LPI 101-500 Exam Prep
LPIC-1 System Administrator Exam 101, Part 1 of 2, version 5.0 (Page 24 )

• Correct answer: /sbin/init

• Why: When using SysV init, the kernel starts the first user-space process with PID 1. That initial program is /sbin/init. It cannot exit and is responsible for starting the rest of the system (by reading /etc/inittab to determine the runlevel and starting the appropriate scripts in /etc/rc.d or /etc/init.d). The other options are not the initial program used by the kernel:

• Quick note: On SysV systems, after /sbin/init starts, it spawns the runlevel scripts to bring the system to the desired state. Some systems may use /bin/init as a link to /sbin/init, but the key concept is that the kernel starts the initial user-space process.

• Active vs passive: Active assessment involves actively scanning targets by sending probes/packets to identify hosts, services, and vulnerabilities. Passive assessment observes traffic without probing.
• External vs internal: External assessment is about testing from outside the network perimeter; the scenario doesn’t specify external vantage, only that tools are identifying hosts/services across the enterprise network.

• Box 1: Azure Lighthouse — ??? ??????? ? ?????????? ????????? ? ?????????? Entra tenants. ??? ??????????? ??? ??? ????? ????? ? VM ? ?????? ?????????/????????.
• Box 2: Azure Monitor Agent ? ?????????????? Data Collection Rules (DCR) — AMA ???????? ??????? Windows (????????, Security Logs) ? DCR ??????????, ????? ??????? ???????? ? ???? ?????????? (? ?????? Log Analytics workspace).

• Correct answer: A — a clear business case has been established.

• The audit focus for IT procurement is ensuring there is a solid economic justification for the investment. A clear business case documents the expected benefits, costs, risks, and alignment with strategic objectives, which governs whether the investment is worth pursuing.
• The other options are important controls or project aspects, but they are secondary to ensuring the investment is justified financially and strategically:

• Workspace: Stores notebooks, libraries, jobs, and other project resources.
• Notebooks: Interactive documents containing code, queries, visualizations, and explanations. Common languages include Python, SQL, Scala, and R.
• Clusters: Groups of virtual machines that run Spark workloads. Clusters can be started, stopped, and automatically scaled.
• Data access: Databricks can read from services such as Azure Data Lake Storage, Azure Blob Storage, and Azure SQL.
• Jobs: Automate notebooks or data-processing workflows on a schedule or in response to events.

• The Act requires:

• It does not, as a public obligation, mandate publishing a detailed report on the training data used.
• Also, the Act does not specify a fixed “six months” retention for system logs in a way that would clearly make A required; logs for traceability are implied, but the six-month period is not a defined, universal requirement.

• A assigned without var becomes a global variable (in non-strict mode). So after myFunction(), a = 5 is accessible.
• b is declared with var inside the function, so it’s local to that function (function-scoped). It’s not defined in the outer (global) scope.

• console.log(a) prints 5.
• console.log(b) throws a ReferenceError: b is not defined.

• IaaS: You deploy and manage virtual machines, operating systems, disks, and networking. Azure manages the physical datacenter and host infrastructure.
• PaaS: Azure manages the operating system and runtime so you can focus on deploying applications, such as with Azure App Service or Azure Functions.
• SaaS: You consume a complete, provider-managed application.

• S3 Lifecycle rules automate actions such as transitioning objects to different storage classes or deleting old objects.
• S3 bucket policies control access permissions; they do not preserve earlier object versions.
• S3 server-side encryption protects data confidentiality by encrypting objects at rest, but it does not prevent deletion or overwriting.

• Accidental deletion or overwriting ? S3 Versioning
• Unauthorized access ? bucket policies and IAM
• Data encryption ? server-side encryption

• The standard Enterprise Architecture domains are: Business, Data, Application, Technology (BDAT).

• A: Business, strategy, application and technology — includes business and application/tech but uses “strategy” instead of data.
• B: Zachman, TOGAF, Cobit, and Heath architectures — names frameworks, not domains.
• C: Business, data, infrastructure and technology — has business, data, and technology; lacks a distinct application domain (uses “infrastructure” instead).
• D: Process, database, software and technology — covers data (database), application (software), and technology, but omits business.

