CompTIA A+ 220-1102 (Core 2) Domain 3: Software Troubleshooting

TESTOUT PC PRO

Which of the following BEST describes the Blue Screen of Death (BSoD)?

A Windows stop error.

• The Blue Screen of Death (or Black Screen of Death in Windows 11) is a Windows stop error that displays when Windows cannot continue to function.

You are troubleshooting a computer that runs Windows 11. The operating system has halted, and a black screen is displayed on the monitor with an error message.

What is the first step you should take to troubleshoot the issue?

Search for the error in Microsoft's knowledge base or by using an internet search engine.

• The first thing you should do when a Black Screen of Death appears is identify the error's source by searching for the error text message in Microsoft's knowledge base or across the internet in general with a search engine such as Google. This will help you identify what is causing the problem so that you can troubleshoot it.

Your system hangs immediately after the BIOS information is shown and displays an error loading operating system error message.

What is the MOST likely source of the problem?

Corrupt MBR or partition table

• Symptoms of a corrupt MBR or partition table include the system hanging immediately after the BIOS information is shown and error messages such as missing operating system or MBR corrupt.

Which programs run during the startup process to allow user logon?

Wininit

Winlogon

• The wininit and winlogon programs run to allow user logon. At this point, the Welcome or user logon screen is displayed.

  NToskrnl.exe, Bootmgr.exe, and Winload.exe occur before the logon and user configuration stage of startup.

Which stage of a legacy BIOS startup loads the boot code in the Master Boot Record (MBR) and then uses the partition table to identify the active disk partition?

Boot loader

• On the boot device, the BIOS searches for and loads the boot code in the Master Boot Record (MBR). The MBR is on the first disk sector and uses the partition table to identify the active disk partition.

During the Runtime (RT) stage of the UEFI boot process, system control passes to ntoskrnl.exe.

Which of the following tasks does ntoskrnl.exe perform?

• Loads device drivers.

• Starts services.

• Configures the OS environment.

Rodney, an employee in the Research Department, reports that he is experiencing blue screen errors while using his Windows computer.

You ask Rodney if anything has changed on the computer recently. Rodney explains that he recently installed a TV tuner board in an expansion slot, and now he has to reboot the computer every time he loads the TV tuner application to watch TV.

You need to fix Rodney's computer and prevent him from using the TV until you can install an updated driver.

What should you do?

Boot the system in Safe Mode. Disable the TV tuner driver in Device Manager.

• You should disable the driver in Safe Mode instead of rolling the driver back. Although you might be able to disable the driver without booting in Safe Mode, booting in Safe Mode is a good way to prevent drivers that could interfere with your task.

What is the FIRST step you should take if an error occurs during startup and your system continually reboots?

Use the Disable automatic restart on system failure option.

• If an error occurs during startup, the system might continually reboot. Start by using the Disable automatic restart on system failure option on the Advanced Boot Menu to stop the automatic reboots. You should then be able to boot the system to complete other troubleshooting tasks or to run Startup Repair.

Your Windows 11 system keeps automatically restarting after a critical system error occurs, giving you little or no time to read the contents of the error message.

How can you keep your Windows 11 system from automatically restarting after a critical system error occurs?

Use the Disable automatic restart after failure option on the Advanced Startup Options menu.

• By default, Windows is configured to reboot whenever a critical system error occurs (Blue Screen of Death). Use the Disable automatic restart after failure option on the Advanced Startup Options menu to stop the automatic reboots, which will give you a chance to read the contents of the error message.

You have booted your Windows workstation in Safe Mode and enabled boot logging. To which log file is the boot logging information now written?

Ntbtlog.txt

• When you choose to enable boot logging, entries are written to the Ntbtlog.txt file. This file is created in the %WinDir% folder.

You experience startup errors after you install a new device.

What should you do FIRST to resolve the issue?

Boot in Safe Mode and roll back the driver.

• If you experience startup errors after you install a new device, the first thing you should do is boot in Safe Mode and roll back the driver

Marcus was attempting to edit some registry settings on his Windows 11 system. Now, when he tries to boot his system, it hangs after the Windows splash screen is displayed.

Because he cannot boot to Safe Mode, he boots the system from the Windows installation disc and accesses the Recovery Environment.

Which Recovery option should Marcus use FIRST to help resolve his boot issue?

