Help desk technician screening questions: troubleshooting, tickets, identity checks and A+
On this page
- Tier 1, Tier 2, desktop support or service desk: place the candidate
- Volume, tools and systems
- A troubleshooting scenario to talk through
- Security judgment: verifying callers and handling access
- Users, communication and documentation
- Certifications and how much weight to give them
- Logistics, knockout checklist and scorecard
- Questions people ask
Help desk technician screening questions should test three things: how the candidate troubleshoots a problem they have not seen before, what they could fix on their own versus escalate, and whether they verify who a caller is before resetting anything. Ask about ticket volume and tools, give a short troubleshooting scenario to talk through, and ask how they handled their most frustrated user. Strong candidates ask questions before offering a fix and name the systems they worked in. Weak candidates jump to "restart it" and cannot say what they did when that did not work.
This is different from call center screening questions, which tests customer service on scripts, handle time and schedule adherence. Help desk work adds technical diagnosis, account and device administration, and security judgment. For engineers who own the network itself, use network engineer screening questions.
Tier 1, Tier 2, desktop support or service desk: place the candidate
| Role in practice | What the day looks like | Question that places them | Common mismatch |
|---|---|---|---|
| Tier 1 service desk | Phone, chat and tickets; password resets; knowledge base fixes; escalations | "What share of your tickets did you close without escalating?" | Customer service role with a few IT tickets |
| Tier 2 support | Escalated tickets, account and device administration, remote fixes | "What admin rights did you have, and what did you still send to Tier 3?" | Tier 1 with a senior title |
| Desktop or field support | Desk-side visits, device setup and imaging, printers, meeting rooms, moves | "How many devices did you deploy in a typical month, and how?" | Remote-only support listed as desktop support |
| MSP technician | Several client companies, different systems per client, billable time | "How many clients, and how did you keep track of each one's setup?" | One client for years described as multi-client |
| IT generalist at a small company | Everything: accounts, laptops, Wi-Fi, vendors, some servers | "What did you own alone, and what went to an outside provider?" | Broad claims of server and network ownership |
Volume, tools and systems
Numbers and system names separate someone who worked a queue from someone who watched one. You do not need to judge the systems; you need to hear whether they match the client's environment.
| Question | What a strong answer sounds like | Red flags |
|---|---|---|
| How many tickets or calls did you handle on a typical day, and through which channels? | A range and a split: "25 to 35, mostly chat and tickets, some phone." | No idea, or a number far out of line with the rest of their story. |
| Which ticketing system did you use, and what did a good ticket note look like? | Names the tool (ServiceNow, Jira Service Management, Zendesk, Freshservice) and describes notes another tech could pick up. | "I just closed them." |
| How many users and devices did your desk support? | An approximate number and the device mix: Windows, Mac, mobile. | Does not know the size of the organization. |
| Which account system did you work in, and what could you change? | Active Directory or Microsoft Entra ID, Google Workspace, Okta; specific rights such as resets, group membership, license assignment. | Claims "domain admin" for a Tier 1 role. |
| How were devices managed and set up? | Intune, Jamf, SCCM or Autopilot, and their part: enrolling, building images, pushing apps. | Set up every laptop by hand without any management tool, at a large company. |
| Which remote support tool did you use? | Names it and explains how they got the user's consent to connect. | Connected to users' screens without telling them. |
A troubleshooting scenario to talk through
Read one scenario and ask the candidate to talk through what they would do. There is no single right answer. You are listening for the order, the questions and the point of escalation. Use the same scenario for every candidate for the role so answers can be compared.
Scenario: "A user calls at 8:45 a.m. They changed their password yesterday. Today Outlook on their laptop keeps asking for a password, and their phone has stopped getting email. They have a client meeting at 9. What do you do?"
A strong answer usually includes:
- Verifying who the caller is before touching the account.
- Questions first: can they sign in to the web version, is the account locked, did anything else change.
- Connecting the password change to devices still holding the old password, such as the phone mail app.
- Checking for a lockout caused by the old password retrying, and clearing it.
- A quick way to get the user to their meeting (web mail) while the proper fix follows.
- A ticket note written so the next technician understands what happened.
Red flags: resets the password again immediately without verifying the caller; reinstalls Outlook first; never asks a question; no thought about the 9 a.m. meeting.
Follow-up questions that show depth:
- "What if the web version fails too?" Strong: checks the account status, multi-factor prompts and any service outage notice before escalating.
- "When would you escalate, and what would you put in the escalation?" Strong: a clear threshold and a note with steps already tried.
- "Tell me about a problem you could not solve. What happened?" Strong: an honest story, what they learned, and whether they followed up on the fix.
