Hard Difficulty Questions

Reset the account password and enable MFA.

Why wrong: While these are important, the first step must be to disable the account to stop ongoing unauthorized access immediately.

Review the server logs to determine the extent of the breach.

Why wrong: Log review is important for investigation, but containment (disabling the account) should come first to prevent further damage.

Notify the employee's manager and HR department.

Why wrong: Notification is part of the incident response process, but the immediate technical step is to disable the compromised account.

Ensure the UPS is connected to a grounded outlet before mounting.

Why wrong: While grounding is important, the immediate safety risk during installation is physical injury from the weight of the UPS.

Verify that the UPS batteries are charged before installation.

Why wrong: Battery charge is not a safety concern during installation. The primary risk is physical injury from lifting.

Install the UPS at the top of the rack for better airflow.

Why wrong: Installing heavy equipment at the top of a rack can make it top-heavy and unstable. The UPS should be installed at the bottom for stability.

find /var/www -type f -perm 4000

Why wrong: This searches for files with exactly permission 4000 (SUID only), but files may have other permissions as well, so it may miss many.

ls -la /var/www | grep '^...s'

Why wrong: This lists files and greps for SUID in the owner execute position, but it does not search recursively and may miss files in subdirectories.

chmod -R u+s /var/www

Why wrong: This command sets the SUID bit on all files, which is the opposite of what is needed and a security risk.

Proceed with the firmware update and document the change afterward.

Why wrong: Proceeding without CAB approval violates change management policy, especially when the change plan is incomplete.

Use the old switch firmware on the new switch to match the documentation.

Why wrong: Using incompatible firmware could damage the switch or cause network issues, and it bypasses the proper process.

Implement the switch and create a separate change request for the firmware.

Why wrong: Implementing first and requesting later is risky; the CAB should be involved before making changes that deviate from the approved plan.

Attempt to roll back the update using the server’s built-in recovery options.

Why wrong: While attempting a rollback is logical, without a documented plan, the technician risks making the situation worse and should escalate first.

Continue troubleshooting until the maintenance window ends, then document the failure.

Why wrong: Continuing to troubleshoot without a plan risks exceeding the maintenance window, causing business impact, and delaying escalation.

Reboot the server to clear the error and retry the update.

Why wrong: Rebooting without understanding the error could lead to data loss or system instability, and does not address the lack of a rollback plan.

Disable the backup job immediately to restore network stability.

Why wrong: Disabling a scheduled backup without authorization could lead to data loss and violates change management.

Increase the network bandwidth to accommodate the backup traffic.

Why wrong: Increasing bandwidth without a change request bypasses the process and may not address the root cause.

Ignore the issue since the backup is a critical process.

Why wrong: Ignoring the outage is unacceptable; the impact must be documented and addressed.

Require a complex password with a minimum length of 20 characters

Why wrong: Complex passwords are important but can still be stolen or guessed; they do not provide a second factor.

Restrict VPN access to specific IP addresses

Why wrong: IP whitelisting can help but is not a second authentication factor and can be bypassed if the attacker uses an allowed IP.

Enable single sign-on (SSO) with Active Directory

Why wrong: SSO simplifies authentication but does not add a second factor; it still relies on a single password.

Use SSH tunneling for all remote access

Why wrong: SSH tunneling provides encrypted access but does not natively support session recording for desktop sessions.

Configure the VPN to use PPTP instead of L2TP

Why wrong: Changing the VPN protocol does not add session recording capabilities; it only affects encryption and compatibility.

Deploy a VNC server on each remote workstation

Why wrong: VNC allows remote control but typically does not include session recording, and managing it across many workstations is complex.

Error handling with try-except

Why wrong: Incorrect. Error handling is important for robustness but not essential for the basic iteration and deletion logic.

A while loop with a counter

Why wrong: Incorrect. A while loop could work but is less natural for iterating over a collection of folders. A for loop is the standard approach.

A function to calculate date difference

Why wrong: Incorrect. Calculating date differences is necessary, but the question asks for the concept essential for iterating through folders, which is a loop.

Speak slowly and loudly, repeating each question until the user understands.

Why wrong: Speaking loudly can be perceived as condescending; it may also not address the core issue of accent comprehension.

Ask the user to transfer the call to a colleague who speaks English more clearly.

Why wrong: This is embarrassing for the user and avoids the problem rather than solving it professionally.

