I85PREP
⌘ K
CCST IT Support study materials
CCST IT Support study resources

CCST IT Support practice questions

One question at a time. Build your CCST IT Support understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1IT Support Fundamentals and Procedures

What is the primary purpose of a help desk ticketing system?

  1. To eliminate the need to communicate directly with end users
  2. To automatically repair software faults without technician action
  3. To store user passwords so technicians can log in as the user
  4. To log, track, and document each request through to resolution Correct answer.

Explanation

A ticketing system creates a durable record of every request so it can be assigned, prioritized, tracked, and reviewed. That history supports reporting, audits, and knowledge base articles. It does not hold credentials or replace human diagnosis and communication.

Question 2IT Support Fundamentals and Procedures

When a support technician escalates a ticket, what is happening?

  1. The ticket's priority is lowered so it can be handled later
  2. The ticket is deleted from the queue to reduce backlog
  3. The ticket is routed to a higher tier or specialist Correct answer.
  4. The ticket is closed without a resolution being recorded

Explanation

Escalation moves an issue to someone with greater expertise, authority, or access when the current technician cannot resolve it. It can be functional (needs a skill) or hierarchical (needs management authority). The ticket stays open and keeps its history.

Question 3IT Support Fundamentals and Procedures

In a support agreement, what does a service level agreement (SLA) typically define?

  1. Target response and resolution times for requests Correct answer.
  2. The physical layout of the server room
  3. The list of software licenses owned by the organization
  4. The schedule of employee performance reviews

Explanation

An SLA is a contract between a provider and a customer that sets measurable expectations, commonly response time, resolution time, uptime, and remedies for missing targets. It gives the support team objective deadlines to work against.

Question 4IT Support Fundamentals and Procedures

Which behavior best demonstrates active listening during a support call?

  1. Restating the user's description in your own words to confirm it Correct answer.
  2. Explaining the fix before the user has described the symptom
  3. Finishing the user's sentences to move the call along faster
  4. Typing a summary of the ticket while the user is still explaining

Explanation

Active listening means giving the user full attention, then paraphrasing or summarizing what was said to confirm shared understanding before acting. This catches misunderstandings early and shows the user they were heard.

Question 5IT Support Fundamentals and Procedures

Which precaution protects internal computer components from electrostatic discharge?

  1. Holding expansion cards by their gold edge connectors
  2. Storing components loose in a plastic bag
  3. Wearing a grounded antistatic wrist strap Correct answer.
  4. Working on carpet in wool clothing to stay warm

Explanation

An antistatic wrist strap bleeds static charge safely to ground so it cannot discharge into sensitive electronics. Cards should be held by their edges or brackets and spare parts kept in antistatic packaging.

Question 6IT Support Fundamentals and Procedures

What is the main reason a change request must be approved before a production system is modified?

  1. To assess risk and impact and allow rollback planning Correct answer.
  2. To increase the number of tickets closed per day
  3. To make sure the technician gets paid overtime
  4. To guarantee that the change will never fail

Explanation

Change approval reviews risk, business impact, dependencies, timing windows, and the rollback plan so that any outage is bounded and recoverable. It also keeps other teams aware of planned work.

Question 7IT Support Fundamentals and Procedures

Why should a technician document the resolution steps in the ticket before closing it?

  1. To satisfy the user's request for a written apology
  2. To build a searchable history for future similar issues Correct answer.
  3. So the ticket can be billed at a higher priority
  4. Because the ticketing tool will not close without notes

Explanation

Resolution notes create an organizational memory: the next technician facing the same symptom can find the verified fix instead of starting over. They also support audit, trend analysis, and knowledge base updates.

Question 8IT Support Fundamentals and Procedures

A user asks a technician to look at a personal photo folder on a company laptop. What is the best action?

  1. Refuse to speak to the user and hang up the call
  2. Explain the support scope and ask about the work issue Correct answer.
  3. Open the folder, since the laptop belongs to the company
  4. Copy the photos to a shared drive for review later

Explanation

Technicians should access only the data needed for the support task and respect user privacy expectations. Redirecting to the actual work problem protects both the user and the organization from unnecessary exposure.

Question 9IT Support Fundamentals and Procedures

A vendor asks a technician to install a remote-access tool on a production server, but there is no ticket and no approved change. What is the correct response?

