First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.
Continue in the practice tool above to load more questions, 50 at a time.
Question 1End User Computing Fundamentals
A user reports that their laptop display is extremely dim even at maximum brightness and is hard to read outdoors. Which component is most directly responsible for illuminating the panel in this situation?
- The graphics processing unit
- The digitizer layer
- The display ribbon cable
- The backlight assembly Correct answer.
Explanation
LCD panels do not emit light themselves, so a backlight assembly provides the illumination that makes the image visible. When brightness stays low at maximum setting, the backlight, its inverter or driver, or the related power path is the first suspect. The GPU renders pixels but does not supply panel lighting.
Question 2End User Computing Fundamentals
A technician must connect a peripheral that requires a reversible, compact connector supporting power delivery and video on a modern thin laptop. Which port type best matches this requirement?
- RJ45
- USB Type-C Correct answer.
- USB Type-A
- VGA
Explanation
USB Type-C is reversible, compact, and can carry power delivery, data, and video when the port supports the relevant alternate modes. Type-A is larger and not reversible, RJ45 is for wired networking, and VGA carries analog video only.
Question 3End User Computing Fundamentals
An office worker wants to keep a copy of important files on an external drive that can be stored in a safe overnight. Which storage characteristic matters most for this requirement?
- The drive is removable and portable Correct answer.
- The drive is permanently mounted inside the chassis
- The drive has the highest possible sequential read speed
- The drive uses the same bus as the system memory
Explanation
The requirement is physical portability so the copy can be locked away separately from the computer. Read speed, internal mounting, and memory bus type do not address off-site or locked storage of a backup copy. Removable external media directly satisfies the stated need.
Question 4End User Computing Fundamentals
Which statement correctly describes the role of an operating system on an end-user workstation?
- It compiles application source code into machine instructions at install time
- It permanently stores user documents in nonvolatile firmware
- It provides the physical network cabling and switching for the office
- It manages hardware resources and provides services that applications use Correct answer.
Explanation
An operating system allocates CPU, memory, storage, and device access, and exposes interfaces that applications call. It does not compile source code as a core function, does not supply network cabling, and does not keep user documents in firmware.
Question 5End User Computing Fundamentals
A user asks why a wired Ethernet connection is generally preferred over Wi-Fi for a desktop that stays in one place and needs stable throughput. Which reason is most accurate?
- Wired links always provide a higher IP address range
- Wired links encrypt traffic by default at the physical layer
- Wired links avoid shared-air interference and contention Correct answer.
- Wired links do not require any network configuration
Explanation
Ethernet uses a dedicated cable medium, so it is not subject to radio interference, signal attenuation through walls, or contention with other wireless clients. Address ranges and configuration requirements are the same as on wireless. Encryption is not provided by the cable itself.
Question 6End User Computing Fundamentals
A user wants to reduce the risk of losing work if the computer loses power unexpectedly. Which practice addresses this directly?
- Increasing the display resolution
- Saving documents frequently and enabling autosave where available Correct answer.
- Using a larger mouse pad
- Disabling the screen saver
Explanation
Frequent saving and autosave features limit how much unsaved work exists in volatile memory when power is lost. Display resolution, screen saver settings, and input accessories do not affect data persistence. The goal is to move work from memory to storage often.
Question 7End User Computing Fundamentals
Which action best describes applying an operating system update on an end-user device?
- Changing the desktop wallpaper to a corporate standard
- Renaming the computer to match an asset tag
- Installing vendor-provided patches that fix defects and close security gaps Correct answer.
- Reformatting the drive and reinstalling all user applications
Explanation
OS updates are vendor-supplied patches and feature releases that correct bugs and remediate vulnerabilities. Reimaging, cosmetic changes, and renaming are separate administrative tasks. Keeping the OS patched is a core maintenance routine.
Question 8End User Computing Fundamentals
A user complains that a wireless mouse cursor jumps and stalls intermittently. Which first step is most appropriate?
- Reinstall the operating system from scratch
- Reconfigure the router's DHCP scope
- Replace the batteries or recharge the device and check the receiver connection Correct answer.
- Replace the laptop display panel
Explanation
Intermittent wireless input problems commonly stem from depleted batteries or a poor receiver connection, so power and link checks come first. Reinstalling the OS, replacing a display, and changing DHCP settings are disproportionate and unrelated to the symptom. Start with the simplest likely cause.
