CompTIA A+ Core 1 & 2

💻 Concrete example — a battery swap that turns into a slot audit

Ticket: "My laptop only runs on the charger, and the trackpad clicks weird now." You flip it over: the bottom cover bows outward. That is a swollen Li-ion pack pressing up into the trackpad from below — the "weird click" is the tell, not a separate fault.

Walk: 1) Power off, unplug, and stop using the machine — never puncture, bend, or "test" a swollen cell. Order the exact OEM part number; a generic pack with the right connector is still the wrong chemistry and capacity. 2) The user also asked for an SSD upgrade while it is open, so check the slot before ordering: the service manual lists one M.2 2280 slot. If it is Key M, an NVMe drive works; if the board only wires that slot for SATA, an NVMe stick seats but never enumerates. 3) Same audit for RAM — this model has 8 GB soldered plus one free SO-DIMM slot, so the maximum you can sell the user is 8 GB soldered + one module, not a matched pair.

Verify: After the swap the cover sits flush and the trackpad clicks evenly. In Device Manager the new drive shows under Disk drives, and Task Manager → Performance → Memory reports the combined total. Dispose of the old pack through the e-waste stream, never the general bin.

💻 Concrete example — one cable for the exec's desk

Request: An executive wants a single cable at the desk: external monitor, wired Ethernet, keyboard/mouse, and charging — and wants the same setup to work with their iPhone.

Walk: 1) The laptop side is easy: a USB-C dock carries all four, because USB-C can move data (USB 3.2 / USB4 / Thunderbolt), video (DisplayPort Alt Mode), and power (PD, up to 240 W) on one connector. Check the laptop's port icons — a plain USB-C port without the DP or Thunderbolt marking will charge and move data but never drive the monitor. 2) The phone side does not follow: if it is a Lightning iPhone, that port is Apple-proprietary and capped at USB 2.0 speeds, so a dock will not give it desktop video — that is a spec ceiling, not a bad cable. 3) The badge reader beside the monitor is NFC at about 4 cm, so the user must tap it, not wave from the chair; the conference-room projector remote is IR and needs unobstructed line of sight, which is why it stops working when someone parks a laptop bag in front of it.

Verify: Monitor lights up on the single cable, the laptop battery icon shows charging, Ethernet shows a wired connection, and the badge tap registers at contact distance. Document that the phone is charge-and-sync only on this dock.

💻 Concrete example — an audit finding on a branch switch

Finding: A vulnerability scan on the branch office reports "cleartext management protocols enabled" on a switch and a file server. You run netstat -an on the file server and see listeners on 21 and 23.

Walk: 1) Map each port to what it does and whether it encrypts. 23 is Telnet — remote CLI in the clear, including the password. Its replacement is SSH on 22. 21 is FTP control, also cleartext; the replacement is SFTP, which rides the same port 22 because it is a subsystem of SSH. 2) Enable SSH on the switch, disable the Telnet transport, and move the file transfers to SFTP. 3) Do not touch the DNS listener on 53 just because it appears "unencrypted" — DNS queries are normally UDP 53, chosen for speed with no handshake, and the scanner is flagging protocol design, not a misconfiguration.

Verify: Re-run netstat -an: 21 and 23 are gone, 22 is listening. Connect once with an SSH client to prove management still works before you leave the site — disabling the only working transport is how a hardening change becomes an outage.

💻 Concrete example — a 10 Gbps link that negotiates at 1 Gbps

Ticket: A new 10 Gbps NAS in the wiring closet links to the core switch at only 1 Gbps. Both ends are rated 10 Gbps and the cable is Cat 6, freshly terminated.

Walk: 1) Check the physical layer first, because that is where the negotiation happens. The run is measured at roughly 80 m through the ceiling. Cat 6 carries 10 Gbps only to about 55 m; past that it falls back to 1 Gbps. Nothing is broken — the cable spec is doing exactly what it says. 2) Replace the run with Cat 6a, which holds 10 Gbps across the full 100 m, and re-terminate both the patch panel and the keystone with the same T568B pinout used everywhere else in the building. 3) While you are in the closet, the user also reports "the guest Wi-Fi can see the accounting share." That is not a cabling issue at all: the guest AP is plugged into an untagged port in the same Layer 2 broadcast domain. Fixing it means a VLAN on the switch, not a new cable or a router change.

Verify: The switch port now shows a 10 Gbps full-duplex link, and a file copy to the NAS sustains far above the old ceiling. Update the cable map with the new Cat 6a run and its measured length.

💻 Concrete example — a new guest VLAN that leaves clients stranded

Change: You add VLAN 30 for guest Wi-Fi so visitors stop landing on the corporate network. After the change, guests associate to the SSID, get a Wi-Fi icon — and every one of them ends up with a 169.254.x.x address.

