PEOPLECERT Managing Successful Programme Foundation (MSP) Exam Actual Questions
Managing Successful Programme Foundation (MSP) (Page 5 )

• A separate scope using a /32 subnet: A /32 identifies one host, but it is not a practical DHCP scope for this purpose.
• A static IP within the DHCP range: This can cause an IP address conflict if DHCP assigns that address to another device.
• SLAAC: Used for automatic IPv6 address configuration, not for assigning a predictable IPv4 address through DHCP.

• Correct answer: D) Amazon Aurora Serverless

• Aurora Serverless is serverless, so compute capacity scales automatically and can pause during idle periods. This minimizes ongoing administration and you pay only for actual usage, which is ideal for infrequent workloads.
• PostgreSQL on EC2 requires full OS and DB administration.
• RDS for PostgreSQL is managed but still involves provisioning capacity and some maintenance tasks.
• Aurora PostgreSQL (non-Serverless) is managed but requires you to manage capacity, though with some automation; it’s not as hands-off as Serverless for intermittent usage.

• Step 1: From Power BI Desktop, select Get Data, choose Folder, enter the folder path, and click OK, then choose Transform data to open Power Query Editor.

• Step 2: In Power Query Editor, expand the Attributes column.

• Step 3: From the Power Query Editor, select the Content column and use Home > Combine Files (aka “Combine binaries”) to consolidate the files.

• Security Development Operations (SDO): a security-focused take on DevOps, integrating security into the development pipeline.
• Service Data Object (SDO): a data representation used in some middleware or enterprise apps.
• Software-Defined Overlay (SDO): a networking overlay concept.
• Secure Data Object: a generic data-security term.

• The app on EC2 connects to Aurora using DB credentials stored on the instance. Secrets Manager centralizes these credentials and can rotate them automatically, eliminating manual updates on each EC2 host.
• Automatic rotation reduces operational overhead and enhances security because credentials are rotated on a schedule without code changes.
• The app can retrieve the current secret at runtime (e.g., via the AWS SDK) and use it to authenticate to Aurora, avoiding reliance on locally stored files.

• B (Parameter Store) can store secrets but lacks seamless built-in rotation for database credentials like Secrets Manager; rotation often requires more custom work.
• C (S3) would require complex tooling to rotate and securely fetch credentials and still risks exposure if access policies aren’t perfect.
• D (Encrypted EBS volumes) would store credentials locally on each instance and does not automate rotation or centralized management.

• runParallel is defined as async, so it returns a Promise.
• To use the result, you attach a then handler (or use await inside another async function).

• A: “Async runParallel() .then(data);” is invalid. “async” is a keyword for function declarations, not something you put in front of a call, and you’d need a function as the then-argument.
• B: “runParallel().done(function(data){return data;});” .done is not standard in native Promises (it exists in some libraries). Without a compatible library, this won’t work.
• C: “runParallel().then(data);” is invalid because then expects a function as its argument; data is not a function.
• D: “runParallel().then(function(data){ return data; });” is valid (or equivalently, runParallel().then(data => data);).

• The robust, standard option is D.
• B could work only with a library that provides .done; otherwise it’s not reliable.

• According to the provided answer key, the four options are: Upload File, User Criteria, HR Profiles, HR Criteria (options B, D, F, G).

• Upload File: Filter by a file you upload (e.g., CSV) that provides data for bulk case creation.
• User Criteria: Filter by criteria related to users (e.g., role, department) to select target users.
• HR Profiles: Filter by HR profile data associated with users.
• HR Criteria: Filter by HR-related criteria or attributes.

• A. IDS attack signatures: An IDS primarily detects suspicious network activity and usually alerts rather than directly scanning and blocking uploaded files.
• C. Load balancer: Distributes traffic among servers but does not inspect files for malware.
• D. WAF: Protects web applications from attacks such as SQL injection, cross-site scripting, and some malicious requests. It is not primarily a PDF-malware scanning solution.