Question 9End User Computing Fundamentals
A user needs to move a 40 GB video project to another workstation using a single portable drive. Which file system consideration is most relevant if the drive must hold files larger than 4 GB?
- The file system must support large individual files, such as exFAT or NTFS Correct answer.
- The file system must be FAT32 for cross-platform compatibility
- The drive must be formatted with a journaling file system
- The drive must use a 512-byte sector size
Explanation
FAT32 caps individual file size at 4 GB, so a 40 GB single file cannot be stored on it. exFAT and NTFS both support very large files, and exFAT is common for portable cross-platform media. Journaling and sector size are separate considerations.
Question 10End User Computing Fundamentals
An end user's laptop battery drains rapidly even when the machine is idle and the lid is closed. Which setting is the most likely contributor to investigate first?
- The sleep and hibernate power plan behavior Correct answer.
- The default printer selection
- The keyboard repeat rate
- The desktop icon spacing
Explanation
Rapid drain while idle and closed suggests the system is not entering a low-power state, so sleep and hibernate settings are the primary suspect. Icon spacing, printer choice, and key repeat rate have negligible power impact. Checking whether sleep is disabled or blocked is the logical first step.
Question 11End User Computing Fundamentals
A user cannot open a shared folder on the office network, but internet browsing works normally. Which area should be investigated first?
- Name resolution and permissions for the internal share Correct answer.
- The local print spooler queue
- The public website certificate chain
- The monitor's color profile
Explanation
Working internet access shows the basic network path is functional, so the failure is specific to the internal share. That points to name resolution for the server or to share and NTFS permissions. Certificate chains for public sites, display color profiles, and print queues do not govern file-share access.
Question 12End User Computing Fundamentals
A user wants to protect a laptop with a password so that a thief cannot read the drive by removing it and attaching it to another machine. Which control best addresses this?
- A strong account password on the user profile only
- Full-disk encryption tied to a startup authentication step Correct answer.
- A screen lock timeout of one minute
- A BIOS password that prevents changing boot order
Explanation
Full-disk encryption protects data at rest, so a removed drive is unreadable without the key. An account password alone does not stop offline reading of an unencrypted disk. A firmware password restricts configuration changes, and a short screen lock only covers an unlocked session.
Question 13End User Computing Fundamentals
A user complains that a newly installed application runs slowly and the system feels sluggish overall. Which built-in resource should be checked first to identify the bottleneck?
- The default browser homepage
- The list of installed fonts
- Task Manager performance counters for CPU, memory, disk, and network Correct answer.
- The monitor refresh rate
Explanation
Performance counters reveal which subsystem is saturated, directing further troubleshooting. Fonts, refresh rate, and browser homepage settings do not identify resource bottlenecks. Checking CPU, memory, disk, and network usage is the standard first diagnostic step.
Question 14End User Computing Fundamentals
A user asks how to safely remove a USB flash drive after copying files. Which practice reduces the risk of data corruption?
- Use the safe-eject option before unplugging the drive Correct answer.
- Shut down the computer without ejecting the drive
- Unplug the drive as soon as the copy dialog closes
- Rename the drive before unplugging it
Explanation
Safe eject flushes cached writes and releases the volume so the file system is consistent before removal. Unplugging immediately can interrupt pending writes. Shutting down without ejecting and renaming do not guarantee that buffers are flushed.
Question 15End User Computing Fundamentals
An organization wants users to access a set of internal web applications without exposing them to the public internet. Which approach best fits this requirement?
- Place the servers on the guest wireless network
- Publish the applications on the internal network and require VPN access from outside Correct answer.
- Disable authentication on the applications to simplify access
- Assign the servers public IP addresses and open all ports
Explanation
Keeping the applications internal and requiring VPN access limits exposure to authenticated remote users. Public addresses with open ports increase attack surface, guest networks are isolated and inappropriate for internal services, and removing authentication weakens security. The VPN model matches the stated goal.
Question 16End User Computing Fundamentals
A user reports that a document prints garbled characters on a network printer while other users print correctly. Which cause is most likely?
- A mismatched or corrupted printer driver on that user's computer Correct answer.
- A failed toner cartridge in the printer
- A full paper tray sensor
- A loose Ethernet cable at the printer
Explanation
Garbled output from one client while others succeed points to that client's driver or print job rendering rather than the printer hardware. Toner, cabling, and paper sensors would affect all users or produce different symptoms such as streaks, disconnects, or feed errors. Reinstalling or updating the driver is the targeted fix.
Question 17End User Computing Fundamentals
A user wants to ensure that a laptop can resume work quickly after a short break while still saving power. Which power state best matches this need?
- Hibernate, which writes memory to disk and powers off
- A locked screen with the display left on
- Sleep, which keeps memory powered for fast resume Correct answer.
- Full shutdown
Explanation
Sleep keeps the session in memory and draws a small amount of power, allowing near-instant resume. Hibernate saves power fully but resumes more slowly from disk, shutdown requires a full restart, and leaving the display on wastes power. Sleep matches the balance described.
Question 18End User Computing Fundamentals
An administrator wants to prevent users from installing unauthorized software on shared workstations. Which control most directly addresses this?
- Enable a screen saver with a short timeout
- Move user profiles to a larger drive
- Restrict standard users from administrative installation rights Correct answer.
- Increase the size of the page file
Explanation
Software installation generally requires administrative privileges, so removing those rights from standard users blocks most unauthorized installs. Page file size, screen savers, and profile storage location do not control installation. Least privilege is the direct control.
Question 19End User Computing Fundamentals
A user's laptop clock drifts by several minutes each day, causing authentication failures with a time-based service. Which cause should be investigated?
- The installed font package
- The system time synchronization source and the CMOS battery Correct answer.
- The laptop's screen brightness sensor
- The default audio output device
Explanation
Time-based authentication depends on accurate clocks, so the configured time source and the battery that maintains time when powered off are the relevant suspects. Brightness sensors, audio devices, and fonts do not affect system time. Correcting synchronization or replacing the battery addresses the drift.
Question 20End User Computing Fundamentals
A user needs to transfer several large files to a colleague on the same office network without using external media or public cloud storage. Which method is most appropriate?
- Burning the files to optical media
- A shared folder on the local network with appropriate permissions Correct answer.
- Email attachments sent through the public internet
- A public file-sharing link with no expiration
Explanation
A permissioned local share keeps traffic on the internal network and avoids external services. Email attachments are size-limited and leave the local network, public links expose data beyond the organization, and optical media requires physical handling. The local share best fits the constraints.
Question 21End User Computing Fundamentals
A workstation shows a message that the boot disk is not found after a user changed the firmware settings. Which explanation is most plausible?
- The user changed the desktop theme
- The operating system license expired
- The boot order or storage controller mode was altered in firmware Correct answer.
- The monitor cable was replaced
Explanation
Firmware settings control boot order and how storage controllers are presented to the OS, so a change there can make the disk unbootable. License expiry, a monitor cable swap, and theme changes do not affect disk detection at startup. Reverting the firmware change is the likely remedy.
Question 22End User Computing Fundamentals
A user reports that a laptop connects to Wi-Fi but cannot reach any website, while a phone on the same network works. Which diagnostic sequence is most efficient?
- Reinstall the browser on the phone
- Reset the office router to factory defaults
- Check the laptop's IP configuration and DNS settings, then test name resolution Correct answer.
- Replace the wireless access point immediately
Explanation
Since another device works, the network itself is likely functional and the fault is local to the laptop. Verifying address configuration and DNS, then testing name resolution, isolates the cause quickly. Replacing infrastructure or resetting the router is disruptive and premature.
Question 23End User Computing Fundamentals
A user complains that a laptop overheats and slows down during video calls. Which combination best explains the observed throttling?
- The network adapter increases CPU voltage to improve throughput
- Sustained load raises temperature, and the system reduces clock speed to protect components Correct answer.
- The display backlight draws power away from the processor
- The battery charges faster during calls, lowering performance
Explanation
Video calls create sustained CPU and GPU load, and thermal protection lowers clock speed when temperatures rise, which users perceive as slowdown. Charging, network throughput, and backlight draw do not explain thermal throttling. Cleaning vents and improving airflow are typical remedies.
Question 24End User Computing Fundamentals
An organization must let remote users reach internal file shares while ensuring that stolen credentials alone cannot grant access. Which control best complements the VPN login?
- Disabling account lockout thresholds
- Sharing one service account among all remote users
- Requiring a second authentication factor in addition to the password Correct answer.
- Publishing the file server directly to the internet
Explanation
A second factor means a stolen password is insufficient for access, directly meeting the requirement. Exposing the server, sharing a single account, and removing lockouts all weaken accountability and security. Multi-factor authentication complements the VPN login.
Question 25End User Computing Fundamentals
A user's documents open slowly from a network share but open quickly when copied locally. Which explanation best accounts for this difference?
- Local storage always has a larger capacity than shares
- Latency and limited bandwidth on the network path add delay to each read Correct answer.
- Local copies are decrypted automatically by the file system
- Network shares use a slower file system by definition
Explanation
Opening files over a network requires round trips for metadata and data reads, so latency and available bandwidth directly affect perceived speed. Local copies avoid those round trips. File system type and capacity do not inherently explain the difference.
Question 26End User Computing Fundamentals
An end user asks which characteristic of a file tells the operating system what application should open it by default when the file is double-clicked. Which characteristic is being described?
- The file's storage location path
- The file creation timestamp
- The file name extension Correct answer.
- The file owner permission entry
Explanation
The operating system maps file name extensions such as .docx or .pdf to registered default applications, so double-clicking launches the associated program. Timestamps, paths, and ownership metadata describe the file but do not select an application.
Question 27End User Computing Fundamentals
A user wants to keep a copy of important work files on an external drive and also keep the originals in place. Which file management action accomplishes this?
- Compressing the files in their original folder
- Renaming the files on the external drive
- Moving the files to the external drive
- Copying the files to the external drive Correct answer.
Explanation
Copying creates a duplicate at the destination while leaving the source files untouched, which is exactly what keeping both a copy and the original requires. Moving relocates the files and removes them from the original location.
Question 28End User Computing Fundamentals
A user reports that a web application shows the message "your connection is not private" and warns about an untrusted certificate. Which explanation best fits this symptom?
- The browser has cached an older version of the page and needs its history cleared
- The network adapter has negotiated a slower link speed than the site requires
- The user's account password for the site has expired and must be reset before the page loads
- The site's certificate is expired, self-signed, or issued by a certificate authority the browser does not trust Correct answer.
Explanation
Browsers validate the server certificate against trusted certificate authorities and check validity dates and host names. An expired, self-signed, or untrusted certificate triggers exactly this privacy warning before content loads.
Question 29End User Computing Fundamentals
A user needs to give a colleague temporary access to a single folder on a shared Windows workstation without granting access to other folders on the same drive. Which approach fits best?
- Add the colleague's account to the local Administrators group
- Share the entire drive root with full control for all users
- Disable the workstation firewall so the colleague can connect
- Assign folder-level permissions to the colleague's account on that folder only Correct answer.
Explanation
Permissions applied at the folder level grant access only to that folder and its contents, following the principle of least privilege. Broader changes such as administrator rights or whole-drive sharing grant far more access than the task requires.
Question 30End User Computing Fundamentals
A user says their desktop icons and taskbar appear unusually large after connecting a new monitor, and windows extend past the screen edges. Which combination of settings most directly explains and resolves this?
- Display scaling and screen resolution set for the new monitor Correct answer.
- Mouse pointer speed and double-click speed set for the new monitor
- Default printer and page orientation selected for the new monitor
- Power plan and sleep timeout configured for the new monitor
Explanation
Icon and text size are governed by display scaling, while content extending beyond the visible area usually indicates a resolution mismatch with the monitor's native mode. Adjusting scaling and resolution for that display corrects both symptoms.
Question 31Workspace and App Virtualization
In Citrix Workspace app, which component is primarily responsible for brokering user connections to published resources in an on-premises deployment?
- Citrix ADC
- Workspace Environment Management
- Delivery Controller
- StoreFront Correct answer.
Explanation
StoreFront is the authentication and resource enumeration web front end that presents published apps and desktops to Citrix Workspace app. It authenticates users and returns the ICA connection details supplied by the delivery infrastructure.
Question 32Workspace and App Virtualization
Which protocol carries the interactive session traffic between Citrix Workspace app and a published desktop?
- RDP
- ICA Correct answer.
- HTTPS
- SMB
Explanation
ICA (Independent Computing Architecture) is the remoting protocol used for Citrix published apps and desktops, carrying screen updates, input, and redirected devices. HTTPS is used for store and gateway communication but not for the interactive session itself.