Walk: 1) That address is APIPA, so the client never completed DORA (Discover, Offer, Request, Acknowledge). The radio works; the Layer 2 path to the DHCP server does not. 2) Check the switch port feeding the AP. It is a trunk carrying VLAN 10 (corporate) but VLAN 30 was never added to the allowed list, so the 802.1Q-tagged guest frames are dropped at the first hop. Add VLAN 30 to the trunk. 3) Guests now get an address but cannot resolve names: the guest scope was handing out the internal DNS server, which does not answer queries from that subnet. Change the scope option to a public resolver for guests only. 4) Leave the corporate VPN alone — remote staff use a client-to-site IPSec tunnel with split tunnelling, so only corporate-bound traffic crosses it. Routing guest traffic through it would be the opposite of the isolation you just built.

Verify: A test phone on the guest SSID gets a 10.30.x.x lease, resolves an external site, reaches the internet, and gets no response when pinging the accounting server. Record the VLAN ID and scope options in the network diagram.

💻 Concrete example — the RAM that will not go in

Ticket: A user bought 32 GB of DDR5 for their two-year-old desktop and says "the slot must be broken — it will not push down."

Walk: 1) Nothing is broken. DDR4 and DDR5 are not interchangeable: the notch sits in a different position specifically so the wrong generation cannot seat, and they run at different voltages (DDR4 at 1.2 V, DDR5 at 1.1 V). Identify what the board takes before ordering — the board is LGA 1700 but a DDR4 variant, so the correct part is DDR4 DIMM, not the DDR5 the user bought. 2) Confirm the rest of the matrix while you are in there: the CPU socket must match physically and the chipset must support that CPU generation, often after a UEFI update. 3) The user also wants a GPU in the top slot — that is PCIe x16; a x4 card will run in it, but a x16 card in a x4 slot is bandwidth-starved. 4) Power: the ATX board needs the 24-pin main plus the 4/8-pin EPS CPU connector. A build that spins fans but never POSTs is very often a forgotten EPS plug.

Verify: Correct DDR4 modules seat with an audible click on both retention clips. POST completes, and UEFI reports the full capacity at the expected speed — enable the memory profile if it defaults to the JEDEC base clock. Confirm Secure Boot and TPM are on if the OS deployment needs them.

💻 Concrete example — choosing a level for four 4 TB drives

Requirement: A small office file server has four 4 TB drives. The owner wants "as much space as possible, but the server must keep running if a drive dies."

Walk: 1) Score each level against the requirement. RAID 0 (striping) gives all 16 TB and the best speed but zero redundancy — one drive lost is everything lost, so it fails the requirement outright. RAID 1 (mirroring) survives a failure but gives 50% usable, and with four drives you are running two mirrors. RAID 5 (striping with distributed parity) survives one drive failure and gives (n−1) × 4 TB = 12 TB usable. RAID 10 (mirror + stripe, minimum four drives) gives 8 TB with faster writes and a much quicker rebuild. 2) "Maximum space with single-drive tolerance" points at RAID 5 → 12 TB. Flag the trade-off honestly: a RAID 5 rebuild reads every remaining drive end to end, which is exactly when a second aging drive tends to die. 3) Then say the part that matters most: RAID is not a backup. It survives hardware failure, not deletion, corruption, or ransomware — the array still needs a separate backup job.

Verify: The array reports Optimal with 12 TB usable. Pull one drive on a test window and confirm the volume stays online in Degraded state, then reinsert and watch the rebuild complete before going live.

💻 Concrete example — sizing a PSU for a GPU upgrade

Request: A workstation with a 500 W non-modular PSU is getting a new GPU. The user reports the machine already reboots during rendering.

Walk: 1) Add it up: CPU 125 W TDP + new GPU 320 W + 64 GB RAM, two NVMe drives, and fans at roughly 50 W together ≈ 495 W. That is essentially the PSU's entire rated output, which explains the reboots — the rail sags under transient load and the supply protects itself. Add the standard 20–30% headroom and you are shopping for ~650–750 W. 2) Check connectors, not just watts: this GPU needs two 8-pin PCIe leads. Daisy-chaining one cable with a pigtail into both sockets is how you get the same instability on a bigger supply. 3) Pick 80 Plus Gold for the efficiency-versus-price sweet spot, and go fully modular so the unused SATA and Molex runs stay out of the case and airflow improves. 4) Inventory the rest of the plugs before closing: 24-pin board, 4/8-pin EPS for the CPU, 15-pin SATA power for drives.

Verify: Run a sustained load for 30 minutes with no reboot, and confirm the 12 V rail stays in spec in the UEFI hardware monitor or a monitoring utility. The old symptom disappearing under the same workload is the proof.

💻 Concrete example — "VT-x is not available" on a fresh VM

Ticket: A developer installs VirtualBox on a Windows workstation, creates a 64-bit Linux VM, and gets "VT-x is not available" on start. Reinstalling VirtualBox changes nothing.

