Core 2 Domain 4: Operational Procedures (21%)¶

Overview¶

Operational Procedures is how a professional technician works: documenting tickets and assets, following change management, backing up, staying safe, handling the environment and regulated data, treating customers well, writing small scripts, supporting users remotely, and (new in V15) understanding AI tools. Many questions here are common sense dressed in vocabulary, so the marks go to people who know the exact terms: synthetic full, GFS, chain of custody, MSDS, SPICE, hallucination.

The objectives are:

• 4.1 Implement best practices associated with documentation and support systems information management.
• 4.2 Apply change management procedures.
• 4.3 Implement workstation backup and recovery methods.
• 4.4 Use common safety procedures.
• 4.5 Summarize environmental impacts and local environment controls.
• 4.6 Explain the importance of prohibited content/activity and privacy, licensing, and policy concepts.
• 4.7 Use proper communication techniques and professionalism.
• 4.8 Explain the basics of scripting.
• 4.9 Use remote access technologies.
• 4.10 Explain basic concepts related to AI.

4.1 Documentation and Support Systems¶

Ticketing systems¶

A good ticket lets anyone pick up the work without calling the user again.

Asset management¶

Types of documents¶

4.2 Change Management¶

Change management makes sure changes are planned, approved, tested, and reversible, so a fix for one problem does not cause an outage somewhere else.

flowchart LR
    A["Request form<br/>(purpose, scope)"] --> B["Risk analysis<br/>and impact"]
    B --> C["Sandbox testing"]
    C --> D["Change board<br/>approval"]
    D --> E["Implement in<br/>maintenance window"]
    E --> F["Peer review and<br/>end-user acceptance"]
    F --> G["Document and close"]
    E -.->|Problems| RB["Execute rollback plan"]

The main stages of a change request, with the rollback plan ready if the change fails.

Elements of a change¶

Change types¶

4.3 Backup and Recovery¶

Backup types¶

Worked example: full on Sunday, failure on Thursday morning. With incrementals you restore Sunday + Monday + Tuesday + Wednesday. With differentials you restore Sunday + Wednesday.

Frequency and recovery¶

• Frequency - Set by how much data the business can afford to lose.
• In-place/overwrite recovery - Restore over the original location. Fast, but overwrites current versions.
• Alternative location recovery - Restore somewhere else, compare, and then move. Safer when unsure.

Rotation schemes¶

flowchart LR
    D["Daily backups<br/>(son, kept 1 week)"] --> W["Weekly backup<br/>(father, kept 1 month)"]
    W --> M["Monthly backup<br/>(grandfather, kept 1 year or more)"]

Grandfather-father-son rotation promotes one daily backup to weekly, and one weekly backup to monthly, so older history is kept with fewer copies.

Backup testing - A backup you have never restored is a hope, not a backup. Test restores regularly.

4.4 Safety Procedures¶

ESD strap caution: do not wear an ESD strap when working on high-voltage equipment. The strap is a path to ground and makes a shock worse.

4.5 Environmental Impacts and Controls¶

Disposal and MSDS¶

• MSDS (material safety data sheet, now often called SDS) describes a product's hazards, safe handling, first aid, and disposal. Look it up for toner, batteries, and cleaning chemicals.
• Proper battery disposal - Lithium-ion and other batteries go to battery recyclers, never the trash.
• Proper toner disposal - Return programs or recyclers. Toner is a fine powder, so clean spills with a toner vacuum.
• Other devices and assets - E-waste regulations apply to PCs, monitors, and phones. Remove and destroy data first.

📖 EPA Electronics Donation and Recycling - US guidance on recycling electronics responsibly

Environment¶

Power problems¶

4.6 Prohibited Content, Privacy, Licensing, and Policy¶

Incident response (for the technician)¶

When you find prohibited content or evidence of a crime on a device:

1. Stop and do not investigate further on your own.
2. Inform management and law enforcement as necessary, following policy.
3. Preserve the evidence: make a copy of the drive (a forensic image) for data integrity and preservation.
4. Keep a chain of custody record: who handled the evidence, when, and why.
5. Collect data by order of volatility: most volatile first (CPU cache and RAM, then swap, disk, and archived data).
6. Complete incident documentation.

