💻 1. Windows Administration (Questions 1–20)
1. How do you repair corrupted system files using SFC and DISM?
- Open CMD as Administrator.
- Run DISM image repair first:
DISM /Online /Cleanup-Image /RestoreHealth (pulls clean binaries from Windows Update/WIM). - Run System File Checker:
sfc /scannow to scan and replace corrupt system files.
2. What is the difference between HKEY_LOCAL_MACHINE (HKLM) and HKEY_CURRENT_USER (HKCU)?
- HKLM: Contains global hardware, boot, driver, and software settings applying to all users on the system.
- HKCU: Contains user-specific profile settings (desktop background, mapped network drives, app preferences) for the currently logged-in user.
3. How do you backup and restore a Windows Registry hive?
- Export: Open
regedit → Right-click desired key/hive → Select Export → Save as .reg file. - Restore: Double-click the
.reg file or open regedit → File → Import.
4. What are the four Startup Types for Windows Services in services.msc?
- Automatic: Starts automatically during OS boot.
- Automatic (Delayed Start): Starts shortly after boot to reduce boot congestion.
- Manual: Triggered on-demand by the OS, application, or user.
- Disabled: Prevented from starting under any circumstances.
5. What is the difference between System Log, Application Log, and Security Log in Event Viewer?
- System Log: Logs events logged by OS components, drivers, and system services (e.g., disk errors, driver failures).
- Application Log: Logs errors and events generated by installed applications (e.g., Outlook crash, SQL error).
- Security Log: Logs audit events such as valid/failed logon attempts, file deletion audits, and privilege usage.
6. What Event IDs are critical for troubleshooting Windows logons and shutdowns?
Event ID 4624: Successful user logon.Event ID 4625: Failed user logon attempt.Event ID 6005: Event log service started (System startup).Event ID 6006: Event log service stopped (Clean shutdown).Event ID 41: System rebooted without cleanly shutting down first (Kernel-Power crash).
7. How do you monitor CPU and Memory leaks using Performance Monitor (perfmon)?
Open perfmon.msc → Add Data Collector Set → Select counters like Process(\*)|\% Processor Time and Process(\*)\Private Bytes over time to observe memory growth without release.
8. What is Reliability Monitor and how do you access it?
A graphical timeline tool providing a daily stability index (1-10) showing application crashes, Windows update failures, and hardware errors. Access by running perfmon /rel.
9. What is the difference between Safe Mode and Safe Mode with Networking?
- Safe Mode: Loads bare-minimum essential drivers and GUI services; disables network interface drivers.
- Safe Mode with Networking: Loads minimal drivers plus network interface drivers and TCP/IP stack to enable LAN/Internet connectivity.
10. How do you enter Windows Recovery Environment (WinRE) when Windows fails to boot?
Interrupt normal boot process 3 consecutive times (holding power button), or boot from Windows Installation Media → Click Repair your computer.
11. What is the SoftwareDistribution folder in Windows?
Located at C:\Windows\SoftwareDistribution, it temporarily caches downloaded Windows Update patches before installation. Clearing it resolves stuck update issues.
12. How do you manually reset Windows Update components via command line?
- Stop update services:
net stop wuauserv and net stop bits. - Rename cache folders:
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old. - Restart update services:
net start wuauserv and net start bits.
13. What is execution policy in PowerShell and how do you bypass it safely?
A safety feature controlling script execution levels (Restricted, RemoteSigned, Unrestricted). Bypass temporarily for a single script: powershell.exe -ExecutionPolicy Bypass -File script.ps1.
14. What PowerShell Cmdlet gets a list of running services on a machine?
Get-Service | Where-Object {$_.Status -eq 'Running'}
15. How do you remotely restart a machine using PowerShell?
Restart-Computer -ComputerName "HOSTNAME" -Force
16. What is DISM (Deployment Image Servicing and Management)?
A command-line tool used to service Windows images (.wim/.ffu), prepare system recovery environments, enable OS features, and repair system health.
