AICPA CPA-Auditing Exam Actual Questions
CPA Auditing and Attestation (AUD) (Page 70 )

• Approval publish: Request approval from a manager of the knowledge base before moving the article into the publish state.
• Instant Publish: Immediately publishes a draft article without requiring an approval.
• Instant Retire: Immediately retires a published article without requiring an approval.
• Retire Knowledge: Moves a knowledge article to the retired state.

• These are the base knowledge workflows that control how articles move between states (Draft, Published, Retired) and whether approvals are required.
• The other options describe different lifecycle actions, but these four cover the standard publish/retire workflows in ServiceNow.

• Mapping:

• Why:

• Quick note: If you were to host a website on a VM, it would be IaaS; if you used a platform service instead of a VM, it would be PaaS. CaaS (containers) isn’t shown here.

• Answer: D

• The strongest security comes from enforcing access at the storage layer. An IAM policy scoped to the Cognito identity prefix restricts each user to their own S3 prefix (folder), so users can only access their own files regardless of client or server code.
• This per-user isolation reduces risk of cross-user data access and is more robust than UI validation or Lambda/API validation alone.
• Implementation note: attach a policy to the Cognito identity role that allows actions on arn:aws:s3:::your-bucket/${cognito-identity.amazonaws.com:sub}/* (per-user prefix). Ensure TLS in transit and enable at-rest encryption (SSE-S3 or SSE-KMS). Use multipart upload for large files up to 300 MB.

• The question asks why some tasks appear locked in the HR Guided Setup Module’s Task view.
• The options are:

• C) They require other tasks to be completed first. In guided setup flows, tasks are usually gated by prerequisites to ensure proper sequencing and data/configuration dependencies. You typically unlock a task only after the necessary preceding tasks are finished.

• A) Elevated roles can restrict access in some contexts, but guided setup tasks are commonly gated by prerequisites rather than solely by role.
• B) Deprecation isn’t the general pattern for “locked” tasks in the guided setup.
• D) A plugin activation could unlock certain features, but the common gating mechanism is task dependencies, not plugin state.

• The page shows the answer as D, but based on how HR Guided Setup usually works, the more accurate reason is typically C (prerequisites). If you’re studying, treat C as the conceptual answer and be aware the listed key may be incorrect. If you want, I can walk through each option in more detail.

• Windows 10 VMs
• Windows Server 2012 or later VMs
• Running VMs—they do not need to be shut down
• Debian 8.2+ VMs, assuming the specific version is supported
• Stopped or deallocated VMs

• A) You can only apply a single template BOM to a service object.

• C) You can modify or delete lines in a BOM template regardless of whether the template has been associated to a service object, or not.

• B) You can apply many template BOMs to a service object — false; typically only one template per service object.
• D) You can modify/delete lines only if not associated — false; you can modify templates even after association (per C).

• A. Flash the BIOS: Not the first move. A BIOS update can be risky when POST is failing. It’s better to first rule out simpler causes (like RAM seating). BIOS flashing is usually done if the CPU isn’t supported by the current BIOS, which you’d check after RAM seating.

• B. Check the CMOS battery: Possible but unlikely the immediate cause. CMOS battery issues would more likely cause BIOS settings to reset or clock problems. RAM seating is a more common, direct fix after a motherboard swap.

• D. Reinstall the old motherboard: Not a troubleshooting step for the new system. The goal is to get the new motherboard to POST, not revert to old hardware.

• C. Reseat the RAM: Correct because memory seating problems are the most common cause of POST failures after a motherboard swap. Re-seating ensures proper contact in the new board’s slots.

• The problem: Guest users can’t create posts in the Monthly Reports channel.
• The recommended fix (answer B): Modify the Guest access settings in the Teams admin center.

• Guest access settings control what guests are allowed to do across Teams (for example, posting, chat, and channel participation). If guests are restricted from posting, enabling the appropriate guest permissions will let them post in channels like Monthly Reports.
• The other options don’t directly change guest permissions in the way that affects posting:

• Why: Table.Profile returns a per-column profile that includes statistics such as count, null count, distinct count, and standard deviation. It also provides min/max and average where applicable, which matches the requested metrics (Count, Average, Null count, Distinct count, Standard deviation).
• Syntax: Table.Profile(table as table, optional additionalAggregates as nullable list) as table
• How it helps: After running Table.Profile on your table, you can extract the per-column stats you need and display them in your semantic model or report.

• Correct answer: B (No, it does not).

• A purchase agreement in Dynamics 365 SCM is a vendor-side price arrangement. It sets prices/discounts for what your company buys from suppliers, not for what you sell to customers.
• The objective in Question 2 is to give clients a quantity-based discount on items they purchase from you. To accomplish this, you should configure a sales price / trade agreement (on the customer/sales side), not a purchase agreement.
• In a sales price trade agreement, you can define quantity breaks such as:

• Create a Sales price trade agreement for the item and relevant customer (or customer group).
• Add quantity breaks: 51–100 with 10% discount, 101+ with 15% discount.
• Ensure the agreement is active for the desired date range.

• What the scenario asks: You have a Power BI semantic model that pulls from multiple sources (Azure SQL Database and SharePoint Online), must support a single dataset for three reports, keep data current (daily refresh by 7 AM PT), and apply RLS to limit sales data by region. You need to choose a storage mode for the tables.

• Correct choice: Dual storage mode.

• Why Dual fits:

• Key concepts:

• Answer: D) Shadow IT

• Why: Shadow IT is when employees use unsanctioned tools or bypass IT controls (like the VPN) to access services, often without IT oversight. It’s an internal behavior, not an external attacker’s activity.

• Not these:

• Quick note: This creates risk due to lack of visibility and control. Mitigations include a defined approved-tools list, enforcing VPN usage, device management, and continuous monitoring.

• Basic: Self-help only; no technical support or design assessment.
• Standard: Technical support, but not the full proactive architectural guidance required here.
• Professional Direct: Provides proactive guidance and architecture-related assistance.
• Premier: Also supports this, but is a more expensive, enterprise-level option.

• The two correct options are:

• The two incorrect options:

• The Balanced Scorecard translates an organization’s vision and strategy into a set of concrete objectives and metrics across four perspectives (financial, customer, internal processes, learning & growth). This framework explicitly links IT goals to business goals and provides a way to measure and monitor alignment over time.

• Enterprise architecture (EA): Great for governance, standards, and roadmaps to ensure IT assets support business needs, but it’s more about structure and alignment at design time rather than directly measuring ongoing alignment of goals.
• KPIs: Useful metrics, but they don’t by themselves provide a full framework to ensure IT goals are aligned with organizational strategy.
• Enterprise dashboard: A visualization tool for metrics; it helps report status but doesn’t inherently establish or assess alignment.

1. Create a new AMI or copy the existing AMI while specifying EBS encryption and an appropriate AWS KMS key.
2. This creates an encrypted AMI backed by encrypted EBS snapshots.
3. Copy the encrypted AMI to the destination Region, using a KMS key available there.
4. Launch the application stack from the encrypted AMI.

• B: AWS KMS does not encrypt an existing unencrypted AMI in place. You must create an encrypted copy.
• C: AWS Certificate Manager manages TLS certificates, not EBS or AMI encryption.
• D: Enabling encryption by default affects newly created EBS volumes and snapshots; it does not encrypt an existing unencrypted AMI during copying.

• Side loading means installing software from sources outside official or trusted repositories.
• This process can bring in malicious payloads because the installed software hasn’t been vetted. A rootkit is a type of malware that hides its presence and maintains privileged access, making it a prime risk when using untrusted sources.
• Why not the other options:

• Only install apps from trusted sources; verify signatures.
• Use application whitelisting and security controls to block sideloading.
• Keep systems updated and use anti-malware tools capable of detecting rootkits.

• A assigned without var becomes a global variable (in non-strict mode). So after myFunction(), a = 5 is accessible.
• b is declared with var inside the function, so it’s local to that function (function-scoped). It’s not defined in the outer (global) scope.

• console.log(a) prints 5.
• console.log(b) throws a ReferenceError: b is not defined.

• Correct answer: All four statements are true (A, B, C, and D). The given key (A,B) is likely incorrect.

• A) Customers can change the size of the Warehouse after creation — Yes. You can resize a virtual warehouse after it’s created using ALTER WAREHOUSE ... SET WAREHOUSE_SIZE.
• B) A Warehouse can be resized while running — Yes. Snowflake supports online resizing; you can change the size without stopping queries.
• C) A Warehouse can be configured to suspend after a period of inactivity — Yes. You can enable auto-suspend with a delay (AUTO_SUSPEND).
• D) A Warehouse can be configured to auto-resume when new queries are submitted — Yes. You can enable auto-resume (AUTO_RESUME) so a suspended warehouse automatically resumes on new queries.

• Example commands:

• Even if a warehouse is resizing or auto-suspending, queries will be queued and then executed once the warehouse has the appropriate capacity.

• Server — provides services or resources
• Endpoint — a user device connected to the network
• Ethernet — a networking technology, not a filtering device
• Firewall — filters and controls traffic

• Correct answer: D) Microservices using API

• Why:

Why B works

• AWS KMS keys are Regional resources. A normal customer managed key in Region A cannot be used directly in Region B.
• A customer managed multi-Region KMS key (MRK) has related key replicas in both Regions. The replicas share key material and key ID, although each has a Regional ARN.
• With client-side encryption, the application encrypts the data before storing it in S3. Cross-Region replication then copies already-encrypted objects, so S3 does not need to decrypt and re-encrypt them with a different Regional key.

Why the other choices are weaker

• A and C: SSE-S3 uses Amazon-managed S3 keys, not the required customer managed KMS key.
• D: SSE-KMS can work only if the solution creates and configures the appropriate KMS key or multi-Region key replica in each Region. As written, it says to create a customer managed KMS key in each Region, which implies separate keys—not the same KMS key. Replication also requires additional KMS permissions and destination encryption configuration.

• Correct answer: No (B).

• To deploy and manage Azure VMs, you use Infrastructure as a Service (IaaS). IaaS provides the actual virtual machines you configure, patch, and control.
• Platform as a Service (PaaS) abstracts infrastructure and OS management and is used for hosting applications (e.g., web apps) on managed runtimes, not for provisioning and managing individual VMs.

• Multiple AWS accounts: Create a separate account for each department or workload. This provides clear isolation and makes it easier to track each department’s usage and costs for chargeback.
• Consolidated billing: AWS Organizations can combine billing for multiple accounts into one central payer account. The company can still view costs by account while managing payment centrally.

• Placement groups: Control how EC2 instances are physically placed for networking or performance; they do not provide departmental billing separation.
• Edge locations: Infrastructure used by services such as Amazon CloudFront; unrelated to chargeback.
• AWS Config: Records and evaluates resource configurations and compliance; it is not a billing-separation mechanism.

• RPO (Recovery Point Objective) — maximum acceptable data loss, measured in time. It specifies how far back in time you can tolerate data loss. Example: RPO of 2 hours means backups must occur at least every 2 hours.

• ARO (Annualized Rate of Occurrence) — expected frequency of a threat occurring per year. It estimates how often a risk is likely to happen on average (used in risk calculations).

• MTTR (Mean Time To Recover) — average time to recover/restore service after an incident. It includes detection, repair, and restoration time, and helps gauge downtime and alignment with RTO.

• The diagnostic output shows that the protocol is TCP (proto=6) and the session state is 2.
• In FortiGate’s session output, state=2 maps to SYN_SENT. This means the TCP SYN has been sent but the handshake hasn’t completed yet.
• Therefore, the session is not ESTABLISHED, FIN/ACK-related states, or other states; it’s in SYN_SENT.

• Global Unicast: These are the IPv6 addresses that are globally routable on the Internet. They’re allocated by Regional Internet Registries (RIRs) and can be reached from anywhere with proper routing (similar to IPv4 public addresses). Example ranges include 2000::/3.

• Link-local: fe80::/10. Used only on the local link; not routable beyond the directly connected network.

• Unique Local Addresses (ULA): fc00::/7. Private addresses for internal use within an organization; not publicly routable on the Internet (like IPv4 private addresses).

• Multicast: ff00::/8. One-to-many addresses used for group communication, not unicast routing.

• Answer: C — Spot Instances

• Why: The workload is a test environment that can be interrupted and does not need to run continuously. Spot Instances let you bid on unused EC2 capacity at a deep discount, making them the most cost-effective option for interruptible workloads.

• Why not the others:

• Quick tips:

• What D means: In Security Command Center (SCC), a posture combines both preventative controls (predefined and custom organization policies) and detective controls (predefined and custom Security Health Analytics [SHA] modules). Scope this posture to the business unit folder to enforce those controls across the Vertex AI environment.

• Why this is correct: You need both preventative guardrails (policies) and detective guardrails (SHA findings) to meet internal security requirements. A posture provides a unified, scalable way to apply and monitor these controls to a specific organizational unit.

• Why the other options are weaker:

• If you want, I can break down the exact components of a SCC posture and how to apply it to a Vertex AI project.

powershell 
Get-AzureVM -ServiceName <service-name> -Name <vm-name> | 
  Set-AzureStaticVNetIP -IPAddress <private-ip> | 
  Update-AzureVM

• New-AzureRMVMConfig configures VM settings but does not itself assign the static IP.
• Set-AzureSubnet is not the appropriate cmdlet for assigning a VM’s private IP.
• The Azure portal option mentioned in the question was not the intended method for this older deployment model.
• Changing settings in Windows Network and Sharing Center is incorrect because Azure assigns the IP through the VM’s virtual network interface; manually configuring it inside the guest can cause conflicts.

• The correct permission is Manage Sandboxes (the official Salesforce name; the option in the list is written as “Manage Sandbox,” which is effectively the same idea but the canonical name uses the plural).
• Why: Sandboxes are a lifecycle feature. Only users with the explicit Manage Sandboxes permission can perform create, delete, refresh, or activate actions.
• Why the other options aren’t correct:

• On-prem you generalize and capture the VM as a VHD.
• Upload the VHD to Azure with Add-AzVhd.
• Register the VHD as an image in Azure with Add-AzImage (or New-AzImage) so it appears as a selectable image.
• Create new VMs from that image (e.g., with New-AzVM -Image ...).

• In Spark, an executor is a JVM that can have multiple cores. Each task can consume some CPUs (spark.task.cpus).
• The executor’s resources are effectively partitioned into slots, where each slot can run one task. The number of slots per executor is roughly spark.executor.cores / spark.task.cpus.
• Therefore, multiple tasks can run in parallel within the same executor (via these slots). So the statement “Tasks run in parallel via slots” is correct.

• A: A slot is not another name for an executor; a slot is a unit inside an executor.
• B: There’s no requirement that there must be fewer executors than tasks; tasks can be scheduled over time across the available slots.
• C: An executor can run more than one core; it’s not limited to a single core.
• D: There isn’t a rule that there must be more slots than tasks; tasks can wait if slots aren’t available, and you can have equal or even fewer slots than concurrent tasks.

• What the scenario tests: How monitoring paths on a Universal Forwarder (UF) behave when you deploy an app via the Deployment Server.
• How monitoring is configured: Log paths to monitor are defined in inputs.conf (within apps/local on the UF). Splunk on the UF merges inputs from all apps and local config.
• Key point: Deploying a new app that adds a monitor for a log file does not typically remove existing monitors. The UF will continue monitoring any previously configured paths and will add the new ones from the deployed app.

• Correct answer: C) /var/log/maillog and /var/log/messages.

• Improve QA testing efficiency: A prototype may help discover defects early, but that is not its greatest benefit.
• Decrease time allocated for user testing and review: Prototyping usually requires additional user involvement and review, not less.
• Minimize scope changes: Prototypes can actually reveal new requirements or cause scope changes. However, discovering those changes early is beneficial.

• Pay-as-you-go in Azure is an operating expense (OPEX) model, not an “elastic” expenditure model.
• Elastic or scalable terms describe capacity planning, not the cost category. The cost should be treated as OPEX since you pay for usage each month.
• The parallel question (Question 12) shows the correct approach is using an operational expenditure model.

• Sustainability is not a CAF perspective (it's not one of the CAF perspectives).
• Performance efficiency and Reliability are pillars of the AWS Well-Architected Framework, not CAF.

1. Define Power Platform DLP policies
2. Add custom prompt modifications
3. Conduct adversarial testing

1. DLP policies first

1. Prompt modifications second

1. Adversarial testing last

• Correct answer: B) Context window.

• Why: The context window is the number of tokens the foundation model can process in a single inference. It sets the maximum length of the combined input (prompt) and the model’s output. A larger context window allows more content to be included in one prompt.

