100-140 Cisco Certified Support Technician IT Support Exam Topics and Questions

This is where the exam establishes whether you understand the professional frame around support work, not just the technical acts. The cost here is underestimating how deeply the exam tests process discipline: queue management, SLAs, KPIs, and the structured problem-solving cycle are all fair game. Candidates who treat this as soft background material and focus entirely on hardware and networking typically drop marks they did not expect to lose.

– The operational machinery of a help desk

Queue management means knowing what happens when tickets pile up and how priority rules govern which one moves first. SLAs set the contractual ceiling on response and resolution time, and KPIs are how the organisation measures whether that ceiling is being met. The exam tests whether you understand these as connected levers, not isolated definitions. A ticket that breaches SLA is a KPI event; a queue that is not managed by priority creates SLA risk. Time management sits in the same cluster: a technician who handles tickets in arrival order rather than priority order is failing a measurable standard, and the exam is interested in that distinction. Ticketing systems are the record of all of this, and the exam expects you to know what a good ticket entry looks like: it captures what was reported, what was tried, and what happened, in enough detail that a different technician can pick up the work without calling the user again.

– Writing documentation that actually works

The exam tests documentation at two levels. The first is completeness: a useful ticket entry records the problem description, every troubleshooting step in sequence, and the result of each step. Missing any of those three makes the record useless for the next interaction. The second level is future utility. Documentation written for the moment reads differently from documentation written so that someone unfamiliar with the case can understand it six months later. The exam scenario will often give you a description and ask you to judge whether it meets that standard. Vague language, missing results, or steps recorded without outcomes are all failure modes the exam surfaces. Clarity and factual precision are the two qualities the exam rewards consistently in this sub-area.

– The problem-solving cycle

Cisco's structured troubleshooting process runs from defining the problem through gathering information, identifying a probable cause, planning a fix, implementing it, observing results, and looping back if the problem persists. The exam tests the order and the logic, not just the labels. Identifying a probable cause before gathering detailed information is a sequence error; implementing changes before devising a plan is another. The loop condition matters too: the process does not end at 'observe results'; it ends when the problem is confirmed resolved and the changes are documented. That final documentation step is frequently tested as the step candidates forget. Treating the cycle as a rigid checklist is closer to what the exam rewards than treating it as a rough guide.

How IT Support Job Tasks and Responsibilities is tested

Items in this topic tend to present a scenario, a technician action, and ask whether the action is correct or what should happen next. The demand is procedural: you need to know the right step in the right order, not just recognise that a step exists. The SLA and KPI sub-area produces items that reward understanding the relationship between the two, not the ability to recite definitions. Documentation items reward the ability to spot what is missing from a ticket entry. The problem-solving cycle is tested both in sequence and in isolation: you may be dropped into the middle of a scenario and asked what the technician should do next, which requires knowing where in the cycle the scenario sits. The most common mark-loss pattern is treating the cycle as flexible when the exam treats it as fixed, and treating documentation as optional when the exam treats it as mandatory. Candidates who have only skimmed this topic often miss the loop-back and final-documentation steps entirely.

From process discipline, the exam moves to physical and device-level knowledge. Hardware is one of the broadest topic areas on this exam: it spans safety, device identification, ports and cables, component installation, driver management, and fault investigation. The breadth is exactly where candidates lose marks. Knowing how to swap RAM is not enough if you cannot also identify an ESD risk, read a Device Manager error, or advise on e-waste disposal. Every sub-area has appeared as a scenario item.

– Safety and device identification

Electrical shock, electrostatic discharge, fire risk, and personal safety are not background knowledge on this exam. They appear as scenario items where you must identify the correct precaution or the mistake a technician made. ESD in particular is tested in the context of component handling, so knowing when and why to use an anti-static wrist strap matters. On the device identification side, the exam expects you to help a user locate specific system facts: hostname, processor type, RAM, disk space, OS version, IPv4 and IPv6 addresses, and MAC address. The tools differ by platform. On Windows, Task Manager, System Information, Event Viewer, and ipconfig each surface different data. On macOS, Activity Monitor, About This Mac, System Settings, Console, and ifconfig cover the same ground differently. The exam tests which tool surfaces which fact, not just that the tools exist.