17. How do you find the Uptime of a Windows PC using PowerShell?
(Get-CimInstance Win32_OperatingSystem).LastBootUpTime
18. What is the purpose of the Pagefile.sys file in Windows?
A hidden virtual memory file on disk used by OS when physical RAM utilization is exhausted or to offload inactive RAM pages.
19. How do you check if a Windows license is activated via command line?
Run slmgr.vbs /dli or slmgr.vbs /xpr in CMD.
20. What is user profile corruption and how do you resolve it?
Occurs when `NTUSER.DAT` fails to load during logon. Fixed by backing up user data, deleting corrupted profile entry under HKLM\Software\Microsoft\Windows NT\CurrentVersion\ProfileList, and recreating the profile on next logon.
🔑 2. Active Directory (Questions 21–35)
21. What is the difference between Security Groups and Distribution Groups in AD?
- Security Groups: Used to assign permissions to resources (files, folders, printers) AND can be used for email distribution.
- Distribution Groups: Used exclusively for email broadcast lists; cannot be used to assign resource access permissions.
22. What is Kerberos and which default port does it run on?
The default ticket-based authentication protocol in Active Directory domains using tickets (TGT/TGS) issued by KDC. Runs on **Port 88**.
23. How do you force Group Policy update on a client machine?
Run gpupdate /force in CMD/PowerShell.
24. What command generates a detailed HTML Group Policy result report for a user?
gpresult /h C:\gpreport.html
25. What is the order of Group Policy processing (LSDOU)?
Local Policy → Site → Domain → Organizational Unit (OU). Settings applied later override earlier settings unless "Enforced" is enabled.
26. How do you unlock a locked user account in Active Directory?
Open dsa.msc → Right-click User → **Properties** → **Account** tab → Check **Unlock Account** → Apply.
27. What causes repetitive Account Lockouts and how do you trace them?
Caused by cached old passwords in mapped drives, mobile devices, scheduled tasks, or services. Traced using Microsoft Account Lockout Status tool (LockoutStatus.exe) or checking Event ID 4740 on the PDC.
28. What are FSMO Roles in Active Directory?
Flexible Single Master Operation roles (Schema Master, Domain Naming Master, RID Master, PDC Emulator, Infrastructure Master) that perform specialized domain tasks.
29. Which FSMO role handles time synchronization and password changes?
The **PDC Emulator (Primary Domain Controller Emulator)**.
30. What command tests Active Directory replication status?
repadmin /replsummary or repadmin /showrepl
31. What is SYSVOL folder and why is it important?
A domain-wide shared directory stored on Domain Controllers holding Group Policy templates (GPT) and startup/logon scripts replicated across DCs via DFSR.
32. How do you fix "The trust relationship between this workstation and the primary domain failed"?
- Log in using local administrator account.
- Unjoin domain to Workgroup & restart.
- Rejoin machine to domain with valid domain admin credentials & restart.
- Alternatively, run PowerShell:
Test-ComputerSecureChannel -Repair.
33. Why is DNS essential for Active Directory functionality?
AD relies on DNS SRV records (located in `_msdcs` zone) to locate Domain Controllers, Global Catalogs, and Kerberos KDC authentication services.
34. What is the difference between Fine-Grained Password Policy (FGPP) and default Domain Password Policy?
Default policy applies globally to all domain users. FGPP allows admins to apply distinct password/lockout policies to specific users/groups via Password Settings Objects (PSOs).
35. What is tombstone lifetime in Active Directory?
The period (default 180 days) during which deleted AD objects remain in tombstone state before permanent garbage collection removal.
☁️ 3. Microsoft 365 (Questions 36–50)
36. What is the difference between Microsoft 365 Shared Mailbox and User Mailbox?
- User Mailbox: Requires a paid license; used by a single individual with personal login credentials.