  1. Install it because the vendor supports the server
  2. Install it and grant the vendor domain administrator rights
  3. Require an approved change and ticket first Correct answer.
  4. Give the vendor the local administrator password by email

Explanation

Third-party access should be tied to an authorized request and an approved change, with the least privilege needed for the task and a record of what was done. Unrecorded remote tools are a supply-chain risk and leave no audit trail.

Question 10IT Support Fundamentals and Procedures

A caller claiming to be the CFO demands an immediate password reset and refuses to answer verification questions. What should the technician do?

  1. Reset the password because of the caller's senior title
  2. Give the caller the temporary password over voicemail
  3. Ask the caller to email a photo of their ID badge
  4. Apply standard verification and escalate the refusal Correct answer.

Explanation

Identity verification steps apply to everyone regardless of claimed rank, because a title is exactly what an impersonator will claim. A refusal to verify is a social engineering red flag that should be reported through the escalation path.

Question 11IT Support Fundamentals and Procedures

Two tickets arrive at the same time: Ticket A, one user cannot print to a shared printer; Ticket B, the payroll server is down for all staff on payday. Which ticket is worked first, and why?

  1. A, because a single-user ticket is quicker to close
  2. B, because it affects many users on a critical deadline Correct answer.
  3. A, because printer faults always have the highest impact
  4. B, because server tickets are always assigned to tier 1

Explanation

Priority is derived from impact (how many people and which business functions are affected) and urgency (deadline or revenue pressure). Ticket B is both broad in impact and time critical, so it outranks a single-user printer issue.

Question 12IT Support Fundamentals and Procedures

A user is shouting about a recurring outage. Which response is most appropriate?

  1. Explain that the user is overreacting to a minor issue
  2. Transfer the call to a manager without saying anything
  3. Match the user's tone so they know you understand
  4. Acknowledge the frustration and restate the next steps Correct answer.

Explanation

Acknowledging emotion first lowers tension and lets the conversation move to facts. Restating the problem and the next steps gives the user a concrete sense of control and progress.

Question 13IT Support Fundamentals and Procedures

Which ticket note gives the next technician enough information to act on it?

  1. Fixed it, user is happy now, closing the ticket
  2. Swapped NIC; link at 1 Gbps; user confirmed email works Correct answer.
  3. User called again about the same thing, very annoying
  4. Network problem, looked at it for a while, see earlier notes

Explanation

Effective notes state the symptom, the action taken, the observed result, and the user's confirmation, which is enough for someone else to continue or repeat the fix. Opinions and vague references to earlier notes add nothing actionable.

Question 14IT Support Fundamentals and Procedures

A technician has spent 45 minutes on an outage and is unsure of the next step, while the SLA window is closing. What should the technician do?

  1. Reassign the ticket to the user and ask them to call back
  2. Escalate with notes on symptoms and steps already tried Correct answer.
  3. Close the ticket as resolved to protect the SLA metric
  4. Keep trying alone until the SLA window passes

Explanation

Escalation criteria exist to protect the customer's service level, so a stalled ticket should move up with a clear summary of symptoms and attempted fixes. This avoids duplicated effort and gets fresh expertise on the problem.

Question 15IT Support Fundamentals and Procedures

Before closing a ticket, what confirms the issue is truly resolved?

  1. The user confirms the original task now works Correct answer.
  2. The ticket has been open longer than the SLA allows
  3. The technician's own test passed on a different machine
  4. The user has not called back within ten minutes

Explanation

Resolution is defined by the user being able to perform the originally failing task in their own environment. Testing elsewhere or relying on silence does not prove the user's problem is gone.

Question 16IT Support Fundamentals and Procedures

Before installing a major firmware update on a production server, what should be done first?

  1. Schedule the update for the busiest hour to see errors quickly
  2. Confirm a current backup and a tested rollback method exist Correct answer.
  3. Delete old backups to free space for the new firmware
  4. Disable monitoring so alerts do not interrupt the work

Explanation

A recoverable state is the prerequisite for any risky change: current backups protect the data and a tested rollback returns the system to service if the update fails. Then the work runs in an approved window with monitoring in place.

Question 17IT Support Fundamentals and Procedures

A workstation shows ransomware notes and files are being encrypted. What is the best first action?

  1. Disconnect the workstation from the network to limit spread Correct answer.
  2. Pay the ransom quickly to recover the files
  3. Email coworkers to warn them using the infected machine
  4. Run a full antivirus scan and wait for it to finish

Explanation

Containment comes first in any malware incident: isolating the host stops lateral movement and further encryption. Notification, investigation, and recovery follow once the spread is limited.

Question 18IT Support Fundamentals and Procedures

Why does an organization tag and record IT assets in an asset inventory?

  1. To replace the need for antivirus software
  2. To track ownership, location, warranty, and changes Correct answer.
  3. To prevent users from ever moving their laptops
  4. To increase the resale value of the equipment

Explanation

An asset inventory ties each device to an owner, a location, a support status, and a change history, which is essential for patching, warranty claims, audits, and incident scoping. It is a record-keeping control, not a technical protection.

Question 19IT Support Fundamentals and Procedures

A printer jams every day around 10 a.m., and a technician clears the jam each time. How should this repeated fix be described?

  1. The root cause is the user; the workaround is a new printer
  2. Clearing the jam is the root cause fix; the schedule is the symptom
  3. Clearing the jam is a workaround; root cause is why it jams daily Correct answer.
  4. There is no difference; both actions permanently fix the printer

Explanation

A workaround restores service without removing the underlying defect, so the symptom returns. Root cause analysis asks why the jam happens at that time, such as a large batch job, worn rollers, or humidity, and fixes that condition.

Question 20IT Support Fundamentals and Procedures

After resolving a novel issue, what makes a knowledge base article most useful to others?

  1. Password and license keys used during the fix
  2. A long narrative of the technician's day before the call
  3. A link to the vendor's homepage with no further detail
  4. Clear symptoms, environment, steps, and verified fix Correct answer.

Explanation

A useful article lets a reader recognize the problem, confirm it matches their environment, and follow reproducible steps to the same verified outcome. It must never contain credentials, which change and should not be shared.

Question 21IT Support Fundamentals and Procedures

Which statement belongs in a blameless post-incident review?

  1. Someone should be disciplined before the review starts
  2. The junior admin caused the outage by being careless
  3. We should stop allowing changes to that server
  4. The change lacked a rollback step, which we will add Correct answer.

Explanation

A blameless review focuses on process and system conditions that allowed the failure, producing concrete corrective actions. Naming individuals discourages reporting and hides the real causes.

Question 22IT Support Fundamentals and Procedures

A technician must explain a password reset to a nontechnical user. Which approach is best?

  1. Tell the user to look it up on the internet themselves
  2. Use plain language and check the user can repeat it Correct answer.
  3. Read the vendor's technical bulletin aloud word for word
  4. Use the internal acronyms the technician uses daily

Explanation

Explaining in plain language and confirming understanding keeps the user able to repeat the task on their own, which reduces repeat contacts. Jargon and scripted reading shift the burden back to the user.

Question 23IT Support Fundamentals and Procedures

Over one month, forty tickets describe the same Wi-Fi drops in one building. What is the most appropriate next step for the support team?

  1. Raise the severity of each ticket to critical and stop there
  2. Open a problem record to find and fix the underlying cause Correct answer.
  3. Ban users in that building from the wireless network
  4. Close each ticket after a reboot and continue as before

Explanation

A pattern of identical incidents signals a shared underlying defect, which is exactly what problem management exists to eliminate. A problem record coordinates root cause analysis so the incidents stop recurring.

Question 24IT Support Fundamentals and Procedures

How does disaster recovery differ from business continuity?

  1. Disaster recovery covers every department; continuity covers IT only
  2. They are identical terms used interchangeably in IT
  3. Business continuity focuses only on restoring backups and servers
  4. Recovery restores IT systems; continuity keeps business running Correct answer.

Explanation

Disaster recovery is the technical subset that restores systems, data, and infrastructure after a disruption. Business continuity is the broader plan that keeps essential business functions operating, including people, processes, and alternate sites.

Question 25IT Support Fundamentals and Procedures

A laptop may become evidence in an HR investigation. What should the technician record first?