System Restore

• The most common cause of the system hanging after the Windows splash screen is displayed is a bad driver or corrupt registry settings. If you cannot boot to Safe Mode, boot into the Recovery Environment and use System Restore.

You have just received a call from one of your customers. She informs you that after turning her computer on, she received the following error:

Error loading operating system
BOOTMGR is missing
Press Ctrl+Alt+Del to restart

Every time she restarts her computer, the same error appears.

Which of the following tools will work BEST to fix this issue?

bootrec

• To fix a Master Boot Record (MBR) error, run the bootrec /fixmbr command. You could include other switches as well to further repair the boot sector or rebuild the entire boot configuration data.

You are troubleshooting a Windows 11 system that won't boot. The system appears to initialize just fine, and POST completes correctly.

However, Windows does not load, and an error message is displayed on the screen, indicating that the operating system is not found. You determine that the Master Boot Record (MBR) is corrupt.

To fix the issue, you perform the following steps:

1. Boot the system from the Windows 11 installation DVD.

2. Access the Recovery Environment.

3. Open a Command Prompt window.

Enter the command that you should run at the Command Prompt to address this issue.

bootrec /fixmbr

• The bootrec /fixmbr command writes a Windows-compatible MBR to the system partition. This command does not overwrite the existing partition table. Use this method when you need to resolve MBR corruption issues or when you have to remove non-standard code from the MBR.

One day, while trying to start your Windows 11 computer, the system displays the following error:

Windows could not start. Could not read from the selected boot disk. Check boot path and disk hardware.

Which of the following solutions will MOST likely fix the problem?

Boot into the Recovery Environment and run the bootrec /rebuildbcd command.

• This specific error message is generated when a system cannot find the partition specified in the BCD database (where the operating system files are located). For example, the database might point to the D: drive for the operating system files, but that drive may not exist. Run bootrec /rebuildbcd to rebuild the boot loader database with a list of valid operating system locations.

Which of the following is a troubleshooting step to try when troubleshooting application conflicts?

Check for application driver updates.

• Checking for application driver updates is the best solution. Also, checking for updates to the application itself and Windows are good troubleshooting steps during application conflicts.

Which of the following is the Not enough USB controller resources warning most often a result of?

Plugging into a 3.0 USB port.

• The Not enough USB controller resources warning typically happens when plugging into a 3.0 USB port because it is limited to 16 endpoint pairs.

Which of the following can an overheated hard drive cause?

System instability

• System instability occurs when a hard drive is overheated.

Which of the following is the No operating system found error likely caused by?

Incorrect boot order

• Incorrect boot order usually causes the No operating system found error.

Wendy had been searching the internet for a great deal on jewelry. While looking at one site, a pop-up was displayed that told her she had just been chosen as the winner of a nice prize. Being excited to win, Wendy clicked on the link provided to claim her prize. The next day, when Wendy tried to turn on her computer, her computer displayed the Blue Screen of Death (BSOD).

After interviewing Wendy, you suspect that the pop-up she clicked on installed some malicious software that has caused her computer to lock up.

Which of the following is the BEST place to begin repairing Wendy's computer?

Boot the computer from the Windows installation disc and run Startup Repair.

• Although BSOD can be caused by many things, given the circumstances and your suspicion that malware may be the cause, you should first isolate Wendy's computer and then try to make her computer bootable by running Startup Repair. Startup Repair attempts to fix problems that keep Windows from loading. If this process fixes her computer, you would then take the proper steps to find and remove the malicious software that caused the issue in the first place.

Nathan, a long-time Mac user, has been using his Mac computer for some time now with no issues. Recently, however, he reported that his cursor turns into a pinwheel and he can't do anything.

Which of the following would be the BEST first step for troubleshooting this issue?

Determine if the problem is caused by software or hardware.

• When troubleshooting system lockups, a good place to start is to determine if the problem is being caused by software or hardware. Once you know that you can narrow your troubleshooting steps further.

As you are working on your Windows 10 computer during a fierce thunder storm, lightning strikes the nearby transformer, and your office loses all power. Since your laptop's battery is dead, your computer instantly turns off. Once power to the building has been restored, you turn your computer on and notice that you are now getting a missing DLL error message.

Which of the following tools is MOST likely to rectify this issue?

sfc

• System File Checker (SFC) is integrated with Windows Resource Protection, which protects registry keys and folders as well as critical system files. If any changes are detected to a protected system file, the modified file is restored from a cached copy located in the Windows folder itself.

Which of the following is the BEST step to try first when troubleshooting a Windows operating system problem?

Reboot the system.

• Rebooting is always the first step to try when troubleshooting an operating system error. Rebooting can clear the RAM, end tasks, allow the computer to cool down, and restart an interrupted update.

You have been troubleshooting services on your system. Where is the best place to check to make sure that they are now running properly?

Event Viewer

• The best place to check to make sure that services are running properly is Event Viewer. If services are not working properly, you can find error codes in Event Viewer that you can use to further troubleshoot the problem.

Your Windows OS starts to act strangely. You find out that there was a Windows automatic update three days ago.

Which of the following would be BEST to try first to resolve the issue?

Uninstall the update

• Windows allows you to roll back to the time before a new update (within a short window of time). Simply uninstalling the update is the best choice.

You've just connected a new USB device to your Windows system. You used the installation disc that came with the device to install the drivers needed to support the device. Since the installation, the system frequently crashes when you try to access the new device.

Which of the following steps would MOST likely resolve this issue?

Download and install the latest driver from the manufacturer's website.

• The first step is to download and install the latest driver for the device from the manufacturer's website.

Adding more RAM does not necessarily improve system performance. Which of the following must you also do to make sure that system performance does improve?

Upgrade the CPU to one with multiple cores.

• Adding more RAM by itself may not increase the speed of a sluggish system because increased RAM requires more processing power. Upgrading the CPU when you add RAM can improve system performance.

Which of the following troubleshooting utilities scans the operating system files and replaces corrupt files?

System File Checker

• System File Checker scans the operating system files and replaces corrupt files when possible.

You want to make sure that you always have the latest patches installed on your workstation for an order entry application created by the DataComLink corporation.

What should you do to ensure this?

The best way to make sure that an application is up to date include the following actions:

• Manually check the manufacturer's website regularly for software updates.

• Configure the application to automatically download and install updates as they are released.

You have just installed the latest Windows updates on your Windows 11 computer. After the computer has rebooted, you get the following error message:

Error: Windows failed to start. A recent hardware or software change might have caused the issue after you installed Windows updates.

Because your computer won't start, you have booted your computer into the Advanced Options section of the Windows 11 recovery environment (see image below).

While troubleshooting this issue, which of the advanced options would be the BEST to try first?

Start-up Repair

• The Startup Repair option scans your PC for problems like missing or damaged system files. It can't fix hardware issues or Windows installation problems, but it is the best first place to start if you are experiencing trouble booting into Window.

While running a presentation editor on your Windows 11 laptop, your computer locks up. When you try powering on your computer, Windows 11 will not start.

Which of the following tools should you use FIRST to try and resolve the issue?

Startup Repair

• Startup Repair is the first step you should attempt when trying to repair your Windows 11 operating system. The utility will go through and look at all of your startup files, the files that are needed to get Windows up and running, see if there's a file that's missing, any files that are corrupt, files that have been altered by malware, or anything else like that. It will then replace the bad files with a known good copy.

Which of the following is a tool that lets you revert a system's files and data from a previously saved point in time without changing documents, pictures, or email?

System Restore

• System Restore is a utility that allows you to revert the system back to a previously created restore point that does not change files like documents, photos, or email.

What tool can you use to create a full system image of your Windows drive?

Backup and Restore

• The Backup and Restore option can be used to create an image of a Windows 11 computer. A system image creates a full backup of your drive

You have recently purchased a Windows 11 laptop and have just installed several applications, including a graphics editor. Using the application, you have edited several images that you need to send to a company executive for a presentation.

However, you are experiencing problems using the application and are deciding whether or not to use the Reset this PC option to remove the application and try re-installing it.

What can you expect to happen if you use this option?

The laptop will be reset to the factory defaults.

You are given the choice to keep your edited images.

• When you use the Reset this PC option, Windows resets itself to its factory default settings. However, you are given the option to keep your files (such as the edited graphics) or remove everything (including the graphics files).

You are an IT technician for your company. Fred calls you to complain that every time he opens his internet browser, the default home page has been changed to a site he is not familiar with.

You suspect this change is being caused by a malware infection on his system. However, after you run antimalware and antivirus software on Fred's system, it is still having the same issue.

Which of the following would be the next BEST way to remove the malware?

Restore Fred's computer back to a previous restore point.

• Although all of the options could remove the malware and virus, the best first step is to try to restore the computer back to a restore point prior to the infection.

Micka, a tech-savvy employee, tried to upgrade her computer from Windows 10 to Windows 11 from the internet. Something went wrong during the upgrade, and Micka's computer will no longer boot to Windows. She has brought her computer to the IT department for you to repair.

You have tried to repair the computer, but you are unable to get it to boot to Windows.

Which of the following methods would be the QUICKEST way to get Micka's computer back to its original Windows 10 operating system?

Restore her system using the recovery partition.

• The recovery partition contains a Windows 10 factory image as it came fresh from the factory, including all of the correct drivers for its devices. Her system can be recovered using this partition, but all of her data will be lost.

System Restore has been enabled for all volumes on a Windows system.

Recently, a new network driver was installed on the system. However, the driver code contained bugs, and now your network board no longer functions. You are unable to access the internet to download an older version of the driver. You need to revert the system to a prior restore point that was taken before the driver was installed.

Click the option you would use to do this.

System Restore

• Select the System Restore option to revert the system to a prior restore point. This will restore the system to the state it was in when the restore point was taken, including the network board driver.

Which of the following is true about System Restore?

System changes made since the restore point was taken are undone.

• System changes made since the restore point was taken are undone. Any applications, device drivers, or patches installed since the restore point was taken will be removed when the system is reverted to that restore point.

To protect a Windows 11 system, you've configured System Restore to automatically protect your system using restore points. Will this adequately protect the user data on the system?

No. You need to enable File History.

• You also need to create a backup of your user data. You can do this using the File History or Backup and Restore (Windows 7) features

You have been troubleshooting startup errors on your Windows 11 computer by undoing recent changes, such as rolling back device drivers for a local printer and new graphics card while in Safe Mode.

However, the changes you are making are not resolving the startup errors.

Which of the following steps will MOST likely help you to find the specific cause of the error without the need to re-install Windows?

Disable and then enable devices and services one by one.

• If undoing recent changes does not fix the problem, you could disable all unnecessary devices and services. If you can boot normally, you can then identify the component that was causing the problem by enabling devices and services one by one until the system becomes unstable.

While using a Windows 11 system, you accidentally downloaded and installed a malware package from a phishing email exploit. You were able to reboot the system into Safe Mode and use System Restore to revert the system to a point in time before the malware infection occurred.

Given this information, which of the following are true?

After reverting the system to a prior restore point in this scenario, the following facts are true:

• Your user files were not affected when the system was reverted to the restore point.

• You must reinstall any applications that were installed after the restore point was taken.

System Restore is currently disabled for all volumes on a Windows 11 system. You need to enable System Protection for the C: volume.

Click the option you would select to do this.

Configure

• To enable system protection in this scenario, you would select the C: volume from the Available Drives list and then click Configure.

To protect user data on a Windows 11 system, you've configured System Restore to automatically create restore points for the C: volume.

Given that your user profile data is stored in the default directory (C:\Users), will this strategy adequately protect your users' data?

No. You need to enable File History.

No. You need to create a backup of your user data as well.

• Using restore points alone is an incomplete strategy for protecting user data. You should also use Backup and Restore (Windows 7) in Control Panel to back up user data or enable File History. This is because System Restore on Windows 11 maintains restore points for applications, device drivers, or patches installed since the restore point was taken. However, user data is not affected (include the user profile) by restore points. It remains the same.

You have decided to install a new Ethernet network adapter in your Windows 11 desktop computer. After installing the card and booting to Windows, you notice that you have no network connection. After looking in Device Manager, you see that the new network card was detected, but Windows doesn't know what it is.

After doing a quick search on the internet, you find what looks like the correct driver and install it. A reboot of Windows is performed, but almost immediately after logging on, your computer crashes. Thinking this must be a fluke, you reboot again with the same result.

Which of the following is the BEST method in this scenario to get Windows to load properly?

Boot to Safe Mode and uninstall the network driver.

• When a computer starts in Safe Mode, only the bare minimum background services that are very important to boot and run Windows are initialized. From this mode, you can then find the driver that is causing problems and uninstall it.

In which of the following situations would driver rollback be the BEST option to use?

You recently installed a new video driver, and now the system behaves erratically.

• Driver rollback would be best suited to a situation where you've installed a misbehaving driver and need to revert to an older version. Driver rollback preserves the old driver every time you install a newer driver. So, you could use driver rollback to uninstall the current driver and restore the previous version.

During the POST, you receive the following message:

Keyboard not present. Press F1 to continue.

What are the MOST likely causes of this error message?

A stuck key on the keyboard

A poor keyboard connection

• If the keyboard is not detected during the POST, the keyboard is probably not attached to the computer correctly. Check that the keyboard is securely connected to the keyboard port. While a bad keyboard will also result in this error, you should check the keyboard's connection to the computer before replacing the keyboard.

You've just installed several devices to a computer at once, but now the computer fails to boot properly.

Which of the following troubleshooting steps is the BEST to try first?

Remove all of the newly added devices and install them one at a time.

• When installing something, you should always install one device at a time. That way, if a problem occurs after the new device is installed, you know that the new device has caused the problem.

You have just finished installing a new Windows Update when your computer locks up. What should you do first?

Uninstall the Windows Update

• If you just completed a Windows Update, you should first uninstall the Windows Update to see if your computer returns to normal.

Which of the following are the FIRST settings you should check if you suspect that a malware attack has impacted your internet connection?

DNS settings

Proxy settings

• The two recommended settings you should check first are proxy and DNS settings. Adjusting the proxy settings can redirect the user to another location where the attacker can then integrate penetration tools to find vulnerabilities. A DNS server can be reconfigured to take a user outside the network and on to a similar web page.

An employee calls to complain that their browser keeps opening up to a strange search engine page, and a toolbar has been added to their browser.

Which of the following malware issues are MOST likely causing the problem?

Software issues

• Software issues can result in a browser opening to a strange search engine page and unwanted toolbars.

While browsing the internet, a pop-up browser window comes up, warning you that your system is infected with a virus. You are directed to click a link to remove the virus.

Which of the following are the BEST next actions to take?

Update the virus definitions for your locally installed anti-malware software

Run a full system scan using the anti-malware software installed on your system.

• This scenario is an example of a rogue antivirus attack. As such, you should assume that your system has been infected by some kind of malware, possibly by one of the sites you visited recently.

• You should first close your browser window and then update the virus definitions for your locally installed antivirus software. Next, you should run a full system scan using the antivirus software installed on your system.

You are an IT technician for your company. Vivian, an employee, has been receiving error messages, indicating that some of her Windows system files are corrupt or missing. To fix this issue, you ran the Windows System File Checker tool (SFC.exe).

Shortly after the files were repaired, Vivian called again because she is still having the same issue. You now suspect that a corruption or a renaming of the system files is being caused by malware.

Which of the following is the FIRST step you should take to remove any malware on the system?

Disconnect Vivian's computer from the network.

• When you suspect that a computer may be infected with malware, you should immediately disconnect (quarantine) the computer from the network to prevent propagation of the malware. After the computer is isolated, you can back up the computer and begin to remove the malware by using a virus removal program (anti-malware software) in Safe Mode.

Which of the following are likely symptoms of a malware infection?

Common symptoms of a malware infection include the following:

• Slow computer performance

• Internet connectivity issues

• Operating system lockups

• Windows update failures

• Renamed system files

• Disappearing files

• Changed file permissions

• Access denied errors

Which of the following terms describes a Windows 11 operating system patch for a desktop that targets a specific problem and is released on a short-term, periodic basis?

Hotfix

• A hotfix is an operating system patch that targets a specific problem.

What is the minimum amount of free space recommended for updating a 64-bit machine?

20 GB

• You should have at least 16 GB of free space to update your 32-bit machine, or 20 GB of free space to update your 64-bit machine.

Which of the following should you do FIRST when you suspect a malware infection?

Investigate and verify the malware symptoms.

• When you suspect a malware infection, you should investigate and verify that the symptoms are not from other causes before taking further steps

Which of the following is a common malware symptom?

Some common malware symptoms include the following:

• Devices running slow

• Files being deleted, renamed, or altered

• Heavy network traffic

• Inability to access the internet

• Increased pop-up ads

• False antivirus ads

Which of the following should you do immediately after a malware infection is confirmed?

Quarantine the infected system.

• If a malware infection is confirmed, you should immediately quarantine the system to prevent the malware from spreading through the network. You should remove the device from the network and disconnect any shared drives or connections.

Which of the following is the name for a special computer that is used for malware analysis?

Sheep dip computer

• A special computer that is designed for malware analysis is known as a sheep dip computer. A sheep dip computer has the following characteristics:

  • Is isolated from the network.

  • Has port monitors, file monitors, and anti-malware software.

  • Is used to analyze malware infections and clear the infections.

You are troubleshooting a malware infection. As part of the remediation process, you have used a USB drive to boot into a lightweight version of Windows.

Which of the following did you MOST likely boot into?

WinPE

• In this scenario, you have most likely booted into a WinPE environment. A Windows Pre-Installation environment (WinPE) is a lightweight version of Windows that boots from a USB drive and is typically used to help deploy Windows in an enterprise environment or to troubleshoot Windows issues.

You have been tasked with removing malware from an infected system. You have confirmed that there is an infection, and you continue running scans and removing the malware, but every time the system is rebooted, the malware comes back.

Which of the following should you do to help prevent this from happening?

Disable Windows System Restore

• The first step in the remediation process is to disable Windows System Restore. Many malware programs embed copies of themselves in the System Restore files so that if the computer is rebooted or a System Restore is attempted, the malware simply reinfects the machine. By disabling System Restore, the malware copy is removed and should not be able to reinfect the system.

After a malware infection has been fully remediated, you should re-enable System Restore and run a full system backup.

Which of the following is the BEST place to save this backup?

On an external drive

• After your computer has been cleared of a malware infection, perform a full system backup and save it to an external drive.

You are troubleshooting a malware infection. You have run multiple anti-malware scans, but remnants of the malware remain on the system.

Which of the following is your NEXT step?

Manually remove any files or Registry keys.

• Even after running anti-malware scans, remnants of the malware may remain. Do research to determine if specific files, Registry keys, or settings need to be manually taken care of.

Which of the following is the most important step in the post-remediation process?

Educate the end user on malware prevention.

• The last and most important step is to educate the end user on malware prevention. Many malware infections are caused because a user downloaded a file or clicked a link from an unknown source. Educating the user on proper computer safety is the most effective malware prevention technique.

After upgrading to the newest version of Windows, an important application is no longer running. Which of the following is the BEST option for troubleshooting the problem?

Enable Hyper-V to run the program on the previous version.

• If an application stops running after upgrading to a newer version of Windows, the issue most likely is a compatibility one. So enabling Hyper-V to create a virtual machine and then using the previous version of Windows to run the program would be the best option.

Which type of file is commonly used by trusted websites to create installation software for mobile devices?

APK Files

• Trusted websites that create installation software for handheld devices use APK files. These files have signatures on them that only allow the vendor to install software on the manufacturers' devices.

Your company is creating a financial application that you want to first test on mobile devices. Several customers have asked to be part of the beta testing process.

What do the employees need to do on their mobile devices in order to be able to participate in the beta test?

Turn on Developer Mode.

• Developer Mode is made for software companies and manufacturers to be able to create and test applications and features on mobile devices.

Which mobile device vulnerability results in a user unlocking all of a mobile device's features and capabilities?

Jailbreaking

• Jailbreaking a handheld device unlocks all the features and capabilities of that device. Once a mobile device is jailbroken, large holes in the operating system can be exploited, including the system files.

Which of the following are common symptoms of a compromised mobile device?

Two of the most common symptoms of a compromised mobile device are:

• Connectivity issues - If a device seems sluggish, it may be because an application is leaking data and using bandwidth to constantly transmit its own signal.

• Increased data usage - If you are experiencing an increased amount of data usage, this could be a telltale sign that there is an application

You have just visited a website on your mobile device when your web browser locks up, and you receive a warning that your device has a virus. You are given a phone number to call to remove the virus.

Which of the following describes the type of malware symptom that you are MOST likely experiencing?

False security warning

• Just like a normal desktop system, a mobile device can be the victim of a site that falsely purports to know that a virus was installed (the site might even lock your browser). These are false security warnings that will have address links or a phone number to call.