🖥️ Section 1: Enterprise Windows Administration (Questions 1–20)
1. Explain the Windows boot process in detail.
- UEFI/BIOS Phase: POST runs, initializes hardware, reads NVRAM to locate UEFI boot entry.
- Bootmgr Phase: UEFI loads
bootmgr.efi from EFI System Partition (ESP), reads BCD (Boot Configuration Data). - Winload Phase:
winload.efi loads Windows Kernel (ntoskrnl.exe), HAL, and Boot-Start drivers into RAM. - Kernel Initialization:
ntoskrnl.exe initializes executive subsystems, launches smss.exe (Session Manager). - User Session & Winlogon:
smss.exe spawns winlogon.exe, lsass.exe, and services.msc. User authenticates via credential provider.
2. How do you troubleshoot random BSODs in an enterprise environment?
Collect Memory Dumps (`C:\Windows\MEMORY.DMP` or Minidumps in `C:\Windows\Minidump`). Configure WinDbg, load symbols via Microsoft Symbol Server (`https://msdl.microsoft.com/download/symbols`), run `!analyze -v` to pinpoint the faulting driver module (`.sys`) or memory corruption address. Correlate with System Event Log (Event ID 41, 1001) and driver updates.
3. Explain Windows Recovery Environment (WinRE) architecture and repair workflow.
WinRE is a lightweight OS based on Windows PE stored in a dedicated hidden recovery partition (`winre.wim`). Access via `reagentc /enable`. Troubleshooting involves using BCD edit commands (`bootrec /fixmbr`, `bootrec /rebuildbcd`), running offline SFC (`sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows`), or applying DISM image repairs offline.
4. How do you troubleshoot profile corruption at scale?
Check Event ID 1511 / 1515 in System Log. Log in as Local Admin, back up user data folder from `C:\Users\username`. Open Registry `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList`, identify SID key appended with `.bak`, backup and delete the registry entry, reboot machine, and allow Windows to generate a fresh profile directory before restoring user data.
5. Explain Windows Registry architecture and hive mapping.
Registry consists of physical database files (Hives) stored in `C:\Windows\System32\config` (SYSTEM, SOFTWARE, SAM, SECURITY, DEFAULT) and user profile `NTUSER.DAT`. HKEY_LOCAL_MACHINE maps global system configuration, while HKEY_CURRENT_USER dynamically links to the active user's SID hive under HKEY_USERS upon logon.
6. How do you optimize Windows performance across thousands of endpoints?
Deploy GPO / Intune Device Configuration Profiles to disable non-essential startup telemetry, restrict SysMain and Windows Search indexing rules on SSDs, configure Storage Sense for automated temp purging, optimize Pagefile size, enforce Enterprise Power Plan via GPO, and monitor disk IOPS using Endpoint Analytics.
7. What is Windows Autopilot and how does it work?
A cloud-based deployment technology where hardware vendors register device Hardware Hash (HWID) to the M365 tenant. When a user powers on a fresh PC and connects to Wi-Fi/Ethernet, Autopilot intercepts OOBE, binds the device to Microsoft Entra ID, enforces Intune enrollment, and pushes policies/apps automatically without custom OS imaging.
8. Explain Windows servicing channels (GA vs LTSC vs Insider).
- General Availability (GA) Channel: Annual feature updates (e.g., 23H2, 24H2) receiving 24-36 months of enterprise support.
- Long-Term Servicing Channel (LTSC): Special edition receiving security patches for 5-10 years without feature updates; designed for critical infrastructure (medical, factory line, ATM).
9. How do you troubleshoot persistent Windows Update failures?
- Check `C:\Windows\Logs\CBS\CBS.log` and `C:\Windows\WindowsUpdate.log` (generated via PowerShell `Get-WindowsUpdateLog`).
- Stop `wuauserv` and `bits` services.
- Purge `C:\Windows\SoftwareDistribution` and `catroot2` folders.
- Run `DISM /Online /Cleanup-Image /RestoreHealth` followed by `sfc /scannow`.
10. Explain the core architectural difference between DISM and SFC.
- SFC: Scans local system files against a cached local copy in `C:\Windows\System32\dllcache` or WinSxS.
- DISM: Services and repairs the actual Windows Component Store (WinSxS) itself by pulling fresh, known-good files directly from Windows Update or a mounted WIM file.
11. What causes Windows login delays and how do you diagnose them?
Caused by slow Group Policy processing, synchronous GPO script execution, unreachable Domain Controllers causing Kerberos timeout, broken profile drives, or high disk I/O. Diagnosed using Process Monitor (`ProcMon` boot logging) or Windows Performance Toolkit (`wpr` / `xperf` tracing logon phases).
12. Explain Windows Credential Manager and how to flush cached tokens.
Credential Manager (`control keymgr.dll`) stores cached credentials for SMB shares, Remote Desktop, and Web authentication in encrypted vaults (`C:\Users\\AppData\Roaming\Microsoft\Credentials`). Flush corrupt domain/M365 cached tokens via `cmdkey /list` and `cmdkey /delete:TargetName`.
