Hard Difficulty Questions

The antivirus subscription has expired; renew it

Why wrong: While possible, the question states no prompts were seen; a disabled update service is a common cause that also explains the lack of prompts.

The user has manually set the antivirus to manual update mode

Why wrong: Manual mode would still show prompts or notifications; the lack of any prompts points to a service-level issue.

The computer is infected with a virus that blocks updates

Why wrong: Infection could block updates, but the technician found no other symptoms; the update service being disabled is a simpler and more common cause.

Disable the USB blocking Group Policy for the entire domain

Why wrong: Disabling the policy for the whole domain exposes all workstations to risk, not just the manager's.

Give the manager a company-approved USB drive and tell them to use it only once

Why wrong: Without changing the block policy, the drive will still be blocked; instructions alone do not remediate the technical restriction.

Create a local admin account on the manager's workstation and disable the USB block locally

Why wrong: Local changes can be overridden by Group Policy and create a security gap; it is better to manage via policy.

Reset the account password and enable MFA.

Why wrong: While these are important, the first step must be to disable the account to stop ongoing unauthorized access immediately.

Review the server logs to determine the extent of the breach.

Why wrong: Log review is important for investigation, but containment (disabling the account) should come first to prevent further damage.

Notify the employee's manager and HR department.

Why wrong: Notification is part of the incident response process, but the immediate technical step is to disable the compromised account.

The MDM profile is corrupt and needs to be re-pushed.

Why wrong: A corrupt MDM profile would likely prevent installation entirely, not cause the app to crash on launch.

The devices have insufficient storage space.

Why wrong: Insufficient storage would cause an installation failure, not a crash after successful installation.

The app is not signed with the correct enterprise certificate.

Why wrong: An incorrect signature would prevent installation entirely, not allow installation but crash on launch.

Perform a quick format of each drive.

Why wrong: A quick format only removes the file system index, not the actual data. Data can be easily recovered with software.

Overwrite the drives with zeros using a low-level format.

Why wrong: Overwriting can be effective, but it takes time and there is a risk that some data may remain on bad sectors. Degaussing is more thorough.

Physically destroy the drives with a hammer.

Why wrong: Physical destruction is secure but not efficient for multiple drives. Degaussing is faster and equally secure.

Ensure the UPS is connected to a grounded outlet before mounting.

Why wrong: While grounding is important, the immediate safety risk during installation is physical injury from the weight of the UPS.

Verify that the UPS batteries are charged before installation.

Why wrong: Battery charge is not a safety concern during installation. The primary risk is physical injury from lifting.

Install the UPS at the top of the rack for better airflow.

Why wrong: Installing heavy equipment at the top of a rack can make it top-heavy and unstable. The UPS should be installed at the bottom for stability.

Perform a full format on each drive.

Why wrong: A full format does not securely erase data; it can be recovered with specialized tools.

Overwrite each drive with zeros using a software tool.

Why wrong: While overwriting is effective, it may not be sufficient for all drives (e.g., SSDs with wear leveling) and is not as absolute as physical destruction.

Remove the drives and store them in a locked cabinet.

Why wrong: Storing drives does not destroy data; it only delays disposal and does not meet the destruction policy.

Break them into small pieces and place them in a sealed bag in the trash.

Why wrong: Breaking fluorescent tubes releases mercury vapor, which is toxic, and disposal in trash is illegal.

Place them in the regular recycling bin for glass.

Why wrong: Regular glass recycling facilities cannot handle mercury contamination; this can contaminate the entire batch.

Burn them in an industrial incinerator.

Why wrong: Incinerating fluorescent tubes releases mercury into the atmosphere, causing environmental harm.

Proceed with the firmware update and document the change afterward.

Why wrong: Proceeding without CAB approval violates change management policy, especially when the change plan is incomplete.

Use the old switch firmware on the new switch to match the documentation.

Why wrong: Using incompatible firmware could damage the switch or cause network issues, and it bypasses the proper process.

Implement the switch and create a separate change request for the firmware.

Why wrong: Implementing first and requesting later is risky; the CAB should be involved before making changes that deviate from the approved plan.

Attempt to roll back the update using the server’s built-in recovery options.

Why wrong: While attempting a rollback is logical, without a documented plan, the technician risks making the situation worse and should escalate first.

Continue troubleshooting until the maintenance window ends, then document the failure.

