Step 3 — Test the Theory to Determine the Cause

Once you have a working hypothesis, validate it. The goal is to prove that the suspected cause actually explains the symptoms—or to eliminate it and move to the next theory.

Execute Controlled Tests

• Start with reversible checks. Swap cables, reboot services, or apply configuration changes you can easily roll back.
• Gather metrics as you test. Monitor logs, interface counters, or application dashboards to see how the system responds.
• Keep a change log. Note the time, action taken, and result so you can undo or escalate with confidence.

Interpret the Results

• Theory confirmed: You have evidence that the change resolved the issue or reproduced the failure. Proceed to Step 4 to plan the fix.
• Theory disproved: Document the outcome, revert any temporary changes, and return to Step 2 to form a new hypothesis.

Know When to Escalate

• Skill or authority limits: If the resolution requires access you do not have (e.g., modifying Group Policy, changing firewall rules, or purchasing expensive hardware), escalate to the appropriate team.
• Risk considerations: Stop and escalate if further testing could jeopardize production systems or violate change-control policy.
• Communicate clearly: Provide the work performed, evidence gathered, and recommended next steps when you hand off the case.

---

✅ Exam Must-Knows

• Step 3 is about confirmation: prove or disprove your theory.
• If you cannot confirm the cause, loop back and develop a new theory.
• Escalate when the fix is outside your authority, requires specialized skills, or impacts critical infrastructure.

⚡ Memory Hook: Test → Confirm, Reject, or Escalate.