I85PREP
⌘ K
ITCA study materials
ITCA study resources

ITCA practice questions

One question at a time. Build your ITCA understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1ITCA

Which ITCA domain component is primarily responsible for translating business requirements into technical specifications?

  1. Hardware procurement
  2. Network cabling
  3. Vendor marketing
  4. System analysis Correct answer.

Explanation

System analysis is the discipline that gathers business requirements and converts them into technical specifications that developers and architects can implement. The other activities are operational or commercial tasks that do not perform requirements translation.

Question 2ITCA

In IT service management, which practice focuses on restoring normal service operation as quickly as possible after an incident?

  1. Configuration management
  2. Capacity management
  3. Incident management Correct answer.
  4. Demand management

Explanation

Incident management is dedicated to returning service to normal operation quickly while minimizing business impact. Capacity, configuration, and demand management are planning and control practices rather than rapid recovery practices.

Question 3ITCA

A technician needs to assign a persistent address to a server so it always receives the same IP on the LAN. Which mechanism is designed for this?

  1. A DHCP reservation Correct answer.
  2. A NAT pool
  3. A VLAN trunk
  4. A DNS forwarder

Explanation

A DHCP reservation binds a specific MAC address to a fixed IP so the server consistently receives the same address while still using DHCP. DNS forwarders resolve names, NAT pools translate addresses, and VLAN trunks carry multiple VLANs; none of them assign persistent addresses.

Question 4ITCA

Which of the following best describes the primary purpose of an access control list on a router interface?

  1. To filter traffic entering or leaving the interface based on defined rules Correct answer.
  2. To automatically assign IP addresses to connected hosts
  3. To balance traffic across redundant links
  4. To encrypt all payloads traversing the interface

Explanation

An ACL is a sequential list of permit and deny rules applied to interface traffic, allowing administrators to filter packets by criteria such as source, destination, and port. It does not encrypt payloads, allocate addresses, or perform load balancing.

Question 5ITCA

Which backup strategy copies only the data changed since the last full backup while still requiring the last full backup to restore?

  1. Differential backup Correct answer.
  2. Incremental backup
  3. Mirroring
  4. Snapshot replication

Explanation

A differential backup captures all changes since the most recent full backup, so restoring requires only the last full backup plus the latest differential. An incremental backup captures changes since the last backup of any type and requires the full chain.

Question 6ITCA

Which protocol operates at the transport layer and provides reliable, connection-oriented delivery with acknowledgments?

  1. UDP
  2. ARP
  3. ICMP
  4. TCP Correct answer.

Explanation

TCP is connection-oriented and uses acknowledgments, sequencing, and retransmission to provide reliable delivery at the transport layer. UDP is connectionless, while ICMP and ARP operate at other layers for control and address resolution.

Question 7ITCA

What is the main purpose of a firewall rule that denies all traffic by default?

  1. To enforce a least-privilege posture so only explicitly permitted traffic passes Correct answer.
  2. To simplify the assignment of IP addresses
  3. To increase available bandwidth on the network
  4. To speed up DNS resolution for clients

Explanation

A default-deny rule implements least privilege at the network boundary by blocking everything except traffic that administrators explicitly allow. This reduces exposure to unauthorized access and is a foundational security principle.

Question 8ITCA

Which document typically defines the agreed-upon level of service a provider must deliver, including availability targets?

  1. Configuration baseline
  2. Incident ticket
  3. Service level agreement Correct answer.
  4. Change request

Explanation

A service level agreement formally records the measurable service commitments, such as availability and response times, between a provider and a customer. Change requests, incident tickets, and configuration baselines are operational artifacts rather than contractual service commitments.

Question 9ITCA

An administrator must ensure that a web server can accept incoming connections on port 443 from any external client. Which configuration accomplishes this?

  1. Allow inbound UDP 443 from the server's subnet only
  2. Deny inbound TCP 443 and permit UDP 53
  3. Allow outbound TCP 443 from the server to any destination
  4. Allow inbound TCP 443 from any source to the server Correct answer.

Explanation

HTTPS uses TCP port 443, so an inbound allow rule permitting TCP 443 from any source lets external clients reach the web server. The other options either address outbound traffic, restrict sources incorrectly, or block the required port.

Question 10ITCA

A company wants to recover from a site outage within four hours with minimal data loss. Which two metrics should the plan specify?

  1. CPU and RAM
  2. MTBF and MTTR
  3. RTO and RPO Correct answer.
  4. SLA and OLA

Explanation

Recovery time objective defines the maximum acceptable downtime, and recovery point objective defines the maximum acceptable data loss measured in time. Together they specify the outage duration and data-loss tolerance the plan must satisfy.

