is the major action IT professionals must take in order to respond?

Retrieve and securely store the device(s) and quarantine them.

You must preserve data integrity and protect the rest of the network.