All jobs / IT support / sysadmin

Endpoint Management interview questions

Endpoint Management questions a IT support / sysadmin can be asked, from first job to senior. Open one to see the strongest answer and why it works.

  1. A manager asks what actually changes when a laptop is enrolled in device management. What do you tell them?

    The strongest answer: We can push the settings and applications the company requires, see whether the device still meets them, and remove company data if it is lost — and we cannot see their personal browsing or their photos

    Why it works: Exactly. Saying plainly what it does not do is what gets enrolment accepted instead of quietly avoided.

    • Say what it does and does not do.
    • Settings, applications, compliance state.
    • Company data can be removed remotely.
    • Personal content is not visible.

  2. An app needs a privileged action on 30 laptops. Better pattern?

    The strongest answer: A managed install, a privileged helper, or a group that the app actually needs — not local admin on 30 pets

    Why it works: Exactly. Package the privilege. Wikis of admin passwords are a museum of regret.

    • Package the privileged action.
    • No shared local-admin secrets.
    • No Domain Admin for an app.
    • Do not rely on a walk-up ritual.

  3. Monthly patches are due. How do you roll them?

    The strongest answer: A pilot ring, then more, with a rollback you have practised — not “all workstations at 09:00 Monday”

    Why it works: Exactly. Rings and a way back. Fairness is not a blast.

    • Pilot, then expand.
    • Practise rollback.
    • Do not blast Monday 09:00.
    • Do not skip patches forever.

  4. A kiosk has been hand-tuned for two years. What do you want instead?

    The strongest answer: A rebuildable image and a written config — pets die on annual leave

    Why it works: Exactly. Rebuild beats folklore. Handbooks of tweaks still need the person.

    • Rebuildable image + written config.
    • Hand-tunes are pets.
    • A second pet is not a plan.
    • Do not freeze a pet as “stable.”

  5. A user wants you to remove the MDM profile “just for a week.” What do you do?

    The strongest answer: Find the blocked thing and fix the policy or the exception path — I do not take the device off management to be nice

    Why it works: Exactly. MDM is the deal for that device. Niceness without management is a lost laptop story.

    • Fix policy or a written exception.
    • Do not lift MDM to be nice.
    • Do not teach the bypass.
    • Do not unmanage personal devices as a pair.

  6. How do you talk about patching a mixed Windows/Linux fleet without fake compliance %?

    The strongest answer: By ring, deadline, exception, and who can grant one — I do not quote a pretty percentage I cannot defend

    Why it works: Exactly. A policy you can operate. Invented percentages are how boards get surprised.

    • Rings, deadlines, named exceptions.
    • No undefended %.
    • Do not wait for tweets.
    • Do not exempt “prod-looking” PCs.

  7. Staff are signing in to company mail and files from personal laptops at home. Files are leaving the managed fleet and nobody can say where they have gone.

    What do you put in place?

    The strongest answer: Make access conditional on the device being managed and meeting a policy — encryption, patch level, screen lock — with the browser without downloads for personal devices. The rule belongs at sign-in, not in a handbook

    Why it works: Right — a rule enforced at sign-in is the only one that holds, and the browser-without-downloads path is what makes it liveable.

    • Enforce the rule at sign-in.
    • Require managed and compliant devices.
    • Give personal devices a safe path.
    • Handbooks are not controls.