01. Walking a capture file produced this summary:
total frames : 84,900
TCP : 61,430
UDP : 22,145
ARP : 1,180
other : 145
The team wants to know whether one particular application flow was present. What does this summary let them conclude?
a) That the capture is incomplete, because the four protocol rows do not account for every frame
b) That the flow was absent, because a flow of any size would have shown up in the "other" row
c) That nothing about the flow follows, because the tally counts protocols, not addresses
d) That the flow was present, because it runs over TCP and TCP frames dominate the capture
02. Halfway through building an automated compliance-check system, an engineer notices that a script reports on a narrower device set than the agreed specification demands. Rather than raise it, the engineer edits the specification in the shared document so the wording matches what the script already does.
Why is this a requirements-management failure?
a) The baselined requirement changed outside the agreed change process
b) The requirement is now unverifiable, because behaviour copied from code cannot be tested
c) The specification now holds a design decision that belongs in the architecture description
d) The stakeholder who raised the requirement is no longer recorded as its source
03. An audit script must check every access switch against a written policy, which has been expressed in the script as:
expected = {"ssh_enabled": True, "telnet_enabled": False, "min_password_length": 12}
What must the script do to turn that structure into a policy check?
a) Record the current values from each device as the expected values, then compare later runs against those
b) Apply each expected value to every device and report the devices that accepted the change
c) Confirm that every device exposes all three fields and treat a device that does so as compliant
d) Compare each expected value with the value collected from the device, flagging every mismatch
04. Two automation projects run on the same jump host. One is pinned to an older release of a shared dependency and must not be disturbed when the other project is updated.
Why does giving each project its own virtual environment address this?
a) Each environment keeps the project source in its own directory, so the two projects cannot import each other by accident.
b) Each environment holds its own installed packages, so a version installed for one project is not the version the other project imports.
c) Each environment runs the project in a separate process space from the other.
d) Each environment locks the interpreter to the system build.
05. One script performs two parsing jobs. It scrapes a vendor support page, published as a web page, to read an end-of-life table. It also turns the text output of an interface status command, collected from a switch, into structured data.
Which assignment of libraries fits the two jobs?
a) Beautiful Soup handles both, because neither text carries a formal schema and both need pattern-based extraction.
b) Genie handles both, because both texts are produced by the same vendor and therefore share a parsing model.
c) Beautiful Soup handles the support page and Genie the command output, because one parses markup and the other device text.
d) Beautiful Soup handles the command output because console text is markup.
06. Scoping a new interface-utilisation reporting system, a team writes down the switches it will poll, the ticketing system it will file reports into, and the operators who will read those reports. It writes down nothing else.
In systems terms, what has the team described?
a) The system boundary and the external interfaces that cross it
b) The system requirements, because each named entity implies behaviour
c) The system state, because these are the things the system tracks
d) The system architecture, because the parts and their connections are named
07. A reporting script reads a JSON payload from each device API and uses the field named in_octets. After a firmware release renames that field, the script fails on every device in the estate on its next run. The devices themselves are forwarding traffic normally and their configurations are unchanged.
Which systems concept does the failure illustrate?
a) Configuration drift, since the devices no longer match their intended configuration
b) A failure domain that was drawn too wide, since one script served every device
c) A loss of idempotence, since repeated runs no longer produce the same result
d) A broken interface contract with the device data model the script consumes
08. Two teams build the same interface-audit tool. Team A specifies every feature, builds for eight weeks, then integrates and tests against live devices in week nine. Team B delivers a working audit of one device family in week one and adds one family per week, testing against live devices each time.
Which statement identifies the main systems risk Team A carries and Team B does not?
a) Team A delivers nothing until week nine
b) Team A leaves assumptions about real devices untested until they cost most to fix
c) Team A writes more code before any review
d) Team A has no requirements baseline, so its scope drifts across the eight weeks
09. One audit script compares each device against a snapshot of that same device taken last quarter. A second compares each device against the written security policy. Both report differences.
What distinguishes what the two reports mean?
a) The first names what changed since the snapshot and the second what fails the standard
b) They name the same devices, because a device that has drifted from its snapshot has necessarily left the policy
c) The second is meaningful only once the first has run, because a deviation must be dated before it can be judged
d) The first is stricter, because a snapshot captures every setting while a policy states only a few
10. During requirements definition for an interface-monitoring system, one entry reads: "The system shall use Netmiko to open an SSH session to each switch every five minutes and collect interface counters." A reviewer asks for it to be rewritten.
What is wrong with the entry as written?
a) It is unverifiable, because polling behaviour cannot be demonstrated in a test
b) It is design detail, since it names an implementation inside a requirement
c) It is ambiguous, because the collection interval supports more than one reading
d) It is a non-functional requirement recorded among the functional ones