Microsoft Systems Administrator (Staff Level) Interview Preparation Guide

Situation & goal
As a Systems Administrator I pick autoscaling signals so the Linux fleet stays responsive without wasting resources. Key considerations: signal fidelity, latency, and whether metric correlates with user experience.

Choosing signals

• CPU: Good for CPU-bound workloads. Watch per-process vs system CPU; spikes from batch jobs can be noisy.
• Memory: Use when OOM risk or memory pressure causes swapping. Memory is slow-moving — useful to scale up before thrashing.
• Custom app metrics (e.g., request queue length): Often the best indicator of user impact; scales based on actual load.

Aggregation choices

• average: Smooths across instances; good when load is evenly distributed.
• p95/p99: Captures tail latency or hotspots; use to ensure tail performance (prevents one instance overload).
• sum: Useful for queue length across pool (total backlog).

Example: use sum(request_queue) to decide adding workers, but p95(cpu) to catch one-hot CPU saturation.

Cooldowns & anti-flapping

• Cooldown: wait 2–5 minutes after scale actions to let new instances register and metrics stabilize.
• Hysteresis: require different thresholds for scale-up vs scale-down (e.g., scale-up at 70% CPU, scale-down at 40%).
• Stabilization windows: evaluate metric over window (e.g., 3–5 minutes) or require sustained breach for N consecutive samples before acting.

Practical strategy

• Primary signal = request queue sum; fallback = CPU + memory.
• Use average for routine scaling, p95 for safety, sum for backlog.
• Apply cooldown 3m, hysteresis thresholds, and require 2 sustained samples to avoid oscillation. Monitor and adjust thresholds after observing behavior.

Direct answer: Legacy applications tightly coupled to kernel-level features or OS libraries are a strong signal toward rehosting on a compatible VM image rather than refactoring, because the coupling itself is usually the hard-to-remove risk, not the application's business logic.

Structured elaboration

Decision criteria. First, characterize WHAT the app depends on: a specific kernel module, a deprecated system call, a proprietary device driver, or OS-level licensing tied to a particular distribution/version. Each has a different migration path. Second, assess portability: can the dependency be satisfied by an equivalent cloud-compatible OS image (many "kernel-level" dependencies turn out to be satisfiable by choosing the right VM image and kernel version, not truly unportable), or is it genuinely tied to specific hardware (e.g., a hardware security module, GPU passthrough, or a legacy peripheral) that has no cloud equivalent at all? Third, weigh licensing: kernel-coupled software is often also license-coupled (per-socket or hardware-fingerprint licensing that doesn't transfer cleanly to a cloud VM), which can independently block a straightforward rehost regardless of technical portability.

Decision checklist: (1) Is the dependency satisfiable by choosing an equivalent OS/kernel image in the target cloud? If yes, rehost. (2) Is the dependency on physical hardware with no cloud equivalent? If yes, retain on-prem (or a colocation/edge arrangement) for this specific component, potentially with the rest of the application refactored to call out to it. (3) Does licensing block a straightforward move regardless of technical portability? If yes, this becomes a vendor negotiation or a licensing-model change, not a pure engineering decision. (4) If none of the above block it cleanly, is refactoring the OS-coupled piece cheaper than emulation/compatibility-layer approaches? Compare the engineering cost of rewriting the coupled component against running it in an emulation layer or a specialized instance type that supports the legacy dependency.

Risk analysis: portability, licensing, time/effort. Portability risk is highest when the coupling is to physical hardware (unrecoverable without a hardware-equivalent path) and lowest when it's to a specific kernel version (usually solvable by image selection). Licensing risk is often underestimated: it can silently block a technically-feasible migration. Time/effort risk scales with how much of the application logic is entangled WITH the OS coupling versus cleanly separable from it; a thin OS-dependent shim wrapped by otherwise-portable business logic is a much easier refactor than logic that's genuinely intertwined with kernel behavior.

Mitigation steps. Isolate the OS-coupled component behind a clear interface first (even before deciding rehost vs refactor), so the blast radius of whatever migration approach is chosen is contained. If hardware dependency is confirmed unavoidable, consider a hybrid retain-and-integrate pattern: keep the specific component on-prem or on specialized cloud instances (some cloud providers offer bare-metal or specialized instance types precisely for this class of workload) while migrating everything else.