13. How do you troubleshoot Group Policy processing failures?
Run `gpresult /h C:\gpreport.html` to review applied vs denied GPOs. Inspect Group Policy Event Log (`Applications and Services Logs \ Microsoft \ Windows \ GroupPolicy \ Operational`). Check network connectivity to SYSVOL share (`\\domain.com\sysvol`) and test DNS resolution for domain SRV records.
14. Explain Event Viewer logs and how to create Custom Views for Level-3 auditing.
Logs are stored as XML binary files in `C:\Windows\System32\winevt\Logs`. Custom Views aggregate specific Event IDs across multiple channels (e.g., combining Security Log 4625 [Failed Logon], System Log 7036 [Service State], and Application Log 1001 [Crash Dump]) into unified XML XPath queries.
15. Explain Windows Services dependencies and recovery configuration.
Services often rely on parent driver or service stacks (e.g., `DHCP Client` depends on `NSI` and `AFD`). Viewed via `services.msc` properties → **Dependencies** tab. Configure Service Recovery tab to automatically restart service on 1st/2nd failure and trigger a diagnostic PowerShell script on subsequent crashes.
16. How do you analyze memory dump files using WinDbg?
Install WinDbg → Open Dump File (`.dmp`) → Set Symbol path `srv*C:\Symbols*https://msdl.microsoft.com/download/symbols` → Execute `!analyze -v` → Inspect `MODULE_NAME`, `FAULTING_SERVICE_NAME`, `PROCESS_NAME`, and stack traces to identify kernel driver crashes.
17. Explain Reliability Monitor and its utility in L3 support.
Accessed via `perfmon /rel`. Provides a day-by-day systemic stability index score (1-10), correlating hardware/software changes, Windows updates, app crashes, and blue screens on a unified visual timeline to isolate exact failure start dates.
18. Explain Sysinternals Suite and key tools for desktop engineers.
A suite of advanced Windows diagnostic utilities. Key tools: **ProcMon** (real-time file/registry/process monitoring), **Process Explorer** (advanced task manager showing DLL handles/DLL threads), **Autoruns** (comprehensive startup item inspector), and **TCPView** (socket connection tracker).
19. What is ProcMon (Process Monitor) and how do you configure filters?
Real-time system monitoring tool capturing File System, Registry, and Process/Thread activity. Configure filters (`Ctrl + L`) to isolate specific process names (e.g., `Process Name is outlook.exe`) and filter Result to `ACCESS DENIED` or `FILE NOT FOUND` to detect file permission locks.
20. How do you troubleshoot recurring application crashes?
Inspect Application Log in Event Viewer for `Event ID 1000` (App Crash) or `1002` (App Hang) → Identify faulting module (DLL) → Test app in Safe Mode → Clear AppData cache → Reinstall/Repair Microsoft Visual C++ Redistributables or .NET Framework runtime → Generate dump via Procdump if issue persists.
🔑 Section 2: Active Directory & Identity (Questions 21–35)
21. Explain Active Directory architecture (Forest, Tree, Domain, OU).
Active Directory is hierarchical directory service database (NTDS.dit). **Forest** is the ultimate security boundary sharing single Schema and Configuration partitions. **Tree** is a collection of contiguous domain names. **Domain** is a logical security partition sharing a single AD database. **OU** is administrative container for GPO delegation.
22. What are FSMO Roles and their functions?
- Schema Master (Forest): Controls structure changes to AD schema database.
- Domain Naming Master (Forest): Manages addition/removal of domains in forest.
- PDC Emulator (Domain): Primary time source, handles Kerberos password changes & lockouts immediately.
- RID Master (Domain): Allocates pools of RIDs to DCs for creating unique SIDs.
- Infrastructure Master (Domain): Translates cross-domain object references/GUIDs.
23. Explain Kerberos Authentication protocol workflow.
- User submits credentials → AS-REQ sent to Key Distribution Center (KDC) on DC Port 88.
- KDC verifies hash & issues Ticket Granting Ticket (TGT) (AS-REP).
- User requests access to resource & sends TGS-REQ with TGT to KDC.
- KDC responds with Ticket Granting Service (TGS) ticket (TGS-REP).
- User presents TGS ticket to target resource server for authentication.
24. What is the fundamental difference between NTLM and Kerberos?
- Kerberos: Ticket-based, requires mutual authentication (client verifies server & vice versa), relies on active DNS/KDC, fast and encrypted.
- NTLM: Challenge-response protocol, client hashes password with nonce; slower, vulnerable to Pass-the-Hash attacks, legacy protocol.
25. Explain LDAP and LDAPS ports and usage.
Lightweight Directory Access Protocol queries AD objects (Users, Computers, Groups). Plain LDAP operates over **Port 389**. Encrypted Secure LDAP (LDAPS) operates over SSL/TLS on **Port 636** (or Global Catalog LDAPS on **Port 3269**).
26. Explain DNS integration with Active Directory.
Active Directory relies on AD-Integrated DNS zones stored inside the AD database and replicated automatically to all DCs. AD uses DNS SRV records (under `_msdcs` zone) to register KDC, LDAP, and Global Catalog service locations so client computers can find Domain Controllers.