Question 11ITCA

A user reports intermittent connectivity. The technician confirms the link light is on and pings the default gateway successfully but cannot reach external sites. Which action is the most appropriate next step?

  1. Replace the monitor
  2. Reinstall the operating system
  3. Check the DNS configuration and test name resolution Correct answer.
  4. Replace the network interface card immediately

Explanation

Successful gateway pings indicate local connectivity works, so failure to reach external sites often points to name resolution or upstream routing. Testing DNS is a targeted diagnostic step before replacing hardware or reinstalling software.

Question 12ITCA

Which change management step reduces risk by testing a modification in a non-production environment before deployment?

  1. Change rejection
  2. Change logging
  3. Change validation Correct answer.
  4. Change classification

Explanation

Change validation confirms the change works as intended and does not introduce regressions by testing in a controlled, non-production environment. Classification, logging, and rejection are administrative steps that do not verify technical behavior.

Question 13ITCA

A workstation receives an address starting with 169.254. What does this indicate?

  1. The host is on a VPN tunnel
  2. The host has a valid public address
  3. The host is using a static address from the administrator
  4. The DHCP server was unreachable, so the host self-assigned a link-local address Correct answer.

Explanation

The 169.254.0.0/16 range is the IPv4 link-local block that hosts self-assign when DHCP is unavailable. Seeing such an address usually indicates the client could not contact a DHCP server.

Question 14ITCA

Which control type is a security awareness training program?

  1. Technical control
  2. Administrative control Correct answer.
  3. Physical control
  4. Environmental control

Explanation

Security awareness training is an administrative control because it relies on policies, procedures, and human behavior rather than technology or physical barriers. Technical controls are implemented in systems, and physical controls restrict access to facilities.

Question 15ITCA

An organization wants to prevent a single administrator from both creating and approving a payment. Which principle applies?

  1. Defense in depth
  2. Least privilege
  3. Separation of duties Correct answer.
  4. Non-repudiation

Explanation

Separation of duties divides critical tasks among different people so no single individual controls an entire process, reducing fraud risk. Least privilege limits access rights, defense in depth layers controls, and non-repudiation prevents denial of actions.

Question 16ITCA

A team needs to automate the deployment of identical servers across multiple environments. Which approach best supports this requirement?

  1. Infrastructure as code with version-controlled templates Correct answer.
  2. Ad hoc scripting without version control
  3. Purchasing additional physical servers
  4. Manual configuration of each server

Explanation

Infrastructure as code uses version-controlled templates to provision environments consistently and repeatably, which is essential for identical deployments across environments. Manual or ad hoc approaches introduce drift and inconsistency.

Question 17ITCA

Which statement accurately distinguishes a vulnerability from a threat?

  1. A vulnerability is an attacker; a threat is a weakness
  2. A vulnerability is a weakness; a threat is a potential cause of harm that could exploit it Correct answer.
  3. A vulnerability is a policy; a threat is a control
  4. A vulnerability is an incident; a threat is a response

Explanation

A vulnerability is an internal weakness in a system, while a threat is any potential actor or event that could exploit that weakness to cause harm. Keeping these terms distinct is essential for accurate risk assessment.

Question 18ITCA

A service desk receives many password reset requests. Which solution most directly reduces this workload while maintaining security?

  1. Deploy a self-service password reset portal with identity verification Correct answer.
  2. Remove multifactor authentication
  3. Disable all password expiration policies
  4. Share administrator credentials with users

Explanation

A self-service password reset portal with identity verification lets users reset credentials securely without contacting the service desk, reducing repetitive workload. The other options weaken security rather than improve efficiency.

Question 19ITCA

Which activity belongs to the monitoring and event management practice?

  1. Negotiating contract terms with suppliers
  2. Approving capital expenditure
  3. Designing the organizational chart
  4. Detecting and correlating infrastructure alerts to identify service-impacting conditions Correct answer.

Explanation

Monitoring and event management focuses on observing infrastructure and services, detecting events, and correlating alerts to identify conditions that affect services. The other activities are commercial, organizational, or financial functions.

Question 20ITCA

A database server shows high disk latency during peak hours. Which metric should be analyzed first to determine whether the storage subsystem is saturated?

  1. Keyboard repeat rate
  2. Average disk queue length Correct answer.
  3. Monitor brightness
  4. Printer spool size

Explanation

Average disk queue length reflects how many I/O requests are waiting for the storage device, so sustained high values indicate saturation and latency. The other metrics are unrelated to storage performance.

