This page needs a newer browser to run its tools. You can still read everything here.

IT Support & Help Desk Fundamentals Module 11

Backups, recovery and data disposal interview questions

Interview questions on backups, recovery and data disposal: warm-ups, then what each harder question tests and how a good answer starts.

9 questions: 3 warm-ups and 6 with model answers · Levels: Fresher to senior

Warm-up questions

Short questions with short answers, each answered in full.

Fresher to mid

A user asks whether their files are safe because the folder is in OneDrive. What do you say, in one minute?

Answered in the lesson Backup strategy: 3-2-1, versions and restore tests
Fresher

restic warns about the repository password the moment a repository is created. Why does it, and what should a support desk do about it?

Answered in the lesson Back up Windows PCs, Macs and phones
Fresher to mid

A user deleted a file from Documents half an hour ago and emptied the Recycle Bin five minutes ago. File History is off and the folder does not sync to OneDrive. The drive is healthy. Where can the file still come from, and what do you do first?

Answered in the lesson Restore files and recover data safely

Questions with model answers

What each question tests, the first step of a good answer and the follow-ups to expect.

Fresher to mid

A small design firm asks you for a backup plan. They have a 2 TB file server, 20 Mbit/s uplink, 200 Mbit/s LAN. Give an RPO and an RTO you would propose, with the arithmetic, and the schedule that meets them.
What it tests

Separating RPO from RTO, picking a schedule that gives a stated RPO, computing a restore time from a size and a throughput, and agreeing both numbers with the business before promising them.

First step

Do not start from the tools. Separate the two numbers: ask what work the firm cannot afford to redo (RPO) and how long they can be down (RTO), then let those answers drive the schedule and the restore path. Only once both are agreed do you choose a tool and a storage target.
Follow-ups
- They say they can lose one working day of edits but not more. What is the RPO and how often does the backup run?
- They say the firm must be back inside 8 hours. What RTO does the arithmetic give, and where does your plan fail that bar?
- The uplink is only 20 Mbit/s. How do you still meet the RTO without buying more bandwidth?
- What offline or immutable copy do you add, and why can you not meet the ransomware guidance without one?
From the lesson Backup strategy: 3-2-1, versions and restore tests
Model answer, Pro. Model answers open with any pass; prices are in the notice on this page.
Opening the model answers with your pass…
Model answers open with any MySmartCoPilot pass.
Pro pass · 1 week₹79$2.99
30 days₹179$5.99
1 year₹1,699$45
One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.
Passes can’t be bought right now, so the model answers can’t be opened at the moment. If you have a pass, enter your licence key.
Choose a pass I have a licence key
It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 5 minutes
Mid to senior

A charity's file server has been encrypted by ransomware overnight. Their backups are a nightly job to a USB disk that stays plugged in, plus a OneDrive sync of the users' documents. How do you recover and what do you change for next time?
What it tests

Isolating the server first, finding what each copy really holds, following the policy on paying, restoring from the newest clean copy, and rebuilding the plan with an offline copy and a restore test.

First step

Do not wipe or restore anything yet. First take the server off the network, so the encryption cannot reach anything new. Then find out what each copy holds now: the USB disk stayed plugged in, so treat it as encrypted until checked, while OneDrive keeps deleted files and earlier versions for a limited window that an administrator can use. Restore only from a copy you have checked is clean.
Follow-ups
- Should the charity pay the ransom? What rule do you follow, and why?
- The USB disk is encrypted too. What does OneDrive have, and how do you get it back?
- When all the files are back, what three changes do you make to the plan so the next attack has an offline copy to lose to?
- How do you prove the new plan works before you tell the charity it is safe?
From the lesson Backup strategy: 3-2-1, versions and restore tests
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 6 minutes
Fresher to mid

A user's personal Windows laptop goes for a motherboard repair tomorrow. Windows Backup shows Documents and Pictures backed up to her personal OneDrive, which is nearly at its 5 GB. Her Desktop holds 40 GB of video projects, and she has a 1 TB USB drive at home. What do you do today, and what do you tell her?
What it tests

Knowing what Windows Backup copies and what it cannot hold, making a second copy that the user keeps, proving that copy before the laptop leaves, and thinking past the files to what a new motherboard changes.