- Shared Mailbox: Free up to 50GB (no license required); accessed by multiple delegates granted full access/send-as permissions.
37. How do you assign Full Access and Send As permissions to a Shared Mailbox?
In Exchange Admin Center (EAC) → Mailboxes → Select Shared Mailbox → **Delegation** → Add user under **Read and manage (Full Access)** and **Send as**.
38. What do you do when Microsoft Teams crashes or shows a blank white screen?
Quit Teams completely → Clear Teams cache folder: delete all files under %appdata%\Microsoft\Teams (Classic) or %localappdata%\Packages\MSTeams_8wekyb3d8bbwe (New Teams) → Relaunch.
39. How do you troubleshoot OneDrive sync errors?
- Check system tray icon status.
- Pause and resume sync.
- Reset OneDrive client: run
%localappdata%\Microsoft\OneDrive\onedrive.exe /reset.
40. What is the difference between SharePoint Online and OneDrive for Business?
- OneDrive: Personal cloud storage for individual user files and drafts.
- SharePoint: Team-based document management repository for organization-wide site sharing and collaboration.
41. How do you re-register a user for Multi-Factor Authentication (MFA) in Entra ID?
Open Microsoft Entra Admin Center → Users → Select User → **Authentication methods** → Click **Require re-register MFA**.
42. What is Message Trace in Exchange Online Admin Center?
A tool used to track delivery status, bounces, spam filtering decisions, and transport rules for emails entering or leaving M365 tenant over the past 90 days.
43. What is Autodiscover in Microsoft Outlook?
An Exchange service using XML/DNS queries (`autodiscover.domain.com`) to automatically configure Outlook client mail server settings using the user's email address.
44. How do you troubleshoot Outlook stuck on "Loading Profile"?
- Kill `outlook.exe` in Task Manager.
- Launch in Safe Mode (`outlook.exe /safe`).
- Disable hardware graphics acceleration.
- Recreate Outlook profile via Control Panel → Mail.
45. What is the difference between Microsoft 365 Exchange Online Plan 1 and Plan 2?
- Plan 1: 50 GB Mailbox storage, no archive limit/In-Place Hold.
- Plan 2: 100 GB Mailbox storage, unlimited Auto-Expanding Archiving, In-Place Hold, and DLP support.
46. How do you soft-delete vs hard-delete a user in Microsoft 365?
- Soft-Delete: Deleting a user moves them to Deleted Users for 30 days (restorable).
- Hard-Delete: Permanently deleting via PowerShell:
Remove-MsolUser -UserPrincipalName "user@domain.com" -RemoveFromRecycleBin.
47. What is Litigate Hold (In-Place Hold) in M365?
Preserves all mailbox items (including deleted items and edited versions) for legal compliance and eDiscovery purposes.
48. How do you fix "Out of Office (OOF) replies not working externally"?
Check Exchange Admin Center → Mail flow → Remote domains → Ensure **Allow external automatic replies** is enabled for the default domain setting.
49. What is Dynamic Distribution Group in Exchange Online?
A distribution list whose membership is dynamically calculated based on recipient filters/attributes (e.g., Department = "Sales") rather than static user selection.
50. What command updates or checks M365 PowerShell modules?
Install-Module -Name ExchangeOnlineManagement -AllowClobber
🌐 4. Networking (Questions 51–65)
51. What are the 7 layers of the OSI Model?
1. Physical, 2. Data Link, 3. Network, 4. Transport, 5. Session, 6. Presentation, 7. Application.
52. What is the difference between TCP and UDP?
- TCP (Transmission Control Protocol): Connection-oriented, reliable, guarantees packet delivery via 3-way handshake (e.g., HTTP, HTTPS, SSH).
- UDP (User Datagram Protocol): Connectionless, faster, no delivery guarantee (e.g., VoIP, DNS, Video Streaming).
