Linux Foundation LFCS Exam Prep
Linux Foundation Certified System Administrator (Page 22 )

• Escape to host: A virtualization attack where code escapes a guest VM and accesses the host system. Nothing in the scenario mentions virtualization.
• Browser extension: Can redirect or manipulate web-browser traffic, but not normally database-server traffic.
• Valid accounts: Describes using stolen or compromised credentials, not redirecting network traffic.
• Process injection: Injecting malicious code into a legitimate database or networking process could allow an attacker to alter how that process handles outgoing traffic.

• O File Gateway fornece uma interface de compartilhamento de arquivos usando protocolos como SMB ou NFS.
• Os usuários continuam acessando os arquivos localmente, aproveitando a baixa latência e o cache local.
• Os dados são armazenados de forma durável no Amazon S3, enquanto os arquivos acessados com frequência permanecem em cache no ambiente local.
• Isso amplia a capacidade de armazenamento sem exigir a substituição completa da infraestrutura existente.

• A: Montar buckets S3 diretamente não oferece uma experiência de compartilhamento de arquivos local tão adequada.
• C: Amazon WorkSpaces fornece desktops virtuais, não é uma solução principal de armazenamento compartilhado.
• D: Um volume EBS pertence a uma instância EC2 e não deve ser compartilhado diretamente entre vários usuários como um sistema de arquivos comum.

• On VirtualNetworkA: enable Allow gateway transit.
• On VirtualNetworkB: enable Use remote gateways.

1. Install a Cassandra-compatible ODBC driver.
2. Configure a data source name (DSN), if required.
3. In Power BI Desktop, select Get Data > ODBC.
4. Choose the configured DSN and connect.

• Microsoft SQL Server database: Connects to SQL Server, not Cassandra.
• OLE DB: Requires a compatible OLE DB provider; this is not the standard choice for Cassandra in Power BI.
• OData: Requires Cassandra data to be exposed through an OData service, which is not the normal direct connection method.

• A — .gitignore: Controls Git tracking; it does not configure Copilot exclusions.
• B — copilot.ignore: This is not the standard GitHub Copilot Business exclusion mechanism.
• D — Renaming files: Adding _no_copilot has no recognized effect.

• Suspended an operator who refused to use unsafe equipment.
• Paid another operator a bonus for using it.
• Prioritised short-term productivity over employee safety.

• A — Management is not particularly concerned with managing risks.

• B — Employees will perceive that management does not care about health and safety risks.

• C — The factory’s safety record is likely to be poor.

• Reduce the training data: Usually makes overfitting worse.
• Add hyperparameters: Hyperparameters already control training; simply adding them does not solve the problem. Proper tuning could help, but that is not what the option states.
• Increase training time: More training can worsen overfitting if the model is already memorizing the training data.

• A script of cloud CLI commands: IaC because the commands can be saved, reviewed, versioned, and rerun consistently.
• Manually run curl commands: Not necessarily IaC; they are manual actions unless organized into an automated script.
• A sequence of REST requests passed to an API: Could represent automation, but the wording does not explicitly say they are stored and executed as reusable code.
• Commands entered into a cloud console: Manual operation, not IaC.

• A Screen Flow can present a form that inspectors complete and submit on an Experience Cloud page.
• It can collect inspection findings, validate the input, and create or update records.
• An Autolaunched Flow has no user interface, so it cannot directly provide the form.
• A Related List only displays related records, and Record Detail is primarily for viewing or editing an existing record—not for a custom inspection submission form.

• Identify the causes of delays.
• Improve its workflow and collaboration.
• Adjust tools or development practices.
• Discuss improvements during retrospectives and apply them in future sprints.

• A: An impediment log can help track issues, but merely maintaining one does not remove the impediments.
• B: Directing the team toward solutions reduces team ownership and self-organization.
• C: Adding impediments to the product backlog may be appropriate in some cases, but it does not automatically ensure they are addressed promptly.
• D: Best reflects agile leadership: empowerment, continuous improvement, and removal of impediments.