  1. A full wipe of the drive to remove malware
  2. The user's opinion about the allegations
  3. The device's resale value and warranty end date
  4. Who handled the device, when, and where it was stored Correct answer.

Explanation

Chain of custody documents every person who handled the evidence and every location and time, so its integrity can be defended later. The device should be preserved and isolated rather than altered.

Question 26IT Support Fundamentals and Procedures

What does a service level agreement (SLA) primarily define for IT support?

  1. The response and resolution targets for each request type Correct answer.
  2. The physical security controls applied to the data center
  3. The list of software products the organization is licensed to run
  4. The salary structure for support staff by tier

Explanation

An SLA is an agreement between the service provider and the customer that sets measurable expectations, most commonly how quickly a request will be acknowledged and resolved for each priority level. Licensing, facilities security, and staff pay are governed by other documents and processes.

Question 27IT Support Fundamentals and Procedures

Which task is normally performed at the first line of support (Tier 1)?

  1. Negotiating a support contract with a hardware vendor
  2. Resetting a forgotten password for a locked account Correct answer.
  3. Rebuilding a corrupted database index
  4. Designing a new network segment for a branch office

Explanation

Tier 1 handles high-volume, well-documented issues that can be resolved with standard scripts and knowledge articles, and password resets are the classic example. Network design, deep database repair, and contract negotiation require senior engineers or management.

Question 28IT Support Fundamentals and Procedures

A technician is about to start a remote support session on a user's desktop. Which action is most appropriate before taking control?

  1. Disconnect the user's second monitor to simplify the view
  2. Begin working immediately so the session stays within the time limit
  3. Disable the user's antivirus so the remote tool runs faster
  4. Confirm the user agrees to the screen share and has saved work Correct answer.

Explanation

Remote control lets the technician see personal data and act directly on the user's machine, so consent and a warning to save open work are required. The warning also prevents data loss if an application must be closed or the machine restarted during the session.

Question 29IT Support Fundamentals and Procedures

A user walks up to the help desk with a laptop that will not charge, and no ticket exists yet. What should the technician do first?

  1. Tell the user to submit a ticket through the self-service portal and return tomorrow
  2. Open the laptop to check the charging port
  3. Hand the user a spare laptop and send them away
  4. Log a ticket with user, asset, symptom, and contact details Correct answer.

Explanation

Every support interaction should be captured so it can be tracked, measured, and handed over to another technician. The ticket records who reported the fault, which asset is affected, what the symptom is, and how to reach the user before diagnostic work begins.

Question 30IT Support Fundamentals and Procedures

A nightly backup job has reported success for six months. Which additional practice best shows that the backups can actually be used?

  1. Increasing the retention period for all backup sets
  2. Moving the backup server into the main server room
  3. Test-restoring sample files on a regular schedule Correct answer.
  4. Recording the size of each backup job in a log

Explanation

A successful job only shows that the backup software finished copying data; only a restore proves the data is intact and recoverable within the required time. Retention settings, log entries, and server placement do not validate recoverability.

Question 31IT Support Fundamentals and Procedures

A user forwards an email that asks them to confirm their password through a link. What is the most appropriate guidance and action?

  1. Open the link from a spare account to see the destination page
  2. Reply to the sender asking them to remove the user from their list
  3. Delete the message and take no further action
  4. Have the user report it and notify the security team Correct answer.

Explanation

Credential-phishing messages should go through the official reporting channel so security can block the sender and check whether other staff received the same lure. Interacting with the message, including replying, confirms a live address to the attacker.

Question 32IT Support Fundamentals and Procedures

When creating an account for a new hire, which approach best applies the principle of least privilege?

  1. Give full administrator rights for the first month, then review
  2. Copy the permissions of the department's most senior member
  3. Grant only the access the role needs, adding more by request Correct answer.
  4. Mirror the rights held by the previous person in the post

Explanation

Least privilege means each account holds only the access required to do the job, with anything extra granted through a documented request. Copying another person's rights or starting everyone as an administrator carries over permissions the role never needed.

Question 33IT Support Fundamentals and Procedures

A desktop powers on, the fans spin, but the screen stays blank and the chassis beeps in a repeating pattern. What is the most efficient next step?

  1. Look up the beep pattern in the vendor's manual Correct answer.
  2. Replace the motherboard as the first action
  3. Reseat the monitor cable and retest the display output
  4. Reinstall the operating system from recovery media

Explanation

Power-on self-test beep patterns are vendor-specific signals that identify which subsystem failed before the system can display anything. Decoding the pattern points the technician to memory, video, or storage instead of guessing at parts.

Question 34IT Support Fundamentals and Procedures

An employee's phone, which holds the authenticator app for company MFA, is lost while traveling. What should IT do?

  1. Email the current one-time code to the user's personal address
  2. Disable MFA on the account until the phone is found
  3. Ask the user to reuse an old recovery code indefinitely
  4. Verify identity, reset MFA, and enroll a new device Correct answer.

Explanation

A lost second factor is a routine event handled by confirming the user's identity, invalidating the old enrollment, and registering a replacement device. Removing the factor or relying on the same recovery code long term removes the protection MFA provides.

Question 35IT Support Fundamentals and Procedures

A user's branch printer fails only when printing from one application. The technician maps a different printer so the user can keep working. How should this be recorded?

  1. As user error, since only one application is affected
  2. As a workaround, with the underlying issue left open Correct answer.
  3. As a duplicate of any earlier printer ticket
  4. As a permanent fix, and the ticket should be closed

Explanation

A workaround restores service without removing the cause, so the ticket should stay open or be linked to a problem record until the real fault is fixed. Closing it as resolved hides a defect that will return and stops others from investigating.

Question 36IT Support Fundamentals and Procedures

A user asks the technician to install a free screen-recording utility that is not in the approved software catalog. What is the most appropriate response?

  1. Install it but hide the shortcut from other users
  2. Tell the user to download and install it themselves
  3. Install it, since free tools carry no licensing risk at all
  4. Send the request through the software approval process Correct answer.

Explanation

Software outside the approved catalog has not been assessed for licensing, security, or supportability, so it goes through the request and review process. Installing unvetted tools, or having the user self-install them, puts the same unassessed software on the endpoint.

Question 37IT Support Fundamentals and Procedures

A repair needs a part that will not arrive until tomorrow, and the user asks when the laptop will be ready. What is the best response?

  1. Promise it will be ready within the hour so the user stays calm
  2. Avoid the question and wait for the user to follow up
  3. Say the outcome is unknown and move on to the next ticket
  4. Say the part is due tomorrow and set a time to update Correct answer.

Explanation

A realistic estimate plus a committed follow-up keeps the user informed and preserves trust. Promises that cannot be met damage credibility, and leaving the user without a check-in point invites escalation.

Question 38IT Support Fundamentals and Procedures

After an outage, the team finds the database server ran out of disk space and restores service. In a root cause analysis, what is the next step?

  1. Ask why the disk filled and why no alert warned of it Correct answer.
  2. Add disk space to every server in the estate
  3. Close the investigation now that service is restored
  4. Assign blame to the team that owns the database

Explanation

Root cause analysis continues past the immediate technical cause to the process and monitoring failures behind it, which is where lasting fixes come from. Stopping at the symptom, over-provisioning everywhere, or blaming people does not prevent a repeat.

Question 39IT Support Fundamentals and Procedures

A technician is about to replace a failed disk in a RAID 5 array that is already running in a degraded state. What should be verified first?

  1. That the array's write cache has been disabled permanently
  2. That the replacement drive has the largest available capacity
  3. That a verified backup of the array's data exists Correct answer.
  4. That the other disks are the same brand as the failed one

Explanation

A degraded array has no redundancy left, so a rebuild failure or an unsuitable drive can destroy all data. A current, verified backup is the safety net that makes the repair safe to attempt.

Question 40IT Support Fundamentals and Procedures

A technician has reproduced a fault and confirmed a probable cause. According to the standard troubleshooting model, what is the appropriate next step?

  1. Escalate to the vendor before making any change
  2. Ask the user to reinstall the affected application
  3. Plan the fix, then implement and verify full function Correct answer.
  4. Document the outcome and close the ticket

Explanation

Once the cause is established, the model calls for a plan of action that weighs the effect on the user and system, followed by implementation and verification that normal service is fully restored. Documentation and closure come after verification.

Question 41Hardware and Endpoint Device Support

Which memory module form factor is used in most laptop computers?

  1. DIMM
  2. SIMM
  3. SO-DIMM Correct answer.
  4. RIMM

Explanation

Laptops use the shorter SO-DIMM form factor because the chassis has very little vertical clearance above the motherboard. Full-size DIMMs are the standard for desktop boards.

Question 42Hardware and Endpoint Device Support

Which power supply connector provides the main power to an ATX motherboard?

  1. 8-pin EPS
  2. 6-pin PCIe
  3. 4-pin Molex
  4. 24-pin ATX Correct answer.

Explanation

The 24-pin ATX connector is the primary power feed for an ATX motherboard. The other connectors feed specific devices or supply supplemental power to the CPU or a graphics card.

Question 43Hardware and Endpoint Device Support

Which protocol allows an M.2 solid-state drive to transfer data over PCIe lanes at high speed?

  1. SATA
  2. NVMe Correct answer.
  3. eSATA
  4. PATA

Explanation

NVMe is designed specifically for flash storage on the PCIe bus, allowing far higher throughput and queue depth than older storage protocols. AHCI over SATA remains limited by the SATA interface.

Question 44Hardware and Endpoint Device Support

Which video connector carries both digital video and audio and is commonly found on televisions and monitors?

  1. S-Video
  2. HDMI Correct answer.
  3. DVI-D
  4. VGA

Explanation

HDMI carries digital video and embedded audio over a single cable, which is why it is the common choice for consumer displays. VGA, DVI-D, and S-Video do not carry audio.

Question 45Hardware and Endpoint Device Support

Which device provides battery power to a workstation during a short power outage?

  1. Power strip
  2. Surge suppressor
  3. Line conditioner
  4. UPS Correct answer.

Explanation

An uninterruptible power supply contains a battery and inverter so the connected equipment keeps running when mains power drops. The other devices only condition or distribute utility power.

Question 46Hardware and Endpoint Device Support

What is the purpose of applying thermal paste between a CPU and its heat sink?

  1. To conduct electricity between the CPU and the socket
  2. To fill microscopic air gaps and improve heat transfer Correct answer.
  3. To insulate the CPU from the heat sink
  4. To bond the heat sink permanently to the CPU

Explanation

Machined surfaces are not perfectly flat, so a thin layer of paste displaces air, which is a poor conductor of heat. This lowers the thermal resistance between the CPU and the heat sink.

Question 47Hardware and Endpoint Device Support

Which practice best protects internal components from electrostatic discharge while working inside a desktop case?

  1. Working with the computer on a carpeted floor
  2. Wearing rubber gloves
  3. Wearing an antistatic wrist strap connected to a grounded point Correct answer.
  4. Leaving the power cord connected with the PSU switched on

Explanation

A wrist strap bleeds static charge from the technician to a known ground so it cannot discharge through a component. The system should also be unplugged before service work begins.

Question 48Hardware and Endpoint Device Support

What must be done before a new Bluetooth mouse can be used with a laptop for the first time?

  1. Turn off Wi-Fi on the laptop
  2. Install a driver from a USB flash drive
  3. Put the mouse in pairing mode and add it in the Bluetooth settings Correct answer.
  4. Connect the mouse by cable to charge it

Explanation

Bluetooth peripherals must be placed in discovery mode and then paired with the host through the operating system's Bluetooth settings. Once paired, the connection is remembered.

Question 49Hardware and Endpoint Device Support

Which RAID level uses mirroring only, with exactly two drives holding identical data?

  1. RAID 6
  2. RAID 0
  3. RAID 1 Correct answer.
  4. RAID 5

Explanation

RAID 1 writes the same data to both drives, so either drive can fail without data loss. RAID 0 provides no redundancy, and RAID 5 and RAID 6 require three or more drives because they use parity.

Question 50Hardware and Endpoint Device Support

Which statement describes an advantage of a solid-state drive over a mechanical hard disk drive?

  1. It offers a lower cost per gigabyte at high capacities
  2. It requires a physically larger drive bay
  3. It stores data on spinning platters for faster access
  4. It has no moving parts, so it resists shock and delivers faster random access Correct answer.

Explanation

Flash memory has no platters or actuator arms, which removes seek latency and makes the drive far more tolerant of bumps and drops. Cost per gigabyte still favors mechanical drives at high capacities.