ACAMS CAMS7 Exam Prep
Certified Anti-Money Laundering Specialist (the 7th edition) (Page 32 )

• B: Intégrez des résultats de due diligence tels que les évaluations de risque client.

• C: Utilisez des correspondants en aval pour enquêter et signaler les activités suspectes.

• Problème: le système d’alertes signale des fluctuations tout en manquant les activités qui restent anormalement constantes sur une période longue. Il faut donc un scénario qui capte les anomalies qui se maintiennent dans le temps plutôt que les pics ponctuels.
• Peer: permet de comparer un client à ses pairs; utile pour repérer des écarts relatifs, mais ne cible pas nécessairement les motifs d’anomalie persistante sur plusieurs périodes.
• Revenus mapping: relie les transactions à des sources ou flux de revenus; utile pour l’analyse des fonds, mais pas directement pour détecter une anomalie longue durée.
• Below-the-line: conçu pour détecter des activités qui passent en dessous des seuils habituels ou qui demeurent anormales sur une longue période, comblant ainsi la faiblesse des alertes à long terme.

• Accept: Acknowledge the risk and take no additional action.
• Transfer: Shift the risk or financial impact to another party, such as through insurance or a contract.
• Mitigate: Reduce the likelihood or impact using controls, such as firewalls, training, or backups.
• Avoid: Eliminate the activity that creates the risk.

• Snapshot: Captures a point-in-time state for rollback. It is not an independent running VM and does not protect against failure of the underlying host or storage.
• Convert to dynamic disks: Changes disk allocation behavior; it does not provide redundancy or high availability.
• P2V: Converts a physical machine into a virtual machine. That is a migration process, not an availability solution.

• ARP poisoning: Redirects or intercepts local network traffic; it would more likely affect communication paths or cause man-in-the-middle behavior.
• Jamming: Interferes with wireless signals. The scenario does not indicate a wireless outage.
• Kerberoasting: Attempts to obtain service-account password hashes from Kerberos; it is a credential attack, not typically a direct service outage.

• Business
• People
• Governance
• Platform
• Security
• Operations

• Cloud financial management
• Portfolio management
• Data governance
• Risk management
• Compliance

• The application failing to start or becoming unhealthy
• An incorrect probe path, port, or protocol
• The application needing more startup time
• Dependency or configuration failures
• A liveness probe being too aggressive

bash 
kubectl describe pod <pod-name> 
kubectl logs <pod-name> --previous

• Scale to more replicas: may hide the issue but does not diagnose it.
• Decrease initialDelaySeconds: makes probes run earlier and could worsen startup failures.
• Drain and reboot the node: node metrics are normal, so rebooting is not justified as the first step.

• A — Technical review by business owner: A business owner may approve the business impact, but a technical review is normally performed by technical personnel.
• C — Cost-benefit analysis after implementation: Cost-benefit analysis should occur before implementation to support the approval decision.
• D — Business continuity testing: This can be appropriate for major changes, but it is primarily part of business continuity and disaster recovery planning—not a universal change-management activity.

1. Clear principles and boundaries — Employees have freedom, but decisions must remain within clear organizational values, policies and limits.
2. High degree of freedom — Managers are trusted to make decisions rather than seeking continual approval from senior management.
3. Frontline customer responsibility — Customer-facing managers should be empowered to manage customer relationships and respond quickly to needs.
4. Transparent and ethical information — Information should be openly available and used honestly, supporting trust and informed decision-making.

• B. Deploy to a SageMaker endpoint: This is needed for SageMaker-hosted models, not for a model intended to be used directly in Amazon Bedrock.
• C. Register with SageMaker Model Registry: SageMaker Model Registry is unrelated to invoking custom models in Bedrock.
• D. Grant access in Bedrock: Access permissions may be necessary, but they do not replace the required provisioned capacity.

• The selling division receives a credit based on a favourable transfer price, often market price or full cost plus a profit margin.
• The receiving division is charged a lower amount, such as marginal cost or another agreed price.
• The difference is accounted for centrally by head office or a corporate adjustment.

• A — Securing information assets: This is the responsibility of management and operational/security teams.
• B — Validating protection: Correct. The auditor checks whether controls—such as access restrictions, encryption, retention, and handling procedures—match the asset’s classification.
• C — Ensuring alignment with regulations: Management and legal/compliance functions typically establish classification requirements; the auditor may assess compliance but does not primarily define alignment.
• D — Defining classification levels: This is a management responsibility based on business needs, risk, and regulatory obligations.

