A business analyst is writing requirements for a new online store.
Which requirement is non-functional?
Users can reset their password by following a link sent to their email address.
Search results return within 2 seconds for 95% of requests at peak load.
The system generates a PDF invoice for every completed order at month end.
Administrators can export the full list of active users as a CSV file on demand.
B
A response-time target under load describes how well the system performs, which makes it a non-functional (quality) requirement. The other three describe specific behaviors the system must provide, so they are functional requirements.
IT Project Management Fundamentals
25
Select One
A company sells a closed-source desktop application to customers. It wants to include a third-party library, must not be required to release its own source code, and wants the fewest license obligations among the options.
Under which license should the library be provided?
MIT License
GNU General Public License v3
GNU Affero General Public License v3
No license file; the code is publicly visible on GitHub
A
The MIT License is permissive. It allows use in closed-source products, and the main obligation is to keep the copyright and license notice. GPLv3 is a strong copyleft license: distributing a combined work triggers source-sharing obligations. AGPLv3 adds obligations even for use over a network, and code with no license is all rights reserved, so there is no permission to use it at all.
IT Project Management Fundamentals
24
Select One
Every change merged into a team's main branch is automatically built, tested, and deployed to a staging environment. Deployment to production happens only after a release manager approves the release.
Which practice does this describe?
Continuous deployment
Continuous integration only
Continuous delivery
Infrastructure as code
C
Continuous delivery keeps every change built, tested, and deployable, and a person approves the production release. Continuous deployment releases to production automatically with no manual gate, continuous integration alone stops at build and test while this pipeline also deploys to staging, and infrastructure as code describes managing infrastructure through code, not a release practice.
DevOps Fundamentals
23
Select One
A team is moving an application from virtual machines to containers.
Which TWO statements about containers are correct?
Each container runs its own guest operating system kernel on top of the host.
All containers on a host share the kernel of that host's operating system.
Files written to a container's writable layer remain after the container is removed.
Unchanged image layers can be cached and reused by later builds and pulls.
B
Containers are isolated processes that share the host kernel, which makes them lighter than VMs, and images are built from layers whose unchanged layers are cached and reused. A separate guest kernel per instance describes virtual machines, and a container's writable layer is deleted along with the container, so persistent data belongs in volumes.
DevOps Fundamentals
22
Select Two
D
A developer made a commit on the local main branch but has not pushed it. The developer wants to undo that commit while keeping all of its changes staged, so they can be corrected and committed again.
Which command should the developer run?
git revert --no-edit HEAD
git reset --hard HEAD~1
git checkout HEAD~1
git reset --soft HEAD~1
D
git reset --soft HEAD~1 moves the branch back one commit and leaves that commit's changes staged. The --hard option discards the changes entirely, git revert adds a new commit that undoes the old one so both remain in history, and git checkout HEAD~1 detaches HEAD while the commit stays on main.
DevOps Fundamentals
21
Select One
A privately held online retailer based in the United States sells only to US customers and accepts credit card payments directly on its own website.
Which standard specifically governs how the retailer must protect cardholder data?
Health Insurance Portability and Accountability Act (HIPAA)
Payment Card Industry Data Security Standard (PCI DSS)
General Data Protection Regulation (GDPR)
Sarbanes-Oxley Act (SOX)
B
PCI DSS applies to any organization that stores, processes, or transmits payment card data. HIPAA covers protected health information, GDPR covers personal data of people in the EU and this retailer serves only US customers, and SOX governs financial reporting controls at public companies while this retailer is privately held.
Security Fundamentals
20
Select One
An attacker stole an employee's password through a phishing email, signed in to the company's cloud console, and accessed data far outside that employee's job duties.
Which TWO controls would most reduce the likelihood and impact of this kind of incident?
Require multi-factor authentication for all console and VPN sign-ins.
Require password changes every 30 days with strict composition rules.
Give each team one shared administrator account that is easier to audit.
Grant each user only the permissions that their job role requires.
A
Multi-factor authentication stops a stolen password from being enough to sign in, and least privilege limits what a compromised account can reach. Forced periodic password changes are no longer recommended by NIST SP 800-63B and would not stop a freshly phished password anyway, and shared accounts destroy individual accountability.