27. How does Group Policy processing work under the hood?
When a user logs in, Windows queries DNS for a DC, connects to `SYSVOL` share (`\\domain.com\sysvol`), reads Group Policy Container (GPC in AD) and Group Policy Template (GPT in SYSVOL), evaluates LSDOU hierarchy, and Client-Side Extensions (CSEs) apply registry edits, software scripts, or security templates.
28. Explain GPO Loopback Processing Mode (Replace vs Merge).
Used to apply user-specific Group Policies based on the *computer* location rather than user OU (e.g., Kiosks, Terminal Servers).
- Replace Mode: Completely overrides user's normal GPO settings with policies linked to the computer's OU.
- Merge Mode: Combines user GPOs and computer GPOs; in case of conflict, computer GPO settings take precedence.
29. Explain Fine-Grained Password Policies (FGPP).
Allows applying distinct password complexity, expiration, and lockout thresholds to specific users or Global Security Groups via Password Settings Objects (PSOs) stored in AD Administrative Center, bypassing the single-policy domain limitation.
30. Explain Domain Trusts (Forest Trust, External Trust, Shortcut Trust).
Establishes authentication channels between distinct domains/forests. **Forest Trust** shares trust between two entire root forests (transitive). **External Trust** links non-transitive domains across forests. **Shortcut Trust** connects two deep child domains within a complex forest tree to shorten Kerberos evaluation paths.
31. What is a Read-Only Domain Controller (RODC) and where is it deployed?
Deployed in branch offices with low physical security. Maintains a read-only copy of AD database (`NTDS.dit`), does not store user password hashes by default (uses Password Replication Policies), and prevents unauthorized write-backs to primary DCs if compromised.
32. Explain AD Sites & Services and IP Subnet mapping.
Defines physical network topology of the organization. Subnets are associated with specific AD Sites (e.g., NYC_Site -> `10.10.0.0/24`). Ensures client machines authenticate against their geographically nearest Domain Controller and optimizes inter-site DFSR replication schedules.
33. Explain Active Directory Replication mechanism (DFSR vs KCC).
Knowledge Consistency Checker (KCC) running on DCs automatically generates optimal replication topology (connection objects). **DFSR (Distributed File System Replication)** replicates `SYSVOL` data across DCs. Intersite replication compresses data using RPC over IP or SMTP.
34. How do you troubleshoot AD replication failures?
Execute `repadmin /showrepl` and `repadmin /replsummary` to locate failing replication partners. Check DNS lookup for DC GUIDs. Verify RPC dynamic port range (`135` & `49152-65535`) on firewalls. Run `dcdiag /v` to inspect domain controller health reports.
35. How do you troubleshoot domain authentication failures?
Check System time synchronization (Kerberos fails if time skew exceeds 5 minutes). Verify machine account secure channel password using PowerShell `Test-ComputerSecureChannel`. Check Event ID 4625 on DC for failure status codes (e.g., `0xC000006A` = wrong password, `0xC0000234` = account locked out).
☁️ Section 3: Microsoft 365 & Exchange Online (Questions 36–50)
36. Explain Microsoft 365 enterprise architecture.
M365 combines cloud identity (Microsoft Entra ID), productivity apps (Office Apps, Teams, Exchange Online, SharePoint Online, OneDrive), security engines (Defender for Endpoint/Office 365), and device management (Microsoft Intune) into a unified cloud tenant structure.
37. Explain Hybrid Exchange Deployment.
Connects on-premises Exchange organization with Exchange Online tenant using Exchange Hybrid Agent or HCW (Hybrid Configuration Wizard). Enables unified global address list (GAL), free/busy calendar sharing, cross-premise mail routing, and seamless online mailbox migrations.
38. How do you perform end-to-end Mail Flow troubleshooting in Exchange Online?
Use **Message Trace** in Exchange Admin Center (EAC) to track message status, hop details, transport rules, and spam evaluation. Inspect full RFC 822 internet email headers using Microsoft Message Header Analyzer to review `Received` headers, hop latency, and auth results.
39. Explain SPF, DKIM, and DMARC record functions.
- SPF (Sender Policy Framework): TXT record listing IP addresses/hosts authorized to send mail on behalf of domain.
- DKIM (DomainKeys Identified Mail): Cryptographically signs outgoing emails with a private key; recipient verifies signature using public DNS key.
- DMARC: Specifies enforcement policy (`none`, `quarantine`, `reject`) if SPF or DKIM checks fail.
40. Explain Exchange Online Protection (EOP) filtering pipeline.
Incoming mail passes through Connection Filtering (IP reputation) → Anti-Malware scanning → Transport Rules enforcement → Content Filtering (Spam / Phishing / SCL score assignment) → Zero-Hour Auto Purge (ZAP) for post-delivery malware removal.
41. Explain Microsoft Defender for Office 365 (Safe Attachments & Safe Links).
- Safe Attachments: Detonates incoming email attachments in a secure cloud sandbox virtual machine to analyze behavioral malware prior to inbox delivery.
- Safe Links: Re-writes URLs in real-time, performing time-of-click verification whenever a user clicks an embedded hyperlink in an email or Office document.
