# Service Desk Interview Questions — Answers, Scenarios & Cheat-Sheet Source: https://ai.techclick.in/blog_service_desk_interview Markdown: https://ai.techclick.in/blog_service_desk_interview.md Publisher: Techclick Infosec Pvt Ltd Complete 2026 service desk interview prep — 50+ real questions and answers across ITIL, ticketing tools, troubleshooting, scenario and behavioural rounds, for analyst, engineer, L1 and IT support roles. Interactive, with a printable cheat-sheet. Service Desk Interview Questions — Answers, Scenarios & Cheat-Sheet student learning map A visual study map for Service Desk Interview Questions — Answers, Scenarios & Cheat-Sheet showing learning path, evidence, traps, and practice sequence. TECHCLICK STUDY MAP Service Desk Interview Questions — Answers,... Service Desk · learn the flow, prove with evidence, avoid unsafe shortcuts 1. Start 🎯 By the end you will be able to 2. Understand Pick where you want to start 3. Prove ① ITIL & ITSM basics — the... 4. Practice ② The ticket lifecycle, priority... How to use this page First build the mental model, then answer with the flow, evidence, safe fix, and verification. Finish by testing yourself. Techclick Infosec Pvt Ltd | ai.techclick.in | Training Contact: WhatsApp +91 92772 29456 Content-specific feature visual for this lesson: use it as the 60-second map before reading the full detail. Most engineers think… Most candidates think a service desk job is just "reset passwords and answer calls" — so they walk into the interview talking only about tools and commands. Wrong framing. Interviewers hire for structured thinking and communication . The candidate who calmly says "first I clarify, then I check the scope, then I isolate the layer, then I escalate with notes" beats the one who rattles off ten commands. This lesson trains that structure — and gives you the real answers underneath it. ## ① ITIL & ITSM basics — the concept round Before any troubleshooting, interviewers check that you speak the language of a service desk. The single most-asked question is the difference between an incident , a service request , a problem and a change . Get this clean and the rest of the interview relaxes. Figure 1 — The desk is the single front door Five user channels on the left — phone, email, chat, self-service portal and walk-in — all funnel into one service desk hub in the middle, which logs, categorizes and prioritizes, then escalates to specialist teams and the knowledge base on the right. - One door in. Logged, triaged, then routed. USERS / CHANNELS ESCALATION + KNOWLEDGE 📞 Phone ✉ Email 💬 Chat 🌐 Self-service 🚶 Walk-in SERVICE DESK Single Point of Contact log · categorize · prioritize · escalate L2 · Network team L2 · Wintel / AD L3 · Engineers / Vendor 📚 Knowledge Base / KEDB Every call, email and walk-in enters through one desk. That is why categorization and routing — not deep tech — are the first skills interviewers probe. ### The four words every interview starts with 90% of service desk interviews open by checking if you can tell these four apart. Tap each card. 🔥 Incident tap to flip Something is broken — an unplanned interruption. Goal: restore service fast. "Outlook keeps crashing." 🛒 Service Request tap to flip Something the user wants — pre-approved & routine. Goal: fulfil it. "Please give me shared-drive access." 🔎 Problem tap to flip The root cause behind one or more incidents. Goal: remove it for good. "50 users lost VPN — the gateway failed." 🛠 Change tap to flip A controlled modification to a service, with approval. Goal: deploy safely. "Replace the failed VPN gateway." Two more terms come up constantly. An SLA is the promise IT makes to the business (e.g. "P1 resolved in 4 hours"). An OLA is the internal promise between IT teams that makes the SLA achievable. If the Network team's OLA slips, your SLA to the user breaks too — that's why the desk chases other teams. Quick check · Q1 of 10 · Apply Sneha emails: "Please give me access to the Finance shared drive." Incident or service request — and why? a) Incident — something she needs is missing b) Service request — it is a pre-approved, routine ask, not a service outage c) Problem — it is the root cause of an outage d) Change — it modifies a live service Correct: b. Nothing is broken. Access is a standard, pre-approved ask, so it flows through the request/catalog process with its own approval — not the incident process. Calling it an incident skews your SLA reporting. Pause & Predict You unlock a locked AD account but it locks again in 10 minutes. What is the most likely cause? Type your guess. Reveal answer Answer: A stale cached password somewhere — a mapped drive, a phone mail profile, or an old RDP session still trying the OLD password. Fix the cached credential everywhere, not just the account. A repeat lockout can also signal a brute-force attempt, so note it. Aarav at Wipro faces this A user logs a ticket: "I cannot open the new project folder." The agent marks it a P2 Incident and escalates to the server team. Likely cause It was never an incident. The user simply needs access — that is a service request, not a broken service. Diagnosis Ask one clarifying question: "Did this folder ever work for you, or is this new access you need?" The answer reveals request vs incident. ServiceNow ▸ Category check ▸ misrouted ticket Fix Re-classify as a Service Request, route through the access-approval workflow, and cancel the false escalation. Verify The server team queue is unblocked and the access SLA clock — not the incident clock — now applies. 