53. What is the TCP 3-Way Handshake?
The process to establish a reliable connection: **SYN → SYN-ACK → ACK**.
54. What is a Subnet Mask?
A 32-bit number that segregates an IP address into Network ID and Host ID portions (e.g., 255.255.255.0 = `/24`).
55. What is the difference between DNS A Record, CNAME, MX, and TXT Records?
- A Record: Maps Hostname to IPv4 address.
- CNAME: Alias mapping one domain to another domain.
- MX Record: Points to mail servers handling email for the domain.
- TXT Record: Holds text data (SPF, DKIM, DMARC verification).
56. What is the DHCP DORA process?
Discover → Offer → Request → Acknowledge.
57. What is VLAN and why is it used?
Virtual Local Area Network (VLAN) logically segments a physical switch into distinct broadcast domains for enhanced security, traffic control, and management.
58. What is NAT (Network Address Translation)?
Translates private IP addresses from a local network (LAN) into a single public IP address to traverse the Internet.
59. What is the difference between a Layer 2 Switch and a Router?
- Switch (L2): Connects devices inside the same LAN using MAC addresses.
- Router (L3): Connects different subnets/networks together using IP routing tables.
60. What is VPN and how does Split Tunneling work?
Virtual Private Network creates an encrypted tunnel across public networks. **Split Tunneling** routes corporate traffic through the secure VPN while allowing public Internet traffic to bypass the tunnel directly.
61. What command tests port connectivity to a remote server on Windows?
Test-NetConnection -ComputerName "ServerIP" -Port 443 (PowerShell) or telnet ServerIP 443.
62. How do you resolve Wi-Fi "Connected, no Internet"?
- Check IP assignment via
ipconfig (look for APIPA `169.254.x.x`). - Ping Default Gateway & public IP (`8.8.8.8`).
- Flush DNS and reset Winsock:
netsh winsock reset. - Check corporate proxy or captive portal requirements.
63. What is ARP (Address Resolution Protocol)?
Resolves dynamic IPv4 addresses to physical 48-bit MAC addresses. View ARP table using arp -a.
64. What ports are used for HTTP, HTTPS, SSH, SMTP, and SMB?
- HTTP: **80** | HTTPS: **443** | SSH: **22** | SMTP: **25/587** | SMB: **445**
65. What is a Default Gateway?
The router interface IP on a local subnet responsible for forwarding packets destined for external networks outside the LAN.
🛠️ 5. Hardware & OS Troubleshooting (Questions 66–80)
66. How do you analyze a Blue Screen of Death (BSOD) crash minidump?
Use Microsoft **WinDbg** or **BlueScreenView** to load crash dump files (`.dmp`) located in C:\Windows\Minidump to locate the faulting driver `.sys` file or memory address.
67. What are common BSOD stop codes and their meanings?
CRITICAL_PROCESS_DIED: Essential OS process terminated unexpectedly.DRIVER_IRQL_NOT_LESS_OR_EQUAL: Faulty driver accessing illegal memory.PAGE_FAULT_IN_NONPAGED_AREA: Defective RAM or corrupt system file.INACCESSIBLE_BOOT_DEVICE: Corrupt storage driver or missing AHCI/NVMe controller mode.
68. How do you test a physical Hard Drive or SSD for bad sectors?
Run chkdsk C: /f /r or check SMART health attributes using tools like CrystalDiskInfo or vendor diagnostics (Dell ePSA, HP Vision).
69. What is the key performance difference between SATA SSD and NVMe SSD?
- SATA SSD: Capped at SATA III bus speed limit (~550 MB/s).
- NVMe SSD: Connects directly over PCIe bus lines achieving speeds up to 3500–7000+ MB/s.
70. How do you update laptop motherboard BIOS/UEFI safely?
Ensure laptop is connected to AC wall power with >50% battery → Download official BIOS flash executable from manufacturer site → Run update and do not interrupt or power off during execution.