• /27 (255.255.255.224)

• /26 (255.255.255.192)

• /25: Creates only 2 subnets, not 3
• /28: Provides only 14 usable hosts per subnet

• B. Versioned configuration files — Infrastructure is defined in machine-readable files and tracked in version control, allowing repeatable provisioning and change history.
• D. Docker files — Assuming “Doctor files” is a typo for Dockerfiles, a Dockerfile declaratively defines how to build a container image and is commonly considered infrastructure/configuration as code.

• A. Cloned virtual machine images — These are prebuilt infrastructure artifacts, but cloning an image is not itself a code-based infrastructure definition.
• C. Change management database records — A CMDB records information about infrastructure; it does not define or provision that infrastructure.

• VPC: A logically isolated virtual network within a cloud provider; it describes network design, not the user-access model.
• NFV: Runs network services as software instead of on dedicated hardware.
• SaaS: Delivers software over the internet. Although the application may be delivered as SaaS, the question emphasizes its availability to multiple user groups, which points to multitenancy.

• AWS Network Firewall can inspect and block traffic across a VPC when traffic is routed through the firewall. A Drop action rule can deny traffic from the suspicious source IP.
• GuardDuty findings are sent to Security Hub.
• A Lambda function can be invoked when Security Hub receives a new GuardDuty finding, extract the source IP, and update the Network Firewall policy with a blocking rule.

• GuardDuty threat lists: Used to identify or increase the severity of findings; they do not directly block VPC traffic.
• AWS WAF: Protects supported web applications, such as CloudFront or Application Load Balancers. It does not provide general VPC-wide traffic blocking.
• GuardDuty suppression rules: Suppress or hide findings. They do not block the suspicious traffic.

• IDS attack signatures: Primarily detects suspicious network activity; it is not the best control for scanning uploaded documents.
• Load balancer: Distributes traffic and can improve availability, but does not inspect files for malware.
• WAF: Helps block web attacks such as command injection and SQL injection, but it is not primarily a malware-scanning solution.

• O dispositivo estar registado no Windows Autopilot;
• A atribuição de Profile1 ao grupo;
• O estado de associação ao Microsoft Entra ID e de inscrição no Intune/MDM.

• Employees can work from any location, including remote sites and offices worldwide.
• Login can be relatively seamless after the device is registered.
• It does not require distributing additional physical authentication equipment.

• Geotagging: Identifies location, but location alone is not a strong authentication method and may prevent legitimate remote access.
• Smart cards: Provide strong authentication but require card readers and physical cards, increasing equipment and management requirements.
• Time-based logins: Typically involve one-time codes that users must enter, making the experience less seamless and potentially requiring a token or authenticator app.

• Default route: 0.0.0.0/0; used only when no more specific route exists.
• Network route: A route covering the destination, such as 10.10.13.0/24.
• Host route: An exact 10.10.13.10/32 entry in the routing table.
• Floating static route: A backup static route with a higher administrative distance.

• 2018-12-31 — the date
• 08:59 — the time

• Changing the original column to Date may fail because it still contains the text at and a time.
• Extracting the last 11 characters does not isolate the date.
• Extracting the first 11 characters gets the date plus a space, but the option does not specify changing the result to the Date type.

• FUNCTION (D)
• SECURITY POLICY (E)

1. Create an inline table-valued filter predicate function. It defines which rows a user may see, often by comparing a table column with the current user identity.
2. Create a security policy that applies that function to Table1. The policy filters query results automatically.

• The JSON files contain one billion items, so this is a big-data workload.
• PySpark uses Apache Spark’s distributed, parallel processing, allowing the data to be processed across multiple compute nodes.
• It can read and transform data directly from OneLake, helping minimize unnecessary data movement or duplication.
• A Fabric notebook can also support exploration and visualization, as well as Spark-based analytics and anomaly-detection workflows.