• Answer: A) Clear the Windows event logs

• Windows event logs (System, Security, Application) are key forensic artifacts. If an attacker clears these logs, there’s no built-in local record of actions taken, making it harder for investigators to trace what happened.

• Modify the system time: may misalign timestamps but does not erase past events and can be easily detected.
• Alter log permissions: could prevent new log entries, but it doesn’t remove existing ones and can raise alarms due to permission changes.
• Reduce log retention settings: affects only future logs; it doesn’t wipe already recorded activity.

• In real environments, defenders mitigate this risk with tamper-evident, centralized logging (remote SIEM, write-once storage, log integrity checks) to preserve evidence even if a host is compromised.

• Dynamics 365 Remote Assist — used for remote collaboration and mixed-reality scenarios.
• Dynamics 365 Finance — supports financial and operational management.
• Dynamics 365 Business Central — designed primarily for small and medium-sized businesses’ finance and operations.
• Dynamics 365 for Phones — provides mobile access to Dynamics 365 apps, including Sales, through the mobile Unified Interface.

• A) You can only apply a single template BOM to a service object.

• C) You can modify or delete lines in a BOM template regardless of whether the template has been associated to a service object, or not.

• B) You can apply many template BOMs to a service object — false; typically only one template per service object.
• D) You can modify/delete lines only if not associated — false; you can modify templates even after association (per C).

• Correct answer: D) Microservices using API

• Why:

• The first step in risk management is to understand objectives, constraints, and drivers from those who care about the project. This stakeholder engagement helps identify what could go wrong and what risks are most critical.
• Only after you’ve gathered input from stakeholders should you identify risks and document them in the risk register. Updating the risk register (option C) is important, but it comes after identifying and analyzing risks.
• Options B (ensure resources) and D (revise the risk management plan) are actions that may follow once risks are identified and understood; they’re not the initial step.

• ?????? CPU
• ?????????????????
• ??????????????????????????
• ???????????? throughput
• ??????????????????????????????

• A ??????? system software ????????????????????????????????? ??????????????????????????????????
• B ?????????????????????????? ????????????????????????? ?????????????????????????????
• D ????????????????????????? ?????????????? ?????????????????????????????????????????

• The correct AAA mapping (per Cisco objectives) is:

• Why the given options aren’t fully correct:

• Quick takeaway: when you configure AAA, you should conceptually map them as:

• Example commands (to reinforce concepts):

• Risk tolerance describes the organization’s overall risk appetite, not the risks themselves.
• Risk transfer is a treatment option (e.g., insurance), not a documentation artifact.
• Risk analysis assesses likelihood and impact but doesn’t establish ownership or thresholds in a formal register.

• Why: The data is unlabeled, so you can’t train a model with known input-output pairs. Unsupervised learning discovers structure in the data by grouping similar customers into clusters or tiers without labels.
• What it does: Clustering and segmentation (e.g., k-means, hierarchical clustering, DBSCAN, Gaussian mixtures) to form meaningful groups.
• Why the other options aren’t as suitable:

• C — Schema.describeSObjects(new String[]{myObject})[0].fields.getMap()

• D — Schema.getGlobalDescribe().get(myObject).getDescribe().fields.getMap()

• A: sObjectType is not used this way, and fieldSet() is not the appropriate method for retrieving all fields.
• B: mySObject.myObject is not valid dynamic Apex syntax.

• Import mode loads the data into the Power BI model. Visuals query the in-memory model, which generally provides faster calculation and rendering than DirectQuery.
• Import mode also minimizes online processing because report interactions do not send queries back to the dataflow or SQL Server.
• A daily refresh can load data through the previous day, satisfying the freshness requirement without unnecessary hourly processing.

• DirectQuery keeps querying the data source or dataflow during report use, increasing online processing and potentially slowing visuals.
• Adding a gateway enables connectivity for on-premises sources, but it does not remove the performance disadvantages of DirectQuery.
• An hourly Power Automate refresh is unnecessary when the requirement is only data through the previous day and creates additional processing overhead.