Security Fundamentals
19
Select Two
D
A web application must store user passwords so that users can sign in. If the database is ever leaked, attackers must not be able to recover the passwords easily.
How should the application store the passwords?
Store a salted hash produced by a slow password-hashing algorithm such as bcrypt.
Encrypt each password with AES and store the encryption key in the same database.
Store an unsalted MD5 hash of each password so that login comparisons stay fast.
Encode each password with Base64 so that it is never stored as readable text.
A
A unique salt per password defeats precomputed tables, and a deliberately slow algorithm such as bcrypt, scrypt, or Argon2 makes brute force expensive. AES encryption is reversible, and a key stored in the same database leaks along with it. Unsalted MD5 is fast to brute force and open to rainbow tables, and Base64 is an encoding, not protection.
Security Fundamentals
18
Select One
An internet-facing Linux server's authentication log shows thousands of failed SSH password attempts per hour from many addresses. Administrators sign in with personal accounts and passwords.
Which change most effectively protects the server against these attempts?
Move the SSH daemon to a nonstandard port such as 2222 to hide it from scanners.
Set PermitRootLogin no and keep password authentication for personal accounts.
Require key-based authentication and set PasswordAuthentication no for sshd.
Increase MaxAuthTries so legitimate users are not locked out during the attacks.
C
With password authentication disabled, password guessing cannot succeed, because only holders of an authorized private key can sign in. A nonstandard port reduces log noise but is not a control, disabling root login still leaves the personal accounts open to guessing, and a higher MaxAuthTries gives attackers more guesses per connection. Tools such as fail2ban are a useful extra layer.
Security Fundamentals
17
Select One
A company runs its applications on virtual machines from an Infrastructure as a Service (IaaS) provider.
Under the shared responsibility model, which task is the company's responsibility?
Patching the hypervisor that runs the virtual machines
Patching the guest OS on the virtual machines
Replacing failed disks in the provider's storage hardware
Controlling physical access to the provider's data centers
B
In IaaS, the customer manages everything from the guest operating system up: OS patches, applications, data, and access configuration. The provider is responsible for the hypervisor, the physical hardware, and data center security.
Cloud Computing Fundamentals
16
Select One
A two-tier application runs in a cloud virtual network. The web servers must be reachable from the internet. The database server must never be reachable from the internet, but it must download operating system updates from public repositories.
How should the database server be placed?
Place the database in a public subnet and allow only the web tier in its security group.
Place the database in a private subnet whose route table has no internet route at all.
Give the database a public IP address and block all inbound traffic in its host firewall.
Place the database in a private subnet with outbound access through a NAT gateway.
D
A private subnet gives the database no inbound path from the internet, and a NAT gateway allows outbound connections, such as downloading updates, without accepting unsolicited inbound connections. A public subnet routes through an internet gateway and leaves protection to security-group rules alone, a public IP address makes the server internet-addressable even behind a host firewall, and a subnet with no internet route blocks the updates.
Cloud Computing Fundamentals
15
Select One
A company runs a web workload that uses the same amount of compute 24 hours a day and is expected to stay that way for three years. It also runs nightly batch jobs that can be safely restarted if they are interrupted. All workloads currently run on on-demand instances.
Which TWO changes reduce costs the most for these workloads?
Cover the steady baseline with reserved capacity or a savings plan commitment.
Run the restartable nightly batch jobs on spot or preemptible instances.
Move the baseline workload onto dedicated hosts to get predictable pricing.
Double the batch instance size so that the jobs finish sooner and stop earlier.
A
A steady, three-year baseline suits committed-use pricing such as reserved instances or savings plans, which cost much less than on-demand. Spot or preemptible capacity is the cheapest option for work that can be restarted after an interruption. Dedicated hosts usually cost more and are chosen for licensing or isolation needs, and doubling instance size roughly doubles the hourly rate, so finishing in half the time gives little or no saving.
Cloud Computing Fundamentals
14
Select Two
B
An application runs on several cloud instances in a single availability zone. The business requires the application to stay available if that entire availability zone fails.
What should the team do?
Run instances in two or more availability zones behind a load balancer.
Move the application to a larger instance type with more CPU and memory.
Add more instances in the current availability zone behind a load balancer.
Take nightly backups and copy them to object storage in another region.