Security judgment: verifying callers and handling access
Help desks handle password resets, multi-factor changes and access requests, which makes them a target for people pretending to be employees. A joint CISA and FBI advisory on the Scattered Spider group describes attackers convincing IT help desk staff to reset passwords and multi-factor tokens to take over accounts. These questions show whether the candidate treats that as part of the job.
| Question | What a strong answer sounds like | Red flags |
|---|---|---|
| How did you confirm a caller was who they said before a password reset? | A specific procedure: call back on the number in the directory, a manager's approval, an identity check in a tool. | "If they knew their employee ID, I reset it." |
| Someone says they are an executive, they are traveling and need multi-factor removed now. What do you do? | Follows the same verification anyway and escalates politely if pressured. | Makes an exception because the caller is senior and urgent. |
| What did you do when you noticed something suspicious, such as a phishing email a user reported? | Followed the reporting process to the security team and did not click anything. | Deleted it and moved on. |
| A manager asks you to give a new starter the same access as a colleague. How do you handle it? | Checks the request against the approval process rather than copying access blindly. | Copies every permission without asking. |
Users, communication and documentation
- "Tell me about your most frustrated user and what you did." Strong: calm, specific, and a resolution or a clear handoff. Red flag: mocks users.
- "How would you explain to a non-technical user why their laptop needs a restart for an update?" Strong: short, plain language, no jargon, with a time they can choose. Red flag: condescending or technical.
- "Did you write or update knowledge base articles? Which one?" Strong: a named article and why it was needed. Red flag: never contributed to documentation.
- "How did you handle a ticket you could not close before your shift ended?" Strong: a handoff note and an update to the user. Red flag: left it silently.
- "What metrics was your desk measured on, and how did you do?" Strong: knows the measures their desk used (for example resolution time, satisfaction scores, first contact resolution) and their own standing. Red flag: never looked.
Certifications and how much weight to give them
| Certification | Issuer | What it shows |
|---|---|---|
| CompTIA A+ | CompTIA | Requires two exams: Core 1 on hardware and networking, Core 2 on operating systems and security, per CompTIA. A common entry-level request. |
| ITIL Foundation | PeopleCert | IT service management vocabulary: incidents, problems, changes, service requests. PeopleCert lists both ITIL 4 Foundation and ITIL Version 5 Foundation among its ITIL certifications (as of September 2026). More common for service desks in large organizations. |
| Vendor certifications (Microsoft, Apple, Google, Jamf) | The vendor | Useful when the client runs that platform. Check the issuer's verification and expiry. |
For someone moving into IT from retail or customer service, a certification plus a home lab or volunteer support work is a reasonable signal, especially when the scenario answer is strong. For someone with three years on a busy desk, their ticket and security stories matter more than any certificate.
Logistics, knockout checklist and scorecard
| Question | What a strong answer sounds like | Red flags |
|---|---|---|
| The desk runs 7 a.m. to 7 p.m. with rotating shifts and one weekend day a month. Can you work that? | A clear yes or specific limits. Ask about the schedule itself, not about family or childcare. | Accepts every shift, then declines the first late one. |
| The role is on site and includes carrying equipment and visiting two offices. Does that work? | A clear answer. If the client lists physical requirements, read them as written and ask whether the candidate can meet them with or without reasonable accommodation. | Remote-only expectations for a desk-side role. |
| What pay do you need? | An hourly or salary figure. See salary expectation questions. | Only a salary-site number. |
| Are you legally authorized to work in the US, and will you now or in the future need visa sponsorship? | A direct answer to both. | None. Ask every candidate the same two questions. |
Knock out, or flag to the client before submitting, if:
- The candidate would reset a password or remove multi-factor without verifying the caller.
- The role is Tier 2 and they have never had administrative rights in an account or device system.
- The client's core platform (for example Mac fleets on Jamf) is a must-have and they have never used it.
- The candidate cannot work the required shifts.
| Area | 1 | 2 | 3 | 4 |
|---|---|---|---|---|
| Troubleshooting | Jumps to restart or reinstall | Follows scripts | Asks questions, logical order, escalates well | Finds root causes and documents them |
| Systems | User-level only | Resets and basic account tasks | Account and device administration | Builds images, policies or automation |
| Security judgment | No verification | Verifies when reminded | Verifies every time, resists pressure | Improved the verification process |
| Communication | Technical or impatient | Polite, some jargon | Plain language, clear notes | Writes knowledge base others use |
| Logistics fit | Deal-breaker | Two open questions | One open question | All aligned |
Write down how the candidate answered the scenario, in their words: "asked whether web mail worked before touching anything; 'first I'd call them back on the directory number'" lets an IT manager compare candidates quickly. Interview Signal can tick off the scenario and the verification question as they come up on the call and attach the candidate's answer to each score.
Questions people ask
Is CompTIA A+ required for help desk jobs?
Not usually, but it is one of the most common entry-level requests. CompTIA A+ requires passing two exams, one on hardware and networking and one on operating systems and security. For candidates without work history, it shows structured study; for experienced technicians, ticket and troubleshooting stories count for more.
What is the difference between Tier 1 and Tier 2 help desk?
Definitions vary by company. Tier 1 usually takes calls and tickets, resets passwords, follows knowledge base articles and escalates. Tier 2 usually handles escalations, deeper troubleshooting, device and account administration and sometimes desk-side visits. Ask what the candidate could fix without escalating.
How do I test troubleshooting skills on a phone screen?
Give a short scenario, such as a user who cannot print after a password change, and ask the candidate to talk through what they would check first and why. Listen for questions before fixes, a logical order, and a point where they would escalate.
Why ask help desk candidates how they verify a caller?
Help desks are a known target for social engineering, where an attacker poses as an employee to get a password reset or multi-factor change. A candidate who describes a verification step before any reset understands one of the main security risks of the job.