Walk: 1) This is a Type 2 (hosted) hypervisor running on top of Windows, and it needs hardware virtualization — Intel VT-x or AMD-V — exposed by the CPU. Reboot into UEFI and enable it; on many OEM machines it ships off. 2) Still failing? Check whether Windows itself has claimed the virtualization extensions. If Hyper-V, Windows Sandbox, or memory integrity is enabled, Windows is acting as the Type 1 hypervisor and owns VT-x, leaving the Type 2 product locked out. Turn the Windows feature off (or move the workload onto Hyper-V) — you cannot have both owning the extensions. 3) Size the VM honestly: assigning every physical core and nearly all RAM to one guest starves the host and makes both slow. Leave the host its share. 4) Before the developer applies an untested patch inside the guest, take a snapshot — that is the whole reason the work happens in a VM.

Verify: The VM boots to the installer. Task Manager → Performance → CPU shows "Virtualization: Enabled". Roll the snapshot back once, deliberately, so the developer has seen it work before they need it.

💻 Concrete example — "the provider must have a backup, right?"

Incident: A departing employee's mailbox and OneDrive files are deleted, and 45 days later Finance needs them. The office manager assumes the SaaS provider "obviously has a backup".

Walk: 1) Classify the service first. Hosted email and file storage is SaaS — the provider runs the hardware, the OS, the application, and its patching. That is the maximum a provider covers. 2) Apply the shared responsibility model: even in SaaS, the data, the identities, and the configuration remain the customer's. The provider guarantees the service is available, not that your deleted content survives your own retention settings. Past the default retention window, it is gone unless the tenant enabled a retention policy or a third-party backup. 3) Fix the process, not just the ticket: enable a retention or litigation-hold policy for departing staff, and add an offboarding step that converts the mailbox to shared and exports the files before the account is removed. 4) Contrast the levels so the manager understands the pattern — on IaaS they would also owe the guest OS patching and firewall rules; on PaaS, the application code and its data; on SaaS, only data, access, and settings, which is exactly what failed here.

Verify: The retention policy shows applied in the admin centre, and a test deletion is recoverable after the old window would have expired. Write the offboarding checklist into the knowledge base.

💻 Concrete example — a BSOD the morning after patch night

Ticket: "My PC blue-screens a few minutes after login. Started this morning. I did not change anything."

Walk: 1) Identify. Question the user and ignore "nothing changed" as a fact — treat it as a starting point. Ask what happened last, check Event Viewer and the BSOD stop code, and confirm whether it reproduces. Update history shows a graphics driver installed overnight. 2) Establish a theory. Simplest cause first: the new driver. Note the alternates you are holding in reserve — failing RAM, overheating — so you are not anchored. 3) Test the theory. Boot into Safe Mode, which loads a generic display driver. No crash after fifteen minutes → theory supported. Had it still crashed, the theory dies and you go back to step 2, not forward. 4) Plan. Roll back the driver in Device Manager, and write the rollback for the rollback: if that fails, System Restore to yesterday's point. 5) Implement. Roll back, then pause that driver update so Windows does not immediately reinstall it. 6) Verify full functionality. Reboot, leave it running under the user's actual workload, confirm the external monitor still works — a fix that breaks the second display is not a fix. Put the preventive measure in place. 7) Document. Symptom, stop code, root cause, action, and the fact the vendor driver is held back pending a newer release.

Verify: No BSOD across a full working day, and the ticket record lets the next technician recognise the pattern on the other machines that got the same driver.

💻 Concrete example — the PC that only dies during long jobs

Ticket: A three-year-old desktop shuts off hard — no BSOD, no warning — roughly twenty minutes into any long export. It runs all day for email without a problem.

Walk: 1) Classify the symptom. It boots, it POSTs, and it survives idle work: that rules out the POST-time faults (a continuous beep pattern would point at RAM, and no video with fans spinning would point at the GPU or power). Failure correlated with sustained load and elapsed time is the overheating fingerprint. 2) Confirm rather than assume: Event Viewer shows Kernel-Power 41, an unexpected loss of power, and a hardware monitor shows the CPU climbing past its throttle point right before each shutdown. 3) Find the cause of the heat. The intake filter and heatsink fins are packed with dust, and the CPU fan spins slowly and unevenly. Blow the dust out with compressed air (short bursts, hold the fan blades still), replace the failing fan, and reseat the cooler with fresh thermal paste. 4) Only after the thermal path is fixed do you consider power — and if the temperatures had been normal all along, an aging PSU would have been the next theory.

Verify: Re-run the same long export while watching temperatures: the CPU now plateaus well under the throttle point and the job completes. Note the dust load in the ticket and put the machine on a cleaning schedule — that is the preventive measure step, not an optional extra.

💻 Concrete example — a new hire's laptop that cannot join the domain

Ticket: A new starter's laptop, bought retail, needs to join the company domain, get the standard Group Policy, and have its disk encrypted. Domain join is greyed out.