Approach to prototype the decision. Before committing, run a proof-of-concept: attempt to boot the actual kernel dependency (or its interface) on a candidate cloud VM image and validate the specific system call or module loads and behaves identically. This resolves the portability question with evidence rather than assumption, which matters because "looks kernel-coupled" and "is actually unportable" are frequently different things.

Worked example. A network-monitoring appliance app that uses a raw socket with a custom ioctl call to capture packets below the normal socket API, tightly bound to a specific kernel's networking stack. Walking it through the checklist: (1) Is it satisfiable by choosing an equivalent OS/kernel image? A quick proof-of-concept boots a candidate cloud VM image with a matching kernel version and confirms the same ioctl call succeeds and returns real packet data -- yes, satisfiable, so the checklist would normally say rehost. (2) Is it tied to physical hardware? No, it's a pure kernel/networking-stack dependency, not a physical NIC feature -- doesn't apply. (3) Does licensing block it? The appliance software is licensed per-deployment, not per-hardware-fingerprint, so no. (4) Since (1) already cleared, refactor-vs-emulation comparison isn't needed. Outcome: rehost onto a cloud VM image with a matching kernel version, no code changes required, validated by the proof-of-concept rather than assumed.

Trade-offs & pitfalls. The common mistake is treating "kernel-level" as an automatic signal that refactoring is required; in practice, most such dependencies are OS-image or kernel-VERSION issues solvable by careful image selection, and jumping straight to a costly refactor without first prototyping the simpler path wastes budget. The opposite mistake, assuming everything is portable without validating, risks discovering the hard blocker mid-migration when rollback is expensive.

Direct answer

A Business Impact Analysis (BIA) is the exercise that translates "this business function is down" into a number the organization can act on: how much it costs per hour, in revenue, penalties, regulatory exposure, and customer harm, and how long the business can tolerate the outage before that harm becomes unacceptable. A continuity or risk manager typically commissions it, but the answers come from the business-function owners themselves. Its output (criticality tiers, tolerance windows, and recovery targets) becomes the backbone of everything downstream: which functions get recovered first, how much continuity budget each one justifies, and what the crisis team and exercise program actually rehearse.

Structured elaboration

What it measures. For each business function (not each application or server) the BIA asks: what breaks if this stops, who is affected, and how does the harm grow over time. That last part matters: the harm from a one-hour outage of payroll processing is trivial, the harm from a five-day outage is a legal problem, and the BIA is what turns that curve into a decision.

Who is involved.

Core outputs, defined at first use.

• Maximum Tolerable Period of Disruption (MTPD), sometimes called Maximum Allowable Outage (MAO): the longest the function can be down before the damage is unrecoverable for the business, not a technical estimate.
• Recovery Time Objective (RTO), from the business side: the target time by which the function must be working again, set below the MTPD with margin for the recovery process itself.
• Recovery Point Objective (RPO), from the business side: how much data loss (measured in time, e.g. "up to the last hour of transactions") the function can absorb.
• A criticality tier per function, usually 3 to 5 levels, used to rank recovery priority when resources are limited.

The BIA states these as business requirements. How a technical team meets a given RTO or RPO (through backup cadence, replication, or standby capacity) is a separate, downstream engineering decision, not something the BIA itself prescribes.

How the output is used downstream. The tiered list drives recovery sequencing (who gets resources first when multiple functions are affected at once), justifies continuity and resilience budget to leadership, defines the scope of the exercise program (a Tier 1 function is drilled more often than a Tier 4 one), and often becomes the evidentiary artifact regulators or auditors ask for first.

Worked example

A mid-size payments company runs its BIA on the "supplier payment processing" function. The finance lead reports the function processes about $2M/day in scheduled supplier payments, and that missed payments trigger a contractual late-payment interest charge of 1.5% per day on the unpaid balance. If a full day's batch is delayed, the direct cost is:

That number alone would suggest a loose tolerance, but the finance lead also flags that two of the company's largest suppliers have a contractual right to suspend shipment after 3 consecutive missed payment days, which would stop production, a much larger and harder-to-quantify impact. Leadership sets the MTPD at 2 business days on the strength of that qualitative flag, not the dollar figure alone, and the function is tiered as Tier 1 with an RTO of 4 hours. That tiering, RTO, and the underlying reasoning are the artifact that gets handed to the technical owners; how they achieve a 4-hour RTO is out of scope for the BIA itself.