• The four BDAT domains (business, data, application, technology) is the conventional model you should study.
• None of the options perfectly lists all four BDAT domains. The closest are C (if you map infrastructure to technology) and D (data/application/technology but no business).

• Topic: Conditional Access (CA) policy and MFA for Azure management.
• Policy name: Policy1, created with the template “Require multifactor authentication for Azure management.”
• What the template does: It enforces MFA when signing in to manage Azure resources (Azure management) for the users included in the policy.
• Who is included: The question lists Admin1, Admin2, Admin3, and Admin4 as the admins in the tenant. The template’s default scope for this scenario is to apply to those admin accounts (i.e., all four admins unless you explicitly limit the scope).

• CA policy for “Azure management” targets admin sign-ins.
• If the policy includes Admin1–Admin4, all of them must use MFA on their next sign-in (choice D).

• Step 1: From Power BI Desktop, select Get Data, choose Folder, enter the folder path, and click OK, then choose Transform data to open Power Query Editor.

• Step 2: In Power Query Editor, expand the Attributes column.

• Step 3: From the Power Query Editor, select the Content column and use Home > Combine Files (aka “Combine binaries”) to consolidate the files.

• Elicited and documented customer requirements
• Converted them into clear, measurable specifications
• Validated the requirements with the customer
• Used them as the basis for design, quality checks, and acceptance

• A: Requirements should reflect the customer’s needs—not the supplier’s standards.
• B: Iteration review planning does not replace proper requirements collection.
• D: A retrospective occurs after work is completed and is mainly for process improvement, not initial requirements definition.

• Actual filename: Document.xml.txt
• Explorer displays: Document.xml
• File type: Text Document (.txt)

text 
Document.txt ? Document.xml

• IPv6 address types you’ll typically see:

• Unique Local Addresses (ULAs)

• If an address begins with fdXX:… or fc00:…, place it under “Unique Local Address” (ULA).
• If it begins with 2000::/3, place it under “Global Unicast.”
• If it begins with fe80::, place it under “Link-local.”
• If it begins with ff00::, place it under “Multicast.”

• Forecasting lets sales leaders predict revenue for upcoming fiscal periods, compare forecasts with targets, and review performance by salesperson or team.
• Opportunity Stages help determine the likelihood that opportunities will close. Each stage can have a probability, which contributes to forecast calculations.

• Sales Quotes: Used to present pricing or product proposals to customers; they do not provide revenue forecasting.
• Opportunity List View: Helps users filter and view opportunities, but it is not the forecasting tool.

• Geo-redundant storage (GRS) replicates data to a secondary Azure region, but the secondary copy is normally unavailable for read access.
• RA-GRS provides geo-replication and read-only access to the secondary region, satisfying all requirements.
• Zone-redundant storage (ZRS) replicates data across availability zones within the same Azure region, not separate geographic regions.
• Locally redundant storage (LRS) keeps copies within a single datacenter or region and does not provide geographic resiliency.

• Idioma: “Responda em português.”
• Tamanho: “Responda em até três frases.”
• Formato: “Use uma lista com três recomendações.”
• Objetivo: “Recomende produtos com base nas necessidades do cliente.”

• Mudar o tamanho do LLM: pode alterar capacidade e custo, mas não garante idioma ou respostas curtas.
• Aumentar a temperatura: aumenta a criatividade e a aleatoriedade; não controla diretamente o tamanho ou idioma.
• Aumentar o Top K: permite considerar mais tokens prováveis, aumentando a variedade; também não é o mecanismo principal para controlar idioma ou comprimento.

• Coordinate and manage the assessment team
• Assign assessment activities
• Direct interviews, examinations, and tests
• Ensure the assessment follows the CAP

• Answer key: Lead Assessor — likely wrong
• CAP-based answer: C3PAO

• A. Extranet
• B. VLAN
• C. Intranet
• D. VPN

• Basic: Self-help only; no technical support or design assessment.
• Developer/Standard: Technical support, but generally not the full proactive architecture guidance required here.
• Professional Direct: Includes proactive guidance and architecture recommendations.
• Premier: Also supports this, but is not the minimum-cost option.

sql 
CREATE TABLE my_table 
USING CSV 
OPTIONS (path '/path/to/csv');

sql 
CREATE TABLE my_table 
USING CSV 
LOCATION '/path/to/csv';

• USING CSV specifies the file format.
• path or LOCATION specifies where the files are stored.
• USING DELTA would be used only when the source data is in Delta format.
• FROM is used in a SELECT statement, not normally as the format declaration in CREATE TABLE.

