PEOPLECERT ITIL-DSV Exam Prep
ITIL 4 Specialist: Drive Stakeholder Value (Page 3 )

• Restrict a port to a defined number of MAC addresses
• Use statically assigned or “sticky” MAC addresses
• Shut down or restrict the port when violations occur

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect suspicious network activity, but is not the primary control for limiting switch MAC entries.
• NGFW: Filters traffic at the network boundary; it does not directly prevent MAC table flooding on access switches.

• Authentication — verifies who the user is.
• Authorization — determines what the authenticated user is allowed to access.
• Accounting — records session activity, such as login time and resource usage.

• CIA — confidentiality, integrity, and availability; core security objectives.
• ACL — access control list; rules that permit or deny traffic or access.
• PEM — Privacy Enhanced Mail, an older email security standard.

• File is shared externally ? Access level

• File is labeled “Internal only” ? Sensitivity label

• Documented and evaluated
• Assessed for security, cost, and operational impact
• Reviewed and approved by the appropriate personnel
• Tested before implementation
• Tracked with version history and rollback procedures

• Risk management process: May help assess the issues, but it does not authorize and manage design changes.
• Product design process: Applies primarily while creating a new design.
• Design review process: Normally evaluates a design before release; this design is already released.

• Bronze: Raw ingested data
• Silver: Cleaned, validated, and transformed data
• Gold: Business-level data for analytics, dashboards, and reporting

• MFA adds an additional authentication factor, such as a phone notification or verification code.
• It helps prevent unauthorized sign-ins, even if a password is compromised.
• It does not encrypt, store, or protect credentials used by deployment processes.

• Each Case must follow defined support steps.
• Each step must be completed within a specified time limit.

• Case Escalation Rules: Escalate Cases based mainly on age or criteria; they do not model a complete sequence of service steps.
• Process Builder with Scheduled Actions: Can automate time-based actions but is not the standard framework for Case service-level commitments.
• Omni-Channel Routing: Routes work to agents based on capacity and priority; it does not track Case lifecycle deadlines.

• Scheduling overlapping working hours for critical collaboration
• Assigning independent tasks that can proceed asynchronously
• Adding clear handoffs between offices
• Documenting decisions, questions, and required inputs
• Building appropriate time into the schedule for responses

• Active-active routers: Provide redundant Internet connections/devices. Both can operate, so traffic can fail over or be load-balanced.
• Active-active firewalls: Avoid a single firewall becoming a failure point while maintaining security inspection.
• Load balancers: Distribute requests across multiple web servers. If one server fails, traffic can go to the other.
• Redundant power supplies: A server with separate power supplies should connect to independent power sources or circuits.
• UPS A and UPS B: Provide backup power and redundancy. Ideally, each power supply is connected to a different UPS.
• SONET ring: A ring topology provides alternate paths if a fiber link or segment fails.

• Configure row-level security (RLS) using the sales region and the HR manager’s identity.
• Publish the reports and datasets through a Power BI app.
• Grant the HR managers permission to use the app, but do not add them as workspace members.
• App users can view and interact with reports while RLS limits them to their region.
• They cannot modify the report layout because they do not have workspace editing permissions.

• Adding them to the workspace gives them workspace permissions that may allow report or dataset changes, depending on the assigned role.
• Creating copies is unnecessary and creates maintenance and security problems.
• Hosting datasets and reports in different workspaces does not, by itself, provide the required controlled access.

• Maximum response and resolution times
• Expected uptime or availability
• Performance requirements
• Escalation procedures
• Consequences for failing to meet requirements

• SOW: Defines a project’s scope, tasks, deliverables, and schedule.
• MOA: Documents specific responsibilities agreed upon by two parties.
• MOU: Records a general understanding or intent to cooperate.

• B — Both inner and outer classes can be declared as with sharing.

• C — Inner classes do not inherit sharing settings from the container class.

apex 
public with sharing class OuterClass { 
    public with sharing class InnerClass { 
        // Explicitly uses sharing rules 
    } 
}

• Azure Cosmos DB is a globally distributed NoSQL database service. It stores and retrieves application data, but it does not provide the complete environment for building, testing, and deploying predictive analytics models.
• Azure Machine Learning is the appropriate service for this requirement. It supports creating experiments, training and testing models, and deploying them for predictions.
• Azure Machine Learning Studio provides the browser-based interface for these tasks.

1. You try to access a cloud application, such as accounting software.
2. The application redirects you to the company’s IdP.
3. You authenticate with the IdP.
4. The IdP sends a digitally signed SAML assertion to the application.
5. The application validates the assertion and grants access.

• The user’s identity
• Whether authentication succeeded
• Roles or group membership
• Access-related attributes

• B. Versioned configuration files — Infrastructure is defined in machine-readable files and tracked in version control, allowing repeatable provisioning and change history.
• D. Docker files — Assuming “Doctor files” is a typo for Dockerfiles, a Dockerfile declaratively defines how to build a container image and is commonly considered infrastructure/configuration as code.

• A. Cloned virtual machine images — These are prebuilt infrastructure artifacts, but cloning an image is not itself a code-based infrastructure definition.
• C. Change management database records — A CMDB records information about infrastructure; it does not define or provision that infrastructure.

• The audience and stakeholders
• The complexity and type of requirements
• The communication method and level of detail needed
• Whether to use diagrams, models, documents, demonstrations, or slides

• B: Authority to host the presentation is not the key preparation activity.
• C: Stakeholder sign-off may occur later; presenting requirements does not always require formal approval beforehand.
• D: A scribe may be useful in a meeting, but hiring one is not a core preparation requirement for presenting.

• Third-party attestation: Provides independent validation, but is typically periodic and performed by an external party.
• Penetration testing: Simulates attacks to identify exploitable vulnerabilities; it does not primarily track compliance.
• Vulnerability scans: Identify technical weaknesses, but do not provide a detailed review of procedures or compliance activities.

• BCP (Business Continuity Plan): è più ampio e mira a mantenere le funzioni essenziali dell’organizzazione durante un’interruzione. Il DRP è una componente più specifica del BCP.
• Communication plan: stabilisce come comunicare con dipendenti, cittadini e altre parti interessate, ma non ripristina i sistemi.
• IRP (Incident Response Plan): gestisce la risposta iniziale a un incidente di sicurezza, come un attacco informatico, non principalmente il recupero da un disastro fisico.

• MFA: Protects sign-in and authentication.
• Azure Key Vault: Protects deployment secrets and credentials.
• Answer: No (B).

• Packet capture: Collects and analyzes network traffic; it does not describe the scan type.
• Privilege escalation: Attempts to gain higher permissions after obtaining access.
• System enumeration: Identifies systems, services, or resources, but is not specifically defined by the lack of credentials.
• Passive scan: Observes traffic without actively probing systems. A vulnerability scan is generally an active assessment.

• The requirement is to obtain an assessment of the Azure environment’s design.
• The proposed solution is the Premier support plan.
• Premier can provide this type of guidance, but it is a higher-tier, more expensive option.
• The question specifically says to keep costs to a minimum. A lower tier—typically Professional Direct in the support-plan model used by this question—provides architectural/design guidance.

• Fileless malware: Nothing in the command indicates malware executing only in memory.
• Living-off-the-land binaries: Mimikatz is a credential-access tool, not a normal system utility used for LOLBin abuse.
• Social engineering: The command shows technical credential abuse, not manipulation of an accountant.

• Asynchronous inference is designed for applications that submit individual inference requests, place them in a queue, and retrieve results later. It is useful when requests may take a long time or when traffic is intermittent.
• Batch transform is designed specifically to run inference over an entire large dataset stored in Amazon S3 and produce an output dataset.

• Large dataset/offline processing ? Batch transform
• Large or slow individual requests processed later ? Asynchronous inference

1. Find the subnet-mask increment in the octet where the prefix ends.
2. Identify the network address by finding the subnet boundary at or below the given IP.
3. The first usable address is network address + 1.
4. The broadcast address is one address before the next subnet.
5. The last usable address is broadcast - 1.

• 172.28.228.144/18

• 172.28.228.144/23

• A: It allows for branching and merging...

• C: It allows multiple engineers to work against the same code and configuration files and manage differences and conflicts.

• B: Build automation and infrastructure provisioning are handled by CI/CD and automation tools, not by version control alone.
• D: User Stories and backlogs are managed by project-management tools.
• E: Version control stores and tracks code, but it does not itself ensure that developers write effective unit tests.

• Employees can use approved devices from remote locations or worldwide offices.
• Users do not need to carry or insert extra hardware.
• It helps prevent account takeovers from unknown devices.

• Geotagging: Restricts access based on location, which could interfere with remote work and travel.
• Smart cards: Require additional physical equipment and card readers.
• Time-based logins: Limit access according to time but do not strongly bind access to an authorized user device.

• A — Securing information assets: This is the responsibility of management and operational/security teams.
• B — Validating protection: Correct. The auditor checks whether controls—such as access restrictions, encryption, retention, and handling procedures—match the asset’s classification.
• C — Ensuring alignment with regulations: Management and legal/compliance functions typically establish classification requirements; the auditor may assess compliance but does not primarily define alignment.
• D — Defining classification levels: This is a management responsibility based on business needs, risk, and regulatory obligations.

• Restrict a port to a defined number of MAC addresses
• Use statically configured or “sticky” MAC addresses
• Shut down or restrict the port when violations occur

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect suspicious traffic but is not the primary control for switch-port MAC limits.
• NGFW: Filters routed network traffic, not the switch’s CAM/MAC address table directly.

• B: Developer Edition has limited user, storage, and data-volume capacity, making realistic community testing difficult.
• C: A Developer Edition org cannot contain sandboxes, so it cannot provide separate environments for development, integration, and UAT.
• E: A standalone Developer Edition org is not part of the production org’s deployment path, so change sets cannot be used to deploy from it directly to that production org. The team would need Metadata API, Salesforce CLI, or another deployment method.

• A — Use a custom controller: An Apex class can contain the page’s logic.
• C — Use a standard controller with extensions: The standard controller provides basic CRUD behavior, while an extension adds custom logic.
• E — Use a standard controller: Useful when the page works mainly with one Salesforce object and needs standard functionality.

• A page with no controller for static or controller-free content.
• A custom controller with extensions; extensions are not limited only to standard controllers.

• Suspended an operator who refused to use unsafe equipment.
• Paid another operator a bonus for using it.
• Prioritised short-term productivity over employee safety.

• A — Management is not particularly concerned with managing risks.

• B — Employees will perceive that management does not care about health and safety risks.

• C — The factory’s safety record is likely to be poor.

• Additional running costs: $800
• Less depreciation: $300

• The $100 reduction in fixed production overhead absorbed is only an accounting reallocation. It does not represent an actual saving in total fixed overhead.

• Which host first communicated with the suspected malicious source
• Whether that host initiated suspicious traffic or merely received it
• Which other hosts show evidence of infection, such as connections from the originating host
• Which hosts have no related suspicious activity and are therefore clean

• An outbound connection to a suspicious external address
• A downloaded or executed malicious file
• Later lateral connections from that host to other internal systems
• Firewall logs showing the direction and timing of the traffic

• Accept: Acknowledging the risk and choosing not to take additional action.
• Transfer: Shifting the risk or financial consequences to another party, such as an insurer.
• Mitigate: Reducing the likelihood or impact through controls, such as patching or access restrictions.
• Avoid: Eliminating the activity that creates the risk.

• Assign endpoints to a group based on the result of one policy.
• Use that group as the scope of another policy.
• This effectively passes the endpoints from one policy’s processing flow to another.

• The application failing to start or becoming unhealthy
• An incorrect probe path, port, or protocol
• The application needing more startup time
• Dependency or configuration failures
• A liveness probe being too aggressive

bash 
kubectl describe pod <pod-name> 
kubectl logs <pod-name> --previous

• Scale to more replicas: may hide the issue but does not diagnose it.
• Decrease initialDelaySeconds: makes probes run earlier and could worsen startup failures.
• Drain and reboot the node: node metrics are normal, so rebooting is not justified as the first step.

• Limiting the number of MAC addresses allowed on a switch port
• Restricting ports to specific known MAC addresses
• Taking an action—such as dropping frames or shutting down the port—when the limit is exceeded

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect some attack traffic, but is not the primary control for switch-port MAC limits.
• NGFW: Filters network traffic at the firewall, but does not directly control MAC addresses learned by a switch.

• GPS coordinates
• Date and time the image was taken
• Camera or device information
• Image dimensions and software used

• Log data: Records generated by systems or applications, not normally embedded in image files.
• Encrypted data: Information intentionally encoded to prevent unauthorized access.
• Sensitive data: A broad classification, not the specific type of information being extracted.

• Reconnaissance: Gathering information about the target.
• Weaponization: Creating or combining a malicious payload with a delivery method.
• Delivery: Sending the payload, such as through phishing.
• Exploitation: Triggering a vulnerability or weakness to gain execution or access.

• A. Microsoft 365 group with Assigned membership
• C. Microsoft 365 group with Dynamic User membership

Why?