A
Spreading instances across availability zones behind a load balancer keeps the service running when one zone fails. A larger instance or more instances in the same zone still share that zone's failure. Cross-region backups support disaster recovery, but restoring takes time, so they do not keep the application available during the outage.
Cloud Computing Fundamentals
13
Select One
A startup wants to deploy its own web application code to the cloud. It does not want to install or patch operating systems, manage language runtimes, or administer the underlying servers.
Which cloud service model fits these requirements?
Infrastructure as a Service (IaaS)
Software as a Service (SaaS)
Platform as a Service (PaaS)
On-premises server virtualization
C
With PaaS, the provider runs the operating system, runtime, and servers, and the customer deploys application code. IaaS leaves OS patching to the customer, SaaS delivers a finished application with no custom code deployment, and on-premises virtualization keeps everything self-managed.
Cloud Computing Fundamentals
12
Select One
A team manages 50 Linux servers. Configuration changes are applied by hand, and the servers have drifted apart. The team needs changes to be applied consistently and repeatably, with a record of who changed what and when.
Which TWO practices should the team adopt?
Document each change on a shared wiki page, then apply it over SSH on every server.
Define the desired configuration in a configuration management tool such as Ansible.
Give every administrator root access so that changes can be applied without delay.
Keep the configuration definitions in Git so every change is reviewed and logged.
B
A configuration management tool applies the same declared state to every server, and repeated runs correct drift. Keeping the definitions in Git adds review and a history of who changed what and when. A wiki plus manual SSH is still hand-applied and drifts, and broad root access weakens control and accountability.
System Administration Fundamentals
11
Select Two
D
A custom service, myapp.service, failed during the current boot. The server uses systemd-journald for logging and does not run a separate syslog daemon.
Which command shows this service's log messages from the current boot?
dmesg | grep myapp
journalctl -u myapp.service -b
systemctl list-units --state=failed
tail -n 100 /var/log/messages
B
journalctl -u myapp.service -b filters the journal to that unit and the current boot. dmesg shows only the kernel ring buffer, and systemctl list-units --state=failed lists failed units without their logs. /var/log/messages is written by a syslog daemon, and this server has none.
System Administration Fundamentals
10
Select One
User alice already exists and belongs to the groups alice, wheel, and dev. She must also be able to run Docker commands, which requires membership in the docker group. Her existing group memberships must not change.
Which command should the administrator run?
usermod -G docker alice
useradd -m -G docker alice
chgrp docker alice
usermod -aG docker alice
D
usermod -aG appends a supplementary group. Without -a, -G replaces the whole list, which would remove wheel and dev. useradd fails because the user already exists, and chgrp changes a file's group, not a user's membership. The new membership takes effect at alice's next login.
System Administration Fundamentals
9
Select One
Ransomware encrypted a company's file server and the backup disk permanently attached to it, and the company could not recover its data. The company had also never tested restoring a backup.
Which TWO practices should the administrator adopt so that future incidents can be recovered from reliably?
Keep at least one backup copy offline or immutable, in a separate location.
Replace the attached backup disk with a RAID 1 mirror of the file server's data volume.
Take hourly snapshots and store them on the same volume as the file server's data.
Schedule regular test restores and verify that the restored data is complete.
A
An offline, immutable, or off-site copy (the 1 in the 3-2-1 rule) is out of reach of ransomware running on the server, and regular test restores prove the backups can actually be recovered. RAID 1 mirrors the encryption instantly, so it is redundancy, not backup, and snapshots on the same volume are lost or encrypted along with it.
System Administration Fundamentals
8
Select Two
D
An administrator deleted a 40 GB application log file under /var to free space. The application that writes the log is still running. df still reports the filesystem as 100% full, while du reports far less space in use.
What should the administrator do to free the space?
Use lsof +L1 to find the process holding the deleted log open, then restart it.
Delete older files in /tmp and /var/tmp until df reports free space on the filesystem.
Run fsck on the mounted filesystem so that the orphaned data blocks are reclaimed.
Recreate the filesystem with more inodes, because the inode table has been exhausted.
