Altered, Missing, Renamed, or Inaccessible Files for A+
Short answer
Suspicious file-state behaviors include sudden mass renaming (e.g., odd extensions appended to many files), inability for multiple accounts (including admins) to open files, and unexpected changes in modification timestamps. Cloud sync conflicts and accidental user actions can mimic tampering; contextual clues and rapid scope of change help differentiate.
Why it appears on the exam
- Given a scenario with renamed files and ransom notes, choose the correct classification and initial containment actions. - Distinguish between sync-related missing files and mass tampering based on given evidence. - Identify which checks to perform to confirm whether files are encrypted versus moved or deleted.
Key concepts
Concept 1
Required terms
file tampering: Unauthorized modification, renaming, deletion, or encryption of files. inaccessible files: Files the user previously could open but now cannot access due to permission changes, encryption, or corruption. file tampering: unauthorized modification, renaming, deletion, or encryption of files. inaccessible files: files previously available that now return access errors.
Example
Example 1: Numerous personal documents now have an unfamiliar extension (".locked") and contain ransom notes in each folder.
Concept 2
How Altered, Missing, Renamed, or Inaccessible Files works
Suspicious file-state behaviors include sudden mass renaming (e.g., odd extensions appended to many files), inability for multiple accounts (including admins) to open files, and unexpected changes in modification timestamps. Cloud sync conflicts and accidental user actions can mimic tampering; contextual clues and rapid scope of change help differentiate.
Example
Example 2: A user cannot open work documents and receives "access denied" even when an admin account is used.
Concept 3
Common confusion
Sync services (OneDrive, Google Drive) may show files as "online-only" or conflict copies; technicians may mistake this for deletion. Always check sync status and verify whether multiple systems show the same missing files. Also avoid assuming corruption when permissions or encryption are the cause.
Example
Example 3: System or application files are missing after a user reports odd pop-ups and unexpected reboots.
Concept 4
Core 2 (220-1202) question cues
Given a scenario with renamed files and ransom notes, choose the correct classification and initial containment actions; Distinguish between sync-related missing files and mass tampering based on given evidence; Identify which checks to perform to confirm whether files are encrypted versus moved or deleted.
Example
Example 1: Numerous personal documents now have an unfamiliar extension (".locked") and contain ransom notes in each folder.
Sample questions
Select an answer to reveal the explanation. For tracked practice and weak-area review, use the Cultiv8 app.
Q1.An A+ support scenario describes this situation: Example 1: Numerous personal documents now have an unfamiliar extension (".locked") and contain ransom notes in each folder. Which answer fits best?
Q2.A technician sees this situation: Example 2: A user cannot open work documents and receives "access denied" even when an admin account is used. Which answer should they choose?
Q3.A user reports this support situation: Example 3: System or application files are missing after a user reports odd pop-ups and unexpected reboots. Which option should the technician choose?
Practice this lesson in Cultiv8
The app adds tracked practice, targeted remediation, saved session history, and future readiness scoring.
Continue in Cultiv8