Adobe AD0-E704 Exam Prep
Adobe Certified Master Magento Commerce Architect (Page 3 )

• Low usage during the first three weeks
• Very high usage during the last week

• High availability: Keeps services running despite failures.
• High latency: Means slow response times; it is not a benefit.
• Load balancing: Distributes traffic across resources but does not specifically address scaling resources up and down.

• A: Security groups do not control traffic to an S3 gateway endpoint in this way. Gateway endpoints are configured through route tables.
• B: An S3 bucket policy may be needed for authorization, but the error specifically indicates a connectivity or endpoint-routing problem.
• C: Glue connection settings do not require a fully qualified domain name to resolve this endpoint issue.

• Azure Cosmos DB is a globally distributed NoSQL database service. It stores and retrieves application data, but it does not provide the tools needed to build, test, and deploy predictive analytics models.
• Azure Machine Learning—including the historical Azure Machine Learning Studio—is designed for the machine-learning lifecycle:

• BCP: Maintains essential business operations during and after disruption. It is broader than IT recovery, but the question focuses on restoring the destroyed data center.
• Communication plan: Defines how the organization communicates with staff, the public, and other stakeholders.
• IRP: Handles security incidents such as malware, unauthorized access, or data breaches—not physical disaster recovery.

• Create a record-triggered Flow on Opportunity.
• Run it when the record is created or updated.
• Add entry criteria such as Probability > 50%.
• Use Create Records to create the related Sales Demo Request, populating its Opportunity lookup.

• Apex Trigger: Possible, but unnecessary custom code for a straightforward automation requirement.
• Workflow Rule: Cannot create a related custom record.
• Process Builder: Could create a record, but Flow is Salesforce’s preferred and more capable declarative automation tool.

• 25 — Traditional SMTP server-to-server mail transfer; not normally used for secure client submission.
• 110 — POP3, used to retrieve email and typically unencrypted.
• 143 — IMAP, used to access email and typically unencrypted.

• Data lakes: scalable, low-cost storage for structured, semi-structured, and unstructured data.
• Data warehouses: reliable SQL analytics, governance, and performance features.

• Data lake: Primarily provides flexible, scalable storage but may lack warehouse-style reliability and governance.
• Data warehouse: Strong for structured analytics but less flexible for raw and unstructured data.
• All of these: The individual lake and warehouse do not, by themselves, unify the siloed architecture.

• Customers access the portal without needing a full Dynamics 365 license.
• They submit case information through portal forms.
• The submitted data is stored in Dataverse tables, such as the Case table.
• Security is controlled using web roles and table permissions, so customers can access only appropriate records.

• Dynamics 365 Connector — connects apps to Dynamics 365 data but is not the portal’s underlying data platform.
• Microsoft SharePoint — useful for documents and collaboration, not the standard case-management data source for portals.
• Microsoft Azure Storage — stores files or other data, but is not the native portal business-data platform.

• The Subscribe to Reports user permission.
• At least Viewer access to the report’s folder.
• Access to the report itself.

• Subscribe to Reports: Run Reports is not the relevant Salesforce permission.
• Chatter Subscribe to Reports is not a Salesforce permission.
• Set Running User relates to configuring the user whose permissions determine report results—not subscribing to a report.

• SQL injection (SQLi): Attacks databases by inserting malicious SQL commands.
• Cross-site scripting (XSS): Injects scripts into web pages viewed by other users.
• Sideloading: Installing an application from outside the official app store. It may install unauthorized apps, but it does not generally unlock the operating system or enable restricted system features.

• Gaia Portal: Controlled by Gaia administration settings, not SmartConsole Trusted Clients.
• SSH: Controlled by Gaia or operating-system SSH access settings.
• Security Gateway(s): SmartConsole connects to the Security Management Server, not directly to gateways for this purpose.

• Basic: Self-help only; no technical support or design assessment.
• Standard: Technical support, but not the full proactive architectural guidance required here.
• Professional Direct: Provides proactive guidance and architecture-related assistance.
• Premier: Also supports this, but is a more expensive, enterprise-level option.

• Multiple nodes: Data is replicated several times in the primary region.
• Separate geography: A copy is asynchronously replicated to a secondary Azure region.
• Readable secondary: RA-GRS provides read-only access to the secondary replica, even when the primary region is available.

• GRS: Replicates to another region but the secondary copy isn’t normally readable.
• ZRS: Replicates across availability zones in the same region, not a separate geographic region.
• LRS: Keeps replicas within a single datacenter or region and provides no geographic redundancy.

1. Determine which host was infected first—the originating host.
2. Decide whether each other host is clean or infected based on communication and event logs.

