Veritas VCS-285 Exam Prep
Veritas NetBackup 10.x and NetBackup Appliance 5.x Administrator (Page 4 )

• A: Allow SAN certificates — SANs are used to identify valid hostnames in a certificate. They do not bypass trust validation.
• C: Open the secure LDAP port — A blocked port would normally cause a timeout or connection-refused error, not certificate errors.
• D: Increase the TLS version on the RA — The issue concerns certificate trust, not the organization’s registration authority.

• Accept: Acknowledging the risk without taking additional action.
• Transfer: Shifting the risk’s impact to a third party, such as through insurance or outsourcing.
• Mitigate: Reducing the likelihood or impact of the risk through security controls.
• Avoid: Eliminating the activity or process that creates the risk.

1. Create a custom Sensitive Information Type (SIT) in the Microsoft Purview portal.
2. Use a regular expression to match the 32-character alphanumeric account number.
3. Reference that SIT in the DLP policy protecting SharePoint Online.

• Format-based data ? custom SIT with RegEx
• Built-in sensitive data ? Microsoft-provided SIT
• Document classification/protection ? sensitivity labels
• Security investigation queries ? Advanced Hunting, not DLP detection

sql 
CREATE TABLE my_table 
USING CSV 
OPTIONS (path '/path/to/csv');

sql 
CREATE TABLE my_table 
USING CSV 
LOCATION '/path/to/csv';

• USING CSV specifies the file format.
• path or LOCATION specifies where the files are stored.
• USING DELTA would be used only when the source data is in Delta format.
• FROM is used in a SELECT statement, not normally as the format declaration in CREATE TABLE.

• A. IDS attack signatures: An IDS primarily detects suspicious network activity and usually does not provide dedicated file-upload malware scanning. It is generally detective rather than preventive.
• C. Load balancer: Distributes traffic among servers and improves availability; it does not inspect documents for malware.
• D. WAF: Helps block web-application attacks such as SQL injection, command injection, and XSS. Although a WAF may inspect upload requests, malware detection in PDF files is more directly addressed by antivirus or content-scanning functionality.

• Storage accounts: storage1, storage2, and storage3
• Log Analytics workspace: Analytics3

• Azure Backup reports can send the AzureBackupReports diagnostic log to eligible storage accounts. The storage account’s subscription and region do not have to match the Recovery Services vault, so all three listed storage accounts are valid.
• The Log Analytics workspace must be in the same region as the Recovery Services vault for this configuration. Vault1 and Analytics3 are both in West Europe, making Analytics3 the valid workspace.

• A — Can help keep costs down and improve quality: The provider may have specialist expertise, efficient systems and economies of scale.
• B — There is a known fee if agreed in advance: A fixed or agreed fee can make costs more predictable and support budgeting.
• C — Allows management to focus on core operations and issues: Senior managers spend less time supervising routine finance processes and more time on strategic matters.

• Increased control: Control may decrease because the activity is performed externally.
• Increased independence: The organisation becomes dependent on the supplier.
• Increased understanding of the outsourcing business: The internal organisation usually has greater business knowledge; the provider may initially lack it.
• Increased confidentiality: Sharing financial information externally may create confidentiality risks.
• Internal expertise improved: Outsourcing can reduce opportunities to develop internal finance skills.

• A. A virtual network gateway
• D. A virtual network

• Azure virtual machines must be connected to an Azure virtual network (VNet). The VNet provides private IP addressing and network connectivity for the VMs.
• A virtual network gateway enables communication between the Azure VNet and the on-premises network, typically through a site-to-site VPN or ExpressRoute connection.

• Load balancer: Distributes traffic among Azure VMs; it does not connect Azure to an on-premises network.
• Application gateway: Provides web-application load balancing and Layer 7 routing; it is not the normal resource for on-premises connectivity.
• Gateway subnet: A gateway subnet is required inside the VNet when deploying a virtual network gateway, but the question’s intended two primary resources are the VNet and virtual network gateway.

text 
heartrateheartrateheartrate

• Spark column objects can be multiplied, for example:

python 
  df["heartrate"] * 3

• A DataFrame itself cannot be multiplied, but the expression is referring to a column.
• It is also not primarily a Python syntax error; the code was parsed, then Spark failed while resolving the column name.

• Data loss prevention (DLP): Helps detect or prevent unauthorized data transfers, but does not directly protect data on a stolen, powered-off laptop.
• Operating system hardening: Reduces vulnerabilities and attack surface, but does not adequately protect stored data if the device is stolen.
• Boot security: Helps prevent unauthorized operating systems or boot media from loading. It supports device security but is not the primary solution for protecting the data itself.

• Forecasting lets sales leaders predict revenue for upcoming fiscal periods, compare forecasts with targets, and review performance by salesperson or team.
• Opportunity Stages help determine the likelihood that opportunities will close. Each stage can have a probability, which contributes to forecast calculations.

• Sales Quotes: Used to present pricing or product proposals to customers; they do not provide revenue forecasting.
• Opportunity List View: Helps users filter and view opportunities, but it is not the forecasting tool.

• Residual neural network (ResNet): Primarily used for computer vision tasks such as image classification.
• Support vector machine (SVM): Commonly used for classification and regression, not natural-language query generation.
• WaveNet: Designed mainly for generating or modeling audio and speech.

• ADF: Automatic Document Feeder; a printer/scanner hardware component.
• USB: A short-range wired connection, not a protocol for accessing a remote shared folder.
• PCL: Printer Control Language; it describes how print jobs are formatted, not how files or printers are shared over a network.

• 16 VMs: one failure loses 25 GB and 10 cores—only 6.25% of memory.
• 8 VMs: one failure loses 12.5% of memory.
• 4 VMs: one failure loses 25%.
• 1 VM: one failure loses the entire application environment.

• Uses on-premises data or resources
• Runs components in the cloud
• Can scale across multiple cloud environments when demand increases

• Public cloud: Resources are hosted entirely by a cloud provider.
• Private cloud: Resources are dedicated to one organization, usually in its own environment.
• Hybrid: Combines on-premises and cloud resources.

• A — Correct: Flow Builder is declarative and visual, so administrators and other non-developers can participate in designing and improving business processes without writing Apex.
• D — Correct: Flow Builder provides visual debugging tools, allowing an admin to test paths, inspect variable values, and identify where a specific business case fails.
• E — Correct: A flow’s visual structure documents the logic and makes later maintenance easier than reading and updating custom Apex code.

• B — Incorrect: Flow debugging does not attach a debugger to live customer sessions. The admin uses Flow Builder’s debug functionality with test inputs; this is not live-session debugging and should not be used to monitor real customer transactions.

• A — conformant: Incorrect because one explicit requirement is violated.
• B — consistent: “Consistent” is not sufficient where the implementation contradicts a mandatory specification. The RPC mechanism is covered by the architecture, and the implementation differs from it.
• C — consistent: Incorrect reasoning: the RPC mechanism does have a defined architectural requirement, so conformance must be assessed.
• D — non-conformant: Correct because the implementation fails to follow the specified RPC/threading requirement.

• The files are stored in a document library, which is exposed through the SharePoint Folder connector.
• The connector returns file metadata, including Folder Path, Name, and Content.
• In Power Query, filter Folder Path so only files in the manufacturing reports folder are retained.
• You can then combine the remaining Excel files because they all have the same structure.

• SharePoint List is for SharePoint lists, not document-library files.
• Combine & Load combines files immediately, before you filter to the required folder, and may include unwanted files.
• Transform gives you the opportunity to filter the file list first, which is more efficient and targeted.

• Admin access to the deployment pipeline (B) – lets the developers use the pipeline and deploy content.
• Contributor access to the Development and Test workspaces (E) – required to deploy items into those workspaces.
• Viewer access to the Production workspace (D) – lets them view Production content without allowing deployment or modification.

• Contributor access to Production (F), because that could allow changes or deployment there.
• Viewer access to Development/Test (C), because Viewer is insufficient for deployment.
• Build permission to Production semantic models (A), because building reports on a semantic model is not required merely to view Production items.

• A. Extranet
• B. VLAN
• C. Intranet
• D. VPN

• Prevent connections to malware command-and-control servers
• Identify infected systems making those DNS requests
• Collect information for incident response

• A: Attackers do not normally use sinkholes to map a company’s domain structure.
• B: Redirecting employees from legitimate sites to attacker-owned sites describes malicious DNS manipulation, not a defensive sinkhole.
• D: Attracting attackers away from real resources is more closely associated with a honeypot or deception system.

• Creating and managing users and roles
• Granting and revoking roles and privileges
• Managing access-control responsibilities

• SYSADMIN: Manages warehouses, databases, schemas, and other objects—not primarily users and roles.
• PUBLIC: Automatically granted to every user; it is not an administrative role.
• ACCOUNTADMIN: Has the highest level of access, but should be reserved for account-level administration and emergencies rather than routine security tasks.

• The user starts in the corporate portal.
• The portal launches the Salesforce resource.
• The IdP sends the SAML response to Salesforce.

• Connected App + OAuth is for OAuth authorization and API/app access, not this SAML-based seamless login scenario.
• SP-initiated SSO would begin when the user first requests the Salesforce resource and Salesforce redirects them to the IdP. That is not the described starting point.

• Árvores de decisão: usam regras sequenciais, como “se característica X > valor, siga para este ramo”. São fáceis de visualizar e explicar. Atendem bem a problemas de classificação e regressão com alta interpretabilidade.