👉 So far: a service desk is the single front door; incident = broken, request = a want, problem = root cause, change = a controlled fix; SLA is to the business, OLA is between IT teams. Interview gold When asked "what is the role of a service desk?", say the magic phrase: Single Point of Contact . Then add the four verbs — log, categorize, prioritize, escalate . That one sentence signals you actually understand the function, not just the job title. ### Change management: the three change types and the CAB Once you nail the four record types, interviewers go one level deeper into Change , because it is the one a careless agent can use to take down production. There are three types of change in ITIL 4, sorted by risk. Tap each. ✅ Standard tap to flip Low-risk, repeatable, pre-approved . No CAB each time — it follows a tested, documented procedure. "Onboard a new starter's AD account." 📋 Normal tap to flip Everything that isn't standard or emergency. Needs assessment + CAB approval; sub-graded major / significant / minor by risk. "Upgrade the email server." 🚨 Emergency tap to flip Must go in now — usually to fix a major incident. Fast-tracked via the ECAB ; still gets a post-implementation review. "Patch a live security hole." 🧑‍⚖️ CAB tap to flip Change Advisory Board — the people from different teams who review a normal/risky change before it goes live, weighing risk vs benefit. The urgent version is the ECAB . The submission that asks for a change is the RFC . A clean answer ties it together: "A standard change is pre-approved so it skips the CAB; a normal change is risk-assessed by the CAB; an emergency change is fast-tracked through the ECAB to fix a major incident and is reviewed afterwards." ### Problem vs Known Error, and what RCA really means The other concept interviewers probe is the difference between a Problem and a Known Error . A Problem is the suspected root cause of one or more incidents that is still under investigation. The moment you have identified the root cause and a workaround, it is promoted to a Known Error and recorded in the KEDB so the desk can apply the workaround instantly next time. RCA (Root Cause Analysis) is the structured "why did this really happen" investigation — techniques like the 5 Whys or a fishbone diagram — that turns a Problem into a fix. Add the proactive/reactive distinction and you sound senior: reactive problem management starts after incidents have already hit users; proactive problem management spots trends and patterns (e.g. the same printer failing weekly) and removes the cause before the next incident. Reactive puts out fires; proactive stops them starting. Interview gold One sentence that wins the change/problem round: "Incident restores service now , Problem removes the root cause for good , a Known Error is a Problem we've documented with a workaround, and a Change is how we actually deploy the fix safely." That chain shows you see the whole loop, not four isolated words. ## ② The ticket lifecycle, priority & the tool Next, interviewers want to see that you understand how a ticket moves and how its priority is decided. Recite the lifecycle, then prove you know that priority is a calculation — not a feeling. ### ▶ Watch a ticket move through its life This is the lifecycle interviewers ask you to recite. Press Play for the healthy path, then Break it to see how a mis-categorized ticket dies. ① Log & Identify User calls; you raise INC0010042, capture caller + a clear short description + timestamp. ▼ ② Categorize & Prioritize Pick Category = Network > VPN; set Impact & Urgency → matrix returns P2; routes to Network Support. ▼ ③ Diagnose / Escalate Check the KB; try the standard fix; if beyond L1, escalate functionally with full notes. ▼ ④ Resolve & Close Apply the fix, confirm with the user, set Resolved → Closed, log the resolution code. Press Play to step through the healthy path. Then press Break it . ▶ Play Next ▶ ⚠ Break it ↺ Reset Priority is the most tested — and most failed — concept. It is Priority = Impact × Urgency . Impact is "how big / how many"; urgency is "how fast". You read the cell where they meet off a matrix. Figure 2 — Priority is maths, not volume A three by three grid: rows are Impact High, Medium, Low; columns are Urgency High, Medium, Low. The top-left cell (high impact, high urgency) is P1 critical in red; the bottom-right (low impact, low urgency) is P5 in grey. Colour moves from red through amber and blue to green as severity drops. Priority = Impact × Urgency Impact ↓ / Urgency → High Medium Low High Medium Low P1 P2 P3 P2 P3 P4 P3 P4 P5 A single angry user