Operational Procedures practice questions

Answer: A) So affected people learn of the exposure soon enough to protect themselves, such as by resetting passwords or watching their accounts

Breach notification deadlines stop organizations from delaying disclosure, so affected people can protect themselves in time. GDPR, for example, requires notifying the authority within 72 hours and high-risk individuals without undue delay.

• ACorrect. A deadline limits how long an organization can sit on a breach, so affected individuals can act (change credentials, monitor accounts, watch for fraud) while it still helps. GDPR, for example, requires the controller to notify the data protection authority within 72 hours and to notify affected individuals without undue delay when the breach is likely to pose a high risk to them.
• BIncorrect. A notification deadline is an upper limit on delay, not a protected waiting period. GDPR expects notification even when the investigation is still incomplete, and any delay past the deadline must be justified.
• CIncorrect. The deadline exists to force timely disclosure to regulators and affected people. It is not a way for the organization to control or withhold information until it is ready.
• DIncorrect. Notification rules don't delay remediation. Containing and fixing the issue go on alongside notification as part of incident response.

Answer: A) Silence the phone and return the personal calls after the appointment has ended

CompTIA's professionalism guidance says to avoid distractions such as personal calls during customer interactions. Silencing the phone and returning non-urgent calls afterward keeps the customer's full attention on the work.

• ACorrect. Avoiding distractions such as personal calls and texts is a core professionalism practice. Silencing the phone gives the customer full attention, and the calls can be returned later because none of them are urgent.
• BIncorrect. Even short personal calls interrupt the customer's appointment and suggest the customer is not the priority, whatever their effect on the repair time.
• CIncorrect. Leaving the customer to take non-urgent personal calls is still a personal distraction during billable or scheduled customer time. Idle diagnostic time should go to the customer, for example by explaining progress.
• DIncorrect. Screening calls means the technician keeps looking at the phone, which is still a visible distraction in front of the customer. The non-urgent calls do not need to be monitored during the visit.

Answer: A) Excess retention enlarges breach exposure, and GDPR limits keeping personal data longer than necessary

Retention policies need limits on both ends: keep records at least as long as required, and no longer than necessary. Over-retention increases how much data a breach exposes, and privacy laws such as GDPR limit how long personal data may be stored.

• ACorrect. The more sensitive data a company holds, the more is exposed if a breach happens. GDPR's storage-limitation principle also requires personal data to be kept only as long as needed for its purpose. A good policy sets both a minimum and a maximum retention period.
• BIncorrect. Records don't lose their value as evidence just because the minimum retention period has ended. The real concerns are breach exposure and privacy laws that limit how long personal data can be stored.
• CIncorrect. Retention requirements apply to digital records such as audit logs, and there is no general rule to convert them to paper. This isn't why indefinite retention is a problem.
• DIncorrect. A minimum retention period is a floor for how long records must be kept. Keeping them longer doesn't reset any clock. The actual risks are greater breach impact and possibly breaking storage-limitation rules.

Answer: A) An SLA (Service Level Agreement)

• AAn SLA formally defines measurable service commitments — like response and resolution time targets for different issue severities — giving both the provider and the customer clear, agreed-upon expectations for support performance.
• BAn EULA governs the terms of using a piece of software, not a support organization's response/resolution time commitments.
• CA Safety Data Sheet documents chemical safety information, entirely unrelated to support response-time commitments.
• DA chain of custody form documents evidence handling for an investigation, unrelated to support response-time commitments.

Answer: A) It provides an exact baseline to restore if the change has to be backed out

Documenting a device's current configuration before a change gives the backout plan an exact restore point. It does not replace approval, testing or end-user acceptance.

• ACorrect. A detailed record of the pre-change configuration is what makes a rollback (backout) plan workable. If the change causes problems, the technician can restore the exact previous settings instead of relying on memory.
• BIncorrect. Documenting the current state does not exempt a change from approval. Change requests still go through the organization's review and approval process.
• CIncorrect. Recording the current settings helps with recovery after a change, but it does not replace testing. Testing in a sandbox or lab is a separate step meant to catch problems before deployment.
• DIncorrect. End-user acceptance confirms that the change works for the affected users after it is made. A record of the old configuration is not that confirmation.

Answer: A) A Standard Operating Procedure (SOP)

• AAn SOP documents the exact, consistent steps for performing a recurring task, ensuring the same quality and completeness regardless of which specific technician carries it out, and serving as both a training reference and a quality-control tool.
• BAn SLA defines measurable service commitments (like response times), a different type of document from a detailed step-by-step task procedure.
• CA Safety Data Sheet documents a specific chemical's safety information, unrelated to a recurring IT task procedure.
• DA chain of custody form documents evidence handling for an investigation, unrelated to a recurring IT task procedure.

Answer: A) That the caller appears on the client's documented list of contacts who are authorized to request changes

Change requests should be verified against the client's documented list of authorized contacts before any action. Publicly known details, claimed job titles, and confirmations sent after the fact do not establish authorization and leave the provider open to social engineering.

• ACorrect. Checking the caller against the client's pre-established list of authorized contacts guards against impersonation and social engineering. It also catches honest requests from employees who are not actually authorized.
• BIncorrect. Company names, addresses, and phone numbers are public or easy to find. Knowing them does not prove the caller is authorized, and social engineers often use exactly this kind of information to sound legitimate.
• CIncorrect. Anyone can claim a job title, and claiming seniority is a common pressure tactic in social engineering. A title proves neither identity nor authorization.
• DIncorrect. A confirmation sent after the change does not prevent an unauthorized change. Authorization must be verified before any work is done.

Answer: A) .ps1 (PowerShell script)

Only PowerShell (.ps1) uses cmdlets that pass .NET objects through a pipeline. Batch, VBScript, and Bash scripts don't have this object-based model.

• APowerShell is built on .NET. Its commands (cmdlets) accept and return .NET objects, and the pipeline passes those objects from one command to the next, so no text parsing is needed.
• BBatch files run in the legacy Command Prompt (cmd.exe). They work with text, not .NET objects, and they don't use cmdlets.
• CVBScript runs through Windows Script Host. It is a legacy scripting language that doesn't use cmdlets or a .NET object pipeline.
• DBash scripts are mainly for Linux/Unix shells, and Bash pipes pass plain text between commands, not .NET objects.

Answer: A) Volume licensing

• AVolume licensing lets an organization license software for many machines/users under one agreement, often at a better per-seat cost and with simplified management, compared to purchasing and tracking individual per-seat licenses one at a time.
• BA single per-seat retail license covers just one installation, the opposite of the pooled, organization-wide licensing model being described.
• CAn open-source license is a specific category of software licensing terms (often free, with its own conditions), not the same concept as a commercial volume-licensing agreement for many installations.
• DA chain of custody form documents evidence handling for an investigation, entirely unrelated to software licensing models.

Answer: A) Notify management and the IT security team so they can assess data exposure and remotely wipe or lock the stolen devices

When devices are stolen, the technician should promptly inform management and the security team so they can assess data exposure and contain the risk, for example by remotely wiping or locking the devices.

• ACorrect. Incident response calls for informing management. The security team can then judge what data may be at risk, revoke credentials, and use device management tools to remotely wipe or lock lost or stolen devices.
• BIncorrect. Warranties generally don't cover theft. Contacting manufacturers also does nothing about the immediate risk that company data on the devices could be exposed.
• CIncorrect. Getting users working again matters, but delaying the internal report holds up containment steps such as remote wipe and credential revocation.
• DIncorrect. Waiting leaves company data and accounts exposed indefinitely. Containment steps such as notifying security and remotely wiping or locking the devices should start right away.