Walk: 1) Identify the edition first: winver (or systeminfo) reports Windows 11 Home. That single fact explains all three requirements failing at once — domain join, Group Policy (gpedit.msc), BitLocker, Remote Desktop host, and Hyper-V are Pro/Enterprise features. Home can be an RDP client, which is why the user insists "remote desktop works". 2) The fix is an edition upgrade, not a rebuild: enter a Pro key under Settings → System → Activation and Windows performs an in-place upgrade, keeping files and applications. Reimaging from the corporate image is the alternative when you also want a clean, standardised build. 3) Then join the domain and let the machine pull policy — this is the moment the workgroup → domain switch happens: authentication moves from the local SAM database to Active Directory, and central policy applies. 4) Enable BitLocker last, once the machine is a domain member, so the recovery key escrows to the directory instead of living on a sticky note.

Verify: winver shows Pro, System properties show the domain, gpresult /r lists the applied policies, and the BitLocker recovery key is visible in the directory. Only then hand over the laptop.

💻 Concrete example — a mapped drive policy that never arrives

Ticket: A department gets a new mapped drive via Group Policy. Three users have it; one does not, and rebooting has not helped.

Walk: 1) Force a refresh rather than waiting for the background cycle: gpupdate /force reapplies every policy setting immediately. Note the exact switch — /force, not /refresh. 2) Still missing, so find out what the machine actually received: gpresult /r lists applied GPOs and, crucially, the security groups the user is in. The drive-mapping GPO is security-filtered to a group this user was never added to — the policy is working exactly as configured. 3) Add the user to the group. Group membership is read at logon, so a gpupdate /force alone will not do it: the user must sign out and back in. 4) While the user is logged off, they mention name resolution has been odd since an office move. ipconfig /all shows the right server, so clear the stale cache with ipconfig /flushdns, and if a lease looks wrong, ipconfig /release then ipconfig /renew. 5) Their unrelated complaint about explorer crashes gets the repair chain in its required order: sfc /scannow first, and if it reports it cannot fix files, DISM /Online /Cleanup-Image /RestoreHealth to repair the component store, then sfc /scannow again.

Verify: After sign-in, gpresult /r shows the GPO applied and the drive appears in Explorer. sfc /scannow returns no integrity violations on the second pass.

💻 Concrete example — "Permission denied" on a shared script

Ticket: A designer copies a backup script from a colleague onto their Ubuntu workstation. Running ./backup.sh returns Permission denied, even though they can open the file in an editor.

Walk: 1) Read the state before changing it: ls -l backup.sh shows -rw-r--r--. Readable, writable by the owner — and not executable by anyone. The file copied fine; the execute bit did not survive. 2) Fix exactly that: chmod +x backup.sh (or chmod 755 backup.sh for owner rwx, group and other r-x). Resist chmod 777 — it is the reflex answer and it is world-writable, which is a security finding rather than a fix. 3) The script then fails writing to /var/backups, a root-owned path, so it needs sudo — elevate the one command, do not log in as root. 4) It calls a tool that is not installed, so use the platform's package manager: sudo apt install rsync on Debian/Ubuntu, where the equivalents would be dnf install on RHEL family and brew install on macOS. 5) Finally the designer wants the output on a USB stick shared with a Mac and a Windows PC. NTFS is awkward on macOS and APFS is unreadable on Windows — format it exFAT, the cross-platform answer.

Verify: ls -l now shows -rwxr-xr-x, the script runs to completion, and the USB stick mounts read-write on all three machines.

💻 Concrete example — closing the gaps after a walkthrough audit

Audit findings: An assessor walks into the building behind a staff member, reaches the server room door, and photographs the rack through its window. Management asks for one control per finding.

Walk: 1) Tailgating at the front door. Badge readers are already installed — and they did not help, because the door stayed open for a second person. The control that actually stops it is an access control vestibule (mantrap): two interlocking doors where the second will not open until the first is closed, admitting one person per authentication. 2) No record of who was in the building. Badge readers log every entry, so enable and retain the logs, and pair them with CCTV covering the entrance and the server room door. Be precise about what this buys: cameras are detective and deterrent — they give you the after-the-fact record, they do not stop the entry. 3) Server room reachable by anyone inside. Add a second authentication factor at that door and a physical lock on the rack itself, so a visitor in the corridor is not one handle away from the hardware. 4) The loading dock. The exposure there is a vehicle, not a person, so the control is bollards; fixed for a permanent barrier, removable where delivery trucks need occasional access.

Verify: Re-run the walkthrough. The vestibule refuses the second person, badge logs show the assessor's single entry, the rack is locked, and camera coverage includes both doors with usable footage retention.

💻 Concrete example — the contractor who was given Domain Admin

Situation: A contractor needs to install a line-of-business application on eight machines for two weeks. Someone puts their account in Domain Admins "so it just works", and the security review flags it.

Walk: 1) Name the violation: least privilege says an account gets the minimum permission needed for the task, for the time it is needed. Domain Admin grants authority over every machine and every account in the domain, permanently, to solve a two-week install on eight endpoints. 2) Right-size it: put the contractor in a group with local administrator rights on those eight machines only, with an expiry date on the account. The install still works and the blast radius drops from the whole domain to eight endpoints. 3) Constrain the network path with ACLs: permit the contractor's subnet to the application server on the ports the app needs and deny the rest — source, destination, protocol, port, which is exactly what an ACL is built to express. 4) The app also needs an inbound port on each workstation, so add a rule to the host-based firewall (Windows Defender Firewall) rather than opening it at the perimeter for everyone. 5) Security asks whether the appliance watching that segment would have caught the misuse: an IDS would have alerted and let the traffic through, an IPS sits inline and can drop it. That difference decides which one belongs where.

Verify: The contractor can install on the eight machines and cannot touch a ninth. The account expires on schedule, and the temporary firewall and ACL rules are removed as part of the same change ticket.

💻 Concrete example — a fake antivirus popup that disabled Task Manager

Ticket: A workstation shows a full-screen "Your PC is infected — call this number" warning. Task Manager will not open, and the user admits installing a "PDF converter" yesterday.

Walk: 1) Identify and research the symptoms. A bundled installer that disables management tools and displays scareware is a trojan — it arrived disguised as something useful, which is exactly what distinguishes it from a virus (attaches to a host file, needs user execution) or a worm (self-propagates across the network with no user action). 2) Quarantine the system. Disconnect the network first, before any scanning, so nothing calls home or spreads laterally. 3) Disable System Restore. Restore points can hold a copy of the malware and silently reinfect the machine after cleaning. 4) Remediate. Boot into Safe Mode so the malicious components do not load, update the antimalware definitions offline or from a clean machine, then run a full scan and remove what it finds. 5) Schedule scans and run updates. Patch the OS and browser — the delivery vector is usually a known hole. 6) Re-enable System Restore and create a fresh restore point, this time on a clean system. 7) Educate the end user about vetting downloads — skipping this is how the same machine comes back next month.

Verify: Task Manager opens, the popup is gone, a second full scan comes back clean, and the browser has no unexpected extensions. Reconnect the network only after the scan is clean.

💻 Concrete example — a coordinated attack on the finance team

Incident: In one morning, an accounts clerk gets three contacts. An email from "the CEO" asking for an urgent supplier payment. A phone call from "IT" with a spoofed internal caller ID, asking for their password to fix a mailbox issue. A text with a link to "re-validate your payroll details".

Walk: 1) Name each vector, because the name determines the response. The targeted email using a known executive's identity is spear phishing (business email compromise); the call is vishing; the text is smishing. The shared pattern is manufactured urgency plus a request that bypasses normal process. 2) Give the clerk one rule that covers all three: verify out of band. Call the CEO on the number in the company directory — never a number supplied in the message. Hang up on IT and call the service desk on the published extension; legitimate IT never asks for your password, because they do not need it. Do not tap the link; open the payroll site from a bookmark. 3) Close the process gap that made the payment plausible: require a second approver for supplier bank-detail changes, so a single compromised inbox cannot move money. 4) Check the physical equivalents while you are with the team — finance faces the corridor, so add a privacy filter against shoulder surfing, and get the shredder used for statements to close dumpster diving.

Verify: The clerk reports all three to security instead of acting on them, the supplier change is rejected under the new dual-approval rule, and the message headers confirm the "CEO" address was an external lookalike domain.

💻 Concrete example — "just make me an admin so I can install the printer"

Ticket: A user cannot install a departmental printer driver. Windows asks for a username and password, and they want their account added to the local Administrators group to make the prompt stop.

Walk: 1) Read what the prompt is telling you. They are a standard user, so UAC shows a credential prompt asking for an administrator's username and password. An administrator in the same situation would see a consent prompt — just Yes/No — because they already hold the rights and UAC is only asking them to confirm elevation. 2) Do not grant standing admin rights for a one-off install. Type the administrative credentials into the prompt yourself, or deploy the driver centrally by policy so nobody needs elevation at all. That keeps least privilege intact and prevents this account from installing anything else later. 3) Never disable UAC to end the nagging — that removes the elevation boundary entirely and is the wrong answer in every scenario the exam poses. 4) While you are in the console, check the account hygiene the exam expects: the built-in Administrator account should be renamed and disabled, the Guest account disabled, and rights assigned through groups rather than to individuals. 5) Confirm the password policy is enforced centrally — minimum length of 12 or more, complexity, expiration, history, and lockout after a set number of failed attempts.

Verify: The printer installs, the user's account remains a standard user, and net localgroup administrators shows no new member. The policy settings appear under the resultant set of policy rather than as local overrides.

💻 Concrete example — a stolen laptop and a missing recovery key

Incident: A sales laptop is stolen from a car. Management asks whether the customer data on it is exposed, and wants every laptop encrypted by Friday.