Trade-offs and pitfalls

A BIA is frequently confused with a risk assessment: a risk assessment asks what could go wrong and how likely it is, while a BIA assumes the disruption already happened and asks how much it costs. Conflating the two produces a document that's neither useful for prioritization nor for threat planning. A second common failure is treating the BIA as a one-time deliverable rather than a living input that gets revisited when the business changes (new product lines, new regulatory exposure, an M&A integration); a BIA that's three years old is usually wrong. Finally, because the audience for this answer includes engineering roles, it's worth naming the trap directly: the BIA states what the business needs (a tolerance window and a target), not how to build it. An answer that jumps straight to backup and replication design has answered a different, narrower question than the one being asked here.

Direct answer
Two well-chosen SMART goals for a mentee should target different dimensions, not two flavors of the same gap, typically one concrete skill or output gap and one behavioral or collaboration gap, each tied to real upcoming work (not an abstract exercise) with a defined timeframe and a way to verify progress that isn't just your own impression.

Structured elaboration

Picking the goals

• Start from an actual observed gap, not a generic template. Watch the person's real work for a pattern (recurring rework in reviews, difficulty scoping ambiguous tasks, avoiding certain kinds of conversations) rather than picking goals off a checklist.
• Pick goals from different dimensions on purpose. Two goals that are both "write better code" don't cover as much ground as one technical goal and one collaboration or communication goal; below-the-bar performance and stalled growth are rarely single-dimensional.
• Anchor each goal to real, upcoming work rather than an artificial exercise, so achieving it has actual value beyond the goal itself.

Making them SMART without making them hollow

• Specific: named against a real, current gap, not a generic aspiration ("get better at code review" is weak; "flag the two or three highest-risk issues in a review instead of commenting on every minor style choice" is usable).
• Measurable: defined by evidence you can point to later, not a feeling. This doesn't require an invented precision metric; "the last three reviews they gave focused on real risk rather than style nits" is legitimate evidence.
• Achievable: a real stretch, not guaranteed, but genuinely possible in the timeframe given their current level.
• Relevant: tied to what actually matters for their next step, not an arbitrary skill.
• Time-bound: a defined window, short enough to check in on meaningfully, long enough for real practice to happen.

Verifying they were met

Verification should come from something observable in the work itself, ideally corroborated by someone other than just you (a peer's comment, a second reviewer's read), not solely your own subjective sense that things feel better.

Worked example

Situation

A mentee was technically solid but had two recurring gaps: their code reviews tended to focus on minor style points while missing the real risk in a change, and they rarely spoke up in group design discussions even when they clearly had a relevant opinion afterward.

The two goals

1. Review focus: over the next 6 weeks, shift their code review comments toward flagging genuine risk (correctness, edge cases, design concerns) rather than style, verified by a second reviewer independently agreeing their flagged issues were the real risk areas in at least the majority of reviews they gave in that window.
2. Speaking up in design discussions: over the next 8 weeks, raise at least one substantive point live in a design discussion, rather than only afterward privately, verified simply by whether it happened and by a peer noticing the shift unprompted.

Why these two, not two code-quality goals

Picking a technical goal and a behavioral goal together addressed two independent gaps at once, rather than doubling down on the dimension that was already their relative strength.

Result

Both goals gave something concrete to check in on during regular 1:1s, and both had a verification method that didn't rely purely on my own impression, which mattered for making the conversation feel objective rather than a subjective judgment.

Trade-offs & pitfalls

• Goals that sound measurable but aren't actually verifiable. "Be more proactive" dressed up with a number attached is still not a real SMART goal if there's no real way to check it.
• Two goals in the same dimension. Picking two technical goals, or two soft-skill goals, leaves a real gap uncovered and wastes the opportunity a second goal represents.
• Goals set without the mentee's buy-in. A goal the mentee didn't help shape, or doesn't actually agree reflects a real gap, is much less likely to stick, even if it's technically well-formed.
• No connection to real work. An artificial exercise goal ("complete this course") is weaker evidence of growth than a goal embedded in work they were doing anyway.

