01. HCP exposes Prometheus metrics on an unauthenticated TCP port that accepts only GET requests, with all POST requests blocked. A security-conscious administrator wants to prevent ordinary users from reaching that port at all.
What does HCP's documentation recommend the administrator do?
a) Block the port on the user data networks, since the port itself has no authentication to rely on.
b) Restrict the port to POST requests only, since GET requests are easier to intercept.
c) Take no further action, since restricting the port to GET requests means it does not need to be blocked on the network as well.
d) Require the security role to be granted to any account that needs to query the port.
02. Once HCP has successfully joined an Active Directory domain, the resulting HCP Computer Account is used for essentially every subsequent AD operation.
How does HCP maintain the security of that account's credentials over time?
a) The password never changes after the join succeeds, because HCP discards it and does not store it.
b) HCP automatically changes the HCP Computer Account's password every 30 days.
c) HCP rotates the password only when a new physical node is added to the system, and not otherwise.
d) An administrator must manually reset the HCP Computer Account's password every 30 days; the Active Directory page is where that reset happens.
03. A developer authenticates to a namespace through the S3 compatible API using an Authorization header carrying AWS Signature Version 2 information, and wants the same header to carry an Active Directory identity. Why will that not work?
a) Active Directory is supported, but only where the request also presents a security policy
b) AD works with Signature Version 4 headers, so the request must be upgraded from V2
c) Header authentication supports only AWS local user account credentials
d) AD credentials must be supplied in a cookie instead, which the header displaces
04. Four HCP roles are being compared for their access to user and group account information: Monitor, Administrator, Security and Service. Which of these roles has no access at all to view or configure user and group accounts?
a) Service
b) Administrator
c) Security
d) Monitor
05. A tenant administrator is reviewing what a namespace's service plan is responsible for defining. What does an HCP service plan define for the objects in a namespace?
a) The namespace's permission mask together with its retention mode.
b) Only which storage tier objects are ingested into, with data protection configured completely separately.
c) Only how many redundant copies of an object are kept, without addressing where those copies are stored.
d) Both a storage tiering strategy and a data protection strategy, defined together rather than as separate, unrelated settings.
06. Two failed-over replication links need to be failed back: one active/active, one active/passive. How does the documented failback procedure differ between these two link types?
a) The active/passive link uses a single fail-back action, while the active/active link requires the two-phase begin-and-complete recovery process.
b) Failing back the active/active link is a single action, fail back; failing back the active/passive link has two phases, begin recovery and complete recovery, and begin recovery is always started manually.
c) Both link types require the two-phase begin-and-complete recovery process.
d) Both link types use the same single fail-back action; only the underlying data synchronization differs.
07. From the Tenant Management Console's Chargeback page, an administrator wants a report covering just the current calendar day rather than a longer or shorter span.
Which report frequencies does HCP document for tenant-level chargeback reports, and is a daily option among them?
a) Daily, weekly, or monthly; there is no hourly option.
b) Only monthly reports are available from the Chargeback page, since hourly and daily reporting are not documented as choices there.
c) Hourly, daily, or monthly, so a daily report is available.
d) Hourly or daily only; there is no monthly option.
08. Advanced downstream DNS configuration mode is enabled on an HCP system. An account holding only the administrator role attempts to use the Networks > Network View page to directly access the UNIX IP address management for the [hcp_system] network, and is refused.
Which role does HCP require for this level of direct access?
a) The service role, rather than the administrator role the account already holds.
b) The security role, since DNS integration is a security-configuration matter.
c) The administrator role, once advanced downstream DNS configuration mode has been enabled system-wide.
d) No additional role is required once advanced mode is enabled for the system.
09. Garbage Collection has just deleted an object that the Disposition service had earlier hidden and marked for deletion.
What, if anything, can this deletion cause to happen next?
a) The deletion can trigger the Storage Tiering service to rebalance the storage pool.
b) The deletion can trigger the Compression/Encryption service to rewrite the remaining objects in the pool.
c) When applicable, the deletion can trigger the Shredding service.
d) The deletion can trigger the Duplicate Elimination service to rescan the namespace for matching content.
10. In an A-to-B-to-C replication chain, system B is the primary system for the B-to-C link, using the tenants and directories it already receives from the A-to-B link as the source content for that second link.
What is the read-write status, on system B, of the items replicated to it from A?
a) Those items are read-write on B for administrative changes but read-only for client data access.
b) Those items remain read-only on B, even though B is also the primary system for the link from B to C.
c) Read-write status on B depends on whether the A-to-B or the B-to-C link was created first.
d) Those items become read-write on B once B is designated primary for the B-to-C link, the same way a replication topology configured at the system level is what determines which systems in the chain clients are allowed to write to.