• How to use: Check the FM’s context window value and ensure your prompt length plus the desired completion stays within that limit. If needed, summarize or split input across multiple prompts.

• Why the other options aren’t correct:

• Quick tip: Verify the specific FM’s context window for Bedrock, since different models have different token limits.

• Coordinate and manage the assessment team
• Assign assessment activities
• Direct interviews, examinations, and tests
• Ensure the assessment follows the CAP

• Answer key: Lead Assessor — likely wrong
• CAP-based answer: C3PAO

• Event | search "error"
• Event | where EventType == "error"
• search in (Event) "error"

• Why: Crisis management relies on established, repeatable procedures for responding to an incident (activation of the crisis team, escalation paths, communications, containment actions). This ensures a coordinated, timely, and auditable response.

• Why not the others:

• Post-Incident Review (A) is the after-action step used to capture lessons learned, identify process gaps, and drive improvements across the incident response lifecycle. This directly supports process maturity and a stronger security posture.
• Incident Analysis (D) focuses on investigating root causes during/after an incident, which is important but more of a diagnostic activity than a standalone baseline improvement to maturity.
• Fast Eradication (B) and Incident Containment (C) are tactical actions aimed at stopping the incident, not on maturing the process.

• Azure Files is an example of infrastructure as a service (IaaS). No. Azure Files is a managed storage service, typically considered PaaS (Storage as a Service), not IaaS.
• A DNS server that runs on an Azure virtual machine is an example of platform as a service (PaaS). No. Running a DNS server on a VM is IaaS because you manage the OS and DNS software.
• Microsoft Intune is an example of software as a service (SaaS). Yes. Intune is a cloud-based, fully managed service you use over the Internet.

• Version control provides a single source of truth for metadata changes and tracks every modification.
• It supports branching and merging, so each feature can be developed in isolation and later merged without overwriting others.
• It allows diffs and conflict resolution, making it easier to manage dependencies across features and ensure a stable release.

• Setup Audit Trail: only logs who/change when something happened; it doesn’t prevent overwriting or manage cross-feature dependencies.
• Change Sets: used to deploy changes between orgs, not to coordinate parallel development or prevent conflicts across ongoing sprints.

• Batch processing, such as scheduled data transformations
• Streaming processing, such as continuously ingesting events

• Manipulating data with multiple languages: Mainly a benefit of Databricks and Spark.
• Real-time notebook collaboration: A workspace/notebook feature.
• Alerts for query failures: A Databricks SQL or job-monitoring feature.
• Distributing complex operations: Primarily a Spark compute capability.

• You want: a row for each year and each product (year+product), plus a summary row for each year that totals all products (year only).
• GROUP BY ROLLUP(YEAR(SO.ModifiedDate), P.Name) yields:

• GROUP BY CUBE(YEAR(SO.ModifiedDate), P.Name) produces all combinations of the grouping columns, including:

• This adds extra rows (per-year totals by product across all years and a grand total) that aren’t needed for your stated goal.

• If you want exactly the (Year, Product) and (Year) rows, you can use GROUPING SETS ((Year, Product), (Year)) which is equivalent to Rollup in this two-column case but makes intent explicit.

• SELECT YEAR(SO.ModifiedDate) AS OrderYear, P.Name AS ProductName, SUM(SO.OrderQty) AS TotalQty

• The stage has a default file format defined (e.g., when you create the stage with FILE_FORMAT = (...)), and Snowflake will use that default.

• You use a named file format attached to the stage, or you specify an inline format in the COPY command, e.g., COPY INTO my_table FROM @my_stage FILE_FORMAT = (TYPE = 'CSV');

• Use a stage default: omit FILE_FORMAT in COPY.
• Or rely on a named/inline format: specify FILE_FORMAT in COPY or set a format on the stage.

• ?????? CPU
• ?????????????????
• ??????????????????????????
• ???????????? throughput
• ??????????????????????????????

• A ??????? system software ????????????????????????????????? ??????????????????????????????????
• B ?????????????????????????? ????????????????????????? ?????????????????????????????
• D ????????????????????????? ?????????????? ?????????????????????????????????????????

• Users retain their existing usernames and passwords.
• Existing accounts can be used to access Azure-based resources.
• Administrators avoid manually recreating thousands of accounts.
• The transition is less disruptive before the on-premises data center is retired.