42. Explain Conditional Access Policies in Microsoft Entra ID.
Zero Trust evaluation engine ("If-Then" rules). Evaluates **Signals** (User group, IP location, Device Compliance, Risk level) → Applies **Control Decisions** (Allow, Block, Require MFA, Require Compliant Device, Require Password Reset).
43. Explain Azure AD Connect (Entra Connect Sync) architecture.
Syncs on-premises AD objects (Users, Groups, Contacts) to Microsoft Entra ID. Supports **Password Hash Sync (PHS)** (syncs encrypted password hashes), **Pass-Through Authentication (PTA)** (authenticates directly against on-prem DCs), and **Federation (ADFS)**.
44. Explain Single Sign-On (SSO) protocols (SAML 2.0 vs OIDC).
SSO allows users to authenticate once and access multiple cloud resources. **SAML 2.0** uses XML assertion tokens sent via browser redirects (enterprise standard). **OpenID Connect (OIDC)** is a modern OAuth 2.0-based identity layer using JSON Web Tokens (JWT) optimized for web/mobile apps.
45. Explain Multi-Factor Authentication (MFA) enforcement strategies.
Enforced via Conditional Access rules or Security Defaults. Methods include Microsoft Authenticator app (Number Matching and context push notifications), FIDO2 Hardware Security Keys, and SMS/OOB calls (least secure, susceptible to SIM swapping).
46. What is Microsoft Intune and how does it connect to endpoints?
Cloud-based Enterprise Mobility Management (EMM / UEM) solution. Windows 10/11 endpoints connect via native Windows Device Management Client (`omadm`) over HTTPS REST APIs to fetch MDM policies, app packages, and compliance benchmarks.
47. Explain Autopilot Deployment Profiles and OOBE customization.
Autopilot profiles defined in Intune specify exact OOBE experiences: Hide Privacy Settings, Hide EULA, Select User Account Type (Standard vs Admin), assign language settings, and configure Enrollment Status Page (ESP) to block desktop access until critical apps install.
48. Explain Intune Compliance Policies vs Device Configuration Profiles.
- Compliance Policies: Evaluates if device meets baseline security requirements (e.g., BitLocker enabled, OS build minimum, Antivirus active). Used as signal for Conditional Access.
- Device Configuration Profiles: Enforces settings and restrictions on the endpoint (e.g., Wi-Fi profiles, VPN settings, disabling USB storage, custom registry keys).
49. Explain Device Configuration Profiles (OMA-URI / ADMX templates).
Configurations pushed to endpoints via native MDM CSPs (Configuration Service Providers). Custom settings use OMA-URI paths (e.g., `./Vendor/MSFT/Policy/Config/X...`) or ingested Group Policy ADMX templates translated into cloud policies.
50. Explain BitLocker Management through Microsoft Intune.
Configured via Endpoint Security policy. Enforces XTS-AES 256-bit encryption on OS drives, requires TPM 2.0 protector, silently encrypts drives during enrollment, and automatically backs up 48-digit BitLocker Recovery Keys directly into Microsoft Entra ID device objects.
📦 Section 4: Endpoint Management (SCCM / MECM / Intune) (Questions 51–65)
51. Explain SCCM (MECM) Architecture (CAS, Primary Site, Secondary Site, DPs).
- Central Administration Site (CAS): Used for reporting/administration across massive global hierarchies (>100k endpoints).
- Primary Site: Manages client endpoints, owns SQL site database, evaluates rules.
- Distribution Points (DPs): Remote content servers caching apps, packages, and OS images close to endpoints to save WAN bandwidth.
52. MECM (SCCM) vs Microsoft Intune comparison.
- MECM: On-premises infrastructure, agent-based (CcmExec), ideal for heavy LAN environments, OS deployment (PXE/WDS), deep server/desktop control.
- Intune: Cloud-native, agentless/MDM protocol, optimized for internet-connected remote workforces, rapid policy push, integrated with Entra ID.
53. Explain Application Deployment model in SCCM (App vs Package).
- Application Model: State-based, features detection methods (Registry, MSI GUID, File version), dependency trees, and supersedence.
- Package Model: Legacy task-based execution ("run this script/exe"), does not verify if app is already installed prior to execution.
54. Explain Software Distribution workflow in SCCM (Client logs).
Client queries policy (`PolicyAgent.log`) → Evaluates deployment requirement (`AppDiscovery.log`) → Requests content location (`CAS.log`) → Downloads content from DP via BITS (`ContentTransferManager.log` & `DataTransferService.log`) → Installs application (`AppEnforce.log`).
55. Explain Patch Management via SCCM (Software Update Point / WSUS).
SCCM SUP role integrates with WSUS to synchronize update metadata from Microsoft. Admin builds Software Update Groups (SUGs), creates Deployment Packages hosted on DPs, and pushes patch maintenance windows to target Device Collections.
56. Explain Endpoint Analytics in Intune / Cloud Management.
Cloud service monitoring endpoint health metrics. Analyzes Startup Performance (boot/logon phase duration), Application Reliability (crash frequencies), and Proactive Remediations (PowerShell script pairs auto-detecting and fixing issues silently).
