The technical interview

An MSP provides ongoing IT support to other businesses, usually small and mid-sized ones that cannot justify an internal team. Clients pay a recurring fee, often per user or per device, plus charges for projects, and the MSP promises response times in an SLA. Because the fee is fixed, stable environments and good documentation keep it profitable.

Corporate IT supports one organization’s staff and systems. An MSP supports many client businesses, so the work is more varied and faster. Data center work focuses on physical infrastructure, such as racking, cabling and hardware swaps, and follows strict procedures, often on shifts.

Tier 1 is first contact, handling common problems like password resets and basic troubleshooting, then documenting and escalating the rest. Tier 2 handles deeper problems, and Tier 3 is specialists or engineers handling complex or system-level issues. Good escalation passes work up with full context.

A service level agreement is the response and resolution times a provider promises a customer. If one is at risk, the technician escalates.

I would write a standard operating procedure with a title, a purpose, numbered steps and a version, date and owner line, written so someone with less context could follow it. I would keep it up to date as part of doing the work, since documentation that is wrong is worse than none.

I would clean the data first, removing duplicates and fixing inconsistent labels, then build a pivot table that counts tickets by category or status. That turns a long list into a quick answer, as in Module 1.

I work from the bottom up. I check the physical or Wi-Fi connection, then the IP configuration with ipconfig /all or ip a for a sensible address that is not 169.254, then ping the default gateway, then an outside address, and finally a name to test DNS. The first step that fails shows where to look.

It points to DNS and not the network itself, because the connection works but names are not turning into addresses. I would check which DNS server the device uses and test with nslookup.

The device failed to get an address from DHCP and gave itself one, so DHCP is not working. I would check the link, whether the DHCP server is reachable, and then renew the lease.

Some systems and firewalls are set to ignore ping, so a timeout does not always mean the target is down. Ping also only proves reachability, and a server can answer ping while its actual service is down, so I would test the service itself.

I read the logs. On Windows that is Event Viewer or Get-WinEvent, and on Linux it is journalctl. I filter by severity or time, find the moment the problem started and read the entries just before and after it, not only the error line.

SSH opens an encrypted remote command line on another machine, most often a Linux server. Key authentication uses a public and private key pair, so there is no password to guess or intercept, and the private key never leaves your machine.

Refused means SSH is not running or a firewall is blocking it. Permission denied means the connection worked but the username, password or key was wrong.

A virtual machine is a simulated computer, called the guest, running on a physical machine, called the host. The hypervisor is the software that creates and manages virtual machines and shares out the host’s CPU, memory, storage and networking.

A snapshot saves a virtual machine’s state at one moment so you can restore it in seconds, which makes it safe to try a risky change. It is not a backup, because it usually sits with the machine’s own storage and is lost if that storage fails.

One physical server can run many isolated systems, which saves hardware, power and space, and lets you move, copy and restore systems quickly. It is why snapshots and fast recovery are possible.

A Type 1 hypervisor installs directly on the hardware and is used in data centers and by MSPs, for example Hyper-V or Proxmox. A Type 2 hypervisor runs as an application inside a normal operating system, for example VirtualBox.

Answer with your real choice. For example: “I used VirtualBox because my laptop runs Windows Home, which does not include Hyper-V. I took a snapshot before every change in my labs.”

A switch connects devices within one local network and forwards traffic using MAC addresses. A router connects different networks and forwards traffic using IP addresses.

An IP address identifies a device on a network. The subnet mask says which part of the address is the network and which is the device. The default gateway is the router a device sends traffic to when the destination is outside its own subnet.

DHCP assigns an address and settings automatically, and a static address is set by hand and never changes. Static is used for things that need a stable address, such as servers, printers and network equipment.

DNS turns names into the addresses computers use. An A record maps a name to an IPv4 address, a CNAME points one name at another, an MX record says where to deliver email, and a TXT record holds text such as verification and anti-spam entries.

TCP is connection-based and reliable, so every byte arrives in order, which suits web pages and file transfers. UDP is faster but not guaranteed, which suits things like streaming and some DNS traffic.

22 is SSH, 25 is email sending, 53 is DNS, 80 is HTTP, 443 is HTTPS, 445 is Windows file sharing and 3389 is Remote Desktop. They are what you use in firewall rules and troubleshooting.

That pattern points to the default gateway or routing. I would check the device’s gateway setting, ping the gateway, then ping an outside address, and check DNS if names fail.

An address from the ranges reserved for internal networks, 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. They are not directly reachable from the internet.

A firewall allows or blocks network traffic based on rules. A network firewall sits between networks, such as a LAN and the internet, and a host firewall runs on a single device.

It blocks everything by default and allows only the traffic you need. It is safer than allowing everything and trying to block the bad traffic.

Most firewalls check rules from the top and stop at the first match, so a broad rule above a specific one can silently override it.

NAT lets many devices with private addresses share one public address, translating traffic as it passes. A port forward sends inbound traffic on a chosen public port to a specific internal device and port, and each one is a new door into the network, so it must be justified.