Proceed with remote access without further communication, assuming you can diagnose the issue visually.

Why wrong: This bypasses the need for clear communication but may miss important context; it also disregards the user's input.

Task Manager > Startup tab to check if the service is enabled.

Why wrong: Incorrect. The Startup tab in Task Manager shows startup programs, not Windows services.

Network and Sharing Center to run the network troubleshooter.

Why wrong: Incorrect. The troubleshooter may not detect a stopped service and cannot start it.

Device Manager to reinstall the network adapter driver.

Why wrong: Incorrect. The network adapter driver affects internet access, not the SMB service specifically.

System File Checker (sfc /scannow)

Why wrong: SFC scans and repairs corrupted system files, but it does not rebuild the Boot Configuration Data store.

Diskpart

Why wrong: Diskpart manages disk partitions and volumes; it cannot repair boot configuration data.

CHKDSK

Why wrong: CHKDSK checks the file system for errors but does not address boot configuration data issues.

Deployment Image Servicing and Management (DISM)

Why wrong: DISM is used to capture, mount, and service Windows images, but Sysprep must be run before capturing the image to generalize it.

Windows Preinstallation Environment (Windows PE)

Why wrong: Windows PE is a lightweight boot environment used for deployment and recovery, not for creating or customizing images.

Windows Assessment and Deployment Kit (Windows ADK)

Why wrong: Windows ADK is a collection of tools including DISM and Windows PE, but Sysprep is the specific tool needed to prepare the image.

System > Advanced system settings > Performance

Why wrong: Performance settings do not enforce desktop wallpaper policies.

Personalization > Background

Why wrong: Personalization is where you normally change the background, but it is grayed out due to policy; it does not show policy sources.

Ease of Access Center > Make the computer easier to see

Why wrong: Ease of Access Center provides accessibility options, not policy enforcement for desktop background.

Windows Security > Firewall & network protection

Why wrong: Firewall & network protection manages inbound and outbound rules, not folder access controls.

Windows Security > App & browser control

Why wrong: App & browser control manages SmartScreen and exploit protection settings, but not Controlled Folder Access.

Windows Security > Device security

Why wrong: Device security covers core isolation and security processor features, not ransomware-specific folder protection.

Settings > Personalization > Start

Why wrong: Start personalization only customizes the Start menu layout, it does not restrict the user to a single app.

Control Panel > User Accounts > Manage User Accounts

Why wrong: Manage User Accounts allows user creation and password changes, but does not provide kiosk mode functionality.

Local Group Policy Editor > Computer Configuration > Windows Settings > Security Settings

Why wrong: Group Policy can enforce many restrictions, but the simplest and most direct method for a single-app kiosk is the Settings app.

Settings > System > Power & battery > Battery saver

Why wrong: Battery saver settings turn on power-saving modes, but do not generate a usage report.

Control Panel > Power Options > Edit Plan Settings

Why wrong: Edit Plan Settings allows you to change when the display turns off and sleep timings, but does not provide a historical usage report.

Settings > Privacy & security > Diagnostics & feedback

Why wrong: Diagnostics & feedback controls data sent to Microsoft, not battery usage information.

Event Viewer > Windows Logs > System

Why wrong: The System log records driver and system component events, not user logon attempts.

Event Viewer > Applications and Services Logs > Microsoft > Windows > TerminalServices-LocalSessionManager

Why wrong: This log is specific to Remote Desktop session events, not all local logon attempts.

Computer Management > System Tools > Shared Folders > Sessions

Why wrong: Shared Folders shows current open sessions to shared resources, not historical logon events.

Run chkdsk /f

Why wrong: chkdsk checks for file system errors, not system file corruption.

Run System Restore

Why wrong: System Restore reverts system files to a previous state, but may not fix underlying image corruption.

Run Windows Update

Why wrong: Windows Update installs updates, but does not directly repair corrupted system files.

Single-user mode (Command + S).

Why wrong: Single-user mode boots to a root shell without the GUI, but it does not necessarily prevent third-party kernel extensions from loading. It is also not available on Apple Silicon Macs.

Verbose mode (Command + V).

Why wrong: Verbose mode displays boot-time log messages but does not restrict what loads. It is used for troubleshooting boot failures, not for security isolation.

Target Disk Mode (T key).

Why wrong: Target Disk Mode turns the Mac into an external disk for another computer. It does not restrict what loads on the Mac itself; the malware would still be present on the disk.