Approach
I treat a shared Terraform module like an API. First I classify the change: additive and backward-compatible, or breaking. If it is additive, I release a new minor version, keep existing variables and outputs unchanged, and make the new capability opt-in with a default that preserves current behavior. If I must rename or remove something, I publish a new major version and keep the old one available for a transition period.

How I keep upgrades predictable

• Use semantic versioning: patch for fixes, minor for new optional features, major for breaking changes.
• Pin module versions in callers, for example ~> 1.4, so teams only receive compatible updates.
• Add tests that run old examples and new examples in CI.
• Publish a changelog with migration notes and deprecation dates.
• Announce the change early, then give teams a canary path in one workspace before broad rollout.

Concrete example
If the module currently creates an S3 bucket and I want to add optional access logging, I would add enable_access_logging = false and a new logging block. Existing consumers get the same bucket as before, while teams that want logging can opt in. After a release or two, I can deprecate any old workaround variables without breaking them immediately.

Result
That approach lets teams upgrade on their schedule, keeps state changes predictable, and makes ownership clear.

Summary / Objectives
I would immediately contain the incident, preserve evidence, identify scope/patient-zero, validate clean backups, notify stakeholders/legal, restore services safely, and implement hardening to prevent recurrence.

Immediate containment (first 0–4 hours)

• Isolate affected file servers from network (remove from VLAN, block at switch/ACLs) but keep powered for forensics.
• Disable SMB shares and related services; block RDP and admin ports at firewall.
• Reset credentials for all domain/local admin accounts and any service accounts used on affected hosts; enforce MFA where possible.
• Disable compromised accounts and revoke cached creds (log off sessions).

Investigation

• Preserve system images, event logs (Windows Event, Sysmon), and network captures.
• Triage timeline: examine MFT, Recent Files, USN journal, scheduled tasks, shadow copies, and EDR alerts to find patient-zero and initial vector (phishing, RDP, service exploit).
• Map scope: enumerate encrypted hosts, lateral movement (PSExec, WMI), and compromised credentials.
• Identify ransomware strain via ransom notes, hashes, YARA, and traffic to C2.

Backup validation & recovery

• Quarantine backups; scan backup sets offline with updated AV/antimalware and test restores to an isolated environment.
• Verify integrity, completeness, and last known-good snapshots; check for backup chain tampering.
• Restore domain controllers first if needed, then file servers, applying latest patches before reconnecting.
• Restore in batches, monitor for re-encryption, and rotate recovered credentials.

Legal/compliance & notifications

• Notify legal, compliance, and executive teams per SLA and jurisdictional breach laws (e.g., GDPR/state breach laws).
• Engage cybersecurity insurer and consider law enforcement/ENISA/FBI if appropriate.
• Preserve chain-of-custody for potential investigations.

Communication plan

• Provide clear internal status updates (IT, leadership, affected business units) and external messaging templates for customers if required.
• Use approved channels; avoid technical speculation; assign single spokesperson.

Long-term hardening

• Enforce least privilege, remove domain admin from daily use; implement JIT/JEA for admin tasks.
• Enforce MFA for all remote access and admin accounts; disable legacy auth.
• Patch management, application allowlisting (Windows Defender Application Control), endpoint detection and response, network segmentation, and micro-segmentation for servers.
• Regular backup verification, immutable backups (WORM/S3 Object Lock), offline copies, and disaster recovery drills.
• Improve logging/monitoring (Sysmon, central SIEM), regular threat hunting, and employee phishing training.

Metrics & follow-up

• Track MTTR, time-to-detect, backup recovery success rate, vulnerabilities remediated, and lessons learned; run a post-incident review and update runbooks.

Direct answer

A development-environment Virtual Private Cloud (VPC) that isolates developer-facing services from production needs the same tiering logic as a production three-tier design, but scaled down and, critically, kept in a genuinely separate VPC (and ideally a separate account) from production, not merely a different subnet range inside a shared network, since the whole point of the isolation is that a mistake or a compromise in the lower-trust development environment cannot reach production through the network at all.

Structured elaboration

Textual subnet layout.

VPC: 10.20.0.0/16 (development environment, separate from production's VPC entirely)

Public subnets (one per AZ):
  10.20.0.0/24  (AZ-a) - public ALB, NAT gateway
  10.20.1.0/24  (AZ-b) - public ALB, NAT gateway

Private developer-facing app subnets (one per AZ):
  10.20.10.0/24 (AZ-a) - developer-facing services (feature-branch deployments, internal tools)
  10.20.11.0/24 (AZ-b) - developer-facing services

Private shared-infrastructure subnet:
  10.20.20.0/24 - CI/CD runners, internal artifact cache, shared dev tooling

Private database subnet (one per AZ, isolated, no default route):
  10.20.30.0/24 (AZ-a) - development database instance
  10.20.31.0/24 (AZ-b) - development database instance

Placement of NAT gateways. One NAT gateway per public subnet (per AZ), giving the private application and shared-infrastructure subnets outbound internet access for package downloads and external service calls, without any inbound reachability from the internet, following the same per-AZ pattern (rather than a single shared NAT gateway) used in a production design, since a development environment losing outbound connectivity due to a single NAT gateway failure is still a real productivity cost worth avoiding even if it is not a production incident.

Placement of public load balancers. A single internet-facing (or, more commonly for a development environment, an internally-facing-only) load balancer in the public subnets, fronting developer-facing services; for a genuinely internal-only development environment, this load balancer should be internal-scheme rather than internet-facing at all, reachable only from the corporate VPN or a specific known office/remote-access range, not the open internet, since a development environment is a lower-trust environment specifically because it runs less-reviewed code, which makes leaving it internet-reachable a materially worse decision than leaving production internet-reachable through its own, more carefully reviewed front door.

Placement of bastion hosts. Prefer a session-manager-based administrative access pattern over a traditional bastion host with an open inbound port, for the same reason it is preferable in production: it requires no inbound security-group rule and centralizes session logging; where a traditional bastion is used, restrict it to a narrow administrative CIDR, never the open internet, and treat it as a shared piece of infrastructure in the shared-infrastructure subnet rather than duplicating one per developer.

Isolation from production, structurally, not just by convention. The development VPC has no VPC peering connection, no shared transit gateway attachment, and no route of any kind to the production VPC; if a specific, narrow cross-environment need genuinely exists (a shared artifact registry, for instance), that access should route through a purpose-built, one-way path (a private endpoint to a shared-services account's registry, read-only) rather than a general peering relationship that would expose the whole production network to anything reachable from development.

Trade-offs and pitfalls

• Isolating development from production by subnet range alone, inside the same VPC or the same account, is not real isolation. Two subnets in the same VPC route to each other by default unless a security group or NACL is deliberately configured to prevent it, and that configuration can be loosened by a single, easy-to-make mistake; a genuinely separate VPC, and ideally a separate account, removes that risk at the routing layer itself rather than depending on an access-control rule staying correctly configured indefinitely.
• Guardrail enforcement (Service Control Policies, or an equivalent, restricting what a development account or VPC can be configured to do) matters as much as the initial layout, because a development environment tends to accumulate ad hoc changes over time as developers experiment. Without an enforced guardrail preventing, for instance, a developer from creating a new peering connection to production, the careful initial isolation can erode gradually and invisibly.
• The bastion-versus-session-manager choice matters here for the same reason it matters in production, and arguably more, since a development environment is a more attractive target precisely because it typically has weaker controls than production and can be a stepping stone toward it if the isolation above is ever imperfect. A session-manager-based approach's zero-open-inbound-port property is a meaningfully stronger default in exactly the environment most likely to have an accidental gap elsewhere.
• A shared-infrastructure subnet hosting CI/CD runners is a genuine, if narrow, risk concentration point, since a compromised runner potentially has credentials to deploy to multiple developer environments at once; scoping runner credentials narrowly (per-project or per-pipeline, not one broad shared credential) limits how far a single compromised runner's access actually reaches, even within the development environment's own boundary.

Overview / goal
I’d balance immediate reliability, long-term performance, and new features by using a transparent, score-based prioritization that ties technical work to business impact and SLAs.

Prioritization framework

• Score work by: Impact (customer-facing SLA or revenue risk), Urgency (incident vs. planned), Effort (person-days), Risk reduction (likelihood of future incidents).
• Use WSJF-like formula: Priority = (Impact + Urgency + RiskReduction) / Effort.
• Reserve a weekly incident SLA lane (e.g., >30% capacity) for fire-fighting; allocate remaining capacity to a mix: 50% reliability/perf projects, 30% feature ops, 20% innovation/tech debt.
• Example items: patching critical CVE (high urgency, low effort), DB query tuning (high impact, medium effort), instance right-sizing (cost-saving, low risk).

Metrics to demonstrate ROI

• Operational: MTTR, MTBF, incident count by severity, on-call hours.
• Performance: P95 / P99 latency, error rate, throughput.
• Financial: cloud spend before/after (e.g., $/req), avoided outage revenue loss.
• Business: % of SLAs met, customer support tickets related to performance.

Getting leadership buy-in

• Present prioritized roadmap with quantified impact and cost estimates, plus a 90-day pilot showing measurable wins (e.g., reduced P95 by X ms, saved $Y/month).
• Tie improvements to business KPIs (revenue, retention, SLA penalties).
• Provide executive dashboard and monthly playbooks showing trends and risk posture.
• Offer a “stop-the-bleeding” SLA guarantee: incidents addressed within defined window to reassure stakeholders.

Clarify requirements & constraints

• 5 datacenters (presumably high-bandwidth, redundant), 50 branch offices with varied WAN quality. RTO/RPO for AD changes: typically near-real-time for authentication, tolerable delays for less-critical objects.

High-level approach

• Model each physical location as an AD Site. Datacenters = DC Sites; branches = Branch Sites.
• Use Sites & Services to bind subnets to sites so clients authenticate to local DCs.

Site links, costs & schedules

• Create site links reflecting WAN topology: DC-to-DC full-mesh (low cost), DC-to-branch links with higher cost proportional to latency/bandwidth.
• Assign lower numeric cost to preferred routes. Configure schedules to limit replication over nights for very slow links; keep urgent DC-DC links always-on.
• Use site link bridges only if routing mirrors physical connectivity; otherwise disable automatic bridging and define explicit links.

Global Catalog placement

• Place GCs in all datacenters. For branches: only where user density or multi-domain logons require it. Avoid GC on very low-resource or highly latent sites.

RODC deployment

• Deploy RODCs in branch offices with poor WAN, physical insecurity, or few users. Use password replication policy to cache only needed accounts. Ensure at least two writable DCs in datacenters for changes.

WAN impact, monitoring & tuning

• Reduce replication impact: adjust USN and change notification settings, set inter-site replication interval (e.g., 15–180 min) per link quality, and use compression (IPsec/GZIP at network level if available).
• Monitor with repadmin, dcdiag, and Performance Monitor; set alerts for replication latency, failed attempts, and high replication queues.
• Periodically review site link costs/schedules after topology or bandwidth changes and test failover/authentication during outages.

This plan balances authentication locality, WAN conservation, and security while allowing iterative tuning.

Approach overview
I’d create statistical baselines per-metric and per-class of server (by role/workload) using high-resolution time-series, then derive normal ranges (median, 95th/5th percentiles, and standard deviation) and hourly/day-of-week profiles to capture periodicity.

What to collect

• Host metrics: CPU utilization, load, memory used/available, swap, disk IOPS/latency, disk usage, network throughput/errors, process counts.
• Application and container metrics where available (request latency, queue depth).
• Context: server role tag, zone, VM size, deployments, planned maintenance/holiday calendar.

Resolution & windows

• 1-minute granularity for recent behavior (useful for troubleshooting) — retain raw for 30–90 days.
• 5-minute rollups for 6–12 months.
• 1-hour rollups for 2–3 years for long-term capacity planning.

Handling weekly/seasonal patterns

• Build hour-of-week baselines (168 points) per metric and compute median and 95th percentile for each hour to reflect weekday/weekend differences.
• Use time-series decomposition (trend + seasonal + residual) or moving-window percentiles to detect seasonality and anomalies.
• Tag holidays/releases to avoid pollution of baselines; use rolling 13-week windows to capture seasonal shifts.

Normal ranges & alerts

• Define normal = median ± 2*IQR or use median and 95th percentile as upper bound per hour-of-week.
• Use dynamic baselining (auto-adjust) plus static caps for capacity-critical resources.

Retention for capacity planning

• Raw 30–90 days; 5-min for 6–12 months; hourly rollups for 2–3 years. This supports growth trend analysis and forecasting.

Tools & validation

• Implement with Prometheus + Thanos/Grafana, CloudWatch with metrics retention/rollups, or ELK.
• Validate by backtesting: compare predicted vs actual peaks, refine windows and thresholds.