A
Deleting a file removes its name, but the disk blocks are freed only after the last process closes it. lsof +L1 lists open files whose link count is below 1, which identifies the process. Restarting it (or truncating the file through /proc/PID/fd) releases the space. Deleting other files does not touch the 40 GB, and fsck must not run on a mounted filesystem. Inode exhaustion would show in df -i, and recreating the filesystem destroys its data. To avoid this, truncate active logs or rotate them with logrotate instead of deleting them.
System Administration Fundamentals
7
Select One
A network team assigns the subnet 192.168.10.0/26 to a lab.
How many usable host addresses does this subnet provide?
64
30
62
126
C
A /26 leaves 6 host bits, giving 2^6 = 64 addresses. Subtracting the network address and the broadcast address leaves 62 usable hosts. A total of 30 usable hosts corresponds to a /27, and 126 to a /25.
System Administration Fundamentals
6
Select One
A newly built Linux server can run ping 8.8.8.8 successfully and can reach hosts on other networks by IP address. However, ping example.com fails with "Temporary failure in name resolution."
What is the most likely cause?
The routing table has no default gateway for traffic leaving the local subnet.
The resolver configured in /etc/resolv.conf is missing or unreachable.
A firewall rule on the host is blocking outbound ICMP echo request packets.
The network interface is configured with an incorrect subnet mask value.
B
Pinging an IP address on another network proves the gateway, routing, subnet mask, and ICMP all work. The failure starts only when a name must be resolved, which points to the DNS resolver configuration. On systemd-resolved hosts, /etc/resolv.conf points to a local stub resolver, whose upstream servers are checked with resolvectl status.
System Administration Fundamentals
5
Select One
An administrator has installed a systemd unit file for a new service named backupd. The service is currently stopped and is not enabled. It must start immediately and also start automatically at every boot.
Which single command accomplishes both?
systemctl start backupd
systemctl enable backupd
systemctl daemon-reload && systemctl restart backupd
systemctl enable --now backupd
D
systemctl enable --now creates the boot-time links and starts the unit in a single command. The start command affects only the current boot, and enable alone takes effect only at the next boot. daemon-reload rereads unit files, and restart starts the service now, but neither enables it at boot.
Linux Fundamentals
4
Select One
A web application fails to start because TCP port 8080 is already in use. Working as root, an administrator needs to identify which process is listening on that port.
Which TWO commands display this information?
netstat -rn
ss -tlnp | grep ':8080'
ps -ef | grep -w 8080 | grep -v grep
lsof -iTCP:8080 -sTCP:LISTEN
B
ss -tlnp lists listening TCP sockets with numeric ports and the owning process, and lsof -iTCP:8080 -sTCP:LISTEN shows the process listening on that port. netstat -rn prints the routing table, and ps piped to grep 8080 matches only processes whose command line contains the text 8080, which a listener's often does not.
Linux Fundamentals
3
Select Two
D
An administrator runs a script, ./report.sh, from cron. Both its normal output and its error messages must be written to run.log, replacing the file's previous contents on each run.
Which command line meets this requirement?
./report.sh > run.log 2>&1
./report.sh 2>&1 > run.log
./report.sh > run.log 2> run.log
./report.sh | tee run.log
A
Redirections are processed left to right. > run.log points stdout at the file, then 2>&1 points stderr at the same place. In the second option, stderr is copied to the original stdout before stdout moves, so errors still go to the terminal or cron mail. In the third, the file is opened twice with separate offsets, so the two streams overwrite each other, and a pipe to tee captures only stdout.
Linux Fundamentals
2
Select One
A shared directory, /srv/projects, is owned by root and the group devs. Members of devs must be able to create and edit files in it, and new files must automatically belong to the devs group. Users must not be able to delete or rename files owned by other users. Other users need no access.
Which command sets the required permissions?
chmod 1770 /srv/projects
chmod 4770 /srv/projects
chmod 3770 /srv/projects
chmod 2770 /srv/projects
C
The mode 3770 combines setgid (2) and the sticky bit (1) with rwx for owner and group. On a directory, setgid makes new files inherit the directory's group, and the sticky bit allows only a file's owner, the directory's owner, or root to delete or rename it. Mode 1770 sets only the sticky bit, and 2770 sets only setgid. Mode 4770 sets setuid, which Linux ignores on directories.
Linux Fundamentals
1
Select One
.png)
.svg)
