AICPA CPA-Auditing Exam Actual Questions
CPA Auditing and Attestation (AUD) (Page 100 )

• The Well-Architected Framework has five pillars: Operational Excellence, Security, Reliability, Performance Efficiency, and Cost Optimization.
• Operational Excellence: how you run and improve your systems—monitoring, incident response, and evolving processes.
• Reliability: the ability of a workload to recover from failures, maintain uptime, and scale as demand changes.

• Availability (A) is not a pillar name; it’s an outcome that relates to Reliability.
• Scalability (C) isn’t a pillar name; scalability touches on Performance Efficiency.
• Responsive design (D) is not a pillar in the Well-Architected Framework.

Why B works

• AWS KMS keys are Regional resources. A normal customer managed key in Region A cannot be used directly in Region B.
• A customer managed multi-Region KMS key (MRK) has related key replicas in both Regions. The replicas share key material and key ID, although each has a Regional ARN.
• With client-side encryption, the application encrypts the data before storing it in S3. Cross-Region replication then copies already-encrypted objects, so S3 does not need to decrypt and re-encrypt them with a different Regional key.

Why the other choices are weaker

• A and C: SSE-S3 uses Amazon-managed S3 keys, not the required customer managed KMS key.
• D: SSE-KMS can work only if the solution creates and configures the appropriate KMS key or multi-Region key replica in each Region. As written, it says to create a customer managed KMS key in each Region, which implies separate keys—not the same KMS key. Replication also requires additional KMS permissions and destination encryption configuration.

• prompt: the input or instruction given to the model
• completion: the desired response

json 
{"prompt":"Summarize this customer complaint.","completion":"The customer reports a delayed shipment."}

• B: A .txt file containing CSV-style lines is not automatically a valid fine-tuning dataset. The required structure and format must match the selected Bedrock model.
• C: Provisioned Throughput provides dedicated inference capacity; it does not fine-tune a model.
• D: Journals and textbooks might support domain adaptation or pretraining, but they do not provide the prompt-to-answer examples typically required for supervised fine-tuning.

• Answer: A. Use Amazon SageMaker Serverless Inference to deploy the model.

• Why: SageMaker Serverless Inference hosts the model and serves real-time predictions without you provisioning or managing servers. It scales automatically and handles deployment details.

• Why the others aren’t suitable:

• Quick example flow: web app ? SageMaker Serverless Inference endpoint ? model ? response.

• S3 Lifecycle rules automate actions such as transitioning objects to different storage classes or deleting old objects.
• S3 bucket policies control access permissions; they do not preserve earlier object versions.
• S3 server-side encryption protects data confidentiality by encrypting objects at rest, but it does not prevent deletion or overwriting.

• Accidental deletion or overwriting ? S3 Versioning
• Unauthorized access ? bucket policies and IAM
• Data encryption ? server-side encryption

• Answer: No.

• Why it doesn’t meet the goal:

• How to implement correctly (brief guidance):

• Problème: le système d’alertes signale des fluctuations tout en manquant les activités qui restent anormalement constantes sur une période longue. Il faut donc un scénario qui capte les anomalies qui se maintiennent dans le temps plutôt que les pics ponctuels.
• Peer: permet de comparer un client à ses pairs; utile pour repérer des écarts relatifs, mais ne cible pas nécessairement les motifs d’anomalie persistante sur plusieurs périodes.
• Revenus mapping: relie les transactions à des sources ou flux de revenus; utile pour l’analyse des fonds, mais pas directement pour détecter une anomalie longue durée.
• Below-the-line: conçu pour détecter des activités qui passent en dessous des seuils habituels ou qui demeurent anormales sur une longue période, comblant ainsi la faiblesse des alertes à long terme.

• Why Ishikawa:

• Why not the others:

• A assigned without var becomes a global variable (in non-strict mode). So after myFunction(), a = 5 is accessible.
• b is declared with var inside the function, so it’s local to that function (function-scoped). It’s not defined in the outer (global) scope.

