1. A user needs one application but no administrative duties. Which account approach best follows least privilege?A. Standard account with only required permissionsB. Local administratorC. Shared admin accountD. No password2. A workstation stores sensitive data. Which layered set is strongest?A. WEP and shared adminB. No screen lockC. Default passwordsD. MFA, standard user, encryption, firewall, updates, and screen lock3. Why must BitLocker recovery information be protected and available?A. It increases CPU speedB. Authorized recovery may depend on itC. It replaces backupsD. It configures Wi-Fi4. An application needs one inbound firewall port. What is the best change?A. Disable the firewallB. Allow all trafficC. Create the smallest approved rule for the required trafficD. Make every user admin5. A text message claims to be IT and asks for the user's MFA code. What is the safest interpretation?A. Normal maintenanceB. A printer issueC. A battery problemD. Likely social engineering requiring reporting/verification through a known channel6. A suspicious attachment arrived, but no one opened it. What should the technician avoid claiming?A. That malware definitely executedB. That the message is suspiciousC. That reporting is appropriateD. That scope should be checked7. A browser starts redirecting after an unknown extension is installed. Which first theory is strongest?A. CPU overheatingB. Extension/browser stateC. Printer failureD. RAID degradation8. A workstation is suspected of malware. What should happen before destructive cleanup?A. Delete all logsB. Factory reset immediatelyC. Verify scope, preserve evidence, contain appropriately, and use approved toolsD. Disable every protection9. A retired SSD contains confidential data and will be reused internally. What should determine the sanitization method?A. WallpaperB. Printer queueC. Wi-Fi channelD. Media type, reuse requirement, policy, and required assurance10. A router still uses the vendor default admin password. What is the most important correction?A. Change it to a strong unique credentialB. Enable WEPC. Disable updatesD. Expose management publicly11. A browser certificate warning appears only on one site. What should the technician do?A. Disable certificate checking globallyB. Investigate the site's certificate/trust/time/path evidenceC. Replace RAMD. Reformat the SSD12. Windows reaches firmware but reports no bootable OS after a storage configuration change. Where should troubleshooting focus?A. Printer driverB. Mobile appC. Boot device/storage/bootloader configurationD. Wi-Fi channel13. Only one Windows user profile loads slowly. What does that narrow?A. Profile-specific startup/configuration/dataB. Whole-building powerC. Every user accountD. Printer hardware14. A mobile OS update fails because the device has insufficient free space. What should happen first?A. Root the phoneB. Replace the cameraC. Reset network settingsD. Safely free required storage and retry15. A device uses an unofficial app store and now shows excessive ads and unexpected data use. What is the best approach?A. Assume hardware failureB. Treat it as a mobile-security symptom and review installed apps/source/security stateC. Ignore itD. Disable the screen lock16. A phone is jailbroken. Why does that matter to a support technician?A. It proves the battery is goodB. It improves MDMC. Platform protections and privilege boundaries have been alteredD. It changes the SIM into eSIM17. Files are unexpectedly renamed and inaccessible. What should happen before bulk restoration?A. Preserve evidence and determine whether malware, corruption, permissions, or another cause fitsB. Delete the filesC. Disable backupsD. Replace monitor18. A PC is slow and displays high disk usage. Malware is suspected, but storage is 99% full and cleanup resolves the issue. What does this show?A. Malware is always presentB. Storage cannot cause slownessC. Security tools are uselessD. Symptoms overlap; evidence must establish cause19. After rolling back a bad driver, Windows starts normally. What is the next step?A. Delete the ticketB. Verify related functions and document the result/rollback pathC. Change three more driversD. Disable recovery20. Which troubleshooting record is strongest?A. ‘Fixed’B. A list of guessesC. Symptom, scope, evidence, hypothesis, controlled correction, rollback, verification, remaining uncertaintyD. Only the final rebootGrade locally (0/20)