• Pandas is primarily in-memory and generally suited to smaller datasets. One billion records would be impractical on a typical single machine.
• A Power BI report with core visuals is appropriate for visualization and sharing, but it is not the best tool for large-scale transformation, parallel processing, or anomaly detection. It would normally consume prepared data rather than perform the entire workload.

• Who owns security risks and decisions
• Who is responsible for implementing controls
• Who reports security performance to management
• How security responsibilities align with business objectives

• B — Compliance with audit requirements: Governance may support compliance, but audit compliance is not its main objective.
• C — Monitoring security incidents: This is an operational security activity, not the central purpose of governance.
• D — Creation of tactical solutions: Governance establishes direction and oversight; tactical solutions belong to management and operational teams.

1. Version 1.0.0.0 — original published version
2. Version 2.0.0.0 — newly created and published version
3. Version 3.0.0.0 — new version created when version 1 is restored

Manager role

DAX 
Country[Manager] = USERPRINCIPALNAME()

• Sales
• Human Resources

CFO role

• See sales for all countries
• See no Human Resources data

• Do not restrict the Country table or Sales table.
• Apply a filter to Human Resources that always returns false, such as:

DAX 
FALSE()

• Review administrative-role membership ? PIM access reviews
• Require justification for continued membership ? PIM can require justification when activating or maintaining privileged access
• Alerts about administrator assignment changes ? PIM alerts and notifications
• History of administrator activation ? PIM audit history
• See changes made to Azure resources ? PIM activation/audit information can be correlated with Azure Activity Logs

• NTLM: Uses Windows challenge-response authentication and does not provide the normal web-based MFA redirect flow.
• Single Sign-On: Automatically reuses existing credentials; it is intended to avoid prompting, not to support an MFA workflow.
• Transparent: Intercepts the session without redirecting the user to a separate authentication page.

• Accept: Acknowledge the risk and take no additional action.
• Mitigate: Reduce the likelihood or impact of the risk through controls.
• Avoid: Eliminate the activity or situation causing the risk.
• Transfer: Shift responsibility or financial impact to another party, such as through insurance or a contract.

• Static IP address: Not needed if the workstation already has network connectivity.
• Subnet mask: Incorrect subnetting would usually prevent local communication, including pinging the server.
• Default gateway: Primarily affects communication outside the local network; it does not normally prevent finding an internal domain controller.

DAX 
Sales % of Total = 
DIVIDE( 
    [Total Sales], 
    CALCULATE( 
        [Total Sales], 
        ALLSELECTED(Products) 
    ) 
)

DAX 
Total Sales = 
SUM(Sales[SalesAmount])

Why ALLSELECTED is required

• The numerator, [Total Sales], is evaluated for the current product.
• ALLSELECTED(Products) removes the current product’s visual filter when calculating the denominator.
• It preserves filters applied at the report, page, or slicer level.

Why not ALL(Products)?

DAX 
CALCULATE([Total Sales], ALL(Products))

• Limiting the number of MAC addresses learned on a switch port
• Allowing only specific, approved MAC addresses
• Taking action when the limit is exceeded, such as dropping frames or disabling the port

• Layer 1: Check cables, power, and link lights.
• Layer 2: Check switching, VLANs, and MAC learning.
• Layer 3: Check IP addressing, routing, and gateways.
• Higher layers: Check services, applications, and user settings.

• Create a plan of action: Decide how to implement the fix.
• Implement the solution: Apply the selected fix.
• Verify functionality: Confirm the problem is resolved and systems work normally.

• CBWFQ (Class-Based Weighted Fair Queuing): Creates traffic classes and assigns each class a guaranteed bandwidth or queueing treatment.
• PQ (Priority Queuing): Uses multiple queues with strict priority. Higher-priority queues are serviced before lower-priority queues, making it useful for delay-sensitive traffic—but it can starve lower-priority traffic.