• console.log(a) prints 5.
• console.log(b) throws a ReferenceError: b is not defined.

• Why: A multi-modal embedding model maps both text and images into a shared vector space, enabling cross-modal similarity and retrieval (e.g., find images matching a text query or text matching an image).

• What it does: Enables efficient similarity search using a vector database or nearest-neighbor indexing.

• Why the other options aren’t suitable:

• Quick implementation note: you’d typically pair the embeddings with a vector store (e.g., ANN index) and possibly fine-tune on domain data for better alignment across modalities.

• Quick context: In a three-tier network (Access, Distribution, Core), roles are:

• Why A is correct: The Distribution layer runs Layer 2 and Layer 3 technologies. It often handles VLAN access (L2) and can perform inter-VLAN routing or connect to the core (L3). So it makes sense for the distribution layer to support both L2 and L3.

• Why B is correct: The Core layer is designed to maintain continuous connectivity when devices fail. It is built for high availability and redundancy, providing multiple paths so the network remains reachable even if some components fail.

• Why the others are not correct:

• Residual neural network (ResNet): Primarily used for computer vision tasks such as image classification.
• Support vector machine (SVM): Commonly used for classification and regression, not natural-language query generation.
• WaveNet: Designed mainly for generating or modeling audio and speech.

• Correct answer: A) Hashing

• Why: Hashing produces a fixed-size digest of the software. If the final build is altered in any way, the hash will change, enabling you to detect tampering by comparing the stored digest with a freshly computed one.

• Why not the others:

• What wipe does: A factory reset that erases all data, apps, and settings and returns the device to the OOBE. It removes the device from management and resets identity.
• Why not for this scenario: The goal is to repurpose the same device to a new user with Autopilot. Autopilot Reset keeps the device’s Azure AD/Intune identity and re-provisions the device for the next user without a full wipe.
• What Autopilot Reset does: Removes user data and apps but preserves device identity and management connection, then reapplies the Autopilot provisioning for the next user.
• When you’d use wipe instead: If you’re selling or permanently discarding the device, or you truly want to scrub all traces and start fresh without re-enrolling.

• Why: Crisis management relies on established, repeatable procedures for responding to an incident (activation of the crisis team, escalation paths, communications, containment actions). This ensures a coordinated, timely, and auditable response.

• Why not the others:

• A. Custom and standard objects have standard fields. True. Both object types include standard fields (for example, CreatedDate, LastModifiedDate, Owner). Custom objects also have the Name field, which is a standard field on all objects.
• B. Standard objects are included with Salesforce. True. Standard objects (like Account, Contact, etc.) come with Salesforce out of the box.
• C. A new standard object can be created. False. You can create custom objects, but you cannot create new standard objects.
• D. Only standard objects support master-detail relationships. False. Master-detail relationships can be used with both standard and custom objects.

• Answer:

• Why:

• Why the other centers aren’t the right fit here:

• The mapping and resolution of endpoint identities (EIDs) to their location (RLOCs) in an SD-Access fabric is handled by the control plane using the LISP protocol.
• Why not the others:

• Answer: C (192.168.0.1-192.168.0.99, 192.168.0.101-192.168.0.254)

• Why: The interface is 192.168.0.100/24, so DHCP pools must be within the 192.168.0.0/24 subnet and cannot include the router’s IP (192.168.0.100), the network address (192.168.0.0), or the broadcast (192.168.0.255). Option C provides two ranges that exclude those addresses.

• Why the other options are invalid:

• Active vs passive: Active assessment involves actively scanning targets by sending probes/packets to identify hosts, services, and vulnerabilities. Passive assessment observes traffic without probing.
• External vs internal: External assessment is about testing from outside the network perimeter; the scenario doesn’t specify external vantage, only that tools are identifying hosts/services across the enterprise network.

• In Spark, an executor is a JVM that can have multiple cores. Each task can consume some CPUs (spark.task.cpus).
• The executor’s resources are effectively partitioned into slots, where each slot can run one task. The number of slots per executor is roughly spark.executor.cores / spark.task.cpus.
• Therefore, multiple tasks can run in parallel within the same executor (via these slots). So the statement “Tasks run in parallel via slots” is correct.