– Ports, cables, and converters

The port and cable sub-area is heavily visual in practice, but on a written exam it becomes a matching and identification problem. Video ports span HDMI, USB-C used for video output, DVI, DisplayPort, and VGA. USB comes in A, B, C, and Micro variants, each with a distinct physical form and use case. Serial ports appear in legacy device contexts. RJ-45 with UTP or STP is the standard wired network connector. Power cables differ meaningfully between desktop, laptop, and mobile devices. Thunderbolt 3 and 4 both use the USB-C physical connector but carry different capabilities, and that distinction is a reliable exam trap. Converters matter because a user connecting a DisplayPort source to an HDMI display needs the right adapter, and the exam will ask you to identify what is needed. Knowing which connector is which, and what it can and cannot do, is the minimum standard.

– Component installation and driver management

The exam expects you to identify the processor and motherboard, and to know the practical steps for installing or upgrading RAM, graphics cards, wireless cards, Bluetooth cards, and internal storage. Storage types matter: SATA, SSD, NVMe, and M.2 each have different interfaces and slot requirements. Expansion card compatibility with the motherboard's available slots is a scenario topic. Device Manager is the primary Windows tool for driver management, and the exam tests both installing drivers through it and using it to identify which device has a problem. The yellow warning indicator in Device Manager is the most commonly tested status signal. E-waste disposal rounds out this group: the exam expects awareness of responsible disposal practices for components, particularly those containing hazardous materials.

– Hardware troubleshooting

Basic troubleshooting starts at the obvious end: is the device plugged in, connected to power, and switched on. The exam tests this because candidates who jump to complex causes without checking the basics fail scenario items. Application compatibility requirements introduce a second layer: processor architecture, RAM minimums, GPU requirements, and disk space all determine whether software will run on a given machine. Device Manager is tested again here, this time for reading error codes and device status. Firmware updates appear as an awareness item: the exam expects you to know that firmware updates can resolve hardware issues but also carry risk if interrupted or applied incorrectly. The balance between benefit and danger is the testable point, not the update procedure itself.

How Hardware Issues is tested

This topic produces more scenario items than any other on the exam. A user reports a symptom, and you must identify the likely cause, the correct tool, or the next step. The item style rewards systematic thinking: ruling out power and connection first, then moving to driver and compatibility checks, then to hardware fault. Jumping to a complex cause when a simple one fits the symptom is the most common trap. Port and cable items reward precise knowledge of physical connectors, particularly the Thunderbolt-versus-USB-C distinction and the difference between video output standards. Device Manager items reward knowing what each status indicator means and which action it calls for. Firmware items reward caution: the exam favours the option that acknowledges risk over the one that treats updating as automatically safe. Candidates who have memorised tool names without knowing which data each tool surfaces consistently lose marks on the platform-specific identification items.

Hardware faults are usually visible. Connectivity problems often are not, and that invisibility is what makes this topic demanding. The exam expects you to move between two distinct skill sets: helping users access network resources through directory services and permissions, and diagnosing the lower-level network conditions that prevent connectivity in the first place. Candidates who are strong on one side and weak on the other will find the scenario items here harder than expected, because many of them combine both.

– Directory services, authentication, and access rights

Active Directory remains the dominant on-premises directory service, and the exam tests it alongside cloud-based equivalents: Microsoft Entra ID and AWS IAM. The practical actions matter more than the architecture: resetting passwords, checking security and distribution group membership, verifying permissions, and mapping shared drives are all tested as technician tasks. SMB is the protocol behind Windows shared drive mapping; the exam also covers cloud storage mapping for OneDrive, Google Drive, Dropbox, Box, and S3 buckets. Gpupdate and adgpupdate force a group policy refresh and are tested as the correct tool when a user's policy-dependent settings are not applying. Multifactor authentication appears as an access troubleshooting item: when a user cannot authenticate, knowing whether the issue is the password, the MFA method, or the account state determines the next step.