Walk: 1) Establish what protected the stolen machine. It ran BitLocker with the key sealed in the TPM, so the volume is encrypted at rest with AES and the data is not readable by pulling the drive. Note honestly what BitLocker does not cover: it protects data at rest, not a machine that is powered on and unlocked. Adding a pre-boot PIN to TPM raises that bar. 2) Roll out to the rest of the fleet and hit the edition wall — four laptops run Home, which has no BitLocker. Those need an edition upgrade to Pro; there is no supported way to enable full BitLocker management on Home. 3) Escrow the keys before you encrypt anything, not after: recovery keys must land in Active Directory or Entra ID automatically. A recovery key stored only on the encrypted machine is not a recovery key. 4) A user asks about protecting one folder on a shared workstation — that is EFS, file-level encryption on NTFS, tied to the user's certificate. Back that certificate up or the files are unrecoverable when the profile is rebuilt. 5) Confirm the baseline defences are on: Windows Defender real-time protection enabled, definitions current, and Windows Update delivering security patches on schedule.

Verify: manage-bde -status reports the volume fully encrypted and protection on for each laptop, and each machine's recovery key is visible in the directory before the device leaves the office.

💻 Concrete example — wiping a leaver's phone without wiping their family photos

Situation: An employee resigns. Their work email is on their personal phone under a BYOD arrangement. HR asks IT to "wipe the phone", and the employee objects — it holds years of family photos.

Walk: 1) Both sides are right, and the resolution is the MDM/MAM split. A full remote wipe is an MDM capability: it factory-resets the entire device. On company-owned (COPE) hardware that is exactly what you want. On a personally owned device it destroys personal property. 2) The correct control here is MAM with app protection policies: corporate mail and files live in a managed container, and a selective wipe removes only that container — the account, cached corporate data, and app-level keys — leaving photos, personal apps, and messages untouched. 3) Check the enrolment before promising it: if this phone was enrolled into full MDM at onboarding, the selective option may not exist, and the policy fix is to move BYOD devices onto app-protection-only enrolment. 4) Confirm the baseline mobile controls either way — enforced screen lock with a passcode and short timeout, device encryption, and the ability to locate a lost device. Those are what make a lost phone an inconvenience rather than a breach. 5) Write the difference into the BYOD policy the employee signs, so the wipe scope is agreed before the day it is needed.

Verify: After the selective wipe, corporate mail and files are gone from the phone and the account no longer authenticates, while the personal profile is intact. The management console shows the device as unenrolled from corporate apps.

💻 Concrete example — smart cameras on the corporate VLAN

Finding: A scan turns up twelve smart cameras and two smart thermostats on the main corporate network. Every camera answers on its web interface with the vendor's documented default credentials.

Walk: 1) Fix the credentials first — it is the highest-value minute of work available. Default usernames and passwords for consumer IoT hardware are published in the manuals and collected in public lists, so anyone who reaches the device already has the password. Set unique, strong credentials on each unit. 2) Then segment. Move the cameras and thermostats onto a dedicated IoT VLAN with firewall rules that permit only what they genuinely need — outbound to the vendor's cloud and inbound from the recording server — and deny lateral traffic to the corporate subnets entirely. This is the control that limits the damage when one of them is inevitably compromised. 3) Update firmware on all fourteen and check whether the vendor still ships updates at all; an end-of-support camera is a permanent liability and the honest recommendation is replacement. 4) Disable the features nobody uses, especially UPnP and remote administration from the internet. 5) Flag the adjacent risk while you are documenting: the building's HVAC controller is a SCADA-class industrial system. It follows the same rules with less tolerance — isolated network segment, tightly controlled access, and vendor-coordinated patching rather than ad-hoc updates.

Verify: From a corporate workstation, the camera web interfaces are unreachable; from the recording server they work. Default credentials no longer authenticate on any unit, and firmware versions are current in the inventory.

💻 Concrete example — a departing employee who knows the Wi-Fi password

Situation: An employee leaves on bad terms. Their accounts are disabled the same afternoon — but the office Wi-Fi runs WPA2-Personal, and they know the passphrase, as does every other employee, contractor, and visitor who has ever been given it.

Walk: 1) Understand why disabling the account did not close the gap. With a PSK, the network authenticates the passphrase, not the person. There is no per-user identity to revoke, so the only immediate remedy is rotating the key on the AP and re-entering it on every laptop, phone, printer, and label scanner in the building — which is why nobody ever does it. 2) Rotate it now as containment, then remove the root cause: move the corporate SSID to WPA2/WPA3-Enterprise with a RADIUS server authenticating each user against the directory. From then on, disabling the account also removes network access, with no re-keying. 3) Pick the encryption while you are reconfiguring: WPA3 where the client mix supports it — SAE replaces the WPA2 four-way handshake and blocks the offline dictionary attack against captured handshakes. Where legacy clients force it, run WPA2 with AES-CCMP and never fall back to TKIP or WEP. 4) Leave the guest SSID as a separate WPA2/WPA3-Personal network with client isolation on its own VLAN — a rotating passphrase is acceptable for guests precisely because it grants nothing.