• A: A slot is not another name for an executor; a slot is a unit inside an executor.
• B: There’s no requirement that there must be fewer executors than tasks; tasks can be scheduled over time across the available slots.
• C: An executor can run more than one core; it’s not limited to a single core.
• D: There isn’t a rule that there must be more slots than tasks; tasks can wait if slots aren’t available, and you can have equal or even fewer slots than concurrent tasks.

• What the scenario asks: You have a Power BI semantic model that pulls from multiple sources (Azure SQL Database and SharePoint Online), must support a single dataset for three reports, keep data current (daily refresh by 7 AM PT), and apply RLS to limit sales data by region. You need to choose a storage mode for the tables.

• Correct choice: Dual storage mode.

• Why Dual fits:

• Key concepts:

• Control plane: Managed by Databricks and contains the Databricks web application, workspace services, cluster management, and job orchestration.
• Data plane: Runs in your cloud account and contains compute resources such as:

• Worker node: Data plane compute.
• Driver node: Data plane compute.
• JDBC data source: Usually an external data system.
• Databricks Filesystem (DBFS): Provides storage access and is backed by cloud object storage rather than being entirely part of the control plane.

powershell 
Get-AzureVM -ServiceName <service-name> -Name <vm-name> | 
  Set-AzureStaticVNetIP -IPAddress <private-ip> | 
  Update-AzureVM

• New-AzureRMVMConfig configures VM settings but does not itself assign the static IP.
• Set-AzureSubnet is not the appropriate cmdlet for assigning a VM’s private IP.
• The Azure portal option mentioned in the question was not the intended method for this older deployment model.
• Changing settings in Windows Network and Sharing Center is incorrect because Azure assigns the IP through the VM’s virtual network interface; manually configuring it inside the guest can cause conflicts.

• Copilot??????????
• ???????????????
• ??????????
• ?????????????
• ???????????????????

• Prompts and Suggestions: Retained for 28 days
• User Engagement Data: Kept for Two Years

• Assignment
• Decision
• Get Records
• Loop

• Screen flow: Would include a Screen element.
• Inactive version: Inactive status does not restrict the available elements.
• Activated version: Activation status also does not determine the toolbox contents.

• Windows 10 VMs
• Windows Server 2012 or later VMs
• Running VMs—they do not need to be shut down
• Debian 8.2+ VMs, assuming the specific version is supported
• Stopped or deallocated VMs

• Amazon S3 — Object storage, not a database.
• Amazon DynamoDB — Fully managed NoSQL key-value and document database.
• Amazon Redshift — Managed data warehouse designed for analytics, not primarily transactional MySQL workloads.

• A — SCIM synchronizes changes to user attributes from the identity provider to GitHub.
• B — SCIM deactivates GitHub accounts when users are removed or deactivated in the identity provider.
• D — SCIM automates user provisioning when new users are added to the identity provider.

• C: SCIM does not delete organization repositories.
• E: SCIM does not generate REST API authentication tokens.
• F: SCIM handles identity lifecycle management, not repository permission configuration based on roles.

• Incidents & alerts — see how the phishing activity was detected, correlated, and investigated.
• Threat Explorer — search for the malicious messages, recipients, URLs, attachments, and campaign activity.
• Email and collaboration reports — assess how many users or messages were affected.
• Remediation details — verify whether messages were quarantined, removed, or otherwise contained.

• Microsoft 365 admin center — general tenant administration.
• Microsoft Entra admin center — identity and access management.
• Exchange admin center — mail-flow and Exchange configuration, rather than full phishing-incident investigation.

• Correct answer: A — a clear business case has been established.

• The audit focus for IT procurement is ensuring there is a solid economic justification for the investment. A clear business case documents the expected benefits, costs, risks, and alignment with strategic objectives, which governs whether the investment is worth pursuing.
• The other options are important controls or project aspects, but they are secondary to ensuring the investment is justified financially and strategically: