Q1. A user is experiencing a critical issue where their Linux server repeatedly reboots shortly after startup, and they can only access it via the console. They have managed to capture the last few lines of kernel messages before the reboot, which include 'Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)'. What is the MOST likely cause of this kernel panic?
-
A faulty power supply unit.
-
Corrupted bootloader configuration.
-
A missing or incorrect filesystem driver in the initramfs. ✓ Correct
-
Overheating CPU.
Why: The 'VFS: Unable to mount root fs' error specifically indicates that the kernel cannot find or access the root filesystem. This is often because the initial RAM filesystem (initramfs), which contains essential drivers and scripts needed to mount the actual root filesystem, is missing the necessary driver for the disk or is misconfigured. A faulty PSU or overheating CPU would typically lead to more generic kernel panics or unexpected shutdowns. A corrupted bootloader might prevent the OS from booting entirely or load the wrong kernel, but this specific error points to a problem *after* the kernel has started loading but *before* it can mount the root filesystem.
Q2. A user reports that their macOS laptop is consistently experiencing very slow performance, especially when multitasking. Applications take a long time to launch, and switching between them is laggy. They have checked Activity Monitor and noticed that 'kernel_task' is consistently consuming a very high percentage of CPU and memory. What is the MOST likely reason for this behavior?
-
A malfunctioning internal solid-state drive (SSD).
-
An issue with the macOS update service.
-
A hardware problem that is causing the system to throttle performance. ✓ Correct
-
Malware actively running in the background.
Why: On macOS, when the system detects a hardware issue, particularly with thermal management (like an overheating battery or faulty sensor), it can cause the 'kernel_task' process to consume excessive CPU resources. This is a protective measure by the OS to limit system performance and prevent further damage. While a malfunctioning SSD or malware could cause slowdowns, they wouldn't typically manifest as high 'kernel_task' CPU usage. An update service issue is less likely to cause such a persistent and high system resource drain attributed to the kernel task itself.
Q3. A customer is trying to install a new application on their Windows 11 PC, but the installation process repeatedly fails with the error message: '0x80070005 Access Denied'. They are logged in as a standard user. What is the FIRST troubleshooting step you should recommend?
-
Run the application installer with administrative privileges. ✓ Correct
-
Check the system's available disk space.
-
Verify the integrity of the application's installation files.
-
Temporarily disable the antivirus software.
Why: The 'Access Denied' error (0x80070005) during software installation almost invariably indicates that the installer lacks the necessary permissions to write files or modify system settings. Since the user is logged in as a standard user, they do not have these permissions. Running the installer 'as administrator' provides the elevated privileges required. While checking disk space, verifying file integrity, or disabling antivirus might resolve other installation issues, they do not directly address an 'Access Denied' error related to insufficient user privileges.
Q4. A user reports that after a recent Windows update, their Microsoft Office applications (Word, Excel, Outlook) are crashing intermittently when opening specific file types (e.g., .docx, .xlsx). System restore to a point before the update resolves the issue temporarily, but it returns after the next update. Event Viewer shows 'Application Error' events with the faulting module often identified as 'ntdll.dll' or specific Office DLLs. What is the MOST likely underlying cause?
-
A hardware failure in the RAM modules.
-
Corrupted Office installation files.
-
An incompatibility introduced by the recent Windows update. ✓ Correct
-
A network drive mapping issue affecting file access.
Why: The fact that the issue is resolved by rolling back a Windows update and reappears after the next update strongly suggests a software conflict or incompatibility introduced by the update itself. While RAM failure or corrupted Office files can cause crashes, they wouldn't typically be fixed by a Windows update rollback and then reappear with a subsequent update. Network drive issues might cause problems opening files but are unlikely to result in 'ntdll.dll' or Office-specific DLL faults that are resolved by system restore.
Q5. A user is experiencing a persistent BSOD (Blue Screen of Death) on their Windows 10 machine. The stop code displayed is 'IRQL_NOT_LESS_OR_EQUAL'. They have recently installed a new piece of hardware, a high-performance external USB capture card. What is the MOST likely cause of this BSOD?
-
A corrupted MBR (Master Boot Record).
-
A faulty RAM module.
-
An unstable or incompatible device driver for the new hardware. ✓ Correct
-
An issue with the Windows update service.
Why: The 'IRQL_NOT_LESS_OR_EQUAL' BSOD error often indicates that a driver attempted to access memory it shouldn't have, typically due to improper driver operation. Installing new hardware is a common trigger, as the associated driver may be unstable, incompatible with the current Windows version, or incorrectly installed. While faulty RAM can cause various BSODs, this specific error code points more strongly towards a driver issue. A corrupted MBR would usually prevent the system from booting altogether, and a Windows update service issue wouldn't typically manifest as a BSOD immediately after hardware installation.
Q6. A user reports that their Windows 10 system occasionally fails to shut down properly, requiring them to hold the power button. When they restart, Event Viewer shows Event ID 6008: 'The previous system shutdown was unexpected.' They have recently uninstalled a complex piece of system utility software. What is the MOST likely cause of the shutdown failures?
-
A failing power supply unit (PSU).
-
Registry corruption caused by the uninstallation.
-
A driver conflict remaining after the software removal. ✓ Correct
-
The system is infected with a rootkit.
Why: Complex system utilities often install deep system hooks or drivers that may not be completely removed during uninstallation. This can lead to residual conflicts that interfere with critical system processes like shutdown, resulting in Event ID 6008. While registry corruption is possible, a specific driver conflict is a more common outcome of incomplete uninstallation of such software. A failing PSU would likely cause unexpected shutdowns or reboots at other times, not specifically during the shutdown sequence. A rootkit is a serious infection, but it usually aims to hide its presence and doesn't typically cause straightforward shutdown failures unless it actively interferes with core OS functions.
Q7. A user reports that their workstation unexpectedly restarts immediately after logging into Windows. Event Viewer under 'System' logs a critical error with Event ID 41 from the Kernel-Power source, but provides no specific cause. The user recently installed a new graphics driver. What is the MOST appropriate FIRST step to troubleshoot this issue?
-
Perform a clean boot of Windows to isolate background services and startup programs.
-
Roll back the recently installed graphics driver to a previous version. ✓ Correct
-
Run `sfc /scannow` to check for corrupted system files.
-
Disable the Windows Error Reporting service to prevent future logs.
Why: The user specifically reported installing a new graphics driver immediately before the problem started, and Event ID 41 often indicates a system instability issue. Rolling back the driver directly addresses the most probable recent change that could cause this instability. A clean boot is a good general troubleshooting step for random restarts, but it's less targeted than addressing the known recent driver installation. Running `sfc /scannow` is for system file corruption, which is not indicated by the described symptoms. Disabling error reporting would hinder future diagnostics, not solve the current problem.
Q8. A user's Windows 11 workstation displays a message at boot stating "Your device ran into a problem and needs to restart" with a stop code of CRITICAL_PROCESS_DIED. The system reboots into the same error repeatedly and never reaches the desktop. The issue began immediately after a driver update was pushed the previous night. Which of the following is the BEST FIRST step to restore functionality?
-
Boot into the Windows Recovery Environment and use System Restore to revert to a point before the driver update ✓ Correct
-
Perform a clean installation of Windows 11 from bootable USB media
-
Run chkdsk /r from the Recovery Environment command prompt to repair the file system
-
Access the BIOS/UEFI and disable Secure Boot to allow the driver to load
Why: System Restore reverts system files, drivers, and registry settings to a pre-update state without touching user data, directly addressing the bad driver that caused the boot loop. A clean installation is far too destructive and time-consuming as a first step when a targeted rollback is available. chkdsk /r addresses disk/file-system corruption, but the symptom timeline points clearly to a driver, not a failing volume. Disabling Secure Boot does not remove or roll back the faulty driver and could introduce new security exposure without fixing the loop.
Q9. A user reports that their Android smartphone battery drains from full to empty within about three hours, the device feels warm even when idle, and they notice a game app they never launch appears in the recent-battery-usage list at the top. The problem started after they installed several free apps from a third-party site outside the official store. Which action BEST addresses the MOST likely cause?
-
Boot the phone into Safe Mode to confirm the behavior stops, then uninstall the recently sideloaded apps ✓ Correct
-
Replace the battery, as the rapid drain indicates a failing cell
-
Perform a full factory reset immediately to clear all settings
-
Disable mobile data and Wi-Fi to reduce background network usage
Why: The signs\u2014excessive drain, heat while idle, and an unused app consuming battery after sideloading from an untrusted source\u2014point to a rogue or malicious app; Safe Mode disables third-party apps to confirm the diagnosis before targeted removal. Replacing the battery treats a hardware symptom while ignoring the clear software timeline. A factory reset is more disruptive than necessary as a first response and skips confirming the root cause. Disabling connectivity only masks the network activity and does not stop the app's underlying resource consumption or heat.
Q10. A Windows 10 user reports that every time they open their web browser, the home page redirects to an unfamiliar search engine, pop-ups appear on trusted sites, and new toolbars they did not install are present. The corporate endpoint scan shows no active infection. Following the malware removal best-practice methodology, what should the technician do NEXT after identifying and researching the symptoms?
-
Quarantine the affected system and disable System Restore before remediation ✓ Correct
-
Educate the end user about safe browsing habits
-
Re-enable System Restore and create a fresh restore point
-
Schedule scans and run updates to prevent reinfection
Why: In the CompTIA malware removal procedure, after identifying and researching symptoms, the next step is to quarantine the infected system and disable System Restore so infected files cannot be preserved in restore points during cleanup. Educating the user and re-enabling System Restore with a new restore point are final steps performed only after remediation is complete. Scheduling scans and running updates occurs during the remediation phase, not before quarantine. Performing these later steps first would risk spreading the infection or reinfecting from a compromised restore point.