– Peripheral connectivity

Printers generate the most scenario items in this group. The exam covers connectivity to the printer, helping a user operate a multifunction device, loading paper, clearing a paper jam, clearing the print queue, and swapping toner. Each of those is a distinct task with a distinct correct action. Beyond printers, the exam covers headphones, microphones, external drives, scanners, webcams, wired and wireless keyboards and mice, flat-panel touch input devices, and teleconferencing hardware such as the Webex Desk Pro. The pattern across all of these is the same: start with physical connection, then driver or pairing state, then device settings. The exam rewards that order. Candidates who jump to reinstalling drivers before checking whether the device is recognised at all lose marks consistently.

– IP addressing and network fundamentals

DNS, DHCP, and default gateway are tested as functional concepts, not protocol internals. The exam expects you to know what breaks when each one fails. A self-assigned APIPA address (169.254.x.x) tells you DHCP is not responding. A link-local IPv6 address where a global address is expected tells you DHCPv6 or SLAAC is not completing. Public versus private IP ranges matter for determining whether a device is correctly addressed for its network segment. WLAN SSID identification is tested in the context of a user connected to the wrong network. Firewall awareness is a conceptual item: the exam expects you to recognise that a firewall can block legitimate traffic and that ruling it out is part of connectivity investigation, without expecting you to configure one.

– Diagnostic commands

The command-line tools are tested by name, by platform, and by what they reveal. Ipconfig (Windows) and ifconfig (macOS/Linux) show address configuration. Ping tests reachability to a specific host. Traceroute and tracert show the path to a destination and where it fails. Nslookup tests DNS resolution. Netstat shows active connections and listening ports. Ping6 and traceroute6 are the IPv6 equivalents of their IPv4 counterparts. The iproute2 suite, specifically 'ip addr' and 'ss', replaces ifconfig and netstat on modern Linux systems. The exam tests which command you reach for given a specific symptom: a name resolution failure calls for nslookup, not ping; a routing problem calls for traceroute, not ipconfig. Picking the wrong tool for the symptom is the most reliable way to lose marks in this sub-area.

How Connectivity and Resource Access Issues is tested

Scenario items here typically give you a user symptom and a set of observed facts, then ask what is wrong or what to check next. The access rights items reward working through the logical chain: is the account active, does it have the right group membership, do the permissions on the resource match what the group allows. Skipping a step in that chain is the trap. Network items reward matching the symptom to the correct diagnostic layer: address configuration first, then reachability, then name resolution, then application-layer access. Peripheral items reward the physical-before-logical sequence. The command-line items are often the most precise: the exam will describe a specific symptom and reward the candidate who selects the tool that directly addresses it. Knowing that ping tests reachability but does not test name resolution, for example, changes which tool fits a DNS failure scenario. Candidates who know the commands by name but not by purpose consistently lose marks here.

Connectivity problems sit at the network layer. This topic moves up to the OS and application layer, where the same symptom can have a different cause depending on whether the device runs Windows, macOS, iOS, or Android. The exam also folds in cloud, virtualisation, and application installation, which means the scope here is wider than the topic name suggests. Candidates who prepare only for one platform and skim the others will find the multi-platform scenario items costly.

– Windows OS support tasks

Display settings and multi-monitor configuration are practical help desk tasks the exam treats as testable procedures. BitLocker recovery codes appear as an access scenario: a user cannot boot because BitLocker is prompting for a key, and the technician needs to know what that key is and where it comes from. Windows Update and application update management, clearing the browser cache, and terminating unresponsive processes with Task Manager are all tested as discrete actions. Boot sequence and safe mode entry matter for diagnosing startup failures. Power management settings affect both desktop and laptop behaviour and appear in battery and sleep-related scenarios. OneDrive backup and restore is tested as a practical user assistance task. Accessibility features appear as an awareness item: the exam expects you to know they exist and that a user may need them enabled, not that you configure every option.

– macOS support tasks

The macOS items parallel the Windows ones but with platform-specific tools and behaviours. Allowing applications the necessary permissions is a common macOS support task because the OS is more restrictive by default than Windows, and users frequently encounter permission prompts they do not understand. Mounting external drives is a discrete task. AirDrop troubleshooting appears as a connectivity-adjacent item. Terminating unresponsive processes uses Activity Monitor rather than Task Manager. Cloud backup on macOS splits between iCloud for file-level backup and Time Machine for full system backup; the exam tests knowing which tool fits which recovery scenario. The key failure mode for candidates here is defaulting to Windows procedures when the scenario specifies macOS.

– Mobile devices, virtualisation, and cloud

Mobile device support covers the most common user-facing issues: restart procedures, charging failures, connectivity problems, email account setup, mobile app behaviour, collaboration software, and a basic understanding of mobile device management (MDM). Both iOS and Android are in scope. The virtualisation and cloud sub-area is conceptual rather than procedural: the exam expects you to recognise the major cloud providers (AWS, Azure, GCP), understand what a virtual machine and a hypervisor are at a functional level, and identify cloud service models well enough to route an incident to the right team. The routing decision is the testable point. You are not expected to administer any of these platforms, but you are expected to know which team owns a cloud-infrastructure problem versus an end-user application problem.

– Application installation and common app issues

Application installation is tested through the lens of trust and policy. Installing from an approved marketplace or an organisation's approved source is the safe path; installing from untrusted or unknown sources carries security risk, and the exam tests whether you recognise that distinction. Email, collaboration tools, and productivity applications generate the majority of application support tickets in practice, and the exam reflects that. Common failure modes include misconfigured account settings, permission issues, and version incompatibility. The exam expects you to assist users with these applications without necessarily having deep expertise in each one, which means the tested skill is systematic troubleshooting rather than application-specific knowledge.

How Operating System and Application issues is tested

Items in this topic frequently specify a platform, then describe a symptom. The demand is to identify the correct OS-specific tool or procedure. Answering with a Windows tool when the scenario specifies macOS, or vice versa, is a direct mark loss. BitLocker and safe mode items reward knowing the sequence of steps, not just that the feature exists. The cloud and virtualisation items reward the routing decision: recognising which type of issue belongs to which team is the exam's practical test of that knowledge. Mobile items are typically straightforward but reward the correct order of operations: restart before deeper investigation, verify connectivity before assuming an app is broken. Application installation items reward the security-aware choice: the option that follows approved channels wins over the option that resolves the problem faster through an untrusted source. Candidates who treat the cloud sub-area as peripheral and skip it often lose marks on incident-routing scenarios.

After four topics built around fixing things, this one is about recognising danger and not making it worse. The exam does not expect you to be a security analyst, but it does expect you to know which threats a front-line technician encounters, how to respond without escalating the risk, and how company policy protects both the user and the organisation. The trap here is overconfidence: candidates who work in IT often assume they know this material and do not prepare it carefully enough.

How Common Threats and Preventions is tested

Security items on this exam are scenario-based and test the first-responder decision, not deep security engineering. A user reports a suspicious email: the item rewards the action that contains the situation without introducing new risk. A caller claims to be from IT and asks for credentials: the item rewards the response that follows policy rather than the one that resolves the call fastest. Social engineering items reward scepticism and process adherence over helpfulness. The help desk technician as a target is a specific concept the exam tests: you need to recognise that a request for access or information directed at you personally may be an attack, not a routine call. Password items reward understanding of what makes a password strong and why reuse is dangerous, not the ability to recite a complexity rule. PII and confidentiality items reward knowing what counts as sensitive data and what the correct handling procedure is. Candidates who treat this topic as common sense rather than studied knowledge lose marks on the social engineering and data classification items.

The final topic covers the tools a technician uses to do the job remotely and to research problems they cannot immediately solve. Remote access software and AI-assisted research are the two main areas. Neither is purely technical: the exam tests judgment about when and how to use these tools, not just the ability to name them. After five topics on what to fix and how to fix it, this one asks whether you are using the right instrument for the investigation.

How Job Tools is tested

Remote access items test tool recognition and appropriate use. The exam expects you to know the difference between tools like Remote Desktop, Remote Assistance, TeamViewer, VNC, and Webex in terms of what each is suited for, not to configure them from scratch. Choosing the wrong tool for the support scenario is the typical mark-loss pattern. AI research items are more nuanced: the exam tests awareness of what AI can and cannot reliably do, the ethical considerations around using it, and the privacy and security risks of inputting sensitive information into an AI query. The distinction between predictive and generative AI is a conceptual item, not a deep technical one, but candidates who have not prepared it will guess. Knowledge base and forum items reward knowing when to consult an internal article versus an external technical forum, and how to evaluate the reliability of what you find. The exam rewards methodical source selection over speed.