Lesson 5: Technician Review Board

Core path: 42 minutes

Today you do not get points for naming the right domain.

You defend the support decision.

Choose three incidents from this week. At least one must come from Core 1-heavy material and at least one from Core 2-heavy material. Your third incident should cross more than one layer.

The review-board standard

For every incident, your defense must answer ten questions.

1. What was the symptom and scope?

State what the user experienced, what you directly observed, and what systems/users were affected.

2. What was the strongest evidence?

Name the exact observation, log, tool output, device state, policy state, or change record that most changed your theory.

3. What theory did you choose?

Describe the failed or misconfigured boundary precisely enough that someone else could test it.

Weak:

The computer was broken.

Better:

Windows loaded, Safe Mode worked, and normal startup failed after the display-driver update, so the normal-mode driver path was the strongest current theory.

4. What alternative did you reject?

A professional diagnosis includes plausible alternatives.

Explain why one competing theory became weaker after the evidence was reviewed.

5. What controlled action did you choose?

The action must be proportional to the evidence.

Do not use reset, reinstall, format, factory reset, disable-all-security, or grant-admin-everywhere as shortcuts when a narrower action exists.

6. What safety, privacy, or authorization boundary applied?

Examples:

• electrical/battery safety;
• user data preservation;
• credential/privacy handling;
• managed-device policy;
• approved remote-support authorization;
• malware/security escalation;
• warranty or serviceability restriction.

7. What was the rollback or recovery path?

If the change could make things worse, explain how you would recover.

If no practical rollback existed, state that clearly and explain what backup/escalation was required before proceeding.

8. How did you verify recovery?

Verification must test the required function, not merely the absence of one error message.

9. How would you explain the result to the user?

Use plain language.

Bad:

DNS resolution was nonfunctional because recursive lookup failed at the resolver boundary.

Better:

Your computer could reach the network, but it could not translate the portal name into the address it needed. We corrected the name-resolution setting and verified the portal opens normally now.

10. What must be documented or escalated?

Include:

• actions taken;
• before/after state;
• parts/configuration involved;
• time/impact when relevant;
• unresolved risk;
• follow-up owner;
• escalation when outside your authority.

Cross-domain challenge

The review board may ask one of these questions:

• What evidence would have changed your diagnosis?
• Why did you not choose the more destructive fix?
• What layer did you prove healthy first?
• What user data could have been at risk?
• What happens if your correction fails?
• Which part of the incident is outside your administrative control?
• How does this case connect to a different week of the course?

You should be able to answer without memorized exam wording.

Final submission

For each of the three incidents, submit:

incident title:
symptom and scope:
strongest evidence:
theory:
rejected alternative:
controlled action:
safety/privacy/authorization boundary:
rollback/recovery:
verification:
customer explanation:
documentation/escalation:

Then add one final paragraph:

Which part of technician work has changed most for you since Week 1: identifying components, choosing evidence, controlling changes, troubleshooting across layers, or explaining the result? Use one incident as evidence.

Review-board rubric

A strong defense is:

• evidence-based;
• technically bounded;
• safe;
• reversible where practical;
• verified;
• understandable to a user;
• professionally documented.

Week 17 checkpoint

You are ready for the capstone when you can move through this chain without being told the answer category:

complaint
→ scope
→ boundaries
→ evidence
→ theory
→ controlled action
→ rollback
→ verification
→ communication
→ documentation

Week 18 will ask you to do that across one complete client service challenge.