• A: True. You can change the size of a Virtual Warehouse after creation (via UI or ALTER WAREHOUSE).

• B: True. A warehouse can be resized while it’s running; the resize will take effect without needing to stop queries.

• C: True. A warehouse can be configured to suspend after a period of inactivity (AUTO_SUSPEND).

• D: True. A warehouse can be configured to auto-resume when new queries are submitted (AUTO_RESUME).

Flat organisation

• Few levels of management
• A wide span of control—managers supervise many employees
• Shorter communication channels
• More employee autonomy and quicker decisions
• Fewer formal promotion levels

Tall organisation

• Many levels of management
• A narrow span of control—managers supervise relatively few employees
• A clear hierarchy and reporting structure
• More formal supervision and communication channels
• More obvious promotion and career stages

• Ensure that only users who manage the production environment sign in to the Azure portal from a hybrid Entra-joined device and authenticate with MFA.

• Use Microsoft Entra ID Protection (Identity Protection) to enforce MFA enrollment:

• Update the existing Capolicy1 (a Conditional Access policy):

• Identity Protection MFA registration policy ensures users are enrolled in MFA (Box 1 choice).
• CA policy Capolicy1 with aGrant control of “Require MFA” enforces MFA during sign-in (Box 2 choice).
• Both work together with the hybrid-joined device requirement to satisfy the authentication/authorization rules.

• Apply the MFA registration policy to the production-management users.
• Apply the MFA grant to Capolicy1 for those same users/groups.

• The stage has a default file format defined (e.g., when you create the stage with FILE_FORMAT = (...)), and Snowflake will use that default.

• You use a named file format attached to the stage, or you specify an inline format in the COPY command, e.g., COPY INTO my_table FROM @my_stage FILE_FORMAT = (TYPE = 'CSV');

• Use a stage default: omit FILE_FORMAT in COPY.
• Or rely on a named/inline format: specify FILE_FORMAT in COPY or set a format on the stage.

1. Define Power Platform DLP policies
2. Add custom prompt modifications
3. Conduct adversarial testing

1. DLP policies first

1. Prompt modifications second

1. Adversarial testing last

• Product Owner: May attend, but is not required unless also working as a Developer.
• Scrum Master: May attend to help facilitate or coach, but is not required.
• Developers: Must participate because the event is specifically for them.

• TCP is connection-oriented. It establishes a connection before data transfer using a three-way handshake (SYN, SYN-ACK, ACK), enabling reliable delivery, ordering, and flow control.

• UDP is connectionless. It sends datagrams without a prior connection and provides no guarantee of delivery, order, or protection against duplicates; any reliability is up to the application.

• B incorrectly states UDP uses acknowledgment packets; UDP has no built-in ACKs.
• C wrongly claims UDP provides reliable transfer and that TCP is connectionless.
• D misstates framing bits; neither protocol uses the listed TCP/UDP handshake bits in frames.

• Customize Opportunity Contact Role

• Add the Opportunity Contact Role related list to the Opportunity page layout

• Campaign Member Role relates contacts or leads to campaigns, not opportunities.
• Campaign Member related list would expose campaign participation, not the stakeholders for the opportunity.
• Customize Campaign Role also concerns campaigns.

• Ablauf: Er wird in der gleichen Transaktion ausgeführt, bei der z. B. ein Datensatz erstellt oder aktualisiert wird. Der Benutzer wartet, bis der Workflow abgeschlossen ist.
• Stufen: Kann vor dem Vorgang (pre-operation) oder nach dem Vorgang (post-operation) laufen.
• Zweck: Sofortige Validierung oder Anpassung von Daten, ggf. auch das Verhindern eines Vorgangs, wenn Bedingungen nicht erfüllt sind.

• Automatisierte Flows (Power Automate, automatisierte/ Background Flows) laufen asynchron im Hintergrund, nachdem der Trigger erkannt wurde, und blockieren den Benutzer nicht.

• ?????? CPU
• ?????????????????
• ??????????????????????????
• ???????????? throughput
• ??????????????????????????????

• A ??????? system software ????????????????????????????????? ??????????????????????????????????
• B ?????????????????????????? ????????????????????????? ?????????????????????????????
• D ????????????????????????? ?????????????? ?????????????????????????????????????????

• Incidents & alerts — see how the phishing activity was detected, correlated, and investigated.
• Threat Explorer — search for the malicious messages, recipients, URLs, attachments, and campaign activity.
• Email and collaboration reports — assess how many users or messages were affected.
• Remediation details — verify whether messages were quarantined, removed, or otherwise contained.

• Microsoft 365 admin center — general tenant administration.
• Microsoft Entra admin center — identity and access management.
• Exchange admin center — mail-flow and Exchange configuration, rather than full phishing-incident investigation.

• Correct answer: D. AWS CloudShell

• Why: AWS CloudShell is a browser-based shell that runs in the AWS Console and uses the current authenticated session. It provides a pre-authenticated, ready-to-use command-line environment directly from the Management Console, with AWS CLI and common tools installed.

• Why the other options aren’t correct:

• Correct answer: D — AWS Migration Hub

• AWS Migration Hub provides a single location to track the progress of application migrations. It offers a centralized dashboard to view migration status across multiple tools and projects.

• AWS Application Discovery Service helps inventory and map on-prem applications and their dependencies, not a single progress tracker.
• AWS Application Migration Service (formerly SMS) performs the actual lift-and-shift migrations, but isn’t the centralized tracker itself.
• AWS Service Catalog manages catalogs of IT services for self-service deployment, not migration progress.

• Answer: D

• The strongest security comes from enforcing access at the storage layer. An IAM policy scoped to the Cognito identity prefix restricts each user to their own S3 prefix (folder), so users can only access their own files regardless of client or server code.
• This per-user isolation reduces risk of cross-user data access and is more robust than UI validation or Lambda/API validation alone.
• Implementation note: attach a policy to the Cognito identity role that allows actions on arn:aws:s3:::your-bucket/${cognito-identity.amazonaws.com:sub}/* (per-user prefix). Ensure TLS in transit and enable at-rest encryption (SSE-S3 or SSE-KMS). Use multipart upload for large files up to 300 MB.

• Answer: Internal load balancers (ILB) — option C.

• An ILB has a frontend IP address that must be a private IP within the subnet’s address space. You pick this IP when you create the ILB, and it can be Static or Dynamic.
• Other options don’t require a per-subnet IP:

• IaaS provides virtualized infrastructure, including VMs, disks, and networking. You manage the guest operating system and software installed on the VM.
• PaaS provides a managed platform for deploying applications without managing the underlying VMs or operating systems. Examples include Azure App Service and Azure Functions.

• The connecting host keeps the private key securely.
• The destination host stores the corresponding public key in its authorized keys.
• Authentication can occur without a person entering credentials each time.
• SSH also provides encrypted communication and host authentication.

• Biometric: Requires a human user and is difficult to automate.
• Smart card: Often requires user interaction or card access.
• Hard-coded password: Unsafe because passwords stored in scripts or applications can be exposed, reused, or difficult to manage securely.

• Ethical red-teaming is adversarial testing aimed at uncovering weaknesses and potential exploits in an AI system before deployment.
• A (improving accuracy) is not the primary?? of red-teaming.
• B (simulate model risk scenarios) is related but narrower; red-teaming centers on finding vulnerabilities and risk exposure, not just simulating risks.
• D (ensure compliance) is not the main goal of red-teaming.

• The correct setting to configure is the Enrollment Status Page (ESP) profile.
• Why: ESP tracks the enrollment progress and logs during Autopilot provisioning. You can enable log collection within the ESP policy so that, if ESP times out, the user can collect and share the logs with support.
• Optional enhancement: In the ESP policy (or the Autopilot diagnostics settings), you can enable:

• Automatic enrollment settings: control how devices auto-enroll, not log collection.
• Windows Autopilot deployment profile: controls deployment steps but not ESP log collection.
• Device configuration profile: applies settings but doesn’t provide ESP log collection mechanics.

