Adobe 9A0-303 Exam Prep
Adobe Photoshop CS6 ACE Exam (Page 22 )

• Honeypots: Decoy systems or services made to attract attackers. Legitimate users should not interact with them, so activity there is a strong indicator of malicious behavior.
• DNS sinkholes: Redirect requests for known malicious domains to a controlled internal system. This can reveal infected hosts attempting to contact command-and-control infrastructure.

• Tokenization: Replaces sensitive data with non-sensitive tokens.
• CI/CD: Automates software development, testing, and deployment.
• Threat modeling: Identifies and analyzes potential threats before or during system design.
• Data obfuscation: Makes data harder to understand or interpret.

• A — Too infrequent: Formal strategies are often reviewed only every three to five years. This can make the organisation slow to respond to rapid changes in technology, competitors, regulation or customer needs.

• C — Relies on predicting the future: The approach assumes senior managers can make reasonably reliable forecasts and assumptions. In uncertain environments, these assumptions may quickly become invalid.

• E — Can restrict radical innovation: Formal planning tends to favour existing information, established objectives and incremental improvements. This may discourage experimental or highly innovative strategies that emerge from lower levels of the organisation.

• B concerns the difficulty of achieving competitive advantage through core competences when competing with focused specialists. It is not specifically a drawback of the formal top-down planning process.
• D is an activity organisations should undertake—continuous monitoring—not a drawback of the approach itself.

• Server — provides services or resources
• Endpoint — a user device connected to the network
• Ethernet — a networking technology, not a filtering device
• Firewall — filters and controls traffic

• Hardware and infrastructure
• System software
• Networks and communications
• Technology platforms and services

• Business Architecture: Defines business strategy, organization, functions, and processes.
• Data Architecture: Defines the structure and management of enterprise data.
• Application Architecture: Describes application systems and how they interact to support business and data processing.

yaml 
clusterIP: None

• CronJob: Runs Jobs on a schedule and normally does not need stable networking.
• Deployment: Manages interchangeable, stateless replicas and usually uses a regular Service.
• DaemonSet: Runs a Pod on selected nodes but does not inherently require stable Pod identities.

1. Determine which host was infected first—the originating host.
2. Decide whether each other host is clean or infected based on communication and event logs.

• Compare timestamps and find the earliest suspicious event.
• Look for the host that initiated the malicious connection, file transfer, exploit, or command—not merely a host that later received traffic.
• Follow the timeline through the firewall:

• A host is likely infected if it both receives suspicious activity and then initiates related malicious traffic.
• A host may be clean if the firewall blocked the connection and there is no evidence of execution or follow-on communication.

• Resources that do not need internet access should remain on private network segments.
• Internet-facing access should be restricted to systems that require it.
• Access should be explicitly allowed rather than broadly exposed.

• A: A single administrator with access to core functions may violate least privilege if that access is broader than necessary.
• B: Inspecting traffic supports monitoring and defense, but does not itself limit privileges.
• C: Updating routing configurations supports availability and connectivity, not least privilege.

• Accept: Acknowledge the risk and choose not to take additional action.
• Transfer: Shift the risk or its financial impact to another party, such as through insurance or outsourcing.
• Mitigate: Reduce the likelihood or impact of the risk, such as by implementing security controls.
• Avoid: Eliminate the activity or condition that creates the risk.

1. Modify the database subnet NACL inbound rules to allow traffic from the new web subnet’s CIDR block on the MySQL port (3306).
2. Modify the database subnet NACL outbound rules to allow return traffic to the new web subnet’s CIDR block on the required ephemeral port range.

• A — conformant: Incorrect because one explicit requirement is violated.
• B — consistent: “Consistent” is not sufficient where the implementation contradicts a mandatory specification. The RPC mechanism is covered by the architecture, and the implementation differs from it.
• C — consistent: Incorrect reasoning: the RPC mechanism does have a defined architectural requirement, so conformance must be assessed.
• D — non-conformant: Correct because the implementation fails to follow the specified RPC/threading requirement.

• Create a record-triggered Flow on Opportunity.
• Run it when the record is created or updated.
• Add entry criteria such as Probability > 50%.
• Use Create Records to create the related Sales Demo Request, populating its Opportunity lookup.

• Apex Trigger: Possible, but unnecessary custom code for a straightforward automation requirement.
• Workflow Rule: Cannot create a related custom record.
• Process Builder: Could create a record, but Flow is Salesforce’s preferred and more capable declarative automation tool.

