2nd Line Support Engineer Interview Questions UK: 8 Real Questions and What Interviewers Want

Most 2nd Line Support Engineer interviews in the UK follow a pattern, and knowing it beats guessing. Below are eight questions from our bank of 16, each with a note on what the interviewer is really after.

Eight 2nd Line Support Engineer interview questions, and what the interviewer is thinking

1. A user's Active Directory account keeps locking out throughout the day. How do you find the cause?

Why they ask: Tests practical second-line diagnostic skill on one of the most common recurring tickets.

2. A user says Outlook is not sending or receiving emails, but their colleagues are fine. How would you troubleshoot it?

Why they ask: Checks knowledge of Exchange Online and Outlook client troubleshooting.

3. A remote user cannot connect to the company VPN. What do you check, and in what order?

Why they ask: Examines structured troubleshooting for a very common second-line escalation.

4. A laptop has become very slow and the user says it started this week. How would you diagnose and fix it?

Why they ask: Looks for a methodical approach to a classic performance fault.

5. A user is prompted for MFA repeatedly, or is blocked from signing in to Microsoft 365 with a conditional access message. How would you investigate?

Why they ask: Tests understanding of Entra ID sign-ins and identity troubleshooting.

6. A Windows update has broken a line-of-business application on around thirty machines. What do you do?

Why they ask: Tests incident handling, scope assessment and safe remediation.

7. Tell me about a time you solved a difficult technical problem that first line could not resolve.

Why they ask: Assesses depth of troubleshooting and persistence at second-line level.

8. What does a 2nd Line Support Engineer do that is different from first line, and what does a typical day involve?

Why they ask: Checks understanding of the tier and realistic expectations of the work.

A sample answer to question 1

A user's Active Directory account keeps locking out throughout the day. How do you find the cause?

Repeated lockouts usually mean something is still using an old password. First I would unlock the account and check the lockout details in Active Directory, then find the source of the bad attempts. On the PDC emulator I look at the Security log for Event ID 4740, which names the calling computer. Microsoft's LockoutStatus tool also shows which domain controller recorded the failures. Once I know the source machine, I look for the usual culprits: a mobile phone or tablet with a saved mailbox password, a mapped drive or scheduled task using stored credentials, a service running under the user's account, a disconnected remote desktop session or old cached credentials in Credential Manager. I remove or update them, and ask the user to reconnect devices with the new password. If it is a brute-force attempt from an external address, I would escalate it to security. After resolving it I would explain to the user how to avoid it happening again.

Common mistake to avoid: Just unlocking repeatedly; ignoring a possible brute-force attempt

Want the rest?

Full model answers, key points and common mistakes for all 16 questions are on the 2nd Line Support Engineer interview questions page. The first five are free, no sign-up needed.