Cisco Certified Support Technician (CCST) IT Support — Practice Set 1

Question 1

A help-desk analyst receives a call about a broken laptop screen. She resolves the issue and closes the ticket. Later the same day, the same user calls again with an unrelated printer problem. How should the analyst handle this new issue according to standard ticketing practice?

Accepted Answer

Each distinct issue should have its own ticket. Creating a new ticket allows the organisation to track, assign, and report on each issue independently, ensures proper SLA tracking per issue, and prevents different problems from being conflated. Reopening a closed ticket for an unrelated issue contaminates historical reporting and can incorrectly affect SLA metrics. Verbal notes without tickets leave no auditable record.

Question 2

A user calls the help desk and is frustrated. He has already tried several troubleshooting steps and is repeating himself. The help-desk analyst should FIRST do which of the following?

Accepted Answer

Active listening and empathy are core help-desk skills. Acknowledging the user's frustration validates their experience and builds rapport. Summarising what has already been tried avoids redundant steps and demonstrates the analyst was listening. This approach aligns with ITIL service desk best practices emphasising customer satisfaction and effective communication.

Question 3

A help-desk team uses a tiered support model. A tier 1 analyst cannot resolve a complex server issue after 30 minutes. According to standard practice, what should happen next?

Accepted Answer

Tiered support models define escalation paths: tier 1 handles common issues; tier 2 handles more complex issues requiring deeper technical knowledge; tier 3 involves specialists or vendors. When tier 1 cannot resolve an issue within a defined timeframe, the ticket is escalated to tier 2 along with all documented troubleshooting steps so the next analyst does not repeat work. Closing the ticket unresolved or escalating directly to a vendor skips the defined process.

Question 4

A company's IT service agreement promises that critical incidents will receive an initial response within 1 hour and be resolved within 4 hours. What document formalises these commitments?

Accepted Answer

A Service Level Agreement (SLA) is a contract between a service provider and a customer that defines the expected service levels, including response times, resolution times, availability targets, and escalation procedures. An IT asset inventory tracks hardware and software. CAB minutes record change management decisions. A BCP documents procedures for maintaining operations during a disaster.

Question 5

A help-desk analyst needs to access a remote user's desktop to troubleshoot an application issue without requiring the user to be physically present at the help-desk location. Which technology enables this?

Accepted Answer

Remote Desktop Protocol (RDP, port 3389) and third-party remote support tools allow a help-desk analyst to view and control a user's desktop over a network connection. FTP is used for file transfer, not desktop control. A network printer driver enables printing to a shared printer. SNMP is used for network device monitoring and management, not desktop access.

Question 6

A Windows user reports that an application is not responding and the system is very slow. A help-desk analyst remotely connects to the workstation. Which built-in Windows tool should the analyst use FIRST to identify which process is consuming excessive CPU or memory?

Accepted Answer

Task Manager (Ctrl+Shift+Esc or taskmgr.exe) provides real-time views of running processes along with their CPU, memory, disk, and network usage. It is the standard first tool for identifying resource-hogging processes and ending unresponsive applications. Event Viewer displays system and application event logs for historical diagnostics. Device Manager manages hardware drivers. Disk Defragmenter reorganises fragmented files and would not help identify a runaway process.

Question 7

A technician suspects that a Windows workstation has a driver conflict causing a device to malfunction. Which tool should she use to view all installed hardware and identify devices with errors?

Accepted Answer

Device Manager (devmgmt.msc) displays all hardware devices installed in a Windows system. Devices with driver errors are flagged with yellow exclamation marks or red X icons, making it straightforward to identify and resolve driver conflicts by updating, rolling back, or uninstalling drivers. Task Manager shows processes and performance. Event Viewer shows event logs. ipconfig is a command-line tool for viewing and managing IP configuration.

Question 8

A Windows workstation cannot boot normally after a failed software installation. A technician wants to boot the system with a minimal set of drivers and services to troubleshoot the issue. Which mode should she choose?

Accepted Answer

Safe mode starts Windows with only essential drivers and services, bypassing third-party software and drivers that may be causing boot failures. This allows a technician to diagnose and remove problematic software, update drivers, or restore system settings. Normal mode loads all startup programs and services. Hibernate and Sleep are power-saving states, not diagnostic boot modes.

Question 9

A Linux administrator needs to list all files including hidden files in the current directory and then navigate to a subdirectory named 'logs'. Which command sequence is correct?