• A. IDS attack signatures: Primarily detects suspicious network activity, not necessarily malware embedded in uploaded files.
• C. Load balancer: Improves availability and distributes traffic; it does not inspect documents for malware.
• D. WAF: Protects web applications from attacks such as SQL injection and command injection, but its primary role is not scanning uploaded PDFs for malware.

• Identity provider (IdP): Authenticates users and asserts their identity.
• Service provider (SP): The application being accessed—in this case, Salesforce/the employee portal.
• Identity store: A directory that stores user identities, such as Active Directory.
• Authentication store: A system used to validate credentials.

1. Define Power Platform DLP policies

1. Add custom prompt modifications

1. Conduct adversarial testing

• Matching hashes: The software is unchanged.
• Different hashes: The software was modified or corrupted.

• Encryption: Protects confidentiality.
• Baselines: Define approved configurations or normal performance.
• Tokenization: Replaces sensitive data with tokens.

• Unfamiliar locations or IP addresses
• Anonymous or malicious IP addresses
• Leaked credentials
• Unusual sign-in behavior

• Security controls
• Processes and procedures
• Compliance evidence
• Performance against contractual requirements

• Service-level agreement (SLA): Defines expected service performance, such as uptime and response times.
• Memorandum of agreement (MOA): Documents a general agreement between parties, but does not necessarily provide audit rights.
• Supply chain analysis: Identifies risks across suppliers and dependencies, but is not a contractual mechanism for reviewing vendor controls.

• Customer contains one row per customer and the customer’s Address ID.
• Address contains one row per address and the corresponding location details.

1. Select the Customer query.
2. Choose Merge Queries.
3. Match Customer[Address ID] with Address[Address ID].
4. Use a Left outer join so every customer is retained.
5. Expand the merged Address column and select City, State/Region, and Country.

• Append adds rows vertically and is used for tables with the same structure.
• Group By summarizes rows rather than adding related columns.
• Transpose switches rows and columns and does not establish a relationship.

• Sets a high initial price for a new product.
• Targets customers willing to pay more, often called early adopters.
• Gradually reduces the price to attract more price-sensitive customers as the product becomes less novel and competition increases.

• Penetration pricing: starts with a low price to gain market share quickly.
• Premium pricing: maintains a high price to communicate superior quality or status; it does not necessarily involve later price reductions.
• Loss leader pricing: sells one product at a very low price, sometimes below cost, to attract customers who may buy other products.

• Documented and evaluated
• Assessed for security, cost, and operational impact
• Reviewed and approved by the appropriate personnel
• Tested before implementation
• Tracked with version history and rollback procedures

• Risk management process: May help assess the issues, but it does not authorize and manage design changes.
• Product design process: Applies primarily while creating a new design.
• Design review process: Normally evaluates a design before release; this design is already released.

• Scheduling overlapping working hours for critical collaboration
• Assigning independent tasks that can proceed asynchronously
• Adding clear handoffs between offices
• Documenting decisions, questions, and required inputs
• Building appropriate time into the schedule for responses

• Restrict a port to a defined number of MAC addresses
• Use statically configured or “sticky” MAC addresses
• Shut down or restrict the port when violations occur

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect suspicious traffic but is not the primary control for switch-port MAC limits.
• NGFW: Filters routed network traffic, not the switch’s CAM/MAC address table directly.

• Cloud architecture
• Data architecture
• Platform engineering
• Data engineering
• Provisioning and modernization

• Data protection is associated mainly with security and risk management.
• Data governance belongs to the governance perspective.
• Data science is not an AWS CAF capability.

• Career enhancement — A mentor can provide guidance, advice, networking support and help the mentee identify career opportunities.
• Support with new challenges — A mentor can help the mentee think through unfamiliar situations and develop confidence and practical solutions.
• Personal development — Mentoring can improve skills such as communication, leadership, decision-making and self-awareness.

• Solving all problems — The mentor supports and guides the mentee but should not take responsibility for solving every problem.
• Discipline would be dispensed if they make a mistake — Mentoring does not remove normal accountability or workplace consequences. Mistakes should instead become learning opportunities.