First step

List what the laptop holds against what is already protected, before choosing a tool. Two of the five folders are in OneDrive and the account is nearly full, so the 40 GB on the Desktop has no copy at all, and neither have the programs or anything outside the user folders. The copy has to go somewhere that does not depend on that account: the USB drive.
Follow-ups
- She says OneDrive already has her files. How do you show her what it holds and what it does not?
- Which tool copies the Desktop to the USB drive, and how do you prove the copy is complete?
- What could stop the laptop starting after the new motherboard goes in, and what do you check today because of it?
- The shop replaces the drive as well. How do you put her laptop back together?
From the lesson Back up Windows PCs, Macs and phones
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 6 minutes
Mid to senior

A five-person architecture office keeps its projects on a Mac mini. The owner wants the USB disk he copies by hand each Friday replaced with restic: nightly to the office NAS and weekly to cloud storage, with the repository password kept only in his head. What do you set up, and what do you refuse?
What it tests

Designing a scripted restic backup to two repositories, keeping the password recoverable without weakening it, reading the result of every run, and proving with checks and restore tests that someone else can get a file back.

First step

Start from the restore, not the backup: who must be able to get a project file back, from where, and with what. That question refuses the password kept in one head at once, because restic has no reset, and it shapes the rest: two repositories, a scheduled script whose exit status somebody reads, regular checks and a restore test.
Follow-ups
- The owner still will not write the password down. What do you offer him instead?
- How do you know on Monday morning that the backups of the weekend ran?
- What does the monthly restore test look like, and what does it prove that restic check does not?
- The NAS dies. How long until the office has two copies again?
From the lesson Back up Windows PCs, Macs and phones
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 5 minutes
Fresher to mid

A user's laptop suddenly stopped booting with a message about a missing operating system. The drive does not click or grind, and the user has a three-month-old backup on an external drive. Walk through how you decide whether to attempt software recovery, restore from the backup, or send the drive to a lab.
What it tests

Distinguishing a logical failure from a mechanical failure, checking the drive's health before deciding, and weighing the backup's age against recovery cost and risk.

First step

The absence of clicking or grinding suggests a logical failure, not a mechanical one. Boot from external media or remove the drive and connect it to another PC to check whether it is detected and whether SMART data shows any warnings. If the drive is healthy, the boot failure may be a corrupted boot sector or file system that recovery software can address. If the drive has SMART warnings or cannot be read, image it before any further attempts.
Follow-ups
- The drive is detected but shows as unallocated in Disk Management. What now?
- The three-month-old backup is missing some recent work the user needs. How do you proceed?
- After imaging, recovery software finds the files but the user says some documents are corrupt. What do you check?
From the lesson Restore files and recover data safely
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
Mid to senior

At 18:50 a user calls: every file on the S: drive ends in .lock, with a ransom note in each folder. At 19:00 the file server's nightly backup runs to a NAS share it keeps mounted. The user wants last night's copy back. What do you do in the next ten minutes, and why not restore yet?
What it tests

Running the isolation-first response under time pressure, seeing that the next backup run and a mounted backup share endanger the last clean copy, preserving evidence, and explaining why the restore waits.

First step

Treat it as a ransomware incident, not a restore. Isolate the user's PC without powering it off, then protect the copy you will need: cut the server and the NAS off the network before the 19:00 run or the ransomware can reach last night's copy. Report by phone straight away; the restore waits for the security team.
Follow-ups
- The user insists on restoring right now because the deadline is tomorrow. What do you say?
- The 19:00 job ran before you reached the server. What may it have done to the NAS copy, and how do you find out safely?
- The security team says the attacker first signed in a week ago. How does that change which backup you restore from?
From the lesson Restore files and recover data safely
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 5 minutes

All IT Support & Help Desk Fundamentals interview questions · The IT Support & Help Desk Fundamentals track

Warm-up questions

A user asks whether their files are safe because the folder is in OneDrive. What do you say, in one minute?

restic warns about the repository password the moment a repository is created. Why does it, and what should a support desk do about it?

A user deleted a file from Documents half an hour ago and emptied the Recycle Bin five minutes ago. File History is off and the folder does not sync to OneDrive. The drive is healthy. Where can the file still come from, and what do you do first?

Questions with model answers

A small design firm asks you for a backup plan. They have a 2 TB file server, 20 Mbit/s uplink, 200 Mbit/s LAN. Give an RPO and an RTO you would propose, with the arithmetic, and the schedule that meets them.

A charity's file server has been encrypted by ransomware overnight. Their backups are a nightly job to a USB disk that stays plugged in, plus a OneDrive sync of the users' documents. How do you recover and what do you change for next time?

A five-person architecture office keeps its projects on a Mac mini. The owner wants the USB disk he copies by hand each Friday replaced with restic: nightly to the office NAS and weekly to cloud storage, with the repository password kept only in his head. What do you set up, and what do you refuse?

At 18:50 a user calls: every file on the S: drive ends in .lock, with a ransom note in each folder. At 19:00 the file server's nightly backup runs to a NAS share it keeps mounted. The user wants last night's copy back. What do you do in the next ten minutes, and why not restore yet?