What's the difference between DNS and DHCP?

DHCP hands a device its IP address automatically when it joins the network, along with the gateway and the DNS server. DNS turns names (like portal.company.com) into IP addresses. If DHCP is broken, the device gets no address at all. If DNS is broken, the device is connected but sites won't open by name.

A PC has an address starting with 169.254. What does that mean?

It asked a DHCP server for an address, got no reply, and gave itself a temporary one (APIPA). Check the cable and port first, then that the device is on the right network, then the DHCP server itself.

What's the difference between ping and tracert?

ping tells you whether the other device answers and how long the reply takes. tracert shows the whole path hop by hop, so you can see exactly where the connection stops.

What's the difference between a switch and a router?

A switch connects devices on the same network (the offices on one floor, say). A router connects different networks together, like the company network and the internet.

Name the private IP address ranges.

10.0.0.0 to 10.255.255.255, 172.16.0.0 to 172.31.255.255, and 192.168.0.0 to 192.168.255.255. They're used inside companies and homes and aren't routed on the internet directly.

A user says "the internet isn't working". What are your first steps?

Ask whether colleagues have the same problem (to tell whether it's just them or everyone). Then check the cable or Wi-Fi, then ipconfig for a valid address, then ping the gateway, then ping a site by name, to tell a connection problem from a DNS problem.

What is Active Directory?

A central database of user accounts, computers, groups and permissions. It's where you create a user's account, lock or unlock it, reset their password, and decide what they can open.

A user's account keeps locking after a password change. What's the usual cause?

Usually a device or app is still trying the old password: their phone's mail app, another PC they're signed in to, or a saved credential in Credential Manager. The security log (event 4740) tells you which machine is causing the lockout. It's like changing your front-door lock and forgetting your brother still has the old key: every time he tries it, the lock logs a bad attempt, and after enough tries the door locks itself.

What is Group Policy (GPO)?

Settings applied automatically to a group of computers or users, like mapping a network drive, adding a printer, or blocking certain things. If a machine isn't getting the settings, check it's in the right place (OU) and run gpupdate /force.

Someone calls asking for a password reset. What do you do first?

Verify who they are according to company policy: their employee ID, their manager, or a call back to the number on file. Never reset a password for whoever happens to call; it's one of the most common ways attackers get in.

Print jobs are stuck and won't delete. How do you fix it?

Stop the Print Spooler service, clear the spool folder, and start the service again. Then print a test page.

How do you prioritise when lots of tickets arrive at once?

By impact and urgency: something that stops a whole team or touches security comes before one person's problem. Anything with a deadline (a user with a meeting in fifteen minutes) counts too. And follow the company's priorities (P1, P2…) and each ticket's SLA.

What do you do before making any change on a user's PC?

Make sure their important files are safe, especially any unsaved work. Explain what I'm about to do and how long it'll take. For a big change, take a backup.

How do you explain a technical problem to someone who isn't technical?

No jargon, and an example from their own life. Instead of "DNS isn't responding" I'd say: "You're connected, but the address book the computer uses to find websites isn't answering." Most importantly, tell them what happens now and when it'll work again.

A user clicked a link in a suspicious email and typed her password. What do you do?

Act fast: change her password, sign out all her sessions, and check whether the attacker set up mailbox rules (such as forwarding). Report it to the security team. And don't blame her; people who are afraid to report slow the response down.

What do you write in a ticket when you close it?

Four things: what the problem was, what caused it, what I did, and how I confirmed it's fixed (the user tested it). That way whoever comes next understands it if it comes back.

IT Support Interview Questions and Answers (Help Desk)

A help desk interview doesn't just test whether you've memorised definitions. It tests how you think when a problem lands on your desk. Here are the questions that come up again and again, each with a short answer you can put in your own words.

Part 1: Networking

What's the difference between DNS and DHCP?: DHCP hands a device its IP address automatically when it joins the network, along with the gateway and the DNS server. DNS turns names (like portal.company.com) into IP addresses. If DHCP is broken, the device gets no address at all. If DNS is broken, the device is connected but sites won't open by name.
A PC has an address starting with 169.254. What does that mean?: It asked a DHCP server for an address, got no reply, and gave itself a temporary one (APIPA). Check the cable and port first, then that the device is on the right network, then the DHCP server itself.
What's the difference between ping and tracert?: ping tells you whether the other device answers and how long the reply takes. tracert shows the whole path hop by hop, so you can see exactly where the connection stops.
What's the difference between a switch and a router?: A switch connects devices on the same network (the offices on one floor, say). A router connects different networks together, like the company network and the internet.
Name the private IP address ranges.: 10.0.0.0 to 10.255.255.255, 172.16.0.0 to 172.31.255.255, and 192.168.0.0 to 192.168.255.255. They're used inside companies and homes and aren't routed on the internet directly.
A user says "the internet isn't working". What are your first steps?: Ask whether colleagues have the same problem (to tell whether it's just them or everyone). Then check the cable or Wi-Fi, then ipconfig for a valid address, then ping the gateway, then ping a site by name, to tell a connection problem from a DNS problem.

The diagnosis ladder: when someone says "no internet", start at the bottom and climb one rung at a time. Each rung needs the one below, so there's no point checking DNS with the cable unplugged.

Part 2: Windows and Active Directory

What is Active Directory?: A central database of user accounts, computers, groups and permissions. It's where you create a user's account, lock or unlock it, reset their password, and decide what they can open.
A user's account keeps locking after a password change. What's the usual cause?: Usually a device or app is still trying the old password: their phone's mail app, another PC they're signed in to, or a saved credential in Credential Manager. The security log (event 4740) tells you which machine is causing the lockout. It's like changing your front-door lock and forgetting your brother still has the old key: every time he tries it, the lock logs a bad attempt, and after enough tries the door locks itself.
What is Group Policy (GPO)?: Settings applied automatically to a group of computers or users, like mapping a network drive, adding a printer, or blocking certain things. If a machine isn't getting the settings, check it's in the right place (OU) and run gpupdate /force.
Someone calls asking for a password reset. What do you do first?: Verify who they are according to company policy: their employee ID, their manager, or a call back to the number on file. Never reset a password for whoever happens to call; it's one of the most common ways attackers get in.
Print jobs are stuck and won't delete. How do you fix it?: Stop the Print Spooler service, clear the spool folder, and start the service again. Then print a test page.

Part 3: Troubleshooting and tickets

How do you prioritise when lots of tickets arrive at once?: By impact and urgency: something that stops a whole team or touches security comes before one person's problem. Anything with a deadline (a user with a meeting in fifteen minutes) counts too. And follow the company's priorities (P1, P2…) and each ticket's SLA.
What do you do before making any change on a user's PC?: Make sure their important files are safe, especially any unsaved work. Explain what I'm about to do and how long it'll take. For a big change, take a backup.
How do you explain a technical problem to someone who isn't technical?: No jargon, and an example from their own life. Instead of "DNS isn't responding" I'd say: "You're connected, but the address book the computer uses to find websites isn't answering." Most importantly, tell them what happens now and when it'll work again.
A user clicked a link in a suspicious email and typed her password. What do you do?: Act fast: change her password, sign out all her sessions, and check whether the attacker set up mailbox rules (such as forwarding). Report it to the security team. And don't blame her; people who are afraid to report slow the response down.
What do you write in a ticket when you close it?: Four things: what the problem was, what caused it, what I did, and how I confirmed it's fixed (the user tested it). That way whoever comes next understands it if it comes back.

Tips before the interview

When they give you a scenario, think out loud: say your steps in order. They're scoring how you think more than the final answer.
If you don't know, say so and say how you'd find out: "I'm not sure, but I'd check this and this." That beats guessing.
Have a story ready from your own experience (even from training): a hard problem, how you solved it, and what you learned.
Behavioural questions matter as much as technical ones: how you handle an angry user, or a manager who wants it fixed right now.