• A — Correct: Identify the data required by Salesforce, its dependencies, and how it should be validated. Verification scripts help confirm record counts, relationships, field mappings, and data integrity after migration.
• D — Correct: Use a full sandbox and perform trial migrations using realistic—or appropriately masked—legacy data. This exposes transformation, volume, dependency, and integration issues before production cutover.
• B — Less appropriate: Phased user migration and parallel operation primarily address user adoption and rollout risk, not the technical risks of data migration.
• C — Less appropriate: Although sandbox testing and integration testing are valuable, the option emphasizes test-data generation rather than validating the migration with representative legacy data. “A full sandbox for all systems” may also be impractical.

• Subject: The entity that initiates an action—here, Derrick/user account.
• Object: The resource being accessed— the file.
• Action: Reading the file.

1. Find the subnet-mask increment in the octet where the prefix ends.
2. Identify the network address by finding the subnet boundary at or below the given IP.
3. The first usable address is network address + 1.
4. The broadcast address is one address before the next subnet.
5. The last usable address is broadcast - 1.

• 172.28.228.144/18

• 172.28.228.144/23

• B. Versioned configuration files — Infrastructure is defined in machine-readable files and tracked in version control, allowing repeatable provisioning and change history.
• D. Docker files — Assuming “Doctor files” is a typo for Dockerfiles, a Dockerfile declaratively defines how to build a container image and is commonly considered infrastructure/configuration as code.

• A. Cloned virtual machine images — These are prebuilt infrastructure artifacts, but cloning an image is not itself a code-based infrastructure definition.
• C. Change management database records — A CMDB records information about infrastructure; it does not define or provision that infrastructure.

• Access controls — ensuring only authorized users can access it.
• Encryption — protecting the data if it is intercepted or exposed.

• A: My Domain is required for many SSO configurations, but if SSO works, it is unlikely to be the cause of losing the target record.
• B: HTTP-POST is a valid SAML binding and does not inherently prevent redirection.
• D: An incorrect Federation ID generally causes authentication or user-matching failure—not successful login to the home page.

• Approve major information security policies
• Allocate funding and resources
• Set the organization’s risk appetite
• Ensure security supports business objectives

• Evaluating vendors is generally handled by security, procurement, or technical teams.
• Assessing risks is typically performed by security and risk-management professionals, with management accepting or prioritizing the risks.
• Monitoring regulatory adherence is usually handled by compliance, audit, or security functions.

• 255.255.255.128 = /25: 128 total, 126 usable
• 255.255.255.192 = /26: 64 total, 62 usable
• 255.255.255.224 = /27: 32 total, 30 usable
• 255.255.255.240 = /28: 16 total, 14 usable

• One for the network address
• One for the broadcast address

• 8 total addresses
• 6 usable addresses
• Mask: 255.255.255.248

• A: Reduce management overhead — This is generally an advantage of public cloud, not hybrid cloud. Hybrid environments can increase management complexity.
• B: Cross-platform virtualization — Not the defining advantage of hybrid cloud.
• D: Leverage IaaS and PaaS — Public clouds commonly provide both IaaS and PaaS, so this is not unique to hybrid cloud.

• File hashes
• Strings and metadata
• Binary or code structure
• Known malicious patterns
• Embedded indicators or signatures

• Sandbox: Executes the file in an isolated environment; useful for observing behavior, but usually slower.
• Network traffic analysis: Examines communications generated by a system or application, not the file itself.
• Package monitoring: Tracks software packages or installations and is not the primary method for examining malware signatures.

• Restrict a port to a defined number of MAC addresses
• Use statically assigned or “sticky” MAC addresses
• Shut down or restrict the port when violations occur

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect suspicious network activity, but is not the primary control for limiting switch MAC entries.
• NGFW: Filters traffic at the network boundary; it does not directly prevent MAC table flooding on access switches.

• Microservices: An application design approach that divides software into small services; it does not specifically reduce the number of operating systems.
• Containerization: Uses isolated containers that share the host OS kernel—best match.
• Virtualization: Creates separate virtual machines, and each typically requires its own guest OS, so it does not minimize OS instances as effectively.
• Infrastructure as code: Automates deployment and management of infrastructure; it does not describe the architecture being used.

1. Create a custom Sensitive Information Type (SIT) in the Microsoft Purview portal.
2. Use a regular expression to match the 32-character alphanumeric account number.
3. Reference that SIT in the DLP policy protecting SharePoint Online.