71. What do BIOS Beep Codes signify during boot failure?
POST diagnostic warning patterns indicating hardware initialization failures before video initialization (e.g., 1 beep = motherboard, 2-3 beeps = RAM failure/missing, 5 beeps = CPU failure).
72. How do you resolve a laptop display showing black screen but power light is on?
- Connect external monitor to test GPU output.
- Press
Win + Ctrl + Shift + B to restart graphics driver. - Perform hard power reset (flea power drain).
- Reseat RAM sticks.
73. What is PXE Boot and how is it used in OS Deployment?
Preboot Execution Environment boots a PC directly over the network via NIC to download and install OS images from a WDS/MDT/SCCM server.
74. What is Sysprep and why is it mandatory before imaging a machine?
System Preparation Tool (`sysprep.exe /generalize /oobe`) removes machine-specific unique identifiers (SID, GUIDs) so the image can be safely cloned to multiple endpoints.
75. How do you deploy Windows images remotely using Sysprep & WDS/MDT?
Capture a master generalized image → Import into Windows Deployment Services (WDS) or Microsoft Deployment Toolkit (MDT) → PXE boot target PCs over network to deploy image automatically.
76. What is the difference between Quick Format and Full Format?
- Quick Format: Removes file system header index without checking for bad sectors (data recoverable).
- Full Format: Overwrites disk blocks with zeros and scans entire drive for bad physical sectors.
77. How do you troubleshoot a printer printing blank pages?
Check ink/toner levels → Print internal self-test page from printer console → Remove protective tape on cartridge → Reinstall correct vendor-specific print driver.
78. How do you fix Windows Quick Assist / Remote Desktop refusing connections?
Verify target machine allows remote connections under System Properties → Check Windows Firewall Port 3389 inbound rule → Ensure target user is added to Remote Desktop Users group.
79. What causes High Disk Usage (100%) in Windows 10/11?
SysMain (Superfetch) service, Windows Search indexing, active background Windows Updates, or failing mechanical hard drives.
80. How do you resolve a corrupted USB flash drive that won't format in GUI?
Open CMD as Admin → Run diskpart → list disk → select disk X → clean → create partition primary → format fs=ntfs quick.
🔒 6. Security (Questions 81–90)
81. What is BitLocker Drive Encryption and what is TPM?
BitLocker encrypts the entire volume. **TPM (Trusted Platform Module)** is a dedicated microchip on the motherboard that securely stores BitLocker cryptographic keys and verifies system boot integrity.
82. Where is BitLocker Recovery Key stored in a Domain or M365 environment?
Automatically backed up to Active Directory Domain Services (computer object properties) or Microsoft Entra ID (Azure AD) cloud portal.
83. How do you block unauthorized USB storage devices via Group Policy?
In GPMC → Computer Configuration → Administrative Templates → System → Removable Storage Access → Enable **"Removable Disks: Deny read access"** and **"Deny write access"**.
84. What is the difference between Antivirus and EDR (Endpoint Detection and Response)?
- Antivirus: Focuses on static signature matching to block known malware before execution.
- EDR: Records 24/7 endpoint telemetry, detects behavioral anomalies (IOAs), fileless execution, and provides remote isolation capabilities.
85. How do you isolate a malware-infected machine on an enterprise network?
- Disconnect physical Ethernet cable and turn off Wi-Fi immediately.
- Trigger Host Isolation via EDR console (e.g., CrowdStrike/Defender).
- Do NOT power off if memory forensics is required; notify Security Operations Center (SOC).
86. What is LAPS (Local Administrator Password Solution)?
An automated tool that manages and rotates local Administrator account passwords across domain-joined machines, storing randomized unique passwords securely in AD/Entra ID.
87. What is Phishing and how do you analyze a suspicious email?
Social engineering attack attempting to steal credentials. Analyze by inspecting full email headers (SPF/DKIM/DMARC alignment), checking sender domain typos, and scanning links/attachments in a sandbox.