• Box 1: Azure Lighthouse — ??? ??????? ? ?????????? ????????? ? ?????????? Entra tenants. ??? ??????????? ??? ??? ????? ????? ? VM ? ?????? ?????????/????????.
• Box 2: Azure Monitor Agent ? ?????????????? Data Collection Rules (DCR) — AMA ???????? ??????? Windows (????????, Security Logs) ? DCR ??????????, ????? ??????? ???????? ? ???? ?????????? (? ?????? Log Analytics workspace).

• Correct answer: B — A reservation for the server based on the MAC address.

• Why this is the best choice:

• Why the other options are less suitable:

• Quick takeaway: Use a DHCP reservation to give the file server a fixed IP while still benefiting from centralized DHCP management.

• The standard Enterprise Architecture domains are: Business, Data, Application, Technology (BDAT).

• A: Business, strategy, application and technology — includes business and application/tech but uses “strategy” instead of data.
• B: Zachman, TOGAF, Cobit, and Heath architectures — names frameworks, not domains.
• C: Business, data, infrastructure and technology — has business, data, and technology; lacks a distinct application domain (uses “infrastructure” instead).
• D: Process, database, software and technology — covers data (database), application (software), and technology, but omits business.

• The four BDAT domains (business, data, application, technology) is the conventional model you should study.
• None of the options perfectly lists all four BDAT domains. The closest are C (if you map infrastructure to technology) and D (data/application/technology but no business).

Why B works

• AWS KMS keys are Regional resources. A normal customer managed key in Region A cannot be used directly in Region B.
• A customer managed multi-Region KMS key (MRK) has related key replicas in both Regions. The replicas share key material and key ID, although each has a Regional ARN.
• With client-side encryption, the application encrypts the data before storing it in S3. Cross-Region replication then copies already-encrypted objects, so S3 does not need to decrypt and re-encrypt them with a different Regional key.

Why the other choices are weaker

• A and C: SSE-S3 uses Amazon-managed S3 keys, not the required customer managed KMS key.
• D: SSE-KMS can work only if the solution creates and configures the appropriate KMS key or multi-Region key replica in each Region. As written, it says to create a customer managed KMS key in each Region, which implies separate keys—not the same KMS key. Replication also requires additional KMS permissions and destination encryption configuration.

• Correct answer: A: The ITIL service value system (SVS).

• The SVS explains how all components (governance, the service value chain, practices, guiding principles, information and technology, partners and resources, and continual improvement) work together to enable value creation from demand to outcomes.

• B: The ITIL guiding principles describe aspirational guidance for decision-making, not how all components/activities interact.
• C: The four dimensions of service management explain areas to consider (organizations/people, information/technology, partners/suppliers, value streams/processes) but don’t describe the integrated system itself.
• D: A service relationship defines the relationship between provider and consumer, not the overall system of components and activities creating value.

• Correct answer: C. AWS CloudFormation

• Why: CloudFormation lets you define infrastructure as code via templates (JSON or YAML). You can create a single template that describes multiple AWS resources and reuse it to deploy consistent stacks across environments. Templates can be parameterized and stored for repeated deployments. Other options (Marketplace, AMI, OpsWorks) don’t provide reusable deployment templates in the same way.

• Answer: D) Out-of-band management

• Why this is correct:

• Why the other options aren’t suitable here:

• Copilot??????????
• ???????????????
• ??????????
• ?????????????
• ???????????????????

• Prompts and Suggestions: Retained for 28 days
• User Engagement Data: Kept for Two Years

• Self-signed certificate: Causes a certificate warning, not incorrect IP resolution.
• Nameserver record: A DNS record problem would typically affect multiple users, not just one.
• IP helper: Relays DHCP or other broadcast traffic between networks; it does not control website name resolution.

• Wiping securely overwrites the drive so the original data cannot reasonably be recovered. It is generally less expensive than physically destroying the device.
• Recycling could expose the data if the drive is not securely erased first.
• Shredding physically destroys the drive and is effective, but usually more costly and prevents reuse.
• Deletion only removes file references; it is not a secure sanitization method.

• The problem describes the class updating field-level security on some profiles. To prevent updating fields that are not updateable for the current user, you should check each field’s updateability before making changes. Use DescribeFieldResult.isUpdateable() (e.g., via Field.describe() on each field) to guard updates.

• A and D (With Sharing): Running a class with Sharing affects record visibility, not whether a field can be updated by a user. It doesn’t prevent updates to fields the user shouldn’t modify.
• C (WITH SECURITY_ENFORCED in SOQL): This enforces FLS/FRC during queries, but it doesn’t control whether the Apex code updates fields or modifies permissions. It’s not addressing the update behavior directly.

• Equipment and hardware
• Facilities
• Inventory
• Backup media
• Supplies stored at an alternate or remote location

• Personal belongings of staff: Usually not organizational assets.
• DR line-item revenues: Revenue is a financial impact, not a physical asset.
• Cloud-based applications: These are primarily logical or information-processing assets, even though they depend on physical infrastructure.

• Options:

• Answer: The correct choice is A (800-61r3).

• NIST SP 800-61 Rev. 3 is the dedicated guide for incident handling/response and reflects the latest guidance on the incident response lifecycle (preparation, detection/analysis, containment, eradication, recovery, post-incident activity).
• 800-61r2 is an older revision of the same incident response guide.
• 800-53 covers security and privacy controls, not a specific incident response standard.
• 800-171 focuses on protecting CUI in non-federal systems and networks, not incident response guidance.

• Amazon GuardDuty: Detects suspicious activity and threats using security-related data sources; it is not primarily a software vulnerability scanner.
• Amazon Detective: Helps investigate and analyze the root cause of security findings after an event.
• Amazon Cognito: Provides user authentication and authorization for applications.

• Multi-factor authentication
• A secure password change for users whose credentials may be compromised

• A. Implement retries with exponential backoff

• C. Reduce the frequency and/or size of requests

• B. Use PutRecord instead of PutRecords — PutRecord sends one record per call and does not remove the underlying throughput limitation. It may increase request overhead.
• D. Use Amazon SNS instead — SNS is not a direct fix for Kinesis shard throttling and changes the required streaming architecture.
• E. Reduce KCL consumers — KCL consumers read from Kinesis; they do not solve producer-side PutRecords throttling.

• Answer: No (B)

• SaaS (Software as a Service) delivers applications over the internet; you don’t manage the underlying infrastructure or OS.
• Deploying Azure virtual machines requires provisioning and managing virtual machines, OS, updates, and networking—this is classic IaaS (Infrastructure as a Service).
• PaaS is for managed runtime environments (apps hosted on a platform), not for VM deployment.

• What it’s asking: In an ARM template, for an Availability Set, what value should you set for the property platformFaultDomainCount to maximize availability during fabric failures or maintenance?

• Key concept: Fault domains are groups of hardware that can fail independently. By spreading VMs across more fault domains, you reduce the risk that a single hardware fault takes out many VMs.

• Important detail: For managed Availability Sets, the number of fault domains you can use varies by region — typically 2 or 3.

• What to choose: Set platformFaultDomainCount to the maximum supported in your region. In most regions this is 3, which gives you the best resilience. If your region only supports 2, you’d use 2.

• Answer: 3 (Max Value). In ARM template syntax, this would appear as "platformFaultDomainCount": 3 (within the Availability Set resource).

• Answer: Record Producer (option D)

• Why: In ServiceNow HR Service Delivery, to make an HR Service usable from the Employee Service Center (self-service portal), there must be a way for employees to submit the request. A Record Producer provides the employee-facing form that creates the underlying HR Case when submitted. Without a linked Record Producer, the HR Service wouldn’t offer a submit form in the Employee Center.

• What the other fields are generally for (not required for exposure):

• Quick check: Look at the HR Service definition and ensure a Record Producer is associated so employees can submit requests from the Employee Center.