• Format-based data ? custom SIT with RegEx
• Built-in sensitive data ? Microsoft-provided SIT
• Document classification/protection ? sensitivity labels
• Security investigation queries ? Advanced Hunting, not DLP detection

• Customers may boycott V’s products.
• Supermarket customers may stop buying from V.
• Investors may view V as having higher legal, ethical and reputational risk.
• V could face fines, lawsuits, contract losses and higher costs.
• Expected future profits may fall.

• Third-party enterprise application with embedded AI: The provider manages most security controls. The customer mainly manages users, data, and configuration.
• Application using an existing third-party FM: The customer controls the application and its inputs/outputs, but the provider controls the underlying model and infrastructure.
• Fine-tuning a third-party FM: The customer has additional responsibility for training data, data protection, and model behavior, but still depends on the provider’s base model and platform.
• Building and training a model from scratch: The customer controls the model, training data, application, deployment, and many security safeguards. This creates the greatest security ownership.

• netstat: Shows local network connections and listening ports, but not which WAN path carries the traffic.
• nslookup: Resolves domain names to IP addresses.
• ping: Tests reachability and latency but does not show the route.

• The requirement is an assessment of the Azure environment’s design, which requires a support plan offering proactive architectural guidance.
• Premier support would provide this capability, but it is a high-cost option.
• Since the requirement says to minimize expenses, Premier is not the best recommendation.
• A lower-cost plan with the required advisory/design-review capability—historically Professional Direct in Azure’s support-plan model—would be more appropriate.

1. Identify the fact table

• Records something that happened, such as a sale, test, appointment, or measurement
• Contains foreign keys to other tables
• Contains measures or numeric results
• Has many rows

2. Identify a dimension table

• Describe people, products, dates, locations, or departments
• Contain descriptive columns
• Are referenced by the fact table
• Have fewer rows than the fact table

3. Identify the surrogate key

• System-generated
• Unique within the dimension
• Often named PatientKey, CustomerKey, or similar
• Usually an integer
• Not meaningful outside the model

• The type of change: standard, normal, or emergency
• The risk, impact, and complexity
• The change model being used

• A standard change may be pre-authorized through its change model.
• A normal change may require assessment and approval by an appropriate change authority.
• An emergency change may be authorized by an emergency change authority, often using an expedited process.

• Change authorities are not only needed for emergency changes.
• They are not assigned only when a change is deployed.
• They are not only required for normal changes.

• Financial performance
• Customer perspective
• Internal business processes
• Learning and growth

• Increasing the number of indicators can make the scorecard cluttered and less useful. Measures should be limited to those that are strategically important.
• The scorecard is mainly a tool for implementing and monitoring strategy, not for formulating strategy.
• It should contain both leading indicators and lagging indicators. Leading indicators predict future performance, while lagging indicators measure results already achieved.

• A. Microsoft 365 group with Assigned membership
• C. Microsoft 365 group with Dynamic User membership

Why?

• Assigned membership: You explicitly add User1, User2, and User3.
• Dynamic User membership: Membership is automatically determined by a rule based on user attributes.

Why the other options are incorrect

• B and D: Security groups do not support the Microsoft 365 group expiration policy.
• E: Dynamic Device groups are intended for devices, not these users, and are also security groups.

• Exploitability
• Attack complexity
• Required privileges
• User interaction
• Impact on confidentiality, integrity, and availability

• CVE: Identifies and tracks a specific vulnerability; it does not primarily measure severity.
• OSINT: Open-source intelligence gathered from publicly available sources.
• SOAR: Security orchestration, automation, and response technology used to automate security workflows.

• Microservices: An application-design approach that divides an application into smaller services. It does not inherently reduce the number of operating systems.
• Virtualization: Creates virtual machines, but each VM generally requires its own complete operating system. This improves isolation but does not minimize OS instances as effectively.
• Infrastructure as code: Uses code to automate infrastructure deployment and configuration. It improves consistency but does not determine how many operating systems are used.

• Authentication: Verifies a user’s identity, such as username and password.
• Authorization: Determines what the authenticated user is allowed to access.
• Accounting: Records connection and usage details, such as login time or session duration.

• CIA: Confidentiality, integrity, and availability are broad security objectives, not a specific RADIUS function.
• ACL: An access control list contains permit/deny rules on systems or network devices. RADIUS can support access decisions but is not itself an ACL.
• PEM: Privacy-Enhanced Mail is also associated with certificate and key encoding formats; it is unrelated to RADIUS’s primary purpose.