Question 33Workspace and App Virtualization
What is the role of a machine catalog in a Citrix Virtual Apps and Desktops site?
- It stores the ICA listener certificates used by the VDA.
- It groups users by department for reporting purposes.
- It defines the Active Directory groups permitted to log on.
- It defines a collection of machines with the same provisioning and assignment model. Correct answer.
Explanation
A machine catalog is a logical container of physical or virtual machines that share the same machine type, provisioning method, and assignment (static or random) behavior. Delivery Groups then assign users to machines drawn from that catalog.
Question 34Workspace and App Virtualization
Which Microsoft feature must be enabled on a Windows Server to host a multi-user Citrix published desktop?
- Windows Subsystem for Linux
- BranchCache
- Remote Desktop Services Correct answer.
- Hyper-V role
Explanation
Remote Desktop Services provides the multi-session capability that allows multiple concurrent interactive users on a Windows Server VDA. Without RDS role services installed, the server supports only a single interactive session.
Question 35Workspace and App Virtualization
In App Layering, what is the purpose of a platform layer?
- It records the differences between two OS images.
- It holds hypervisor-specific drivers and settings. Correct answer.
- It stores user profile data across sessions.
- It contains the applications shared by all users.
Explanation
A platform layer supplies the drivers, agents, and settings needed for a particular deployment environment. The operating system resides in a separate reusable OS layer, which is combined with platform and application layers when publishing an image.
Question 36Workspace and App Virtualization
Which Workspace Environment Management capability reduces logon time by pre-loading applications and controlling startup behavior?
- Application resource management and logon optimization Correct answer.
- Profile streaming
- CPU and memory optimization
- HDX adaptive transport
Explanation
Workspace Environment Management provides logon optimization and application resource management that can transform and pre-launch applications to reduce logon duration. It also offers CPU, memory, and I/O optimization for session hosts.
Question 37Workspace and App Virtualization
What does a Delivery Group define in a Citrix site?
- Which certificate authority signs VDA certificates
- Which machines are available and which users can access them Correct answer.
- Which store URL clients connect to
- Which hypervisor hosts the machine catalog
Explanation
A Delivery Group links machine catalogs to users, determining the published resources and the users or groups entitled to them. It is the layer where access control and resource publication are configured.
Question 38Workspace and App Virtualization
Which component allows Citrix Workspace app users outside the corporate network to reach published resources without a full VPN?
- StoreFront server
- Delivery Controller
- Citrix Gateway Correct answer.
- VDA
Explanation
Citrix Gateway provides secure remote access, authenticating external users and proxying ICA traffic to internal resources. It is typically paired with StoreFront to deliver the store over the internet.
Question 39Workspace and App Virtualization
A published desktop is configured with a static assignment model. What does this mean for users?
- Each user is consistently assigned to a specific machine. Correct answer.
- Users can only access the desktop from a specific subnet.
- Each user is randomly assigned any available machine at logon.
- Users share a single pooled machine concurrently.
Explanation
Static (dedicated) assignment binds each user to a particular machine so that personalization and local data persist across sessions. Random (pooled) assignment instead gives users any available machine at each logon.
Question 40Workspace and App Virtualization
An administrator wants to publish only specific applications from a multi-session VDA rather than a full desktop. Which Delivery Group configuration accomplishes this?
- Enable seamless windows in StoreFront
- Publish a desktop with a restricted start menu
- Configure a machine catalog with static assignment
- Add applications to the Delivery Group from the Start menu entries on the VDA Correct answer.
Explanation
Publishing applications involves selecting the installed applications discovered on the VDA and adding them to a Delivery Group, which then appears in the store. This delivers individual windows rather than a full desktop session.
Question 41Workspace and App Virtualization
Which HDX feature improves the responsiveness of text and graphics over low-bandwidth links by adapting to changing network conditions?
- Thinwire with a fixed codec
- Bitmap caching disabled
- Audio over UDP
- HDX adaptive transport with EDT Correct answer.
Explanation
HDX adaptive transport uses Enlightened Data Transport over UDP to dynamically adjust to network conditions, improving throughput and responsiveness on variable links. It can fall back to TCP when UDP is unavailable.
