Level 3 exam — IT & Systems

Exam — fresh questions

12 questions to validate level 3 with Sofiane, a support technician turned systems administrator in a distribution SME in Algiers: accounts and permissions, Active Directory, GPO, PowerShell and backup.
Answer everything, then click Check: your score and explanations will appear.

3.1 · Recall

1. What should be assigned in priority to manage access cleanly?

rights to groups, not to people one by one rights to each user, taken in isolation administrator rights to the whole team rights to computers rather than to accounts

Permissions are assigned to groups; people are then managed by simple membership, which makes arrivals and departures trivial.

3.1 · Application

2. A new accountant arrives at Sofiane's. What is the right move?

ticking her accesses one by one, folder by folder adding her to the domain's “Accounting” group creating a dedicated administrator account for her creating a network share just for her

Adding her to the “Accounting” group makes her inherit all the right accesses at once; when she leaves, it will suffice to remove her from the group.

3.1 · Arbitration

3. A department asks for administrator rights “to be safe”. What does Sofiane answer?

he grants admin to the department to avoid tickets he gives unlimited admin to save time he applies least privilege: the strict minimum he refuses all access to the department to protect it

An administrator account that is too broad is a major risk in case of a mistake, malware or a stolen password: least privilege limits the damage.

3.2 · Recall

4. What is the main role of Active Directory?

to host the company's public web pages and mailboxes online to replace the antivirus installed on all the fleet's workstations to store the users' emails, calendars and documents centrally to serve as a central directory of identities and resources

AD is a central directory: a single identity per person, valid across the whole domain, with centralised management from the domain controller.

3.2 · Application

5. An employee logs on to any workstation of the domain with the same account. Who authenticates him?

the domain controller, which hosts the directory the first workstation on which he logged on the file server of the sales floor the default gateway of the local network

The domain controller (DC) hosts the AD directory and authenticates connections; the workstation no longer has an isolated local account.

3.3 · Recall

6. What are Group Policy Objects (GPOs) for?

installing Windows automatically on each workstation applying rules and configurations centrally replacing the antivirus on all the fleet's workstations hosting the company's internal websites

A GPO linked to an OU automatically applies a policy (security, configuration) to all the objects concerned, without going workstation by workstation.

3.3 · Application

7. Sofiane wants to force a pilot workstation to reapply GPOs immediately. Which command?

ipconfig /flushdns on the pilot workstation ping the domain controller in a loop gpupdate /force on the pilot workstation tracert to the file server

gpupdate /force forces the immediate reapplication of GPOs: it is the recommended test on a pilot workstation before rolling out.

3.3 · Arbitration

8. Two GPOs contradict each other on the same setting. What decides?

both GPOs are deleted to start from scratch the GPO created last always wins the one that suits the department most is applied precedence, the one closest to the object winning

In case of conflict, precedence decides — often the GPO linked to the closest OU. Better a few clear, well-named GPOs.

3.4 · Application

9. In Get-Process, what do “Get” and “Process” designate?

the verb (read) and the noun (the target), Verb-Noun format a folder and a file present on the disk a session identifier and password the server name and its IP address

Cmdlets follow the Verb-Noun format: Get- reads, Set- modifies; this regularity makes the language predictable.

3.4 · Arbitration

10. Sofiane wants to delete objects with a pipeline. What does he do first?

he runs the delete command directly he first tests in read mode with a Get- he copies a script found online without reading it he disables all the server's backups

You always test a command in read mode (Get-) before acting (Set-/Remove-): it is the best safeguard against destructive mistakes.

3.5 · Recall

11. What does the 3-2-1 rule of a good backup say?

three passwords, two accounts, one administrator three servers, two antiviruses, one network firewall three copies, on two media, one of which is off-site three backups on Monday, two on Tuesday, one on Friday

3-2-1: three copies of the data, on two different types of media, one of which is kept off-site to survive a local disaster.

3.5 · Application

12. Why does Sofiane plan regular restoration tests?

to free up space on the server's disks because the law requires it every week to measure the real speed of the local network because an untested backup does not exist

You sometimes back up for months and then the restoration fails: an untested backup does not exist. You therefore check that the data really comes back, within an acceptable time.

What's next?

Score ≥ 80%: move on to Level 4 — cloud & Microsoft 365 with Sofiane.
Score between 50% and 80%: rework the failed section(s) (3.1 accounts/rights, 3.2 Active Directory, 3.3 GPO, 3.4 PowerShell, 3.5 backup), reread the lesson, then retake the test.
Score < 50%: reread the whole level 3 while applying each 48h challenge (rights matrix, AD domain, targeted and tested GPO, PowerShell pipeline, 3-2-1 rule) before trying again.
And then? Keep the groups/permissions logic, the domain map, a well-targeted GPO and Sofiane's 3-2-1 sheet: level 4 plugs them into the cloud and Microsoft 365.