• Guiding principles
• Governance
• Service value chain
• Practices
• Continual improvement

• Guiding principles: Recommendations that guide decisions and actions; they do not describe the entire system.
• Four dimensions: Perspectives used to ensure a balanced approach to service management.
• Service relationship: Describes cooperation between a service provider and service consumer, rather than the whole value-creation system.

• Use one Azure AD directory for the organization.
• Separate divisions with subscriptions and/or resource groups.
• Assign each division’s administrator appropriate Azure role-based access control (RBAC) permissions, scoped to their subscription or resource group.

python 
def add_integers(a, b): 
    return a + b

• Uses def to define a function.
• Accepts two parameters, a and b.
• Uses return to send their sum back to the caller.
• Uses indentation to define the function body.

python 
result = add_integers(3, 4) 
result is 7

• ARP poisoning: Redirects or intercepts local network traffic; it would more likely affect communication paths or cause man-in-the-middle behavior.
• Jamming: Interferes with wireless signals. The scenario does not indicate a wireless outage.
• Kerberoasting: Attempts to obtain service-account password hashes from Kerberos; it is a credential attack, not typically a direct service outage.

• Multiple nodes: Data is replicated several times in the primary region.
• Separate geography: A copy is asynchronously replicated to a secondary Azure region.
• Readable secondary: RA-GRS provides read-only access to the secondary replica, even when the primary region is available.

• GRS: Replicates to another region but the secondary copy isn’t normally readable.
• ZRS: Replicates across availability zones in the same region, not a separate geographic region.
• LRS: Keeps replicas within a single datacenter or region and provides no geographic redundancy.

• The listener has a virtual IP address on the load balancer.
• The active SQL Server replica must respond using the listener’s IP address, not its own VM IP.
• Floating IP allows the listener IP to be preserved and returned by the active replica.
• This is required for the SQL Always On listener configuration.

• A health probe for the SQL listener/cluster role
• The SQL Server listener port, commonly 1433
• Appropriate backend pool membership

• Disable default accounts: Default or unused accounts may have predictable names or credentials and can be abused by attackers. They should be disabled, removed, or secured with strong credentials where necessary.
• Remove unnecessary services: Every running service can contain vulnerabilities or provide an entry point. Removing services the server does not need reduces exposure.

• Add the server to the asset inventory: Important for asset management, but it does not directly harden the system.
• Document default passwords: Default passwords should be changed or disabled—not recorded for continued use.
• Send logs to the SIEM: Supports monitoring and detection, rather than directly reducing the attack surface.
• Join the corporate domain: A deployment/configuration decision, not inherently a hardening measure.

1. Product + ProductSubCategory: Inner join

1. Result + ProductCategory: Left outer join

• A — Correct: Flow Builder is declarative and visual, so administrators and other non-developers can participate in designing and improving business processes without writing Apex.
• D — Correct: Flow Builder provides visual debugging tools, allowing an admin to test paths, inspect variable values, and identify where a specific business case fails.
• E — Correct: A flow’s visual structure documents the logic and makes later maintenance easier than reading and updating custom Apex code.

• B — Incorrect: Flow debugging does not attach a debugger to live customer sessions. The admin uses Flow Builder’s debug functionality with test inputs; this is not live-session debugging and should not be used to monitor real customer transactions.

• Admin access to the deployment pipeline (B) – lets the developers use the pipeline and deploy content.
• Contributor access to the Development and Test workspaces (E) – required to deploy items into those workspaces.
• Viewer access to the Production workspace (D) – lets them view Production content without allowing deployment or modification.

• Contributor access to Production (F), because that could allow changes or deployment there.
• Viewer access to Development/Test (C), because Viewer is insufficient for deployment.
• Build permission to Production semantic models (A), because building reports on a semantic model is not required merely to view Production items.

• View/inspect configuration: Possible.
• Modify the installed application or its S-Controls: Typically restricted in a test-drive org.

• A: Security groups do not control traffic to an S3 gateway endpoint in this way. Gateway endpoints are configured through route tables.
• B: An S3 bucket policy may be needed for authorization, but the error specifically indicates a connectivity or endpoint-routing problem.
• C: Glue connection settings do not require a fully qualified domain name to resolve this endpoint issue.

• Financial performance
• Customer perspective
• Internal business processes
• Learning and growth

• Increasing the number of indicators can make the scorecard cluttered and less useful. Measures should be limited to those that are strategically important.
• The scorecard is mainly a tool for implementing and monitoring strategy, not for formulating strategy.
• It should contain both leading indicators and lagging indicators. Leading indicators predict future performance, while lagging indicators measure results already achieved.

• Help the team identify the causes of delays.
• Encourage continuous improvement through retrospectives.
• Support the team in changing its process, tools, or collaboration methods.
• Help remove impediments that the team cannot resolve independently.

• A: An impediment log may help, but simply maintaining it does not ensure the impediments are resolved.
• B: Directing the team to solutions conflicts with agile self-management.
• C: Adding impediments to the product backlog could delay their resolution and treats them like product features.

Simple explanation

• The Azure VPN gateway to connect to
• Authentication settings
• Routes for networks that the client can access

• Geo-redundant storage (GRS) replicates data to a secondary Azure region, but the secondary copy is normally unavailable for read access.
• RA-GRS provides geo-replication and read-only access to the secondary region, satisfying all requirements.
• Zone-redundant storage (ZRS) replicates data across availability zones within the same Azure region, not separate geographic regions.
• Locally redundant storage (LRS) keeps copies within a single datacenter or region and does not provide geographic resiliency.

• R-squared (R²): mede quanto da variação dos valores reais é explicada pelo modelo. É mais usado em regressão, não em classificação.

• Accuracy (acurácia): mede a proporção de previsões corretas em relação ao total. É adequada para a classificação de imagens da questão.

• RMSE (Root Mean Squared Error): mede o tamanho médio dos erros entre valores previstos e reais, penalizando erros maiores. É usado principalmente em regressão.

• Learning rate (taxa de aprendizado): controla o tamanho dos ajustes feitos pelo modelo durante o treinamento. Não é uma métrica de avaliação; é um hiperparâmetro.

• principal represents the source or initiating system.
• principal.port is the source port.
• target represents the destination system.
• target.port is the destination port.

text 
principal.port = 5555

• network.ApplicationProtocol = HTTP identifies HTTP traffic but not the backdoor specifically.
• target.port = 5555 finds traffic going to port 5555, rather than originating from it.
• network.ip_protocol = TCP is too broad because many services use TCP.

sql 
SELECT COUNT(*) FROM table;

• A: It does not normally need to scan all data files for this operation.
• B: Results are not simply reused from a query cache every time. Caching is separate from Delta’s metadata optimization.
• D: The relevant metadata is maintained through the Delta transaction log, not directly treated as a Parquet-file metadata operation in this context.

1. Get Data ? Folder in Power BI Desktop.
2. In Power Query Editor, expand the Attributes column to expose metadata such as hidden status and other file attributes.
3. Remove the Content column (and any other data columns you do not need).

• Name
• Extension
• Date accessed
• Date modified
• Folder Path
• Attributes
• Content

• Conserve public IPv4 addresses: IPv4 addresses are limited, so many internal devices share a smaller number of public addresses through NAT.
• Reduce direct exposure: Private addresses are not directly routable from the public Internet, which helps reduce unsolicited access to internal devices.

• ARP poisoning: Redirects or intercepts local network traffic; monitoring would typically show suspicious ARP changes or man-in-the-middle behavior.
• Jamming: Interferes with wireless or radio signals. It would affect connectivity, not usually show a server-specific overload.
• Kerberoasting: Attempts to obtain and crack Kerberos service-account hashes; it does not normally cause a system outage.

• Uses on-premises data or resources
• Runs components in the cloud
• Can scale across multiple cloud environments when demand increases

• Public cloud: Resources are hosted entirely by a cloud provider.
• Private cloud: Resources are dedicated to one organization, usually in its own environment.
• Hybrid: Combines on-premises and cloud resources.

• BCP (Business Continuity Plan): Ensures the organization can continue its broader business operations during and after a disruption. It is broader than the IT-focused recovery required here.
• Communication plan: Defines how information is shared with employees, the public, and other stakeholders; it does not restore systems.
• IRP (Incident Response Plan): Handles and contains security incidents, such as malware or unauthorized access. A tornado is a disaster, not primarily a cybersecurity incident.

1. Convert text and images into numerical embeddings.
2. Store or compare those embeddings.
3. Retrieve the most semantically similar items.

• Embedding model: Best for similarity search and retrieval.
• Generation model: Best for producing new text or other content from multimodal input.

• Restarting the device: May fix software glitches, but would not usually make cable orientation matter.
• Swollen battery: A safety concern, but it would not typically cause recognition only in one cable orientation.
• Failing cable: Possible, but less likely because the problem occurs with this particular device and not other devices of the same type.