Verify: The leaver's credentials are rejected at the RADIUS server, an active test account loses connectivity within seconds of being disabled, and the AP reports the corporate SSID on WPA3-Enterprise (or WPA2-Enterprise with AES) and the guest SSID isolated.

💻 Concrete example — "the intranet is down" (it is not)

Ticket: Several users report the intranet site is unreachable. Others say it is merely slow. The server team insists the server is healthy.

Walk: 1) Split name from path immediately. ping 10.20.5.40 (the server's IP) succeeds with normal round-trip times, while ping intranet.corp.local fails to resolve. Connectivity is fine; this is DNS. That single comparison has already eliminated half the possible causes. 2) Interrogate DNS directly with nslookup intranet.corp.local: the configured resolver returns an old IP from before last week's server migration. Querying the authoritative server explicitly returns the correct address, so the record is right and the cache is stale. 3) Clear it on the client with ipconfig /flushdns, and get the stale entry corrected on the resolver so you are not repeating this for every user. 4) Now handle the "slow" group, which is a different fault with a different tool. tracert shows normal latency to hop 3 and a sharp jump at hop 4, pointing at one WAN link rather than the server. pathping run over a few minutes quantifies packet loss at that same hop — the evidence to hand the network provider. 5) On the server itself, netstat -an confirms it is listening on 443 and shows established sessions, closing off "the service is not running" as a theory.

Verify: After the flush and the resolver fix, the site resolves to the new IP and loads for the affected users; the slow group improves once the carrier addresses the lossy hop.

💻 Concrete example — a "quick" firewall rule for the new payment app

Request: Finance needs an inbound rule at the perimeter for a new payment application, live Monday. Your manager asks you to "just add it before you leave".

Walk: 1) Raise a change request rather than editing the rule base. The RFC states the purpose, the exact rule (source, destination, port, protocol), and the requester. Anything touching the perimeter is not a standard pre-approved change. 2) Write the scope and risk analysis: which systems are affected, what the blast radius is if the rule is wider than intended, and the risk level. Note the alternative you rejected — a VPN-only path — and why. 3) Write the rollback plan before implementation, because "remove the rule and restore the saved configuration" only works if you exported that configuration first. Export it now. 4) Get approval from the change board and schedule a maintenance window outside business hours. This is the step the scenario is testing: approval precedes implementation, always. 5) Implement in the window, test the application path end to end, and confirm nothing else broke. 6) Update the artefacts: the network diagram gains the new flow, the rule base gains a comment with the change number, and the knowledge base gains an article so the next technician knows why the rule exists. 7) Compare against the baseline afterwards — if firewall CPU or throughput has moved materially, you know it was this change.

Verify: The payment app connects, an unrelated service is spot-checked as unaffected, the diagram matches reality, and the change record shows approval timestamped before implementation.

💻 Concrete example — designing to a 1-hour RPO and a 4-hour RTO

Requirement: A firm's order system may lose at most one hour of data (RPO = 1 hour) and must be back within four hours (RTO = 4 hours). Today it runs one nightly full backup to a local NAS.

Walk: 1) Test the current design against the numbers and it fails immediately: a nightly full means a failure at 16:00 loses the whole working day — roughly eight hours against a one-hour RPO. Frequency must rise to hourly. 2) Choose the type by restore chain. A full every hour is the fastest restore but the heaviest to run. Incrementals back up everything since the last backup of any kind — smallest and quickest to write, but a restore needs the last full plus every incremental since, and eleven of those inside a four-hour RTO is a real risk. Differentials back up everything since the last full: they grow through the day but restore from exactly two pieces, the full plus the latest differential. Weekly full + nightly full + hourly differentials meets both numbers with the shortest chain. 3) Apply 3-2-1: three copies, on two different media types, with one off-site. The current design has one copy on one NAS in the same building — a fire or ransomware event takes production and backup together. Add cloud or rotated offline media, and keep at least one copy immutable or offline so encryption cannot reach it. 4) Match the site to the RTO: a four-hour target rules out a cold site; a warm site fits, and a hot site is the near-zero-downtime option if the budget allows.

Verify: Run a real restore, not a job-status check. Time it end to end, restore to a scratch server, and confirm the application opens the data. A backup that has never been restored is an assumption, not a backup.

💻 Concrete example — a logon script blocked by execution policy

Ticket: A colleague sends a .ps1 file that maps departmental drives at logon. On the test machine it fails: "running scripts is disabled on this system".

Walk: 1) Identify the file type before anything else. .ps1 is PowerShell, the Windows automation language built on Verb-Noun cmdlets. The error is not a bug — it is the default execution policy refusing to run unsigned scripts, a safety feature doing its job. 2) Read the script before you loosen anything. It maps drives, and it also contains a line that deletes a temporary folder — on a path that resolves to the user's Documents folder on machines with a different profile layout. That is the unintended consequence the exam warns about, and it is why "just run it" is the wrong answer. Fix the path first. 3) Set the policy at the appropriate scope: Set-ExecutionPolicy RemoteSigned allows local scripts and requires a signature on downloaded ones — a proportionate setting. Do not use Unrestricted to make an error go away. 4) Test on one machine before deploying to the department, and roll it out through Group Policy rather than emailing the file around. 5) Recognise the neighbours while you are here: .sh is Bash for Linux/macOS (needs a #!/bin/bash shebang and chmod +x), .py is Python and cross-platform, .bat is legacy Windows Batch, .vbs is VBScript, and .js is JavaScript.

Verify: The corrected script maps the drives on the test machine, the temporary-folder line targets the intended path, and nothing in the user's Documents folder is touched. Only then does it go into the logon policy.

💻 Concrete example — helping a user without kicking them off

Ticket: A user cannot get a spreadsheet macro to run and asks you to "look at my screen". They are mid-document with unsaved changes.

Walk: 1) Do not reach for RDP. On a Windows workstation it opens a new session on port 3389 and disconnects the console user — you would see a clean desktop, they would lose their screen, and the error you were called about would not be in front of you. 2) Use a screen-sharing or remote-assistance tool that attaches to the existing session — VNC on port 5900 behaves this way by design, and so do the built-in quick-assist style tools. Both of you see the same desktop, and the user can watch what you change, which is also better support. 3) The user then asks you to fix "the same problem" on the Linux build server. That is a command-line job: SSH on port 22, encrypted, with key-based authentication preferred over passwords. Its unencrypted ancestor Telnet on port 23 is never the answer. 4) Their final request — "can I RDP in from home?" — gets a firm no in that form. Never expose 3389 directly to the internet; it is scanned constantly and brute-forced. Put it behind a VPN so the tunnel authenticates first, and require multi-factor authentication on the VPN.

Verify: The user keeps their session and their unsaved work while you watch the macro fail, the SSH session authenticates by key, and an external port scan shows 3389 closed from the internet.

💻 Concrete example — a RAM upgrade on a carpeted office in January

Job: Add memory to six desktops in a carpeted office in winter, and remove two dead machines — one with a failed PSU, one an old CRT-based till.

Walk: 1) Set up against ESD before opening anything. Dry winter air plus carpet is the worst case; a static discharge you cannot feel is thousands of volts and will damage RAM, a CPU, or a motherboard — sometimes as a latent fault that fails weeks later, which is the expensive kind. Use an anti-static wrist strap clipped to unpainted chassis metal, work on an ESD mat, and keep each module in its anti-static bag until it goes in. 2) Handle correctly: hold boards and modules by the edges, never touching gold contacts or traces, and align RAM by its notch rather than forcing it. 3) The dead PSU is not a repair job. Power supplies hold a lethal charge after being unplugged — never open one. The same rule, more strongly, applies to the CRT: it stores extremely high voltage even when disconnected, so it is never opened and goes out through certified e-waste. 4) Unplug from mains before any internal work — a modern board is still energised at standby with the PSU switch on. 5) For disposal, consult the SDS (Safety Data Sheet) for the battery and toner you are also clearing out: it states the handling, storage, and disposal requirements, and the answer is always the certified recycling stream rather than the general waste bin.

Verify: All six machines POST with the full memory and no intermittent faults over the following week. The PSU and CRT leave on the e-waste manifest, signed and filed.

💻 Concrete example — an angry user and a laptop full of personal files

Ticket: A user arrives visibly angry: their laptop has been "broken for three days", nobody has updated them, and they have a client deadline tonight.

Walk: 1) Let them finish. Active listening means no interrupting, no defending the service desk, and no jumping to a diagnosis while they are still talking. Take notes, then restate the problem back in your own words so they can hear that you have it right — that alone resolves most of the anger. 2) Do not argue, dismiss the complaint, or blame another team; the three-day gap is a real service failure and acknowledging it costs nothing. Avoid jargon — "the storage device is failing" lands, "the SMART attributes show reallocated sectors" does not. 3) Set a realistic expectation and beat it rather than promising what you cannot deliver: a loaner machine within the hour with their files restored from backup, the failing drive replaced by tomorrow. Then proactively update at the time you said you would, even if the news is "still on track". 4) While recovering data you see personal files, medical documents, and private photos. You do not open them, you do not mention them, you do not comment on them to colleagues — confidentiality is absolute, and a technician who gossips about a user's files is finished. If something appears to breach policy or law, it goes through the defined escalation path, not into a conversation. 5) Take the personal call the user gets mid-handover as your cue to step back and give them privacy rather than hovering.

Verify: The user leaves with a working loaner and their files, and gets the promised update on time. The ticket records the fault and the actions — and nothing about the contents of their documents.