No. Exposed Remote Desktop is scanned and attacked constantly, so a VPN or a proper remote access gateway is the safer path.

I check rule order first, then the firewall logs to see which rule actually matched. I also check the host’s own firewall and that the internal address and port are right, and I test the port with Test-NetConnection or nc. I would never fix it by adding an “allow any any” rule.

A server is defined by the role it plays, providing a service such as files, sign-in, DNS or a website to other machines. It can be physical or virtual, on-premises or in the cloud, and it behaves the same either way from the network’s point of view.

Active Directory centrally manages users and computers. A domain is the group it manages, and a domain controller is the server that holds Active Directory and checks sign-ins, so one account works across every joined machine.

An organizational unit organizes where users and computers live, so you can delegate admin tasks and apply Group Policy. A security group grants access, so you add users to a group and give the group permission instead of setting it person by person.

It lets an administrator push settings, such as password rules or mapped drives, to every user or computer in an OU without touching each machine.

I disable the account immediately, which blocks access while keeping it recoverable, and I do not delete it right away. Then I follow the company’s offboarding checklist.

Domain-joined machines find their domain controllers through DNS, so broken DNS breaks sign-ins even when the domain controller is healthy. A client pointing at the wrong DNS server is a common cause of “can’t log in to the domain” tickets.

There are two layers, share permissions and NTFS permissions on the folder, and both apply over the network, with the more restrictive one winning. Best practice is to grant access to groups, not individuals, so access stays manageable.

I first verify the person’s identity under the company’s process. Then I reset the password in Active Directory or the admin portal and require a change at the next sign-in, and I log the ticket.

Keep three copies of your data, on two different types of media, with one copy offsite. It protects against failures, mistakes and site-wide events like fire or theft.

A full backup copies everything. An incremental copies only what changed since the last backup, which is small and fast but needs the whole chain to restore. A differential copies everything changed since the last full backup, which grows larger but needs only the full and the latest differential to restore.

The recovery point objective is how much data you can afford to lose, measured in time. The recovery time objective is how long recovery is allowed to take. They decide how often you back up and how fast restore must be.

A job that reports success only proves the copy happened. Restoring a test file and checking it is the only way to know the backup works, and I would record the date, what was restored, how long it took and the result.

An immutable backup cannot be altered or deleted for a set period, even by an administrator account, which protects against ransomware that targets backups too.

No. A snapshot is a quick restore point stored with the machine, and a backup is a separate copy that survives if the machine or its storage is lost.

A ticket starts as new, becomes open while someone works on it, may go to pending while waiting on someone, and finishes as resolved and closed with a summary. I would add internal notes for technical detail and public replies in plain language for the customer.

By business impact, not how loudly someone asks. An office locked out of a file share outranks one person who wants a different desktop background.

It lets every account have a unique strong password, and shared vaults let a team share access without everyone knowing every password. It must be protected with multi-factor authentication, and passwords should never be pasted into chat or email.

Different technicians touch the same client constantly, so knowledge in one person’s head is a risk. Good documentation answers what a technician needs during an outage, and it must be kept current.

It is how MSPs bill and how a team sees where effort goes, and on a fixed fee it shows whether a client is profitable. Honest entries protect the client, the company and your credibility.

I take the problem seriously, acknowledge how they feel, restate the problem so they know I heard it, and then do accurate technical work with an honest time estimate. I own the ticket until it is resolved or properly handed off.

Five things: what was reported, what I checked, what I changed, the result, and the next step. Another technician with less context should be able to pick it up.

When the problem is beyond my skills or permissions, or the SLA is at risk. I include a summary, the steps tried, the business impact and how to reach the user, so the next person does not start over.

I greet the person, confirm who they are, narrate what I am doing and why, and ask before touching anything outside the request, such as personal files.

AI is good for first drafts, explaining unfamiliar errors and speeding up repetitive writing. It cannot know my environment and may be wrong, so I verify everything, test destructive changes in a snapshot first, follow company policy, and never paste client data or credentials into a public tool.

I ask what error they see, whether it is just them, and whether a password changed recently. I check for a typo or caps lock, whether the account is locked, expired or disabled, and whether the device can reach the network and DNS. I reset or unlock the account after verifying identity, confirm they can sign in and log what I did.

I ask when it started and what changed, then check what is using CPU, memory and disk in Task Manager or top, the free disk space and pending updates. I fix the cause I find, restart the smallest thing first, and note the result.

I check the basics first, power, paper, connection and error lights, then the print queue for a stuck job. Restarting the print service often clears a stuck queue, and if one computer fails while others work I look at that computer’s driver and connection.

I check that they have a network connection and DNS, whether others can open it, and whether the share and the folder permissions allow their group, remembering that the stricter of the two wins. I fix access through the right group and confirm with the user.

I check whether it is down for everyone with a quick header test such as curl -I, whether it is only that person’s browser or network, and the error code. A cleared cache or a different network often isolates the cause.