• staff use the new system;
• transactions and reports are checked;
• problems are corrected;
• feedback is collected.

• Phased changeover: different parts or functions are introduced in stages, often according to a planned sequence.
• Pilot changeover: one representative department, branch or group acts as a test site before wider implementation.
• Parallel changeover: old and new systems operate at the same time.
• Direct changeover: the old system is stopped and the new one starts immediately.

• Whether a user has a console password
• Password age and last password change
• Whether MFA is enabled
• Access key status
• Access key creation date and last-use information
• Access key age, which helps audit rotation

• IAM Access Analyzer identifies unintended access to resources; it does not report credential age or rotation.
• AWS Artifact provides AWS compliance documents and agreements, not details about your IAM users.
• AWS Audit Manager helps collect evidence for audits, but it is not the direct tool for viewing IAM credential rotation details.

• A — Add a Path for Stage: A Path lets users update the Opportunity’s Stage directly from the record page, without opening the full edit form. It can also display guidance and key fields.
• B — Use a Kanban list view: Users can move Opportunities between stages by dragging records between columns, which is ideal when Stage is the only field they normally change.

• Review the risk register.
• Use the previously defined risk response plan, such as assigning a backup resource, reprioritizing work, or using another qualified engineer.
• Implement the response promptly because the task is on the critical path.

• B: Revising the schedule without first applying the planned response may be premature.
• C: Excluding a required task could compromise the project’s objectives and requirements.
• D: Updating the risk and lessons learned records is appropriate, but it should happen after managing the immediate issue, not as the next primary action.

• Matching hashes suggest the file has not changed.
• Different hashes indicate that the file was modified, whether authorized or unauthorized.

• Backup: Helps recover the previous version but does not identify or stop unauthorized changes.
• File labels: Classify or mark files; they do not verify integrity.
• Security audit: May discover weaknesses or improper changes, but is periodic and not a direct technical integrity control.

• vBond — orchestration plane: Authenticates devices, helps them discover each other, and assists with NAT traversal and initial control-connection setup.
• vSmart — control plane: Distributes routing and policy information to WAN Edge devices using the overlay control plane.
• vManage — management plane: Provides centralized configuration, monitoring, and orchestration through its GUI/API.
• WAN Edge — data plane: Forwards user traffic across the SD-WAN fabric.

• Writing with Apache Spark, typically as Delta tables.
• Reading with Apache Spark for processing and analysis.
• Reading with T-SQL through the lakehouse’s automatically generated SQL analytics endpoint.
• Reading with KQL through Fabric’s query capabilities that can access lakehouse data.

• Eventhouse: Optimized for real-time and KQL workloads, but it is not the natural destination for Spark-based writes or general lakehouse storage.
• Datamart: Intended mainly for relational analytics and Power BI; it is not designed for Spark-based data ingestion.
• Warehouse: Primarily T-SQL-based and structured. It does not provide the same native Spark write experience or flexibility for semi-structured data.

• SQL injection
• Cross-site scripting (XSS)
• Malicious file uploads
• Common web-application exploits

• Layer 4 firewall: Filters primarily by IP addresses, ports, and transport protocols; it lacks detailed web-application inspection.
• NGFW: Provides advanced network filtering and may include application awareness, but a WAF is more specialized for protecting web applications.
• UTM: Combines several security functions in one device, but it is not specifically focused on web-application attacks.

• Workspace: Stores notebooks, libraries, jobs, and other project resources.
• Notebooks: Interactive documents containing code, queries, visualizations, and explanations. Common languages include Python, SQL, Scala, and R.
• Clusters: Groups of virtual machines that run Spark workloads. Clusters can be started, stopped, and automatically scaled.
• Data access: Databricks can read from services such as Azure Data Lake Storage, Azure Blob Storage, and Azure SQL.
• Jobs: Automate notebooks or data-processing workflows on a schedule or in response to events.

json 
"Resource": "arn:aws:s3:::bucket-name/*"

• A: Revoking or changing an instance profile does not reliably invalidate temporary credentials that have already been issued and may still be valid.
• B: Changing the EC2 security group does not necessarily stop the attacker from using the stolen credentials from elsewhere.
• C: Amazon Macie helps discover sensitive data; Object Lock prevents modification/deletion, not reads or downloads.

• Inherent risk: Risk that exists before controls are implemented.
• Avoided risk: Risk eliminated by choosing not to perform the risky activity.
• Operational risk: Risk arising from failures in processes, people, systems, or daily operations.