CCST IT Support cheat sheet

An incident is an unplanned interruption or degradation of an IT service; a service request is a routine user ask such as access or information.

Ticket priority is derived from impact and urgency; high impact plus high urgency produces the highest priority.

An SLA defines expected response and resolution times and the responsibilities of provider and customer.

Functional escalation moves a ticket to a higher technical skill tier; hierarchical escalation moves it to management.

Problem management seeks the root cause of one or more incidents and prevents recurrence.

A good ticket record includes user identity, symptom, time, affected asset or service, actions taken, and outcome.

Standard changes are pre-approved low-risk changes; normal changes require review, and emergency changes use an expedited approval path.

A knowledge base article should be indexed by symptom, verified for accuracy, and updated when procedures change.

POST runs firmware checks on CPU, memory, and video before boot; failures may appear as beep codes, diagnostic LEDs, or on-screen messages.

DDR generations are keyed differently and are not interchangeable; match the motherboard's supported DDR type and speed.

SMART reports drive health indicators and can warn of impending HDD or SSD failure before total loss.

UEFI Secure Boot verifies bootloader signatures before loading the operating system.

Laser printing stages are charging, exposure, developing, transferring, fusing, and cleaning; jams often occur near transfer or fusing.

USB-C is reversible and can carry data, power, and video, but not every USB-C port supports the same speeds, power delivery, or display modes.

A PSU must supply enough total wattage and sufficient current on the required voltage rails for the installed components.

Display standards differ by connector: HDMI and DisplayPort carry video and audio, while older VGA carries analog video only.

A typical boot sequence is firmware POST, boot device selection, bootloader, operating system kernel, and user session initialization.

NTFS permissions are cumulative across group memberships; an explicit Deny entry overrides Allow entries.

When share permissions and NTFS permissions both apply over a network, the most restrictive effective permission wins.

Windows administrative tools include Task Manager, Event Viewer, Device Manager, Services console, and Disk Management.

Safe Mode loads basic drivers and services and is used to isolate driver, malware, or startup-application problems.

A restore point rolls back system files and registry settings but does not restore personal user files.

Common file systems include NTFS for Windows, APFS for macOS, ext4 for Linux, and exFAT for removable media with broad cross-platform support.

Package managers such as apt, dnf, Homebrew, and winget install, update, and remove software while resolving dependencies.

Private IPv4 ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16; they require NAT for public internet access.

A 169.254.x.x APIPA address indicates a Windows host did not obtain DHCP configuration.

DHCP uses the DORA process: Discover, Offer, Request, Acknowledge, providing IP address, mask, gateway, and DNS settings.

The default gateway must be an address on the host's local subnet and is used to reach remote networks.

DNS A records map hostnames to IPv4 addresses; AAAA records map to IPv6, and CNAME records alias one name to another.

Common ports include 80 HTTP, 443 HTTPS, 53 DNS, 67/68 DHCP, 22 SSH, 3389 RDP, and 25 SMTP.

Ping tests ICMP reachability, tracert shows the path to a destination, ipconfig displays local IP configuration, and nslookup queries DNS.

Wi-Fi uses 2.4 GHz, 5 GHz, and 6 GHz bands; WPA2 and WPA3 provide stronger encryption than WEP.

The CIA triad is confidentiality, integrity, and availability; controls should protect each goal as required.

Authentication factors are knowledge, possession, and inherence; MFA combines two or more different factor types.

Least privilege grants only the access needed for a task, reducing damage from mistakes, malware, or compromised accounts.

Phishing indicators include urgency, mismatched sender domains, unexpected attachments or links, and credential requests.

Hashing is one-way and supports integrity checks; encryption is reversible with a key and protects confidentiality.

The 3-2-1 backup rule keeps three copies of data, on two media types, with one copy offsite or offline.

A standard troubleshooting sequence is identify the problem, form a theory, test the theory, plan and implement a fix, verify full function, and document.

RTO is the maximum acceptable downtime after a disruption; RPO is the maximum acceptable amount of data loss measured in time.