• Compare timestamps and find the earliest suspicious event.
• Look for the host that initiated the malicious connection, file transfer, exploit, or command—not merely a host that later received traffic.
• Follow the timeline through the firewall:

• A host is likely infected if it both receives suspicious activity and then initiates related malicious traffic.
• A host may be clean if the firewall blocked the connection and there is no evidence of execution or follow-on communication.

kusto 
Event | where EventType == "error"

• == is the KQL equality operator.
• -eq is a PowerShell operator, not KQL.
• is is not the correct equality operator in this context.

text 
Event | where EventType –eq "error"

• Event | search "error" — valid, broad search.
• search in (Event) "error" — valid, broad search.
• Event | where EventType == "error" — valid, targeted filter.

• Use one Azure AD directory for the organization.
• Separate divisions with subscriptions and/or resource groups.
• Assign each division’s administrator appropriate Azure role-based access control (RBAC) permissions, scoped to their subscription or resource group.

• 2000::/3 — Global unicast, used for publicly routable IPv6 addresses.
• FC00::/7 — Unique local, used for private internal addressing.
• FE80::/10 — Link-local, used only on the local network segment and not routed between subnets.

• Create Power Query parameters for the Azure SQL server/database—or at least the database name.
• Use the parameter in the PBIX connection.
• Publish the same PBIX separately to the relevant development, test, and production workspaces.
• Set each dataset’s parameter value in the Power BI service so it points to the corresponding Azure SQL database.

• Development dataset ? DevelopmentDB
• Test dataset ? TestDB
• Production dataset ? ProductionDB

• The same PBIX is used for every lifecycle stage.
• Each stage consumes data from its matching database.
• Deployment pipelines are not required.
• Azure SQL is a cloud source, so gateway administration is generally avoided.
• Only the parameter value differs between published datasets, reducing maintenance.

• SAMLRequest: the SAML authentication request
• RelayState: the original destination or application state

• RedirectURL: not the standard SAML parameter for preserving the original request.
• DisplayState: not a standard SAML SSO parameter.
• StartURL: Salesforce-related terminology, but not the standard parameter used in this SAML exchange.

• Normalize casing in the data source—for example, convert all values to uppercase or lowercase.
• Add an index key to provide a unique, stable identifier for each row or value.

• The user authenticates with the external Identity Provider.
• Salesforce receives the SAML assertion.
• Salesforce uses attributes in that assertion—such as username, email, first name, last name, and profile/community information—to create the user during the first login.
• On later logins, Salesforce updates or uses the existing user record.

• On-the-fly provisioning is a general phrase; the Salesforce capability being tested is specifically JIT provisioning.
• Salesforce APIs would require a separate integration and provisioning process.
• Identity Connect is designed primarily to synchronize users from an identity directory, not to create users at the moment of their first SAML login.

• A — Reports: Reports are informational and don’t enforce access during an SSO transaction.
• B — Apex trigger and Permission Sets: A trigger could update permissions when a Case changes, but this creates synchronization and timing issues. It also changes Salesforce permissions rather than making a direct, real-time decision for the external system.
• C — Custom SAML JIT Provisioning: JIT provisioning is primarily for creating or updating users at login. It isn’t the appropriate mechanism for dynamically querying business records and deciding whether access should be granted.
• D — Connected App Handler: Designed for custom, programmatic control during connected-app authentication and authorization. Apex can check the user’s current open classified cases and permit or reject the SSO request.

• Secure: uses encryption, such as HTTPS or SFTP.
• Cross-platform: supported by many languages and operating systems.
• Internet-friendly: designed to communicate across networks, usually using standard Internet protocols.

• JSON/REST over HTTPS — widely supported, secure, and Internet-friendly.
• SOAP over HTTPS — also secure and highly cross-platform, though more heavyweight.
• XML over SFTP — secure file-based exchange, but it is not an API-style interface.

• Remote and global access: Employees can authenticate from anywhere, not just a specific location.
• Seamless login: The device can authenticate in the background, reducing repeated password or MFA prompts.
• Minimal equipment: It uses devices employees already have, rather than requiring separate hardware.

• Geotagging: Identifies location but is not a complete authentication method and can be spoofed.
• Smart cards: Can provide strong authentication, but require cards and often readers, adding equipment and user steps.
• Time-based logins: Restrict access by time but do not verify the user or device adequately.

• The identified risk
• Its likelihood and potential impact
• The person or team responsible for handling it
• The response or treatment plan
• Risk thresholds, such as when escalation or action is required
• Current status and review dates

• Risk tolerance: The amount of risk an organization is willing to accept; it is a concept or limit, not usually the primary documentation.
• Risk transfer: Moving the responsibility or financial impact of a risk to another party, such as through insurance.
• Risk analysis: The process of evaluating risk likelihood and impact.

1. You try to access a cloud application, such as accounting software.
2. The application redirects you to the company’s IdP.
3. You authenticate with the IdP.
4. The IdP sends a digitally signed SAML assertion to the application.
5. The application validates the assertion and grants access.

• The user’s identity
• Whether authentication succeeded
• Roles or group membership
• Access-related attributes

• Monitoring: Detects activity but does not remove the underlying risk.
• Patching: Useful for systems that must remain operational, but these desktops are unused.
• Isolating: Can be a temporary containment measure, but permanently removing unnecessary systems is more appropriate.

Question 3: AWS Storage Gateway File Gateway

• A: S3 bucket per user — S3 is object storage, not a traditional shared file system; mounting it requires extra tools and is less efficient.
• B: File Gateway — Provides a local file share using standard file protocols while storing files in Amazon S3. This preserves convenient local access and extends storage capacity.
• C: WorkSpaces and WorkDocs — Designed for virtual desktops and document collaboration, not large shared file storage.
• D: EC2 with EBS — EBS is attached to one EC2 instance and is not designed for direct multi-user file sharing.

• Honeypots: Decoy systems or services made to attract attackers. Legitimate users should not interact with them, so activity there is a strong indicator of malicious behavior.
• DNS sinkholes: Redirect requests for known malicious domains to a controlled internal system. This can reveal infected hosts attempting to contact command-and-control infrastructure.

• Tokenization: Replaces sensitive data with non-sensitive tokens.
• CI/CD: Automates software development, testing, and deployment.
• Threat modeling: Identifies and analyzes potential threats before or during system design.
• Data obfuscation: Makes data harder to understand or interpret.

• The servers are powered on.
• The network is functioning.
• Devices can still reach the server network.

• ARP poisoning: Redirects or intercepts local network traffic; it usually affects communication paths rather than overwhelming a service.
• Jamming: Disrupts wireless or radio signals. It would not fit a system that remains accessible from devices on the server network.
• Kerberoasting: Attempts to crack service-account credentials from Kerberos tickets; it does not normally cause an immediate outage.

• Resources that do not need internet access should remain on private network segments.
• Internet-facing access should be restricted to systems that require it.
• Access should be explicitly allowed rather than broadly exposed.

• A: A single administrator with access to core functions may violate least privilege if that access is broader than necessary.
• B: Inspecting traffic supports monitoring and defense, but does not itself limit privileges.
• C: Updating routing configurations supports availability and connectivity, not least privilege.

• Import: Copies data into the Power BI model. It requires scheduled or manual refresh, so it may not meet the two-minute requirement.
• Live connection: Connects to an existing Power BI semantic model or Analysis Services model; it is not the appropriate choice for connecting directly to the Azure SQL database in this scenario.

• The requirement explicitly says the organization wants to use SAML to secure Salesforce API access.
• The SAML Bearer Assertion Flow exchanges a SAML assertion for a Salesforce OAuth access token.
• It is intended for server-to-server or other noninteractive integrations where the application has already been authenticated by an identity provider.
• The connected app can be configured so administrators authorize or preauthorize applications that consume the APIs.

• B — JWT Bearer Flow: Uses a signed JWT, not a SAML assertion. It would be appropriate if the requirement specified JWT-based authentication.
• C — SAML Assertion Flow: This is not the standard Salesforce OAuth flow name; the relevant name is OAuth 2.0 SAML Bearer Assertion Flow.
• D — User-Agent Flow: Designed for interactive browser-based authorization, not a SAML-based server-to-server integration.

• Have a definite, clear objective (C): Know exactly what you want to communicate. A clear purpose reduces ambiguity and irrelevant information.
• Plan the communication (E): Decide what to say, who needs the information, the appropriate channel and the best timing.
• Seek feedback (F): Check that the receiver understood the message. This could involve asking for confirmation or inviting questions.

• Ask questions (A): Usually associated with the receiver checking or clarifying information, although a sender may use questions in practice.
• Give feedback (B): Feedback is generally the receiver’s response to the sender’s message. The sender’s responsibility here is to seek feedback.
• Consider their contribution (D): This is not a standard sender-focused step in the communication process. The sender should consider the receiver’s needs and perspective, but the wording is less precise than the three recognised actions above.

• Ease of exploitation
• Required privileges
• User interaction
• Impact on confidentiality, integrity, and availability

• CVE: Identifies and names a specific publicly known vulnerability; it does not measure severity.
• OSINT: Refers to intelligence gathered from publicly available sources.
• SOAR: Automates and coordinates security operations, such as alert response and playbooks.

• tag=Priv searches the tag field for values beginning with Priv. The wildcard can match the remaining characters, so it matches Privileged.
• tag=Priv would search for the exact tag Priv, not Privileged.
• tag=priv* uses lowercase priv; tag matching is treated as case-sensitive here, so it may not match the tag Privileged.
• tag=privileged uses the wrong capitalization for the exact tag.