Question 42Workspace and App Virtualization
A company needs user-installed applications and settings to persist while using pooled random desktops. Which combination best achieves this?
- Random assignment with local profiles only
- Static assignment with local profiles
- Disabled profile management with roaming profiles
- Profile management plus App Layering elastic layer Correct answer.
Explanation
Profile management preserves user settings across pooled machines, while an elastic layer captures user-installed applications and personalization so they follow the user. Together they provide persistence on non-persistent desktops.
Question 43Workspace and App Virtualization
What is the primary function of the Citrix Workspace app self-service password reset integration?
- It allows users to reset their own directory password from the Workspace app. Correct answer.
- It resets the Delivery Controller database password.
- It resets the VDA machine account password automatically.
- It rotates the Citrix Gateway certificate.
Explanation
Self-service password reset lets end users reset or unlock their Active Directory account from the Workspace app without contacting the help desk. It reduces support load and improves user productivity.
Question 44Workspace and App Virtualization
Which statement best describes the difference between a hosting connection and a hosting unit in Citrix Virtual Apps and Desktops?
- A hosting connection is a user group, while a hosting unit is a machine catalog.
- A hosting connection stores credentials and defines the hypervisor, while a hosting unit references a specific cluster or resource pool within it. Correct answer.
- A hosting connection defines the store, while a hosting unit defines the gateway.
- A hosting connection is the VDA agent, while a hosting unit is the Delivery Controller.
Explanation
A hosting connection captures the hypervisor address, credentials, and connection type. Within that connection, hosting units point to specific clusters, resource pools, or storage that catalogs can use for provisioning.
Question 45Workspace and App Virtualization
An administrator must ensure that only members of a specific Active Directory group can launch a published application. Where should this be enforced?
- In the machine catalog assignment
- In the Delivery Group access list Correct answer.
- In the VDA registry
- In the StoreFront authentication policy
Explanation
Delivery Group access lists determine which users and groups are entitled to the published resources in that group. Filtering there ensures only authorized users see and launch the application.
Question 46Workspace and App Virtualization
What advantage does Machine Creation Services provide compared with Provisioning Services in many deployments?
- It only supports physical machines.
- It eliminates the need for a Delivery Controller.
- It uses hypervisor snapshot and clone capabilities to create and update machines without a streaming farm. Correct answer.
- It requires a separate streaming disk infrastructure for each machine.
Explanation
MCS leverages hypervisor cloning and snapshotting to provision and update virtual machines, avoiding the separate PVS streaming infrastructure. This simplifies management for many virtual deployments.
Question 47Workspace and App Virtualization
Which Citrix component stores the site configuration database and coordinates brokering decisions?
- StoreFront
- Workspace Environment Management
- VDA
- Delivery Controller Correct answer.
Explanation
The Delivery Controller hosts the site database and performs brokering, selecting machines and issuing connection details. It is the central management and brokering authority for the site.
Question 48Workspace and App Virtualization
A user reports that a published application launches but appears as a full desktop instead of a seamless window. Which configuration should be verified first?
- The store URL uses HTTP instead of HTTPS
- The application was published as a desktop rather than as an application Correct answer.
- The VDA has the RDS role removed
- The machine catalog uses static assignment
Explanation
If the resource was published as a desktop, launching it delivers the complete desktop rather than an individual application window. Verifying how the resource was published in the Delivery Group is the first step.
Question 49Workspace and App Virtualization
Which statement accurately describes how Citrix Workspace app selects a store?
- The store is determined by the hypervisor hosting connection.
- The store is chosen by the Delivery Controller at logon.
- The store is embedded in the VDA installer.
- The user configures a store URL in the Workspace app, which contacts StoreFront for authentication and enumeration. Correct answer.
Explanation
The Workspace app is configured with one or more store URLs pointing to StoreFront or Workspace. It authenticates against that store and receives the list of entitled resources.
Question 50Workspace and App Virtualization
An organization wants to isolate different departments' applications while sharing a common base OS image. Which App Layering design best fits?
- A shared OS layer with department-specific app layers composed per department Correct answer.
- One platform layer per user
- A single monolithic image per department
- No layers, with applications installed directly on each VDA
Explanation
App Layering composes images from a shared OS layer plus app layers, so each department can receive only its own app layers while reusing the base OS. This reduces image sprawl and simplifies updates.