57. Explain Co-Management in MECM & Intune.
Bridges on-prem MECM and cloud Intune. Allows devices to be managed by both systems simultaneously. Workloads (Compliance, Device Config, Patching, Endpoint Protection) can be shifted dynamically from MECM to Intune using sliders.
58. Explain Driver Management strategies during OS Deployment.
Driver packages structured by PC model in MECM/MDT. Modern best practice utilizes **Dynamic Driver Provisioning** (querying WMI model string during Task Sequence `select * from Win32_ComputerSystem where Model like '%Latitude 5440%'`) or injecting vendor Driver CAB packages.
59. Explain SCCM Task Sequence execution during OSD.
PXE client boots into WinPE image → Formats drive/partitions → Applies Operating System WIM file → Injects drivers → Joins domain → Installs SCCM Client (`ccmsetup.exe`) → Executes post-install app packages and custom configurations.
60. How do you deploy Windows Feature Updates at scale via Intune/MECM?
In Intune, use **Windows 10/11 Feature Updates** policy specifying target OS build (e.g., Windows 11 23H2). Uses Windows Update for Business (WUfB) deployment service, applying feature updates in-place via enablement packages without full OS re-imaging.
61. Explain Device Compliance Evaluation in Intune.
Intune Management Extension (IME) / MDM client scans host status against compliance rules → Reports state to Intune service → Intune updates device state in Microsoft Entra ID → Conditional Access permits or blocks M365 access based on state.
62. Explain Endpoint Security Baselines in Intune.
Pre-configured groups of Microsoft-recommended security settings (e.g., Security Baseline for Windows 10/11, Defender Baseline) that allow admins to deploy enterprise hardening rules (Credential Guard, LAPS, firewall rules) with one click.
63. Explain Remote Support tools integration in enterprise EUC (Remote Help / Quick Assist).
Enterprise tools like **Microsoft Remote Help** integrate with Intune, enforcing RBAC permissions (e.g., L1 = View Only, L2 = Full Control with Elevation), requiring MFA, and logging session details for security compliance audits.
64. Explain Proactive Remediations in Intune (Script Pairs).
Consists of a **Detection Script** (checks for misconfiguration/error, exits with code 1 if found) and a **Remediation Script** (executes fix when exit code 1 is triggered). Runs on schedule without user interaction.
65. How do you troubleshoot a failed application deployment in SCCM?
Inspect `AppDiscovery.log` to check requirement rules → Check `AppIntentEval.log` → Check `ContentTransferManager.log` for DP download errors → Open `AppEnforce.log` to view exact command-line execution and MSI exit code (e.g., `1603` = fatal error, `3010` = reboot required).
🌐 Section 5: Networking (Questions 66–80)
66. Explain TCP Three-Way Handshake and State Diagram.
- SYN: Client sends TCP packet with SYN flag and initial sequence number (ISN).
- SYN-ACK: Server responds with SYN-ACK acknowledging client ISN.
- ACK: Client sends final ACK packet. Connection transitions to `ESTABLISHED` state.
67. Explain VLAN Tagging (IEEE 802.1Q) and Trunking.
802.1Q inserts a 4-byte VLAN tag header into Ethernet frames traversing switch **Trunk Links**. Allows multiple VLANs to share a single physical uplink cable while maintaining complete Layer 2 broadcast isolation.
68. What is Spanning Tree Protocol (STP / RSTP) and why is it critical?
STP (802.1D) and RSTP (802.1w) prevent Layer 2 switching loops in redundant network topologies by blocking redundant port paths. Prevents broadcast storms and MAC address table instability.
69. Explain DNS Resolution Hierarchy (Root, TLD, Authoritative).
Client queries local DNS cache/hosts file → Recursive DNS Resolver → Root Hints Server (`.`) → Top-Level Domain (TLD) Server (`.com`) → Authoritative DNS Server for target domain → Returns IP address mapping to client.
70. Explain DHCP Relay Agent / IP Helper in enterprise networks.
Since DHCP Discover broadcasts (`255.255.255.255`) cannot cross Layer 3 routers, an **IP Helper Address** configured on the switch interface captures client broadcasts and forwards them as unicast UDP packets directly to the central DHCP server across subnets.
71. How do you troubleshoot enterprise VPN connectivity issues?
Verify Internet connectivity → Ping gateway FQDN → Test IPsec/SSL port connectivity (UDP 500/4500 for IPsec, TCP 443 for SSL) → Check client certificate validity in `certlm.msc` → Inspect client VPN logs & Routing Table (`route print`) for split-tunnel conflicts.
72. Explain NAT types (SNAT, DNAT, PAT).
- Source NAT (SNAT): Replaces private source IP with public IP for outbound web browsing.
- Destination NAT (DNAT): Replaces public destination IP with internal private IP (Port Forwarding).
- Port Address Translation (PAT): Maps multiple private IPs to a single public IP using distinct ephemeral port numbers.
73. Explain Firewall Rule processing logic (Stateful vs Stateless).
Rules evaluated top-down (first match wins) ending in implicit deny. **Stateful Firewalls** track connection states in a state table, automatically allowing return response traffic. **Stateless Firewalls** filter packets individually without context, requiring explicit inbound and outbound rules.
74. Explain Network Segmentation and Micro-segmentation.
Segmenting a corporate network into isolated subnets/VLANs (User LAN, Server DMZ, IoT, Executive). **Micro-segmentation** enforces host-level firewall policies (e.g., Windows Defender Firewall / EDR) restricting lateral east-west communication between devices on the same subnet.
75. Explain Proxy Servers (Explicit vs Transparent, PAC files).
Proxies intercept outbound web traffic. **Explicit Proxy** requires browser configuration (often using Proxy Auto-Config `.pac` files). **Transparent Proxy** redirects web traffic seamlessly at the gateway router level without client configuration.
76. Explain SSL/TLS Certificate chain of trust and handshake.
Validates identity using public key infrastructure (PKI). Client trusts a certificate if signed by a trusted Root Certificate Authority (CA) via intermediate CAs. During TLS handshake, client/server exchange certificates, verify expiration/CRL revocation, and establish symmetric session encryption keys.
77. Explain Load Balancers (Layer 4 vs Layer 7).
- Layer 4 Load Balancer: Routes traffic based on network/transport protocols (IP address and TCP/UDP port) without inspecting packet payload.
- Layer 7 Load Balancer: Inspects application layer content (HTTP headers, cookies, URL paths) to make intelligent routing decisions.
78. Explain Enterprise Wi-Fi Authentication (802.1X / EAP-TLS).
Endpoints authenticate to enterprise Wi-Fi using 802.1X protocol. **EAP-TLS** provides highest security by using dual digital certificates (Server CA certificate validates network, Client Certificate stored in machine store validates device) via RADIUS server (Microsoft NPS).
79. What causes Packet Loss and how do you diagnose it?
Caused by network congestion, failing Ethernet cabling, bad NIC drivers, duplex mismatches, or faulty switch ports. Diagnosed using `pathping`, continuous `ping -t -l 1472` (fragmentation check), or Wireshark packet captures.
80. Explain Network Monitoring tools and SNMP protocol.
Simple Network Management Protocol (SNMP) uses agent queries (OIDs / MIBs) to track bandwidth, CPU, memory, and port status on network infrastructure. Monitored via enterprise platforms like PRTG, SolarWinds, or Datadog.
🔒 Section 6: Security & Compliance (Questions 81–90)
81. Explain Zero Trust Architecture guiding principles.
Framework operating under three core tenets:
- Explicit Verification: Always authenticate and authorize based on all available data points (identity, location, device health).
- Use Least Privilege Access: Just-In-Time (JIT) & Just-Enough-Access (JEA).
- Assume Breach: Minimize blast radius and segment access.
82. Explain Microsoft Defender for Endpoint (MDE) enterprise capabilities.
Provides Endpoint Protection (next-gen AV), Endpoint Detection and Response (EDR), Threat & Vulnerability Management (TVM), Attack Surface Reduction (ASR) rules, and automated investigation and remediation (AIR) playbooks.
83. Explain BitLocker Enterprise Management & Network Unlock.
BitLocker enforced via GPO/Intune. **Network Unlock** allows domain-joined machines connected to the corporate wired network to unlock automatically during boot without requiring user PIN input by querying a WDS key server.
84. Explain Privileged Access Management (PAM) vs Privileged Identity Management (PIM).
- PAM: Manages and audits privileged administrative accounts across local/on-prem infrastructure.
- PIM: Microsoft Entra ID service providing time-bound, approval-based Just-In-Time (JIT) role elevation for cloud admin roles.
85. Explain Windows LAPS (Local Administrator Password Solution) implementation.
LAPS manages local admin passwords on endpoints. Local agent automatically rotates password on configured schedule, generates a randomized complex string, and securely stores password in AD attributes or Microsoft Entra ID device object accessible only to authorized IT staff.
86. Explain Endpoint Hardening techniques and Attack Surface Reduction (ASR) rules.
ASR rules block common attack vectors in Defender. Examples: blocking executable content from email client/webmail, blocking credential stealing from Windows LSASS process, blocking Office apps from spawning child processes (`cmd.exe`/`powershell.exe`).
87. Explain Vulnerability Management workflow (CVE, CVSS scoring).
Continuous cycle: Discover → Prioritize → Remediate → Verify. MDE scans endpoints for Common Vulnerabilities and Exposures (CVEs), ranks risk using CVSS scores (0-10), and IT deploys software updates or configuration fixes to lower risk exposure.
88. Explain Data Loss Prevention (DLP) for Endpoints.
DLP engines inspect sensitive data types (Credit Cards, SSNs, IP code) in three states: **Data at Rest** (files stored on disk), **Data in Transit** (network egress/email), and **Data in Use** (blocking clipboard copy, printing, screen capture, or USB file transfer).
89. Explain Security Incident Response lifecycle (NIST SP 800-61).
Six phases: 1. Preparation → 2. Detection & Analysis → 3. Containment (Isolating infected host) → 4. Eradication (Malware removal/reimage) → 5. Recovery (Restoring host to production) → 6. Lessons Learned (Post-incident review).