• Side loading means installing software from sources outside official or trusted repositories.
• This process can bring in malicious payloads because the installed software hasn’t been vetted. A rootkit is a type of malware that hides its presence and maintains privileged access, making it a prime risk when using untrusted sources.
• Why not the other options:

• Only install apps from trusted sources; verify signatures.
• Use application whitelisting and security controls to block sideloading.
• Keep systems updated and use anti-malware tools capable of detecting rootkits.

• What the goal is: You want to add guest (external) users to your Azure AD tenant contoso.com, one entry per external user in a CSV.

• The proposed solution uses New-AzureADUser for each external user. Why this isn’t correct: New-AzureADUser creates a regular (internal) user in your directory. It does not create a guest/B2B user invite. So you’d end up with 500 ordinary accounts, not guest accounts with external access.

• The correct approach: Use New-AzureADMSInvitation for each external user. This invites the external user to your directory and creates a guest user (a B2B collaboration user) in your tenant. The invited user then accepts the invitation and gains access as a guest.

• Azure AD vs directory/tenant: Azure AD is the cloud identity service. A directory (also called a tenant) is your specific instance of that service (contoso.com in your scenario). The terms are often used interchangeably in exams.
• Guest user vs internal user: A guest user is external to your organization; an internal user is created directly in your directory as a normal employee/user account.
• B2B invitation: The process of inviting external users so they can collaborate in your resources; New-AzureADMSInvitation is designed for this.

• An IDS monitors network traffic for signs of attacks and raises alerts. It can be deployed out-of-band (via a SPAN/mirror port or a tap) so it analyzes traffic without being inline, meaning it doesn’t measurably affect latency.
• An IPS (intrusion prevention system) is inline and can block threats, but that processing can introduce some latency and potential throughput impact.
• A firewall also inspects traffic and can add latency, though usually modest with proper hardware, but its primary purpose isn’t continuous passive analysis.
• A load balancer distributes traffic and isn’t used for intrusion analysis.

• A — conformant: Incorrect because one explicit requirement is violated.
• B — consistent: “Consistent” is not sufficient where the implementation contradicts a mandatory specification. The RPC mechanism is covered by the architecture, and the implementation differs from it.
• C — consistent: Incorrect reasoning: the RPC mechanism does have a defined architectural requirement, so conformance must be assessed.
• D — non-conformant: Correct because the implementation fails to follow the specified RPC/threading requirement.

• Premium file shares: contoso104 only
• Blob access tiers: contoso101, contoso102, and contoso103

• Premium Azure Files shares require a storage account with the FileStorage account kind. This is a specialized account type and is not used for blob storage.
• Blob access tiers such as Hot, Cool, and—where supported—Archive apply to blob-capable accounts, such as General-purpose v2 or BlobStorage accounts shown in the exhibit.
• contoso104 is therefore excluded from the blob-tier selection because it is the premium Files account.

• Mapping:

• Why:

• Quick note: If you were to host a website on a VM, it would be IaaS; if you used a platform service instead of a VM, it would be PaaS. CaaS (containers) isn’t shown here.

Why B works

• AWS KMS keys are Regional resources. A normal customer managed key in Region A cannot be used directly in Region B.
• A customer managed multi-Region KMS key (MRK) has related key replicas in both Regions. The replicas share key material and key ID, although each has a Regional ARN.
• With client-side encryption, the application encrypts the data before storing it in S3. Cross-Region replication then copies already-encrypted objects, so S3 does not need to decrypt and re-encrypt them with a different Regional key.

Why the other choices are weaker

• A and C: SSE-S3 uses Amazon-managed S3 keys, not the required customer managed KMS key.
• D: SSE-KMS can work only if the solution creates and configures the appropriate KMS key or multi-Region key replica in each Region. As written, it says to create a customer managed KMS key in each Region, which implies separate keys—not the same KMS key. Replication also requires additional KMS permissions and destination encryption configuration.