# Question practice · Free sample

## Windows & identity

### Q1
**Tags:** win-identity, win-eventlog
**Key terms:** logon type 3 ;; network logon ;; event 4625

Which logon type appears in event 4625 when a user connects to a file share over the network?

- **A.** 2 — Interactive
- **B.** 3 — Network
- **C.** 5 — Service
- **D.** 10 — RemoteInteractive

**Correct answer:** B

**Explanation:** Logon type 3 is a network logon: file shares, IIS with Windows authentication, SQL using Windows auth and saved-credential mappings. Type 2 is someone at the console, type 5 is the Service Control Manager starting a service, and type 10 is RDP.

### Q2
**Tags:** win-identity, win-kerberos
**Key terms:** kerberos ;; clock skew ;; 5 minutes ;; w32time ;; pdc emulator

A domain controller's clock drifts. Kerberos authentication starts failing across the domain while NTLM-based access still works. What is the default maximum clock skew Kerberos tolerates?

- **A.** 5 minutes
- **B.** 30 minutes
- **C.** 1 hour
- **D.** There is no limit

**Correct answer:** A

**Explanation:** Kerberos rejects a ticket request when the difference between the client and DC clocks exceeds 5 minutes by default (a `KRB_AP_ERR_SKEW` / 0x25 failure). Fix the time source — usually w32time against a reliable NTP or the PDC emulator — rather than widening the policy.

## IT troubleshooting

### Q1
**Tags:** win-identity, win-kerberos

A server's clock drifts 12 minutes. Users can browse file shares but cannot authenticate to one application. Why?

- **A.** Kerberos requires the client and server clocks to be within 5 minutes
- **B.** The server is out of disk space
- **C.** The users' passwords expired
- **D.** The application needs a restart

**Correct answer:** A

**Explanation:** Kerberos tickets carry timestamps and the default maximum tolerance is 5 minutes. Beyond that the ticket is rejected as expired or not yet valid. SMB may still work in some configurations via cached credentials, which is why the symptom looks partial. Fix time first: point the server at the domain hierarchy and run `w32tm /resync`.

**Trap:** Chasing the application when the real fault is a clock. Time skew looks like a permissions problem.

**Why C is wrong:** An expired password fails everywhere at once, not on one application.

### Q2
**Tags:** win-domain, win-identity

A workstation shows "The trust relationship between this workstation and the primary domain failed". The user can still log on with cached credentials, but network drives are gone. What has happened?

- **A.** The machine account password in Active Directory no longer matches the one on the workstation
- **B.** The user's password expired
- **C.** The DNS server is down
- **D.** The workstation needs a new licence

**Correct answer:** A

**Explanation:** Every domain-joined machine keeps a rotating secret with its computer account. When the two drift — commonly after restoring a VM snapshot, cloning, or long offline time — the secure channel fails and domain authentication stops, while cached credentials still allow local logon. The fix is to re-establish the channel: `Test-ComputerSecureChannel -Repair` (with credentials), or unjoin/rejoin. If snapshots or clones are involved, fix the root cause too, or it returns.

**Trap:** Rejoining the domain immediately. It works, but it hides whether snapshots are silently reverting machine secrets.

**Why B is wrong:** An expired user password would block the interactive logon, and cached credentials would not help.

## AWS

### Q1
**Tags:** cloud-shared-responsibility, cloud-security

Under the AWS shared responsibility model, which of the following is AWS responsible for?

- **A.** Patching the guest operating system on an EC2 instance
- **B.** Physical security of AWS datacentres
- **C.** Configuring security group rules
- **D.** Encrypting data in customer-controlled S3 buckets

**Correct answer:** B

**Explanation:** AWS is responsible for security **of** the cloud — the facilities, hardware, network and hypervisor. You are responsible for security **in** the cloud — the guest OS, data, and configuration of your resources.

**Trap:** A. Applying OS patches is the most-answered wrong option. The split moves with the service model: on EC2 you patch; on Lambda or RDS AWS patches.

**Why C is wrong:** Security groups are your configuration, not AWS infrastructure.

### Q2
**Tags:** cloud-economics

Which cloud benefit describes replacing a large upfront hardware purchase with pay-as-you-go billing?

- **A.** Massive economies of scale
- **B.** Trade fixed expense for variable expense
- **C.** Stop guessing capacity
- **D.** Go global in minutes

**Correct answer:** B

**Explanation:** This is the CapEx-to-OpEx shift, one of the six advantages of cloud computing. "Stop guessing capacity" is about elasticity and over-provisioning — a different advantage.

**Trap:** C. Both are advantages, but only B is about the shape of the cost.

## Azure

### Q1
**Tags:** cloud-shared-responsibility

In the shared responsibility model, which tasks always remain the customer's responsibility regardless of the service model?

- **A.** Physical security of the datacentre
- **B.** Information and data, accounts and identities, and devices
- **C.** The hypervisor and host operating system
- **D.** The physical network

**Correct answer:** B

**Explanation:** Data, identity and your endpoints are always yours, in every model. Everything above that shifts: in IaaS you patch the OS, in PaaS the provider does, in SaaS you mostly just manage your users and data.

**Trap:** C. The hypervisor is always Microsoft's, which makes it a popular wrong answer for anyone who has only run IaaS.

### Q2
**Tags:** cloud-economics

Which cloud benefit does the phrase \"trading capital expenditure for operational expenditure\" describe?

- **A.** High availability, where redundant components keep the service reachable through a component failure rather than changing how the service is paid for
- **B.** Consumption-based pricing replacing large upfront hardware purchases
- **C.** Elasticity
- **D.** Fault tolerance

**Correct answer:** B

**Explanation:** With cloud, you pay for what you consume rather than buying servers upfront. This is the CapEx-to-OpEx shift, and it removes the risk of over-provisioning hardware for a peak that never arrives.

## PowerShell

### Q1
**Tags:** powershell-objects, powershell-pipeline

In PowerShell, what is passed along the pipeline between cmdlets?

- **A.** Plain text lines only
- **B.** .NET objects with properties and methods
- **C.** Serialised JSON
- **D.** Strings formatted by `Format-Table`

**Correct answer:** B

**Explanation:** PowerShell pipelines pass .NET objects. This is why `Get-Process | Where-Object CPU -gt 10` can filter on a real numeric property instead of parsing text — the single biggest difference from bash.

**Trap:** A and D. `Format-Table` looks like it produces text, but it only happens at the very end of a pipeline for display.

**Why A is wrong:** That is how POSIX shells work, not PowerShell.

**Why D is wrong:** `Format-` cmdlets produce formatting directives for the host, not data for other cmdlets.

**Objective:** PowerShell fundamentals

### Q2
**Tags:** powershell-pipeline, powershell-filtering

You need only the `Name` and `Status` properties from a large result set. Which cmdlet do you use?

- **A.** `Format-Table Name,Status`
- **B.** `Select-Object Name,Status`
- **C.** `Where-Object Name,Status`
- **D.** `Out-String Name,Status`

**Correct answer:** B

**Explanation:** `Select-Object` creates new objects with just those properties, which you can still pass down the pipeline. `Format-Table` also *displays* only those columns, which is why it is the trap.

**Trap:** A. Use `Format-Table` only when the output is the end of the line (a human reads it).

**Objective:** Filtering and shaping output