is still Low impact — empathy is free, but the P-code is objective. The matrix is the interviewer's favourite trap: the "make-it-P1!" user only moves urgency , never impact . Say that out loud and you pass. COLOUR KEY P1 critical P2 high P3 medium P4 low P5 planning Priority Example response Example resolution Typical scenario P1 Critical 15 min 4 hours Whole site / server down P2 High 30 min 8 hours App degraded for a department P3 Medium 1 hour 2 business days Recurring issue, workaround exists P4 Low 4 hours 5 business days Single user's email issue These SLA numbers are illustrative — every organization tunes them to its own contracts and business hours. Say that in the interview; it shows maturity. You'll spend your whole day inside a ticketing tool . ServiceNow is the market leader, so know its incident form cold. 🖥️ This is the screen you'll actually work in — Incident → Create New in ServiceNow. (Recreated for clarity — your console matches this. Fields ①②③ are the ones the matrix in Figure 2 drives.) your-instance.service-now.com · Incident · INC0010042 Number INC0010042 Caller * Sneha Iyer (Finance) Category * Network Subcategory VPN Channel Phone State In Progress Impact 2 - Medium 1 Urgency 1 - High 2 Priority 2 - High (auto) 3 Assignment group Network Support Short description * Cannot connect to VPN since 9:10 AM Submit Resolve ① Impact and ② Urgency are the only two priority fields YOU set. ③ Priority is greyed-out — ServiceNow calculates it from the matrix. In an interview, point at this: "I never type Priority, I set Impact and Urgency and let the matrix decide." Quick check · Q2 of 10 · Analyze An issue affects one user, the impact is Low and the urgency is Low. Using the matrix, what priority is it? a) P1 Critical — every ticket matters b) P2 High — the user asked nicely c) P4 Low — low impact times low urgency lands bottom-right d) Whatever priority the user demands Correct: c. Priority is objective. Low impact × low urgency is the bottom-right cell = P4. The user's mood, seniority of their request, or how politely they asked never moves a cell — only impact and urgency do. Pause & Predict In ServiceNow, why is the Priority field greyed-out and read-only? Type your guess. Reveal answer Answer: Because ServiceNow auto-calculates Priority from Impact × Urgency using the matrix. You set the two inputs; the tool derives the output. This stops agents from hand-picking a priority and keeps reporting consistent across the whole desk. 👉 So far: lifecycle = Log → Categorize/Prioritize → Diagnose/Escalate → Resolve/Close; Priority = Impact × Urgency; in ServiceNow you set Impact + Urgency and the tool computes Priority. ## ③ The technical / troubleshooting round Now the hands-on round. Freshers panic and reach for memorized commands. What interviewers actually score is your thought process — can you isolate a problem layer by layer? The classic test is connectivity. Figure 3 — Isolate the layer before you escalate Three stacked tests. Ping the default gateway: if it fails the problem is local LAN or cabling. If it passes, ping a public IP like 8.8.8.8: if that fails the problem is the internet link or firewall. If that passes, ping a hostname: if that fails the problem is DNS, otherwise the network is fine and it is an application issue. ping gateway → ping 8.8.8.8 → ping hostname ping 192.168.1.1 your default gateway LOCAL problem cable / NIC / IP / VLAN FAIL ping 8.8.8.8 a known public IP INTERNET / link problem ISP / firewall / route — escalate FAIL ping google.com resolve a hostname DNS problem wrong/missing DNS — flushdns FAIL PASS ↓ PASS ↓ All three pass → network is fine. It's an application / profile / account issue. This ladder is the answer to the classic "ping works on IP but not the name" question — that one branch is always DNS. Know these three commands and exactly what each tells you: Windows · isolate a connectivity issue ipconfig /all # see your IP, gateway, DNS ping 192.168.1.1 # reach your gateway? (LAN) ping 8.8.8.8 # reach the internet? (link) ping google.com # resolve a name? (DNS) ipconfig /flushdns # clear a bad DNS cache Expected output Reply from 192.168.1.1: bytes=32 time=1ms TTL=64 Reply from 8.8.8.8: bytes=32 time=14ms TTL=117 Ping request could not find host google.com. Pause & Predict "Tell me about a time you made a mistake." Why is "I can't think of one" the worst answer? Type your guess. Reveal answer Answer: Because it reads as either dishonest or as someone with no self-awareness — both worse than the mistake itself. The interviewer is testing accountability, not perfection. Give a real, low-stakes example via STAR, own it, and end on the fix you put in place so it never recurs. ### How AI and copilots are reshaping the service desk (2026) A genuinely current question in 2026 is "how is AI changing the service desk, and how would you use it?" Don't say "it'll take my job" — show you understand the shift. There are two levels: an assistive copilot helps the agent (drafts replies, summarises a noisy ticket, suggests the right KB article), while an agentic AI actually does the work end-to-end — it can reset a password, run the workflow, then close the ticket and confirm. In production, AI now deflects 50–85% of routine, high-volume requests, dropping first response to seconds. The interview-winning framing: "AI handles the repetitive password-reset and access tickets so the desk can shift-left even harder and spend human time on judgement, complex incidents and the customer relationship." That ties the new tech straight back to shift-left and FCR — you sound like someone who'll embrace the tools, not fear them. Add that AI is only as good as the KB feeding it, so writing clean KB articles matters more than ever. Interview gold When AI comes up, end with: "It raises the floor on routine work, so the value of an agent moves to judgement, communication and feeding the knowledge base — and that's where I want to grow." That single line signals you're 2026-ready, not threatened. 👉 So far: every scenario = Clarify → Triage → Isolate → Resolve/Escalate → Document; functional escalation = skill, hierarchical = authority; behavioural answers run on STAR (lead with Action + Result); stand out by talking FCR, MTTR, CSAT and shift-left — and frame AI/copilots as raising the floor so humans handle judgement. ### 🤖 Ask the AI Tutor Tap any question — instant, scoped to this lesson. No login, no waiting. I am a fresher — what do I say about no experience? Technical or behavioural — which is asked more? Do I need to know ServiceNow specifically? What is the #1 mistake candidates make? How do I answer "why service desk?" well? L1 vs L2 — what extra do they expect? Pre-curated from Service Desk docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in. ## 📝 Wrap-up assessment — six more You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end. Q5 · Remember What does SLA stand for, and who is it between? a) Service Level Agreement — a response/resolution target between IT and the business b) System Logic Architecture — a network design document c) Software License Agreement — a vendor contract d) Standard Lockout Action — an AD security policy Correct: a. SLA = Service Level Agreement: the promise IT makes to the business/customer on response and resolution times. The internal version between IT teams is the OLA; the external version with a vendor is the UC. Q6 · Apply A user reports they cannot log in this morning. What is the best FIRST step? a) Reset their password immediately, no questions asked b) Escalate to the AD/identity team straight away c) Tell them to restart and call back later d) Clarify which system and the exact error, and verify their identity, before touching the account Correct: d. You clarify and verify identity first — resetting blindly is a social-engineering risk, and escalating before troubleshooting wastes the L2 team. Find out the system, the error, and whether others are affected. Q7 · Analyze Outlook shows old cached mail but new mail is not arriving. Webmail (OWA) works perfectly. Where is the problem? a) The Exchange/M365 mail server is down b) Client-side — the local OST or Outlook profile, not the mail server c) The user's mailbox has been deleted d) The entire company's mail is down Correct: b. If webmail works, the server and the account are healthy — so the fault is on the client: a corrupt OST or broken profile. Rebuild the OST or create a fresh Outlook profile. OWA working is the clue that isolates client from server. Q8 · Analyze An entire floor loses network connectivity at the same moment. What does the scope tell you, and what do you do? a) It is a single-user P4 — just reset that user's network adapter b) Close it as "no issue found" since you cannot reproduce it c) Reset every affected user's password d) High impact → likely P1/P2: confirm the scope, escalate to Network as a major incident, and keep users informed Correct: d. Many users at once means high impact — this is infrastructure, not a per-user fix. Confirm scope, raise it as a major incident, escalate functionally to Network and hierarchically to your lead, and communicate proactively. Q9 · Evaluate You cannot resolve a ticket because it needs skills/access you do not have. What is the RIGHT escalation? a) Hierarchical — straight to your manager because you are stuck b) Functional — to a more skilled team (L2/L3), with full notes c) Just close it and ask the user to reopen later d) Delete the ticket so it does not breach SLA Correct: b. Lacking skill/access is a functional gap, so it goes to a more skilled team — with full notes so they do not restart from zero. Hierarchical escalation is for authority/visibility (VIPs, SLA breach, major incidents), not "I am stuck". Q10 · Evaluate An experienced candidate is asked "what would you improve on a service desk?" The strongest answer talks in… a) Metrics and patterns — raising FCR, cutting MTTR, lifting CSAT, turning recurring incidents into Problems, shifting left with KB b) How fast they personally type and close tickets c) Never escalating anything to other teams d) Working unpaid overtime to clear the queue Correct: a. Senior thinking is about outcomes and patterns, not personal speed or heroics. Improving FCR/MTTR/CSAT, spotting recurring incidents and raising Problems, and shifting work left with KB articles shows you think about the whole desk, not just your own queue. Submit all answers Try again Lesson complete — saved to your profile. Almost! You need 70% (7 of 10) — re-read the path that tripped you up and tap "Try again". ### 🧠 In your own words Type one line: why is priority set by Impact × Urgency, and not by who shouts loudest? Then compare to the expert version. Compare with expert answer Expert version: Because a service desk has limited hands and must protect the whole business, not one loud user. Impact (how many people are hit) times Urgency (how fast the damage grows) puts the genuinely critical outage ahead of a single annoyed user — even if that user is louder. It also keeps SLA reporting honest and stops the queue being gamed by emotion. ### 🗣 Teach a friend Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary. Generate my one-liner 📩 Quiz me on this in 7 days. Opt in and we'll email 3 micro-questions on Interview Prep at Day 1, Day 7 and Day 30 — spaced repetition is how this sticks. Un-tick any time. ### 📖 Glossary Incident An unplanned interruption or quality drop in an IT service. Goal: restore fast. Service Request A pre-approved, routine ask (access, software, password). Goal: fulfil it. Problem The underlying root cause of one or more incidents. Change A controlled add/modify/remove of anything that affects a service. SLA / OLA SLA = promise to the business; OLA = internal promise between IT teams that supports it. Priority (P1–P5) The urgency code derived from Impact × Urgency; P1 critical → P5 planning. Functional vs Hierarchical escalation Functional = more skill (L1→L2→L3); hierarchical = more authority (agent→manager). FCR / MTTR / CSAT First Contact Resolution %, Mean Time To Resolution, Customer Satisfaction Score. KB / KEDB Knowledge Base = fix articles; KEDB = known errors + workarounds. Shift-left Moving resolution from L2/L3 down to L1 and self-service via KB and automation. Change types & CAB Standard = pre-approved/low-risk; Normal = risk-assessed by the CAB; Emergency = fast-tracked via ECAB to fix a major incident. CAB = the review board; RFC = the request that proposes a change. Known Error / RCA A Known Error is a Problem with a documented root cause + workaround (stored in the KEDB). RCA = Root Cause Analysis (e.g. 5 Whys). Reactive problem mgmt fixes after incidents; proactive removes the cause first. DHCP / DORA / APIPA DHCP hands out IPs via the DORA handshake (Discover, Offer, Request, Acknowledge). A 169.254.x.x (APIPA) address means DHCP failed and the PC self-assigned — no real network. OSI model Seven layers ("Please Do Not Throw Sausage Pizza Away"): Physical, Data Link, Network, Transport, Session, Presentation, Application — used as a layer-by-layer fault checklist. OST vs PST OST = offline cache that syncs with the server (safe to rebuild); PST = local-only archive that does not sync (back it up). Repair with scanpst.exe . BSOD Blue Screen of Death. Read the stop code → boot Safe Mode → roll back the recent driver/update → sfc /scannow then DISM → test RAM → re-image as last resort. Workgroup / Domain / GPO Workgroup = peer-to-peer, local accounts; Domain = central AD control, one login everywhere; GPO = a policy AD pushes to domain machines ( gpupdate /force ). MFA / Conditional Access / Intune MFA = a second sign-in factor; Conditional Access = Entra rules deciding when to demand it; Intune = cloud device management (the cloud successor to GPO). Entra ID = the new name for Azure AD. Term One-line plain-English meaning. ×N --> #### 📚 Sources - Simplilearn — Top 100+ ITIL Interview Questions & Answers (2026) . simplilearn.com - NovelVista — Top 100+ IT Help Desk Interview Questions and Answers 2026 . novelvista.com - ServiceNow Community + Docs — Incident Management workflow, state model & form fields . servicenow.com - ManageEngine — IT Incident Management: ITIL lifecycle, process & roles . manageengine.com - InvGate — ITIL Priority Matrix & Functional vs Hierarchical Escalation . invgate.com - Indeed — How to handle a difficult customer (STAR interview answer) . indeed.com - IT@Cornell — Incident, Request, Problem, Change definitions . it.cornell.edu - NovelVista / Virima — ITIL Change Types: Standard, Normal & Emergency, and the CAB (2026) . novelvista.com · virima.com - Microsoft Learn — Microsoft Intune, Entra ID conditional access & MFA, Group Policy . learn.microsoft.com - Rezolve.ai / Elementum AI — AI copilots & agentic service desk: deflection benchmarks (2026) . rezolve.ai · elementum.ai ### What's next? Cleared the service desk round? The next rung is networking and security fundamentals — the L1/L2 topics that turn a help-desk job into an infosec career. Browse the full interview-prep library and keep your streak going. Next · All interview lessons → Practice on exam.techclick.in → --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt