Computer User Support Specialist Interview Questions

By Marcus Thompson, Head of Tech Careers · Updated July 9, 2026 · ~14 min read

The interview format

A Computer User Support Specialist (BLS 15-1232) or "IT help desk" / "desktop support" / "Tier 1 support" interview is typically a three-to-five-round loop, spread over one to three weeks:

1. Recruiter phone screen (20–30 min). Résumé walk, motivation, base-pay expectations, availability, shift preference, and a light technical filter (name three ticketing systems you have used; walk me through logging into Active Directory).
2. Technical / fundamentals round (45–60 min). Fundamentals (DNS, DHCP, TCP/IP, subnetting basics), Windows and macOS troubleshooting, Active Directory / Group Policy, imaging (SCCM, Intune, Jamf), M365 and Google Workspace administration, and endpoint security (BitLocker, antivirus, MFA, Zero Trust basics).
3. Scenario / troubleshooting round (45–60 min). "A user can't print — walk me through your approach." "A ticket queue is 40 deep and the CEO's laptop just went dark. What do you do?" "A user's OneDrive won't sync — how do you narrow it?"
4. Hiring-manager behavioral round (30–45 min). STAR-format prompts on customer-facing incidents, teamwork, ownership, and pressure.
5. Optional live exercise (30 min). A recorded ticket queue, a screen-shared troubleshooting session on a broken VM, or a scored voice-call role-play with a mock end user.

Hiring managers score two rubrics: a knowledge rubric (fundamentals correct, tools named, methodology systematic) and a voice rubric (empathy, calm, clear escalation, closing the loop with the user). Both matter; a candidate can ace the knowledge rubric and lose on voice, and vice versa. Prepare for both.

Technical & fundamentals questions

1. Walk me through what happens when you type a URL into a browser.

What they're testing: whether you know DNS, TCP handshake, HTTPS, and the network stack in order. Answer shape: "Browser checks its cache, then the OS resolver, then the configured DNS server (typically pushed by DHCP) — DNS resolves the hostname to an IP; the browser opens a TCP connection to port 443, completes a TLS handshake to verify the certificate and negotiate a session key; the browser sends an HTTP request; the server responds with HTML; the browser fetches sub-resources (CSS, JS, images) and renders."

2. What is the difference between DNS and DHCP?

DNS translates hostnames to IPs (marqee.com → 34.117.x.x). DHCP hands out an IP address, subnet mask, gateway, and DNS server to a device on connect. A DNS problem shows up as "can't reach that specific site." A DHCP problem shows up as "no network at all" or an APIPA 169.254.x.x address.

3. What is Active Directory, and what is a Group Policy Object (GPO)?

Active Directory is Microsoft's directory service — the domain database of users, computers, and groups, plus authentication (Kerberos). A GPO is a policy attached to an OU (Organizational Unit) that pushes registry, security, and configuration settings to users or computers in that OU. As a support specialist you'll unlock accounts, reset passwords, reassign OUs, and refresh GPOs (gpupdate /force) daily.

4. How do you check whether a network problem is DNS, IP, or reachability?

The classic ladder — ipconfig /all (Windows) or ifconfig/ip a (macOS/Linux) to confirm an IP, gateway, and DNS; ping the gateway (Layer 2/3); ping a public IP like 8.8.8.8 (routing); nslookup or dig a hostname (DNS); tracert/traceroute for path; then browser or app test. Naming this ladder is exactly what interviewers want.

5. What is the difference between imaging with SCCM, Intune, and Jamf?

SCCM (now Configuration Manager) is the on-prem Microsoft imaging and deployment tool. Intune is Microsoft's cloud-based endpoint management (part of Microsoft Endpoint Manager, MEM). Jamf is the standard for macOS/iOS management. Most modern shops run Intune for Windows and Jamf for Mac; SCCM lingers in large enterprises. Say what you've used, name a task you've done (deployed an OS image, pushed a configuration profile, deployed an app), and don't over-claim.

6. What is BitLocker / FileVault, and how do you recover a locked device?

BitLocker (Windows) and FileVault (macOS) are full-disk encryption. Recovery keys are typically escrowed to Active Directory / Azure AD / Jamf. As a support specialist, you'll pull a recovery key from the escrow, walk the user through entering it at the pre-boot prompt, and log a ticket for a suspect device.

7. What is MFA and why do so many tickets touch it?

Multi-Factor Authentication requires a second factor (SMS, TOTP app, hardware key, or push) in addition to a password. Tickets touch MFA constantly — new phones (re-enroll), lost tokens (issue a temporary access pass), international travel (whitelist), and "MFA fatigue" push-bombing attacks. Naming Conditional Access, Duo, or Okta and describing how you reset MFA safely (identity verification steps, ticket documentation) is table stakes.

8. What ticketing systems have you used?

ServiceNow, Jira Service Management, Zendesk, Freshservice, ManageEngine, and internal tools are the common answers. Beyond naming the tool, describe your ticket hygiene: initial acknowledgment SLA, categorization, notes discipline, warm-transfer language on escalation, and close-out communication with the user.

9. Walk me through your last major incident.

Pick one real incident. Structure: what broke, how it was detected, your role, the coordination (incident channel, IC handoff), the fix, and the post-mortem action items. Interviewers score for calm under pressure, correct escalation timing, and no blame language.

10. What is a VLAN and why does the network team care?

A VLAN (Virtual LAN) partitions a physical switch into isolated logical broadcast domains. As a support specialist you rarely configure them, but you should know that a device on the wrong VLAN can look "connected" but reach nothing — a common misdiagnosis at the desk.

Troubleshooting scenario questions

11. A user says "my email isn't working." What do you ask first?

Answer the meta-question: interviewers want to hear you narrow before you diagnose. Sample answer: "I want to know four things fast — are you Outlook desktop, Outlook web, or mobile; is nothing coming in, nothing going out, or both; when did it start; and did anything change (password, phone, VPN). Depending on the answer I go to Outlook profile, network reachability to Exchange Online, or the mail-flow status page."

12. A user's laptop shows "no internet" but is on Wi-Fi. Walk me through it.

Sample: "Confirm SSID and password, run ipconfig /all — is there a valid IP or a 169.254 APIPA; can I ping the gateway; is DNS resolving with nslookup; try a wired handoff; try a different SSID or hotspot; if all fail on this laptop but other laptops on the same Wi-Fi work, the fault is device-side — release/renew, reset the network stack (netsh int ip reset, netsh winsock reset), then check the NIC driver."

13. A user can't print. Walk through it.

Sample: "Physical first — is the printer online, paper, toner, error light. Then reachability — can the printer's web UI load from another device on the same VLAN. Then user side — is the correct print queue installed; try Print Test Page; check the spooler service; clear stuck jobs; reinstall the queue. If it's a network printer and only this user is affected, it's the queue; if multiple users are affected, it's the printer or the print server."

14. The queue is 40 tickets deep and the CEO's laptop just died. What do you do?

Sample: "Two moves in parallel: acknowledge the CEO ticket instantly and get eyes on the device — same-day is table stakes. In parallel I triage the queue by SLA and severity — password resets and single-user annoyances I batch; multi-user or department-wide I escalate. If the CEO ticket is a hardware failure, I stage a loaner and rebuild the profile from OneDrive so I can hand back a working machine within the hour."

15. Ten users in Finance say Excel is crashing. What's your first move?

Sample: "One-user or many-user changes the diagnosis. Ten users → look for a common vector — a recent Office update, a new add-in pushed by Intune, a corrupt shared workbook on the file share, a Windows update rollup. Check the Office Deployment log, roll back the add-in via Intune, or open an incident ticket if it's a widespread Microsoft outage on the Microsoft 365 status page."

16. A user's OneDrive won't sync. How do you narrow?

Sample: "Sign in state (right-click OneDrive icon, check account); reset OneDrive (%localappdata%\Microsoft\OneDrive\onedrive.exe /reset); check the sync-error list; storage quota; blocked file types or path length; corporate policy (Known Folder Move often bites here). If a single folder fails, it's usually path length or a bad character; if all sync fails, it's account/quota/policy."

17. A user's account is locked and MFA is failing. Walk me through the reset — safely.

Sample: "Verify identity per policy — badge photo, callback to their known-good phone or manager, and a second identifier (employee ID). Then unlock the account in AD/Azure AD, issue a Temporary Access Pass or reset MFA methods, and open a ticket noting the identity-verification steps. Document exactly what I did — because a wrong reset is a security incident."

18. What do you do when the answer is "I don't know"?

Sample: "I say so out loud, share what I've checked so far, and pull in the right person — either the peer on shift or Tier 2 with a warm hand-off. I keep the user in the loop with a specific next step and time, and I write up the ticket with my full troubleshooting log so the next tech doesn't restart from scratch."

Behavioral (STAR) questions

19. Tell me about a difficult user you turned around.

Pick a ticket where the user was escalated or angry. STAR format — Situation (angry user, high-visibility role), Task (fix the issue and repair the relationship), Action (specific verbal moves — acknowledgment, ownership, ETA, follow-up), Result (fixed the issue, user later requested you by name).

20. Tell me about a time you disagreed with a peer or Tier 2 tech.

Interviewers score for professional disagreement — you presented data, listened, and the team got to the right answer. Avoid stories that end in "and I was right."

21. Tell me about a time you missed something that came back to bite you.

Pick a real miss. Own it, name what you learned, and describe what changed in your process (a checklist, a peer review, a stronger ticket close-out). Interviewers score honesty here — they know everyone has misses; they're checking whether you learn.

22. Tell me about a time you had to pick between speed and thoroughness.

Support specialists live inside this trade-off daily. Pick a story — an executive user waiting on a fix versus a proper root cause. Show that you named the trade-off, communicated the temporary fix, and came back for the real fix.

23. Tell me about the ticket you're most proud of.

Choose one where you solved a hard-to-narrow problem or repaired an important user relationship. Interviewers want to see what you value — is it the technical puzzle, the user's day, or the process improvement.

Customer & escalation questions

24. A user says "you're not listening to me" mid-call. What do you say?

Sample: "I stop, say 'I hear you — let me make sure I understand,' summarize what they said back in my words, and let them correct me. Then I share what I'm doing and why, in plain language. Nine times out of ten the frustration is that the person felt talked over. Fixing the listening fixes the ticket."

25. When do you escalate to Tier 2?

When you have exhausted your runbook, when the SLA clock is at risk, when the issue affects multiple users, or when policy requires it (security incident, executive user). Warm hand-off with a written summary — don't cold-transfer.

26. How do you close a ticket the user can't verify?

Set a resolution SLA in the ticket ("closing in 48 hours unless you reply"), auto-reopen on user reply, and never mass-close silently.

27. A user asks you to bend a security rule for convenience. What do you do?

Sample: "Politely no, with a real alternative. 'I can't disable MFA on your account, but I can enable a hardware token so you're not typing codes on every login.' If it's an executive pushing hard, I loop in my manager and let policy speak — never me bending it."

28. How do you handle after-hours calls?

Follow the on-call playbook — acknowledge within SLA, triage by severity, escalate if it's above your rung, and log everything. If your team doesn't have a playbook, ask about it — you signal maturity by knowing that a good on-call rotation is a management responsibility.

29. How do you measure your own success on the desk?

First-contact resolution rate, CSAT/NPS, ticket velocity, and SLA adherence. Naming the metrics your prospective team uses (ServiceNow's default set is standard) shows you already think like a support engineer.

30. What separates a great tier-1 tech from an average one?

Sample: "Two things — the willingness to write things down (runbooks, ticket notes, KB articles) so the next tech doesn't restart from zero, and the humility to hand off cleanly when something is above your rung. Speed and product knowledge come with reps; those two habits shape a career."

How to prepare

Frequently asked questions

Don't want to do this alone?

Getting the interview is one problem; landing the offer is another. Marqee runs the whole loop with you — we pull the exact tech stack from the company's postings, prep your STAR stories, rehearse the scenario questions live, and coach you through the salary conversation with the recruiter. You walk into the interview knowing the rubric.

Keep exploring