• FRTS: Traffic shaping for Frame Relay; it controls the transmission rate rather than selecting packets during congestion.
• CAR: Polices traffic by rate, typically dropping or remarking packets that exceed a limit.
• PBR: Policy-Based Routing; it selects forwarding paths and is not a QoS queueing mechanism.

• Streams — track change data for tables or views.
• External tables — reference data stored in an external cloud storage location.

• Role — account-level security object.
• Warehouse — account-level compute resource.
• User — account-level security object.
• Share — account-level object used to share data.

• The vulnerability scan identifies a vulnerability.
• The administrator verifies that the vulnerability is not present.
• Therefore, the scan produced a false positive.

• True positive: A vulnerability is reported and genuinely exists.
• False negative: A vulnerability exists, but the scan fails to detect it.
• True negative: No vulnerability exists, and the scan correctly reports no issue.

• A. Periodically rotate responsibilities: May reduce some risks, but it does not directly detect unauthorized changes.
• B. Review segregation-of-duties conflicts: Identifies incompatible access combinations, not whether a specific data change was unauthorized.
• C. Log changes in an outside application: Logs provide evidence, but someone must review and analyze them. Logging alone does not detect misuse.
• D. Independent review: Directly detects unauthorized changes and reduces the risk that the person making the change can conceal it.

• Note the question number before leaving—for example, Question 38.
• Use the exam’s question navigator or Back/Previous button to return to that number.
• If you close or refresh the page, your position may not be saved, depending on the site. Reopen the page and select the question number again.
• Avoid using the browser’s Back button if it causes the exam page to reload; use the exam’s built-in navigation instead.

• Orders contains order-level information, such as the order date.
• Order Line Items contains the products, quantities, and line amounts associated with each order.
• Merging them on the order key, such as OrderID, places the order date alongside each line item. This allows you to calculate total order value and analyze it over time.
• Product attributes can remain in the Products table and be related to the resulting line-item table through ProductID.

• Merging line items with products addresses product attributes but does not first provide the order-level date and value needed for time analysis.
• DAX calculated columns or lists add unnecessary model complexity.
• Calculating order counts is not the first requirement and does not combine the required order and line-item data.

1. It examines the source MAC address and learns it on the incoming port.
2. It examines the destination MAC address.
3. If the destination MAC is already in the MAC/CAM table, it forwards the frame only through the associated port.
4. If the destination MAC is unknown, it performs unknown-unicast flooding:

• Two-part tariff pricing: $10 per unit
• Dual pricing: $20 per unit

Two-part tariff pricing

Dual pricing

• Division X, the seller, is credited with the market price: \(\$20\)
• Division Y, the buyer, is charged the marginal cost: \(\$10\)

• Custom domains: supported by Standard.
• Dedicated compute instances: Standard runs on dedicated Azure VMs.
• Load balancing: Standard supports scaling the app across multiple instances with traffic distributed between them.
• Storage: Standard provides more storage than the lower tiers.
• Cost control: Standard is cheaper than higher tiers while meeting the stated requirements.

• Free and Shared use shared infrastructure and are intended for basic/testing workloads.
• Basic provides dedicated instances, but the question’s expected answer treats Standard as the minimum tier providing the required load-balancing capability.

1. Create a temporary Onboarding OU.
2. Move the new account into it.
3. Move the restrictive SCPs from the organization root to the Production OU.
4. Allow the account to update AWS Config.
5. Move the account into Production after onboarding.

• An SCP attached at the organization root applies to every account and OU beneath it.
• An SCP attached to the Production OU applies only to accounts in that OU.
• Therefore, moving the restrictive SCP from the root to Production temporarily exempts the onboarding account without weakening the policies for existing production accounts.
• Once onboarding is complete, moving the account into Production subjects it to the normal restrictions.

• B — The most significant risks are held by SQ.

• C — SQ should recognise the cars as inventory.

• F — SQ recognises revenue when LM sells a car to a third party.

• A: LM does not hold the most significant risks.
• D: LM does not recognise the cars as inventory.
• E: SQ should not recognise revenue when cars are merely delivered to LM.