88. How do you configure Windows Firewall inbound/outbound rules via CLI?
netsh advfirewall firewall add rule name="BlockPort" dir=in action=block protocol=TCP localport=445
89. What is WSUS / Patch Management?
Windows Server Update Services centrally manages, tests, and distributes Microsoft software security patches and updates to enterprise endpoints based on corporate schedules.
90. What is the Principle of Least Privilege (PoLP)?
Security concept ensuring users and accounts are granted only the minimum necessary permissions required to perform their explicit job responsibilities.
📊 7. ITIL & Service Desk (Questions 91–100)
91. What is the difference between an Incident and a Service Request?
- Incident: An unplanned interruption or reduction in quality of an IT service (e.g., printer offline, server down).
- Service Request: A formal user request for something to be provided (e.g., request for new laptop, password reset, software install).
92. What is Problem Management in ITIL?
Process focused on identifying and managing the underlying **root cause** of recurring incidents to prevent future occurrences.
93. What is Change Management (Change Enablement)?
Process ensuring risk-assessed, standardized procedures are followed for approving and deploying infrastructure/software modifications without causing downtime.
94. What is a Service Level Agreement (SLA)?
A formal contract between IT service provider and business defining performance targets, response times, and resolution windows based on ticket priority.
95. What are ticket Priority levels and how are they calculated?
Priority = **Impact** (number of affected users/systems) x **Urgency** (business criticality). Categories range from P1 (Critical/Outage) to P4 (Low/Individual request).
96. What is an Escalation Matrix?
A defined hierarchical workflow specifying when and how a ticket should be passed from L1 → L2 → L3 or specialized engineering teams when SLAs are breached or advanced support is required.
97. What is Root Cause Analysis (RCA)?
A structured problem-solving methodology (e.g., 5 Whys, Fishbone Diagram) used to discover the fundamental cause of a major IT failure.
98. Why is maintaining an IT Knowledge Base (KB) important?
Reduces Mean Time to Resolve (MTTR), standardization of troubleshooting steps, enables tier-1 first-contact resolution, and supports user self-service portals.
99. How do you handle a SLA breach on a ticket assigned to you?
Immediately document reason for delay in work notes, communicate updated ETA to end-user/manager, flag ticket status, and escalate if blocking dependency exists.
100. What is First Contact Resolution (FCR)?
Percentage of incoming customer support requests resolved completely during the initial interaction without requiring follow-up callbacks or ticket reassignment.
Scenario 1: A Domain Controller is unreachable, and multiple users cannot log in. How would you troubleshoot and restore access?
- Verify if users can log in using cached credentials on existing laptops.
- Check physical/virtual host power status and ping the DC's static IP.
- Verify Active Directory Domain Services and DNS Server services are running on secondary Domain Controller.
- Check DNS configuration on client endpoints to ensure secondary DC IP is configured as secondary DNS.
- Use `nltest /dsgetdc:domain.com` to check which DC clients are attempting to authenticate against.
Scenario 2: Microsoft Outlook is disconnected for several users, while OWA (Web) is working fine. How would you isolate the issue?
- Since OWA works, Exchange cloud service and credentials are functioning.
- Check if affected users belong to the same office location/subnet (proxy/firewall issue blocking MAPI/HTTPS port 443).
- Test Autodiscover status: Hold `Ctrl` & right-click Outlook tray icon → **Test Email AutoConfiguration**.
- Run `Test-NetConnection outlook.office365.com -Port 443` on client endpoints.
- Check for expired OAuth tokens; prompt users to restart Outlook and complete MFA re-authentication.
Scenario 3: A Windows laptop is stuck in a boot loop after a Windows update. What recovery steps would you take?
- Force boot into Windows Recovery Environment (WinRE) via 3 power interruptions.