Licensing¶

Regulated data¶

Policies and agreements¶

• NDA/MNDA - Non-disclosure agreement (one-way) and mutual NDA (both parties).
• AUP (acceptable use policy) - What users may and may not do with company systems.
• Regulatory and business compliance requirements - Rules the organization must meet.
• Splash screens - Log-in banners that state authorized use and monitoring, supporting legal action later.

4.7 Communication and Professionalism¶

The objective lists behaviors. Most questions ask "what should the technician do?" and the answer is the most professional and customer-focused option.

• Appearance - Match the attire of the environment: formal or business casual.
• Language - Avoid jargon, acronyms, and slang. Explain in plain terms.
• Attitude - Positive, confident.
• Listen actively - Do not interrupt. Take notes.
• Be culturally sensitive - Use appropriate professional titles.
• Be on time - If you will be late, contact the customer.
• Avoid distractions - No personal calls, texting, social media, or personal interruptions.
• Difficult customers - Do not argue or get defensive. Do not dismiss their issues. Do not be judgmental. Clarify by asking open-ended questions, restating the issue, and confirming understanding. Do not post about customer experiences on social media.
• Set and meet expectations - Give timelines and status updates. Offer repair or replacement options. Provide documentation of the services. Follow up later to verify satisfaction.
• Confidential and private materials - Do not read, copy, or discuss documents on the customer's computer, desk, or printer.

Open-ended vs closed questions: "What happens when you try to print?" (open) gathers information. "Is the printer on?" (closed) confirms a detail. Start open, then narrow with closed questions.

4.8 Scripting Basics¶

Script file types¶

📖 PowerShell Documentation - Microsoft's PowerShell overview and reference

Use cases¶

• Basic automation of repetitive tasks
• Restarting machines on a schedule
• Remapping network drives at sign-in
• Installing applications silently
• Automated backups
• Gathering information and data (inventory, logs)
• Initiating updates

A small illustrative example, a batch file that maps a drive at sign-in:

@echo off
net use S: /delete /y >nul 2>&1
net use S: \\fileserver\shared /persistent:no

Other considerations¶

• Unintentionally introducing malware - Only run scripts from trusted sources. PowerShell execution policy and code signing help.
• Inadvertently changing system settings - Test in a sandbox or VM first.
• Browser or system crashes due to mishandling of resources - A loop that never ends, or one that eats memory, can hang a machine.

4.9 Remote Access Technologies¶

Security considerations of each method:

• Require MFA and strong passwords.
• Do not expose RDP, VNC, or SSH directly to the internet.
• Get user consent before viewing their screen, and end sessions when done.
• Watch for unauthorized remote tools: scammers commonly ask victims to install screen-sharing software.
• Log remote sessions, especially RMM, which has admin rights on every managed machine.

4.10 Artificial Intelligence Basics¶

This objective is new in V15. It is about using AI tools safely at work, not how models are built.

📖 NIST AI Risk Management Framework - A widely used framework for managing AI risks

Exam Tips and Traps¶

1. Incremental restore needs the full plus every incremental. Differential needs the full plus the last differential.
2. Synthetic full is assembled on the backup server, not read from the source again.
3. 3-2-1: three copies, two media, one offsite.
4. Rollback plan is the answer when a change could fail.
5. Emergency change is expedited, then documented.
6. Chain of custody starts the moment you find evidence. Do not keep investigating.
7. MSDS for disposal and handling of toner and chemicals.
8. UPS for brownouts and blackouts. Surge suppressor for spikes.
9. Do not wear an ESD strap around high voltage.
10. Difficult customer - listen, do not argue, clarify with open-ended questions.
11. .ps1 = PowerShell, .sh = shell, .bat = batch, .vbs = VBScript.
12. SPICE is remote display for virtual machines. WinRM is remote PowerShell.
13. Hallucination is confident but wrong AI output. Do not paste sensitive data into public AI.

Related Notes¶

• 07 - Security - Destroying data before disposal
• 06 - Operating Systems - Commands used in scripts
• 02 - Networking - Ports for remote access tools
• Strategy - How to handle the professionalism questions on exam day