Question 21ITCA

An organization must retain audit logs for seven years and protect them from alteration. Which combination best satisfies both requirements?

  1. Write-once storage with a defined retention policy Correct answer.
  2. Periodic deletion of logs
  3. Storage on an administrator's workstation
  4. Standard user-writable storage with no policy

Explanation

Write-once storage prevents modification of retained logs, and a documented retention policy enforces the seven-year period. User-writable or ad hoc storage cannot guarantee integrity or retention.

Question 22ITCA

A company wants to reduce the blast radius of a compromised account. Which design choice most directly limits the damage?

  1. Granting all users administrator rights
  2. Disabling audit logging
  3. Granting each account only the permissions required for its role Correct answer.
  4. Using one shared account for all staff

Explanation

Role-based least privilege limits what a compromised account can access, reducing the scope of damage. Broad administrator rights, shared accounts, and disabled logging all increase exposure and reduce accountability.

Question 23ITCA

An engineer must choose between a full backup nightly and incremental backups hourly. Which statement best describes the trade-off?

  1. Hourly incrementals eliminate the need for any full backup
  2. Nightly full backups always reduce storage consumption compared with incrementals
  3. Incremental backups cannot be restored at all
  4. Hourly incrementals reduce potential data loss but require the full chain for restore Correct answer.

Explanation

More frequent incremental backups lower the recovery point objective, meaning less data is lost, but restoring requires the full backup plus the incremental chain. Nightly full backups consume more storage and provide a coarser recovery point.

Question 24ITCA

A security team observes repeated failed logins followed by a successful login from an unusual country. Which response is most appropriate?

  1. Disable logging to reduce noise
  2. Delete all logs to prevent further alerts
  3. Ignore the event because a login eventually succeeded
  4. Treat it as a suspected compromise and isolate the account pending investigation Correct answer.

Explanation

A pattern of failures followed by success from an unusual location strongly suggests credential compromise, so containment and investigation are warranted. Ignoring the event or destroying evidence would allow the intrusion to continue undetected.

Question 25ITCA

An architect must design a system that remains available if one data center fails. Which approach best meets this requirement?

  1. Deploy redundant components across geographically separate sites with automated failover Correct answer.
  2. Store all data on one server with RAID 0
  3. Schedule manual failover only during business hours
  4. Rely on a single data center with a backup generator

Explanation

Geographic redundancy with automated failover allows the service to continue operating when an entire site is lost. Single-site designs, RAID 0, and manual-only failover cannot provide site-level resilience.

Question 26ITCA

Which OSI layer is responsible for logical addressing and routing packets between different networks?

  1. Layer 3, the network layer Correct answer.
  2. Layer 7, the application layer
  3. Layer 4, the transport layer
  4. Layer 2, the data link layer

Explanation

The network layer (Layer 3) handles logical addressing such as IP and determines the path packets take between networks via routers. The data link layer handles physical (MAC) addressing within a local segment, while transport and application layers handle delivery and user services.

Question 27ITCA

A technician needs to identify the physical address of a network interface card on a Windows workstation. Which command displays it?

  1. tracert
  2. ipconfig /all Correct answer.
  3. netstat -an
  4. nslookup

Explanation

The ipconfig /all command lists adapter details including the physical (MAC) address, along with IP configuration. Netstat shows connections, tracert traces a route, and nslookup queries DNS records.

Question 28ITCA

Which cloud service model provides virtual machines and storage where the customer manages the operating system and applications?

  1. Function as a Service (FaaS)
  2. Software as a Service (SaaS)
  3. Infrastructure as a Service (IaaS) Correct answer.
  4. Platform as a Service (PaaS)

Explanation

IaaS delivers fundamental compute, storage, and networking resources, leaving the customer responsible for the OS, middleware, and applications. SaaS delivers finished applications, PaaS provides a managed runtime, and FaaS runs event-driven code without server management.

Question 29ITCA

Which authentication factor category is a hardware token that generates a time-based one-time code?

  1. Somewhere you are
  2. Something you have Correct answer.
  3. Something you know
  4. Something you are

Explanation

A hardware token is a possession factor, classified as something you have. Knowledge factors include passwords, inherence factors include fingerprints, and location is a contextual attribute rather than a token.

Question 30ITCA

A user reports that a website loads slowly but other sites are fast. Which troubleshooting step best isolates whether the problem is DNS resolution or server response?

  1. Reboot the workstation and retest the site
  2. Resolve the site's hostname with nslookup and then test connectivity to the returned IP Correct answer.
  3. Renew the DHCP lease on the workstation
  4. Replace the network cable to the workstation

Explanation

Separating name resolution from direct IP connectivity shows whether DNS is slow or the destination server is slow. If nslookup returns quickly and pinging the IP is also fast, the delay lies elsewhere in the application path.

Question 31ITCA

Which record type maps a hostname to an IPv6 address in DNS?

  1. CNAME
  2. A
  3. MX
  4. AAAA Correct answer.

Explanation

An AAAA record maps a name to an IPv6 address, while an A record maps to IPv4. CNAME creates an alias to another name and MX directs mail delivery.

Question 32ITCA

An administrator must give a vendor temporary access to a server without sharing the administrator's password. Which practice best meets the requirement?

  1. Create a time-limited account with only the needed permissions Correct answer.
  2. Share a single shared administrator account among staff
  3. Email the administrator password to the vendor
  4. Disable the audit log while the vendor works

Explanation

A dedicated, least-privilege account with an expiration window limits exposure and preserves accountability through logging. Sharing credentials or disabling logs undermines both security and auditability.

Question 33ITCA

Which statement best describes the purpose of a service level objective (SLO) within an SLA?

  1. It specifies a measurable target for a service metric such as uptime Correct answer.
  2. It defines the legal penalties for contract breach
  3. It lists the hardware assets owned by the provider
  4. It records the customer's contact information

Explanation

An SLO is a measurable internal target, such as 99.9 percent availability, that supports the commitments in the SLA. The SLA is the broader agreement that may include remedies, while SLOs translate commitments into trackable metrics.

Question 34ITCA

A company wants to ensure that a deleted file can be recovered quickly after accidental removal without restoring the entire server. Which backup characteristic matters most?

  1. Physical distance of the backup site
  2. Granularity of the backup and restore Correct answer.
  3. Backup encryption strength
  4. Compression ratio of the backup

Explanation

Granular recovery allows restoring a single file rather than a whole system image, which directly shortens recovery of an accidental deletion. Encryption, distance, and compression affect security, resilience, and storage, but not the ability to restore one file.

Question 35ITCA

Which practice most directly verifies that a new patch does not break a critical business application before wide deployment?

  1. Deploying the patch to all servers during business hours
  2. Testing the patch in a representative staging environment Correct answer.
  3. Documenting the patch in the change log
  4. Obtaining verbal approval from a colleague

Explanation

A staging environment that mirrors production lets teams confirm the patch works with the business application before rollout. Documentation and approval are part of change control but do not themselves validate compatibility.

Question 36ITCA

What is the primary function of a VLAN in a switched network?

  1. It assigns public IP addresses to hosts
  2. It logically segments broadcast domains on shared hardware Correct answer.
  3. It converts IPv4 traffic to IPv6
  4. It encrypts traffic between switches

Explanation

A VLAN divides a physical switch into separate logical broadcast domains, improving security and reducing broadcast traffic. It does not provide encryption, public addressing, or protocol translation by itself.

Question 37ITCA

A support team notices that a recurring incident keeps returning because the underlying cause was never addressed. Which practice should they apply?

  1. Capacity planning
  2. Incident categorization only
  3. Asset disposal
  4. Problem management root cause analysis Correct answer.

Explanation

Problem management investigates the underlying cause of recurring incidents so they can be eliminated rather than repeatedly fixed. Incident categorization logs and routes tickets but does not resolve the root cause.

Question 38ITCA

Which element of the CIA triad is most directly protected by hashing stored passwords?

  1. Non-repudiation
  2. Availability
  3. Integrity
  4. Confidentiality Correct answer.

Explanation

Hashing prevents stored passwords from being read in plaintext, protecting confidentiality if the database is exposed. It does not by itself ensure availability, and non-repudiation concerns proving actions rather than hiding secrets.

Question 39ITCA

An organization wants to limit the impact of a ransomware infection on a file server. Which control most directly reduces the spread to backups?

  1. Keeping backups on the same mapped drive as the file share
  2. Increasing the backup schedule frequency only
  3. Storing backups unencrypted for speed
  4. Using immutable or offline backups Correct answer.

Explanation

Immutable or offline backups cannot be altered or encrypted by ransomware that reaches the network, preserving a clean recovery point. Simply running backups more often still leaves them reachable by the malware.

Question 40ITCA

Which protocol provides encrypted remote terminal access as a replacement for Telnet?

  1. TFTP
  2. SSH Correct answer.
  3. FTP
  4. SNMP

Explanation

SSH encrypts remote command-line sessions and is the standard replacement for the cleartext Telnet protocol. FTP, SNMP, and TFTP serve file transfer and management functions and do not provide an encrypted interactive shell.

Question 41ITCA

A user cannot reach a website by name but can reach it by IP address. Which configuration is the most likely cause?

  1. Duplex mismatch on the switch port
  2. Faulty DNS server setting Correct answer.
  3. Incorrect default gateway
  4. Expired DHCP lease

Explanation

Successful access by IP but failure by name points to name resolution, so the DNS server setting or DNS service is the likely fault. A gateway or DHCP problem would typically block IP access as well.

Question 42ITCA

Which statement best describes the role of a DMZ in network architecture?

  1. It assigns dynamic addresses to internal clients
  2. It stores offline backups of internal servers
  3. It replaces the need for a firewall
  4. It isolates internet-facing services from the internal network Correct answer.

Explanation

A DMZ is a segmented zone that hosts externally reachable services while limiting their access to internal systems, so a compromise is contained. It does not eliminate firewalls, store backups, or provide DHCP services.

Question 43ITCA

A company must prove that a third-party supplier meets security requirements before signing a contract. Which activity best supports this?

  1. Accepting the supplier's verbal assurance
  2. Relying on the supplier's marketing materials
  3. Reviewing the supplier's security assessment or certification Correct answer.
  4. Skipping due diligence to speed onboarding

Explanation

Vendor due diligence relies on documented evidence such as independent assessments or certifications to confirm controls. Marketing claims and verbal assurances provide no verifiable proof of compliance.

Question 44ITCA

Which metric best measures whether a service desk is resolving tickets within agreed timescales?

  1. Average number of calls per agent
  2. Number of open tickets
  3. Percentage of tickets resolved within the SLA target Correct answer.
  4. Total number of knowledge articles

Explanation

The percentage of tickets resolved within the agreed target directly measures SLA attainment. Raw open-ticket counts and call volumes describe workload but not timeliness of resolution.

Question 45ITCA

Which practice best protects data at rest on a stolen laptop?

  1. A stronger Wi-Fi password
  2. A screen lock timeout
  3. Full-disk encryption Correct answer.
  4. A host-based firewall

Explanation

Full-disk encryption renders the stored data unreadable without the decryption key, protecting it if the device is physically stolen. Screen locks, firewalls, and Wi-Fi passwords address other threats and do not protect data on a removed drive.

Question 46ITCA

An organization wants to reduce the risk of a single failed disk causing data loss on a production server. Which solution most directly addresses this?

  1. Increasing the size of the single disk
  2. Adding a second network interface
  3. Configuring a RAID array with redundancy Correct answer.
  4. Scheduling more frequent log rotation

Explanation

A redundant RAID configuration allows the array to keep operating when one disk fails, protecting against single-disk loss. Larger single disks, log rotation, and extra network interfaces do not provide disk redundancy.

Question 47ITCA

Which statement correctly distinguishes a role from a responsibility in IT service management?

  1. A role is a set of duties a person performs; a responsibility is the obligation to ensure an outcome Correct answer.
  2. A role is always held by one person; a responsibility is always shared
  3. A role is a job title; a responsibility is a department name
  4. A role describes a team's budget; a responsibility describes its tools

Explanation

A role is a defined collection of duties that a person or team performs, while a responsibility is the accountability for ensuring an outcome occurs. One person can hold multiple roles, and responsibilities may be shared or delegated.

Question 48ITCA

A team runs the same application in three environments and wants configuration differences handled without code changes. Which approach best achieves this?

  1. Hard-coding values in the application source
  2. Rebuilding the application for each environment
  3. Storing environment-specific values in external configuration or environment variables Correct answer.
  4. Maintaining three separate code branches

Explanation

Externalizing configuration lets the same build run in each environment with values supplied at deploy time, supporting consistency and automation. Hard-coding or divergent branches create drift and increase error risk.

Question 49ITCA

An analyst must determine whether an alert indicates a true security incident or benign activity. Which step should come first?

  1. Notify the entire company by email
  2. Disable the affected account without review
  3. Immediately block all network traffic
  4. Validate the alert by correlating logs and context Correct answer.

Explanation

Triage begins by validating the alert against logs and context to distinguish a real incident from a false positive before acting. Disruptive actions taken before validation can harm operations or destroy evidence.

Question 50ITCA

A company wants to ensure that only approved software can execute on employee endpoints. Which control type is application allowlisting?

  1. Compensating environmental control
  2. Detective physical control
  3. Preventive technical control Correct answer.
  4. Corrective administrative control

Explanation

Allowlisting is a preventive technical control because it blocks execution of unapproved software before it runs. It is not physical, and it prevents rather than corrects or merely detects.