Why wrong: Continuing to troubleshoot without a plan risks exceeding the maintenance window, causing business impact, and delaying escalation.

Reboot the server to clear the error and retry the update.

Why wrong: Rebooting without understanding the error could lead to data loss or system instability, and does not address the lack of a rollback plan.

Disable the backup job immediately to restore network stability.

Why wrong: Disabling a scheduled backup without authorization could lead to data loss and violates change management.

Increase the network bandwidth to accommodate the backup traffic.

Why wrong: Increasing bandwidth without a change request bypasses the process and may not address the root cause.

Ignore the issue since the backup is a critical process.

Why wrong: Ignoring the outage is unacceptable; the impact must be documented and addressed.

Require a complex password with a minimum length of 20 characters

Why wrong: Complex passwords are important but can still be stolen or guessed; they do not provide a second factor.

Restrict VPN access to specific IP addresses

Why wrong: IP whitelisting can help but is not a second authentication factor and can be bypassed if the attacker uses an allowed IP.

Enable single sign-on (SSO) with Active Directory

Why wrong: SSO simplifies authentication but does not add a second factor; it still relies on a single password.

Review the VPN logs to determine the extent of the breach

Why wrong: Reviewing logs is important for forensics, but the immediate action should be to stop the ongoing access.

Change the VPN server's shared secret

Why wrong: Changing the shared secret affects the VPN server authentication, but the attacker is using a valid user account, so this would not stop them.

Notify the former employee about the security incident

Why wrong: Notifying the former employee is not a security action and could alert the attacker if they are monitoring communications.

Use SSH tunneling for all remote access

Why wrong: SSH tunneling provides encrypted access but does not natively support session recording for desktop sessions.

Configure the VPN to use PPTP instead of L2TP

Why wrong: Changing the VPN protocol does not add session recording capabilities; it only affects encryption and compatibility.

Deploy a VNC server on each remote workstation

Why wrong: VNC allows remote control but typically does not include session recording, and managing it across many workstations is complex.

Error handling with try-except

Why wrong: Incorrect. Error handling is important for robustness but not essential for the basic iteration and deletion logic.

A while loop with a counter

Why wrong: Incorrect. A while loop could work but is less natural for iterating over a collection of folders. A for loop is the standard approach.

A function to calculate date difference

Why wrong: Incorrect. Calculating date differences is necessary, but the question asks for the concept essential for iterating through folders, which is a loop.

Speak slowly and loudly, repeating each question until the user understands.

Why wrong: Speaking loudly can be perceived as condescending; it may also not address the core issue of accent comprehension.

Ask the user to transfer the call to a colleague who speaks English more clearly.

Why wrong: This is embarrassing for the user and avoids the problem rather than solving it professionally.

Proceed with remote access without further communication, assuming you can diagnose the issue visually.

Why wrong: This bypasses the need for clear communication but may miss important context; it also disregards the user's input.

System File Checker (sfc /scannow)

Why wrong: SFC scans and repairs corrupted system files, but it does not rebuild the Boot Configuration Data store.

Diskpart

Why wrong: Diskpart manages disk partitions and volumes; it cannot repair boot configuration data.

CHKDSK

Why wrong: CHKDSK checks the file system for errors but does not address boot configuration data issues.

Deployment Image Servicing and Management (DISM)

Why wrong: DISM is used to capture, mount, and service Windows images, but Sysprep must be run before capturing the image to generalize it.

Windows Preinstallation Environment (Windows PE)

Why wrong: Windows PE is a lightweight boot environment used for deployment and recovery, not for creating or customizing images.

Windows Assessment and Deployment Kit (Windows ADK)

Why wrong: Windows ADK is a collection of tools including DISM and Windows PE, but Sysprep is the specific tool needed to prepare the image.

System > Advanced system settings > Performance

Why wrong: Performance settings do not enforce desktop wallpaper policies.

Personalization > Background

Why wrong: Personalization is where you normally change the background, but it is grayed out due to policy; it does not show policy sources.

Ease of Access Center > Make the computer easier to see

Why wrong: Ease of Access Center provides accessibility options, not policy enforcement for desktop background.

Device Manager

Why wrong: Device Manager allows driver updates and rollbacks, but does not change system-wide driver signing enforcement.

Programs and Features > Turn Windows features on or off

Why wrong: Windows Features controls optional system components, not driver signing policies.

Administrative Tools > Services

Why wrong: Services manages running services, not driver signing enforcement.