• Regressão linear: prevê um valor numérico contínuo, como preço, custo ou temperatura. Não é a escolha principal para classificar genes em categorias.

• Regressão logística: calcula a probabilidade de uma categoria. Pode atender à classificação, inclusive multiclasses, mas sua explicação costuma ser menos intuitiva que uma árvore para documentar decisões.

• Redes neurais: atendem a tarefas complexas, como imagens, texto e padrões não lineares. Porém, são menos interpretáveis, funcionando mais como uma “caixa-preta”.

• GPU: A failure may cause no video output, but the PC usually still powers on.
• RAM: Can prevent booting or produce error beeps, but fans and power indicators generally work.
• CPU: Can prevent startup or booting, but it usually does not cause a completely lifeless system.

• IaaS: You deploy and manage virtual machines, operating systems, disks, and networking. Azure manages the physical datacenter and host infrastructure.
• PaaS: Azure manages the operating system and runtime so you can focus on deploying applications, such as with Azure App Service or Azure Functions.
• SaaS: You consume a complete, provider-managed application.

• You provision the virtual machine.
• You manage the guest operating system, applications, and configuration.
• Azure manages the physical servers, datacenter, and underlying virtualization infrastructure.

• Amazon DynamoDB — Managed NoSQL database, not PostgreSQL.
• Amazon Athena — Serverless service for querying data in S3; intended for analytics, not OLTP.
• Amazon EMR — Managed cluster platform for big-data frameworks such as Hadoop and Spark.

• The connecting host keeps the private key securely.
• The destination host stores the corresponding public key in its authorized keys.
• Authentication can occur without a person entering credentials each time.
• SSH also provides encrypted communication and host authentication.

• Biometric: Requires a human user and is difficult to automate.
• Smart card: Often requires user interaction or card access.
• Hard-coded password: Unsafe because passwords stored in scripts or applications can be exposed, reused, or difficult to manage securely.

1. The sender hashes the original message and sends the message plus its hash.
2. The receiver applies the same hashing algorithm to the received message.
3. The receiver compares the newly calculated hash with the sender’s hash.
4. Matching values indicate that the message was not altered in transit.

• A binary image is not the normal description of a hash result.
• Using a different algorithm produces a different type of digest, so the values cannot be directly compared.
• Hashing verifies integrity, but by itself does not prove who sent the message. Digital signatures or MACs address authentication and integrity together.

• You normally do not create a new sensitive information type for credit card numbers. Microsoft Purview already provides a built-in Credit Card Number sensitive information type.
• The required sequence should generally be:

• Azure Resource Manager (ARM) templates define Azure resources in a declarative JSON file.
• You can deploy the same template repeatedly for each business unit, ensuring that identical resources are created consistently.
• Templates reduce manual administrative effort and support repeatable, automated deployments.
• Parameters can customize values such as names, regions, and sizes while keeping the overall resource configuration the same.

Correct choices

• DB1: Azure Data Box Heavy
• Virtual machines: Azure Migrate

Why

• Replication with minimal downtime
• A test migration
• Final cutover after validation

• Drops packets when traffic exceeds a certain bitrate: This describes traffic policing, not shaping.
• Fragments large packets and queues them: Shaping does not fragment packets as its primary congestion-control action.
• Drops packets randomly from lower-priority queues: Packet dropping may occur if a shaping queue becomes full, but it is not the defining behavior.

• Shaping: buffers and delays excess traffic.
• Policing: drops or marks traffic that exceeds the configured rate.

• A — Reports: Reports are informational and don’t enforce access during an SSO transaction.
• B — Apex trigger and Permission Sets: A trigger could update permissions when a Case changes, but this creates synchronization and timing issues. It also changes Salesforce permissions rather than making a direct, real-time decision for the external system.
• C — Custom SAML JIT Provisioning: JIT provisioning is primarily for creating or updating users at login. It isn’t the appropriate mechanism for dynamically querying business records and deciding whether access should be granted.
• D — Connected App Handler: Designed for custom, programmatic control during connected-app authentication and authorization. Apex can check the user’s current open classified cases and permit or reject the SSO request.

• R-squared (R²): mede quanto da variação dos valores reais é explicada pelo modelo. É mais usado em regressão, não em classificação.

• Accuracy (acurácia): mede a proporção de previsões corretas em relação ao total. É adequada para a classificação de imagens da questão.

• RMSE (Root Mean Squared Error): mede o tamanho médio dos erros entre valores previstos e reais, penalizando erros maiores. É usado principalmente em regressão.