90. Explain ISO 27001 Controls relevant to EUC and Desktop Support.
Key controls include **A.8.1** (Asset Inventory Management), **A.9.2** (User Access Provisioning/Deprovisioning), **A.11.2** (Equipment Security & Clear Desk Policy), and **A.12.6** (Technical Vulnerability Management / Patching).
📊 Section 7: Leadership & ITSM (Questions 91–100)
91. How do you manage and elevate performance in an L1/L2 support team?
Establish clear KPI/SLA targets, implement structured daily huddling, perform weekly ticket QA audits, review First Contact Resolution (FCR) metrics, create clear escalation playbooks, and foster continuous learning through internal technical training sessions.
92. How do you strategically reduce enterprise ticket volume?
Drive **Self-Service Adoption** (password self-service portals), deploy **Proactive Remediations** in Intune to fix issues silently, conduct **Problem Management** on top recurring incident trends, and build an end-user Knowledge Base.
93. Explain Problem Management lifecycle in ITIL.
Incidents focus on restoring service immediately. Problem Management focuses on identifying root cause. Workflow: **Problem Identification → Categorization → Investigation & Diagnosis (RCA) → Identify Workaround / Known Error Record (KER) → Submit Change Request for Permanent Fix**.
94. Explain Root Cause Analysis (RCA) methodologies (5 Whys, Ishigawa).
Structured techniques to uncover core system flaws. **5 Whys** iteratively asks "Why" until the foundational process/technical failure is exposed. **Ishikawa (Fishbone) Diagram** categorizes potential causes across People, Process, Technology, and Environment.
95. Explain Change Management (CAB, Standard/Normal/Emergency Changes).
Governed by Change Advisory Board (CAB).
- Standard Change: Pre-approved, low risk (e.g., standard PC deployment).
- Normal Change: Requires formal risk assessment and CAB approval (e.g., major GPO edit).
- Emergency Change: Expedited approval for critical outage remediation.
96. Explain Major Incident Management (MIM) workflow.
Triggered when a P1 critical outage occurs. MIM Lead establishes dedicated Incident Command Bridge, coordinates L3/L4 engineering teams, issues hourly stakeholder status updates, implements immediate workarounds, and leads post-incident RCA review.
97. Explain KPI vs SLA differences in EUC operations.
- SLA (Service Level Agreement): Contractual commitment to the business (e.g., "P1 incidents resolved in under 2 hours").
- KPI (Key Performance Indicator): Operational metric tracking performance efficiency (e.g., FCR rate, CSAT score, Average Handle Time).
98. How do you prepare monthly EUC management reports for leadership?
Aggregate ITSM telemetry into executive dashboards (PowerBI/ServiceNow): Highlight total ticket volume trends, SLA compliance percentages, top 5 recurring incident categories, Endpoint Analytics health scores, device security patch compliance rates, and strategic automation savings.
99. What are Vendor Management best practices for hardware/software suppliers?
Maintain strict Vendor SLAs (e.g., Dell/HP 4-hour on-site hardware support), conduct quarterly vendor performance reviews (QBRs), enforce warranty tracking via asset management DB (CMDB), and establish escalation contacts for dead-on-arrival (DOA) hardware trends.
100. How do you mentor junior engineers and foster technical growth?
Implement "Shadowing & Reverse-Shadowing" programs, delegate minor project deliverables, encourage industry certifications, maintain a culture of thorough ticket documentation, and host weekly knowledge-sharing sessions on advanced L3 topics.
Scenario 1: A Windows update causes 500 corporate laptops to enter a boot loop. How would you coordinate recovery, communicate with stakeholders, and prevent recurrence?
- Declare Major Incident (P1): Establish MIM bridge and halt Windows Update deployment ring immediately in Intune/WSUS.
- Technical Workaround: Test recovery script via WinRE command prompt (uninstalling patch using `DISM /Image:C:\ /Remove-Package`) or push boot-repair package via Intune if machines maintain transient network sync.
- Communication: Issue broadcast advisory with step-by-step user self-remediation guide for WinRE.
- Root Cause & Prevention: Perform RCA with Microsoft Support, review update ring deployment testing groups, and require mandatory 7-day canary group validation before future update approvals.
Scenario 2: Microsoft 365 authentication fails for users across multiple offices. Describe your troubleshooting process from identity services to Conditional Access.
- Check M365 Health Dashboard and Entra ID Status page for global outages.
- Inspect Microsoft Entra Connect Sync health: Verify on-prem AD to cloud PHS/PTA synchronization is active.
- Test authentication directly via PowerShell (`Get-MgUser`) to isolate federated vs cloud identity issues.
- Review Entra ID Sign-In Logs: Filter by status "Failure" and check failure reason codes (e.g., Conditional Access policy blocking access due to broken IP signal or compliance check failure).
- Temporarily exclude an affected test account from newly modified Conditional Access policies to confirm policy misconfiguration.
Scenario 3: A ransomware attack encrypts several employee laptops. What immediate actions, containment steps, and recovery processes would you initiate?
- Immediate Containment: Trigger Network Host Isolation via Defender/EDR console immediately; physically unplug Ethernet cables and disable Wi-Fi. Do NOT power off if RAM analysis is required.
- Alert Incident Response (IR) & SOC: Escalate to CISO/Security team; preserve forensic evidence and minidumps.
- Scope Assessment: Scan network shares and active Directory for lateral movement or compromised service accounts.
- Eradication & Recovery: Revoke compromised user tokens, force domain password resets, wipe infected machines completely, re-image via PXE/Autopilot, and restore user files from cloud OneDrive/backup backups.
Scenario 4: Your CEO cannot access Outlook, Teams, VPN, or OneDrive 10 minutes before an international board meeting. How would you prioritize and resolve the issue?
- Immediate Priority: Provide an immediate alternative workaround (e.g., provide a fully configured, tested executive loaner laptop or enable OWA/Teams on executive tablet).
- Triage & Diagnosis: Check account status in Entra ID (verify account is not locked out due to incorrect password entry on mobile device or expired MFA token).
- Network & Credentials: Clear cached Windows credentials (`cmdkey /list`), verify internet connection, reset password if required, and re-authenticate M365 apps.
- Post-Meeting Support: Once the board meeting concludes, perform full root-cause analysis on the primary laptop.
Scenario 5: Multiple users report slow logon times after a new Group Policy deployment. How would you identify the root cause and safely roll back the change?
- Run `gpresult /h C:\gpreport.html` on an affected client; inspect Group Policy processing duration per CSE.
- Use Process Monitor (`ProcMon`) Boot Logging feature to capture logon sequence activity.
- Identify faulting policy (e.g., a synchronous drive mapping script attempting to reach an unreachable SMB share or corrupt WMI filter).
- Unlink or unassign newly deployed GPO in GPMC immediately; run `gpupdate /force` on endpoints.
- Fix script/policy timeout in staging OU before re-deploying.
Scenario 6: Intune compliance suddenly marks hundreds of devices as non-compliant, blocking access to Microsoft 365. How would you investigate and restore access?
- Check Intune Admin Center → Device Compliance → Identify which specific setting is failing (e.g., BitLocker status, OS version, Antivirus engine version).
- Determine if a compliance policy setting was recently updated or an expired certificate triggered the failure.
- If caused by policy error, temporarily adjust grace period ("Mark device non-compliant after X days") in Intune to restore M365 access via Conditional Access.
- Deploy proactive remediation script or update setting on endpoints to align compliance status.
Scenario 7: A critical application works on Windows 10 but fails after upgrading to Windows 11. How would you troubleshoot compatibility and decide on a remediation plan?
- Inspect Application Event Log and run ProcMon to detect missing DLLs, file permission blocks, or deprecated Registry references.
- Test running application in Compatibility Mode (Windows 10 mode) and under Administrator context.
- Use Microsoft Application Compatibility Toolkit (ACT) or Compatibility Administrator to build a custom **Application Shim** (`.sdb`).
- If application remains incompatible, contact software vendor for updated Windows 11 build; host application in Azure Virtual Desktop (AVD) / Citrix as interim workaround.
Scenario 8: An executive's BitLocker recovery key is requested after a BIOS update, but the user is traveling. How would you securely verify identity and recover access?
- Enforce Out-of-Band (OOB) identity verification (video call user, verify employee ID badge, confirm details with manager/HR).
- Access Microsoft Entra ID Portal / Active Directory → Search for computer host name → Retrieve 48-digit BitLocker Recovery Key.
- Dictate recovery key over secure voice channel; guide user through key entry.
- Once logged in, run `manage-bde -protectors -disable C:` and re-enable to bind TPM PCR measurements to updated BIOS configuration.
Scenario 9: You discover that software deployment through SCCM is failing for only one remote office. How would you isolate whether the issue is with distribution points, networking, or client configuration?
- DP Check: Verify remote office Distribution Point health status in MECM console; inspect `distmgr.log` and `pkgXferMgr.log` on site server.
- Network Check: Test BITS download and HTTP/HTTPS access to DP from a client using `Test-NetConnection -Port 80/443`. Verify boundary group assignment for remote office subnet.
- Client Check: Inspect `LocationServices.log` on client host to verify client correctly locates remote DP, and check `CAS.log` / `ContentTransferManager.log` for download failures.
Scenario 10: Your service desk receives over 500 tickets in one hour after a global Microsoft 365 outage. How would you organize the response, communicate with users, and manage SLA expectations?
- Declare Major Incident & Ticket Aggregation: Create a single Master Incident Ticket in ServiceNow/Jira and link incoming duplicate child tickets.
- Broadcasting: Deploy banner announcement on Service Desk portal, IT Support phone IVR, and corporate chat channels acknowledging Microsoft vendor outage with link to official status page.
- SLA Management: Pause SLA timers on related child tickets under "Vendor Pending / Outage" state.
- Post-Outage Resolution: Once Microsoft restores cloud service, auto-close all linked child tickets via master incident record and issue post-incident summary.
Answer the 25 L3-level assessment questions below. Enter your full name and submit to calculate your score, view detailed explanations, and receive your technical rating badge from Bora Academy.