- Select **Troubleshoot** → **Advanced Options** → **Uninstall Updates** (remove recent quality/feature update).
- If unsuccessful, select **Startup Repair** or perform a **System Restore** to a restore point created before the update.
- Boot in **Safe Mode**, open CMD as Admin, run `DISM /Online /Cleanup-Image /RestoreHealth` and `sfc /scannow`.
Scenario 4: A user reports that OneDrive is not syncing important files before a client deadline. How would you troubleshoot it?
- Check system tray OneDrive icon for sync pause or credential error flags.
- Verify user's Internet connection and cloud storage quota limit.
- Check for open file locks (e.g., user keeping Excel file open preventing sync).
- Unlink and re-link user account in OneDrive settings.
- Run OneDrive reset executable:
%localappdata%\Microsoft\OneDrive\onedrive.exe /reset.
Scenario 5: Multiple users report slow network performance after office hours. How would you identify the root cause?
- Check router/firewall bandwidth utilization graphs to identify spikes.
- Determine if scheduled network-wide backups, WSUS patch deployments, or cloud sync jobs are configured during after-hours.
- Run `tracert 8.8.8.8` to identify high latency hops (LAN vs ISP boundary).
- Inspect switch ports for broadcast storms or duplex mismatches.
Scenario 6: A VIP user's laptop has suddenly become extremely slow before an important presentation. What is your troubleshooting approach?
- Remain calm, empathetic, and prioritize immediate presentation enablement.
- Open Task Manager (`Ctrl + Shift + Esc`) to check high CPU/Memory/Disk hogs; kill heavy non-essential background processes.
- If disk is throttling, check thermal throttling or fan vents.
- Provide a ready standby backup laptop or transfer presentation file to a clean USB / OneDrive folder as immediate workaround.
Scenario 7: A printer used by an entire department has stopped printing. How do you determine whether the issue is with the printer, network, driver, or print server?
- Printer Hardware: Check paper/toner and print a manual configuration page from printer physical console.
- Network: Ping printer IP from a desktop. Open printer embedded web server (EWS) via browser IP.
- Print Server: Check if Print Spooler service on print server is stopped; restart `spoolsv.exe`.
- Driver: Test sending a print job directly via IP bypassing the print server to isolate driver/queue failure.
Scenario 8: A new employee cannot access Microsoft Teams, Outlook, and SharePoint after joining. What checks would you perform?
- Check M365 Admin Center to verify if appropriate license (e.g., E3/E5) is assigned to the user account.
- Verify user account is active (not disabled) and group memberships are properly synced via Azure AD Connect.
- Verify Conditional Access policies are not blocking sign-in from unmanaged devices/locations.
- Clear credential manager cached tokens (`control keymgr.dll`).
Scenario 9: BitLocker recovery is triggered after a BIOS update. How would you help the user regain access securely?
- Verify user's identity following strict security verification policy (employee ID, manager confirmation).
- Retrieve BitLocker Recovery Key from Microsoft Entra ID portal or Active Directory Users & Computers.
- Guide user to enter 48-digit numerical recovery key on BitLocker prompt.
- Once booted into Windows, suspend BitLocker (`Manage-bde -protectors -disable C:`) and re-enable to re-bind TPM to updated BIOS hardware PCR measurements.
Scenario 10: You receive 15 high-priority tickets at the same time, including issues from executives and general users. How would you prioritize, communicate, and resolve them?
- Prioritize by Business Impact: Segregate single-user issues from department-wide outages (P1 outage > P2 Executive > P3 Individual).
- Communication: Send a quick broadcast/ticket notification acknowledging the outage to manage expectations and avoid duplicate calls.
- Delegate & Escalate: Assign outage tickets to infrastructure team while addressing VIP and user tickets sequentially based on SLA matrix.
Complete the 25-question evaluation below. Enter your full name and click submit to calculate your score, receive detailed explanations, and obtain your official technical rating badge from Bora Academy.