• Learning rate (taxa de aprendizado): controla o tamanho dos ajustes feitos pelo modelo durante o treinamento. Não é uma métrica de avaliação; é um hiperparâmetro.

json 
{ 
  "Effect": "Deny", 
  "NotAction": [ 
    "iam:*", 
    "route53:*", 
    "cloudfront:*", 
    "support:*" 
  ], 
  "Resource": "*", 
  "Condition": { 
    "StringNotEquals": { 
      "aws:RequestedRegion": "eu-west-1" 
    } 
  } 
}

• SCPs set maximum permissions; they do not grant permissions. The default SCP allows actions, so the restriction must be an explicit Deny.
• aws:RequestedRegion checks the Region targeted by an API request.
• StringNotEquals: eu-west-1 denies requests directed to every other Region.
• NotAction allows designated global services to remain usable because they do not operate in a single AWS Region.
• Attaching the SCP to the OU makes it apply to existing accounts and accounts later added to that OU.

• IPsec: Protects traffic at the network layer, commonly for VPNs; it is not WPA2’s authentication protocol.
• SSL: Protects specific application sessions and has largely been replaced by TLS.
• SSH: Secures remote command-line administration.

• SOW
• SLA
• MOA
• MOU

• Application management: Controls which apps can be installed or used; it does not remove existing data after theft.
• Full-disk encryption: Protects data when the device is powered off or locked, but it may not help if the attacker has already unlocked the device.
• Containerization: Separates corporate data from personal data, but the attacker may still access the corporate container using the stolen credentials.

• Restarting the device: may fix software problems, but not a directional connection issue.
• Swollen battery: is a safety concern, but would not typically cause recognition only in one orientation.
• Failing cable: possible in general, but less likely because it works on other similar devices.
• Dirty or damaged port: best matches the symptoms. Inspect and carefully clean the port, or have it serviced if damaged.

• A — Add a Path for Stage: A Path lets users update the Opportunity’s Stage directly from the record page, without opening the full edit form. It can also display guidance and key fields.
• B — Use a Kanban list view: Users can move Opportunities between stages by dragging records between columns, which is ideal when Stage is the only field they normally change.

1. Determine which host was infected first—the originating host.
2. Decide whether each other host is clean or infected based on communication and event logs.

• Compare timestamps and find the earliest suspicious event.
• Look for the host that initiated the malicious connection, file transfer, exploit, or command—not merely a host that later received traffic.
• Follow the timeline through the firewall:

• A host is likely infected if it both receives suspicious activity and then initiates related malicious traffic.
• A host may be clean if the firewall blocked the connection and there is no evidence of execution or follow-on communication.

Flat organisation

• Few levels of management
• A wide span of control—managers supervise many employees
• Shorter communication channels
• More employee autonomy and quicker decisions
• Fewer formal promotion levels

Tall organisation

• Many levels of management
• A narrow span of control—managers supervise relatively few employees
• A clear hierarchy and reporting structure
• More formal supervision and communication channels
• More obvious promotion and career stages

• Help the team identify the causes of delays.
• Encourage continuous improvement through retrospectives.
• Support the team in changing its process, tools, or collaboration methods.
• Help remove impediments that the team cannot resolve independently.

• A: An impediment log may help, but simply maintaining it does not ensure the impediments are resolved.
• B: Directing the team to solutions conflicts with agile self-management.
• C: Adding impediments to the product backlog could delay their resolution and treats them like product features.

• The target API uses HTTPS, so Mule must validate the server’s TLS certificate.
• The TLS configuration is set to None, meaning no custom truststore is configured.
• Mule therefore uses the JRE’s default truststore to determine whether the target certificate is trusted.
• If the issuing CA certificate is in that truststore, the TLS handshake can succeed.
• If it is absent—or the certificate is otherwise invalid—the request fails with a TLS/handshake error.

• Business
• People
• Governance
• Platform
• Security
• Operations

• Cloud financial management
• Portfolio and program management
• Risk management
• Data governance
• Compliance and oversight

• Interactive development and exploration
• Small datasets
• Lightweight transformations or testing
• Avoiding the overhead and cost of multiple workers

• Automated reports: Jobs may benefit from job clusters or SQL warehouses.
• Working with SQL in Databricks SQL: Databricks SQL warehouses are the relevant compute option.
• Automatically scaling for larger data: A multi-node cluster with autoscaling is more suitable.
• Large amounts of data: Distributed worker nodes are generally needed.

• Premium file shares: contoso104 only
• Blob access tiers: contoso101, contoso102, and contoso103

• Premium Azure Files shares require a storage account with the FileStorage account kind. This is a specialized account type and is not used for blob storage.
• Blob access tiers such as Hot, Cool, and—where supported—Archive apply to blob-capable accounts, such as General-purpose v2 or BlobStorage accounts shown in the exhibit.
• contoso104 is therefore excluded from the blob-tier selection because it is the premium Files account.