• I can’t view the images, so I can’t tell which table is labeled as A in your screenshot. But here’s how to decide:

• How to identify the fact table:

• How to identify the surrogate key in the Patient table:

• Relationship:

• What the dataflow options mean:

• Why C fits best:

• Startup scripts run at computer startup, before any user logs on, making them ideal for machine-wide configuration on each new VM.
• They execute under the Local System account, which is appropriate for initial setup tasks.
• Linking a GPO to the OU ensures every new VM in that domain automatically receives the configuration—great for scalability.

• A) SetupComplete.cmd runs only once, right after Windows Setup, not on every boot, so it isn’t ideal for provisioning multiple VMs consistently.
• B) Logon scripts run per user, not per machine, so they aren’t reliable for initial VM configuration before a user signs in.
• D) Placing scripts in a VHD doesn’t automatically execute them.

• Basic: billing/subscription support only; no technical support requests can be opened.
• Developer, Standard, Professional Direct, and Premier: include technical support and allow opening new support requests.

• If option A corresponds to “Developer, Standard, Professional Direct, Premier,” that is the correct choice.
• If the option text is really “Premier only,” that would be incorrect per current Azure docs.

• DNS????????????????

• ???????????

• ????????????????

• Pull: Downloads changes from the central repository and updates the local repository.
• Push: Sends local commits to the central repository.
• Commit: Records local changes in the repository’s history.
• Merge: Combines changes from different branches.
• Clone: Creates a new local copy of a repository.

• Cutover: The old system is replaced immediately. It may be fast, but any failure can cause significant disruption.
• Phased: The system is introduced in stages, which reduces implementation risk but may prolong the transition.
• Pilot: The system is first deployed to a limited group or location. This is useful for testing but does not necessarily minimize downtime for the entire organization.

• B. Enable column profile — This turns on column profiling, which computes statistics like min and max for each column.
• C. Show column profile in details pane — This ensures the per-column profile is visible in the details pane.
• E. Enable details pane — This makes the details pane available so you can view the column profile there.

• A. Show column value distribution may help with distribution but isn’t specifically about min/max.
• D. Show column quality details shows data quality (valid/null counts), not min/max.

• Quick context: In a three-tier network (Access, Distribution, Core), roles are:

• Why A is correct: The Distribution layer runs Layer 2 and Layer 3 technologies. It often handles VLAN access (L2) and can perform inter-VLAN routing or connect to the core (L3). So it makes sense for the distribution layer to support both L2 and L3.

• Why B is correct: The Core layer is designed to maintain continuous connectivity when devices fail. It is built for high availability and redundancy, providing multiple paths so the network remains reachable even if some components fail.

• Why the others are not correct:

• Why: ADS is designed to collect information about on-premises environments to plan migrations. It inventories details like hostname, IP address, MAC address, OS, hardware, and installed software, plus dependency mappings. This data helps you understand your current environment before moving to AWS.

• How it differs from the other options:

• Practical use: Install the ADS agent on on-prem hosts to collect data, then view the inventory in Migration Hub to inform migration planning and sequencing.

1. Download the updated VPN client configuration package from the Azure VPN gateway.
2. Remove or update the existing VPN client configuration on the Windows 10 workstation.
3. Install the new package and reconnect.

• The correct answer is A: CCTV recordings are not regularly reviewed.

• CCTV is a monitoring/control mechanism. If recordings aren’t reviewed, security events (break-ins, policy violations, equipment tampering) can go undetected and unaddressed.
• Regular review is essential for deterrence, incident response, and forensic evidence. Without it, the entire CCTV control provides little value.

• B (records deleted after one year) affects forensic availability, but it’s a data-retention issue rather than the ongoing effectiveness of the surveillance program.
• C (footage not recorded 24x7) creates gaps in coverage, which is a concern, but regular review of available footage still supports detection; 24x7 coverage is a separate policy/perimeter issue.
• D (cameras not in break rooms) is more about privacy and space planning than core data-center security monitoring.