Accepted Answer

On Linux, 'ls -a' lists all files including hidden files (those with names beginning with a dot). 'cd logs' changes the current directory to the 'logs' subdirectory. 'dir /a' is a Windows Command Prompt command. 'list --all', 'move', 'open', and 'go' are not valid Linux shell commands for these tasks.

Question 10

A technician uses the Windows command prompt to run 'netstat -an'. The output shows a line: 'TCP  0.0.0.0:3389  0.0.0.0:0  LISTENING'. What does this indicate?

Accepted Answer

Port 3389 is the default port for Remote Desktop Protocol (RDP). A LISTENING state with local address 0.0.0.0:3389 means the RDP service is bound to all network interfaces and is accepting inbound connection requests. This is a normal state when RDP is enabled. It does not indicate an active file transfer, a blocked port, or a VPN connection.

Question 11

A technician needs to find out why an application crashed yesterday on a Windows workstation. The application did not generate its own log file. Which built-in Windows tool provides access to application crash events and system error logs?

Accepted Answer

Event Viewer (eventvwr.msc) provides access to Windows event logs including the Application log, System log, and Security log. Application crashes, errors, and warnings are recorded in the Application log with associated error codes and timestamps. Task Manager shows currently running processes. Windows Update manages OS patches. Resource Monitor shows real-time resource usage.

Question 12

A user reports that her computer cannot connect to any websites. A technician runs 'ipconfig' and sees that the IPv4 address is 169.254.x.x. What does this address indicate?

Accepted Answer

The 169.254.0.0/16 address range is Automatic Private IP Addressing (APIPA). Windows assigns an APIPA address when a DHCP server is unreachable. An APIPA address allows local link communication only; it cannot route to other networks or the internet. This is a strong indicator that the DHCP server is unavailable or the network cable/wireless connection has an issue.

Question 13

A user successfully pings the default gateway (192.168.1.1) but cannot access any websites by name. Pinging a public IP address (8.8.8.8) succeeds. Which component is MOST likely faulty?

Accepted Answer

Successful pings to both the default gateway and a public IP address (8.8.8.8) confirm that layer 3 connectivity is working. The failure to resolve website names indicates a DNS problem. When DNS fails, host names cannot be resolved to IP addresses. Checking the DNS server address in the IP configuration (ipconfig /all) and testing with nslookup is the correct next step.

Question 14

A network technician runs 'traceroute' (or 'tracert' on Windows) from a workstation to a remote server and sees that requests time out at the third hop. What does this MOST likely indicate?

Accepted Answer

Traceroute/tracert sends packets with incrementing TTL values to map the path to a destination. Timeouts at a specific hop indicate that either a router at that hop is not forwarding packets (routing failure), a firewall is blocking ICMP TTL-exceeded messages from that device, or there is a network outage beyond that point. DNS, a remote web service crash, or a local subnet mask error would not cause a traceroute failure at a specific intermediate hop.

Question 15

A technician needs to confirm which well-known port is associated with SSH (Secure Shell). Which port number is correct?

Accepted Answer

SSH uses TCP port 22 by default. Port 21 is used by FTP (control channel). Port 23 is used by Telnet (unencrypted remote terminal). Port 443 is used by HTTPS. Knowing common port assignments is essential for firewall rule analysis and network troubleshooting.

Question 16

A laptop connects to a corporate Wi-Fi network using WPA2-Enterprise. The user is prompted for their Active Directory username and password to authenticate. After a recent password change, the laptop refuses to connect. What is the MOST likely cause?

Accepted Answer

WPA2-Enterprise uses 802.1X authentication and typically caches user credentials. After a password change, the OS often retains the old cached credentials, causing authentication to fail at the RADIUS server. The fix is to delete the saved wireless network profile and reconnect, entering the new credentials. A hidden SSID, WPA2 incompatibility, or DHCP exhaustion would cause different and more general connectivity failures.

Question 17

A remote employee working from home needs to access the company's internal file server securely over the internet. Which technology should the IT team deploy to enable this?

Accepted Answer

A VPN creates an encrypted tunnel between the remote employee's device and the corporate network, allowing secure access to internal resources such as file servers as if the device were on the local network. A public FTP server exposes files to the internet without inherent security. Telnet provides unencrypted remote terminal access and is considered insecure. An HTTP proxy provides web access but does not extend full network access to internal resources.

Question 18

A company's security policy requires passwords to be at least 12 characters long, include uppercase and lowercase letters, numbers, and symbols, and be changed every 90 days. Which password practice does this policy primarily address?

Accepted Answer

Password complexity requirements (length, mixed character types) and regular rotation (changing every 90 days) are fundamental password security practices designed to make passwords harder to guess or brute-force and to limit the exposure window if a password is compromised. SSO consolidates authentication across multiple systems. Biometric and certificate-based authentication are alternatives to passwords.

Question 19

An employee receives an email with a Microsoft Word attachment. When he opens the attachment, a macro runs automatically and installs software without his consent. The software then spreads to other computers on the network without any further user interaction. Which type of malware BEST describes the network-spreading component?

Accepted Answer

A worm is self-replicating malware that spreads across networks without requiring user interaction after the initial infection. The key distinguishing characteristic is autonomous propagation. Ransomware encrypts files and demands payment for the decryption key. Adware displays unwanted advertisements. Spyware collects user data covertly. The original attachment delivery could be a Trojan, but the self-spreading network component is a worm.

Question 20

A user receives an email that appears to come from her bank's CEO asking her specifically, by name and with details about her recent transactions, to wire funds urgently. Which attack type does this MOST represent?

Accepted Answer

Spear-phishing is a highly targeted form of phishing that uses personalised information (name, role, recent activity) to appear credible and trick a specific individual. Unlike generic phishing emails sent to thousands of recipients, spear-phishing messages are crafted for one target. Vishing uses voice calls. Pharming redirects DNS lookups to fraudulent websites.

Question 21

A Windows pop-up asks a standard user to enter administrator credentials before an application can make system-level changes. Which Windows security feature is generating this prompt?

Accepted Answer

User Account Control (UAC) is a Windows security feature introduced in Windows Vista that prompts for administrator credentials or consent before allowing actions that could affect system settings or other user accounts. UAC reduces the exposure of elevated privileges by ensuring that standard users cannot silently install software or modify system-level settings. Windows Defender is an antivirus solution. BitLocker provides drive encryption. Windows Firewall controls network traffic.

Question 22

A tier 1 analyst successfully resolves a rare issue that took two hours to diagnose. To help future analysts solve the same issue faster, what should the analyst create?

Accepted Answer

Knowledge base (KB) articles capture solutions to known issues so that future analysts can resolve similar problems quickly without repeating lengthy diagnostic processes. This is a core ITIL knowledge management practice. An email to the user does not benefit future analysts. A change request is appropriate if a system change is needed to prevent recurrence but does not document the troubleshooting knowledge. A new ticket is created when a new incident occurs.

Question 23

A company classifies support tickets into four priority levels. A priority 1 (P1) ticket represents a total outage affecting all users. A priority 4 (P4) ticket is a cosmetic issue with no business impact. A finance department's accounting application is completely down one hour before month-end close, affecting 20 users. How should this ticket be prioritised?

Accepted Answer

Ticket priority is based on both impact (number of users affected, criticality of the business function) and urgency (time sensitivity). A critical financial application down one hour before month-end close has very high urgency and high impact — this combination warrants P1 treatment regardless of the user count. Priority is not solely determined by the number of users affected; business criticality and time pressure are equally important factors.

Question 24

An IT team wants to replace all company laptops with a newer model over the next quarter. Before procurement, they review a document that lists every company-owned laptop with its serial number, assigned user, purchase date, and warranty status. What is this document called?

Accepted Answer

An asset inventory (also called a configuration management database or CMDB in ITIL terminology) tracks all IT hardware and software assets, including serial numbers, assigned users, purchase dates, warranty information, and location. It is essential for lifecycle management, procurement planning, and security auditing. A change management log records changes made to IT systems. An incident report documents a specific security or operational event. A service catalogue lists IT services offered to users.

Question 25

A company needs to upgrade the operating system on its core ERP server. Before the change is made, the team must submit a formal request, obtain approval from a review board, define a rollback plan, and schedule a maintenance window. Which process governs this workflow?

Accepted Answer

Change management is the ITIL process that controls the lifecycle of all IT changes. It requires a Change Request (CR) to be submitted, reviewed by a Change Advisory Board (CAB), approved, scheduled, tested with a rollback plan, and documented. The goal is to minimise disruption to services while enabling necessary improvements. Incident management handles unexpected disruptions. Problem management identifies root causes of recurring incidents. Release management oversees deploying new software versions but is a subset of the broader change management process.

100-140 CCSTISP — Cisco Certified Support Technician (CCST) IT Support