• Assigned membership: You explicitly add User1, User2, and User3.
• Dynamic User membership: Membership is automatically determined by a rule based on user attributes.

Why the other options are incorrect

• B and D: Security groups do not support the Microsoft 365 group expiration policy.
• E: Dynamic Device groups are intended for devices, not these users, and are also security groups.

1. Clear principles and boundaries — Employees have freedom, but decisions must remain within clear organizational values, policies and limits.
2. High degree of freedom — Managers are trusted to make decisions rather than seeking continual approval from senior management.
3. Frontline customer responsibility — Customer-facing managers should be empowered to manage customer relationships and respond quickly to needs.
4. Transparent and ethical information — Information should be openly available and used honestly, supporting trust and informed decision-making.

• The S3 bucket as an origin for static content
• The Application Load Balancer (ALB) as an origin for dynamic content
• An Amazon Route 53 alias record pointing the application domain to CloudFront

Why this works

• Static data: CloudFront caches objects from S3 at edge locations, reducing latency for users worldwide.
• Dynamic data: CloudFront forwards requests that require application processing to the ALB. It can also maintain persistent connections and use the AWS global edge network to improve delivery performance.
• One domain: CloudFront behaviors can route different path patterns to different origins—for example, /static/* to S3 and other paths to the ALB.

Why the other options are incorrect

• Global Accelerator is designed primarily for accelerating traffic to applications with endpoints such as ALBs, not for caching S3 content.
• Using separate domains or splitting static and dynamic traffic adds unnecessary complexity.
• CloudFront already provides the required global edge distribution and caching, so combining it with Global Accelerator is unnecessary here.

• If the hashes match, the software has likely not changed.
• If they differ, the software was modified or corrupted.

• Encryption: Protects confidentiality by making data unreadable; it does not primarily verify that software was unchanged.
• Baselines: Establish expected configurations or states, but hashing is the specific method for checking file integrity.
• Tokenization: Replaces sensitive data with non-sensitive tokens and is unrelated to software integrity.

1. Define – establish the project’s objectives, scope, feasibility and requirements.
2. Design – plan how the project will be carried out, including resources, schedules and controls.
3. Deliver – execute the project and produce the required outputs.
4. Develop – close the project formally and capture learning for future projects.

• Filing documentation and records
• Closing project and accounting systems
• Settling costs
• Handing over the completed work and obtaining sign-off
• Reviewing performance and giving feedback

• A — Too infrequent: Formal strategies are often reviewed only every three to five years. This can make the organisation slow to respond to rapid changes in technology, competitors, regulation or customer needs.

• C — Relies on predicting the future: The approach assumes senior managers can make reasonably reliable forecasts and assumptions. In uncertain environments, these assumptions may quickly become invalid.

• E — Can restrict radical innovation: Formal planning tends to favour existing information, established objectives and incremental improvements. This may discourage experimental or highly innovative strategies that emerge from lower levels of the organisation.

• B concerns the difficulty of achieving competitive advantage through core competences when competing with focused specialists. It is not specifically a drawback of the formal top-down planning process.
• D is an activity organisations should undertake—continuous monitoring—not a drawback of the approach itself.

• File1.png — Yes: User1 can apply Label1 with the Microsoft Purview Information Protection client. The client supports labeling image files such as .png in this scenario.

• Folder2 — No: Folder2 is the root folder. The client does not allow labeling the root folder itself. Although the client can label ordinary folders, selecting one applies the label to existing files and subfolders—not automatically to future files.

• File1.docx — Yes: .docx is a supported Microsoft Word file type, so User1 can apply Label1 to it.

• B — Reviewing the strategy: Usually performed by a security steering committee or other governance body.
• C — Communicating the strategy: The security manager may help communicate it, but communication is not the primary governance responsibility tested here.
• D — Approving the strategy: Approval belongs to executive management or the appropriate governing authority, not the person who develops it.

• Prevention costs – costs incurred to stop defects occurring, such as staff training, quality planning and supplier evaluation.
• Appraisal costs – costs of checking whether products meet standards, such as inspection, testing and quality audits.
• Internal failure costs – costs of defects found before delivery to customers, such as scrap, rework and retesting.
• External failure costs – costs of defects found after delivery, such as warranty claims, returns, complaints and product recalls.

1. Get Data > Folder

1. Expand the Attributes column

1. Remove the Content column

• Folder connector: lists files and their metadata, but also includes a Content binary column.
• Combine Files: processes and combines the actual CSV contents, which is explicitly disallowed here.