• B — Prompts and suggestions retained for 28 days
• C — User engagement data kept for two years

• The key distinction is between content data—your prompts, code context, and generated suggestions—and engagement data, such as usage activity.
• Do not confuse retention with training: enterprise Copilot data is generally not used to train GitHub’s models without appropriate authorization.
• For a current exam, verify the policy version cited by the exam provider. The key’s C is likely correct, but B should be treated cautiously and may no longer reflect the current policy.

• Admin access to the deployment pipeline (B) – lets the developers use the pipeline and deploy content.
• Contributor access to the Development and Test workspaces (E) – required to deploy items into those workspaces.
• Viewer access to the Production workspace (D) – lets them view Production content without allowing deployment or modification.

• Contributor access to Production (F), because that could allow changes or deployment there.
• Viewer access to Development/Test (C), because Viewer is insufficient for deployment.
• Build permission to Production semantic models (A), because building reports on a semantic model is not required merely to view Production items.

kusto 
Event 
| summarize make_set(EventID) by Computer

• summarize groups records.
• by Computer creates one result row per virtual machine.
• make_set(EventID) returns an array containing unique event IDs for that computer.

kusto 
| summarize make_list(EventID) by Computer

sql 
SELECT COUNT(*) FROM table;

• A: It does not normally need to scan all data files for this operation.
• B: Results are not simply reused from a query cache every time. Caching is separate from Delta’s metadata optimization.
• D: The relevant metadata is maintained through the Delta transaction log, not directly treated as a Parquet-file metadata operation in this context.

• Assign users or their team an appropriate security role.
• Ensure the role has the required table privileges, such as read, create, write, and append.
• Share the app with that security role in the app designer.

• Dynamics administration center: Used for environment and service administration, not routine app access configuration.
• Manage Roles: Not the specific Dataverse area used to define app and data permissions.
• Security Roles: Define what users can access and which operations they can perform.

• Laws and regulations
• Litigation holds
• Industry or contractual obligations
• Tax, financial, health, or privacy requirements

• Business strategy and direction: May influence retention, but cannot override legal requirements.
• Storage capacity and longevity: Practical considerations, not the primary driver.
• Business ease and value analysis: May support decisions after compliance obligations are identified.

1. Start with the 48-bit MAC address.
2. Split it into two 24-bit halves.
3. Insert FF:FE between the halves, creating a 64-bit value.
4. Invert the U/L bit—the seventh bit from the left in the first MAC byte.

text 
MAC:       00:1A:2B:3C:4D:5E 
EUI-64:    02:1A:2B:FF:FE:3C:4D:5E

• FE80 is the prefix commonly used for an IPv6 link-local address, not part of the EUI-64 interface ID.
• The interface ID is not random.
• The MAC address is modified by inserting FF:FE and changing the U/L bit.

• Reviewing security policies and standards checks whether controls are documented, not whether they work.
• Reviewing security logs may show that monitoring is occurring, but does not directly establish that preventive controls are effective.
• Analyzing technical security practices is broad and may assess implementation, but it is less objective than an actual controlled attack.

• Design/compliance effectiveness: policies, standards, and procedures
• Operational effectiveness: logs, records, and evidence that controls operate
• Technical security effectiveness: penetration testing or vulnerability testing

• Red team: Simulates attackers; exploits weaknesses to test security.
• Blue team: Defends systems; monitors, detects, and responds to attacks.
• Purple team: Combines red- and blue-team efforts to improve detection and defense.
• White team: Oversees or manages the test, defining rules, scope, and authorization.

• Fileless malware: Nothing in the command indicates malware executing only in memory.
• Living-off-the-land binaries: Mimikatz is a credential-access tool, not a normal system utility used for LOLBin abuse.
• Social engineering: The command shows technical credential abuse, not manipulation of an accountant.

• Separate accounts/domains create a strong administrative boundary between non-production and production.
• Separate projects provide distinct IAM boundaries, billing, quotas, service accounts, and resources.
• Developers can receive permissions in the development project without automatically gaining access to production.
• Production administrators can be restricted from development resources, supporting separation of duties and least privilege.

• A: Creates excessive project fragmentation without being required by the stated requirement.
• C: Keeps development and production under one account and does not clearly separate administrative duties.
• D: Uses one account and only two projects; it provides some project isolation but weaker organizational separation.

• Hardware and infrastructure
• System software
• Networks and communications
• Technology platforms and services

• Business Architecture: Defines business strategy, organization, functions, and processes.
• Data Architecture: Defines the structure and management of enterprise data.
• Application Architecture: Describes application systems and how they interact to support business and data processing.

• The explanation states that Traffic Analytics can be enabled by a user with one of these subscription-level roles:

• Question 34 — Network Contributor: Yes
• Question 35 — Owner: Yes
• Question 36 — Reader: Yes, according to the stated explanation and documentation