AICPA CPA-Business Exam Prep
CPA Business Environment and Concepts (Page 57 )

• Correct answer: A) Hashing

• Why: Hashing produces a fixed-size digest of the software. If the final build is altered in any way, the hash will change, enabling you to detect tampering by comparing the stored digest with a freshly computed one.

• Why not the others:

• Generates a syslog message
• Shuts down the PoE port
• Places the port into error-disabled (err-disabled) state
• Frees the power allocation

• A device starting to draw power does not necessarily generate a syslog message.
• Monitoring does not pause data traffic while checking power.
• Drawing less than the configured minimum does not automatically mean the device has failed and should be disconnected.

• Increase/decrease the number of epochs: Changes how long training runs, but does not reuse a pre-trained model.
• Unsupervised learning: Trains from unlabeled data and does not specifically address adapting an existing model.

• Used for communication on the local link or LAN segment
• Automatically generated on IPv6-enabled interfaces
• Not routed by routers to other networks
• Commonly used by devices to communicate with their local IPv6 router
• Begins with FE80 through FEBF

• FC00::/7 — unique local unicast
• FE80::/10 — link-local unicast
• FF00::/8 — multicast
• 2000::/3 — global unicast

• As the project progresses, you gain information, refine requirements, and lock down baselines (scope, schedule, cost). This reduces overall risk and uncertainty because more is known and addressed.
• At the same time, changes become more costly over time. Later changes can affect already approved baselines, cause rework, impact the critical path, require more coordination, and incur penalties or delays, all of which raise the cost of making changes.

• A — Can help keep costs down and improve quality: The provider may have specialist expertise, efficient systems and economies of scale.
• B — There is a known fee if agreed in advance: A fixed or agreed fee can make costs more predictable and support budgeting.
• C — Allows management to focus on core operations and issues: Senior managers spend less time supervising routine finance processes and more time on strategic matters.

• Increased control: Control may decrease because the activity is performed externally.
• Increased independence: The organisation becomes dependent on the supplier.
• Increased understanding of the outsourcing business: The internal organisation usually has greater business knowledge; the provider may initially lack it.
• Increased confidentiality: Sharing financial information externally may create confidentiality risks.
• Internal expertise improved: Outsourcing can reduce opportunities to develop internal finance skills.

• Review the risk register.
• Use the previously defined risk response plan, such as assigning a backup resource, reprioritizing work, or using another qualified engineer.
• Implement the response promptly because the task is on the critical path.

• B: Revising the schedule without first applying the planned response may be premature.
• C: Excluding a required task could compromise the project’s objectives and requirements.
• D: Updating the risk and lessons learned records is appropriate, but it should happen after managing the immediate issue, not as the next primary action.

text 
heartrateheartrateheartrate

• Spark column objects can be multiplied, for example:

python 
  df["heartrate"] * 3

• A DataFrame itself cannot be multiplied, but the expression is referring to a column.
• It is also not primarily a Python syntax error; the code was parsed, then Spark failed while resolving the column name.

• Drops packets when traffic exceeds a certain bitrate: This describes traffic policing, not shaping.
• Fragments large packets and queues them: Shaping does not fragment packets as its primary congestion-control action.
• Drops packets randomly from lower-priority queues: Packet dropping may occur if a shaping queue becomes full, but it is not the defining behavior.

• Shaping: buffers and delays excess traffic.
• Policing: drops or marks traffic that exceeds the configured rate.

• Creating and managing users and roles
• Granting and revoking roles and privileges
• Managing access-control responsibilities

• SYSADMIN: Manages warehouses, databases, schemas, and other objects—not primarily users and roles.
• PUBLIC: Automatically granted to every user; it is not an administrative role.
• ACCOUNTADMIN: Has the highest level of access, but should be reserved for account-level administration and emergencies rather than routine security tasks.

• Pay-as-you-go in Azure is an operating expense (OPEX) model, not an “elastic” expenditure model.
• Elastic or scalable terms describe capacity planning, not the cost category. The cost should be treated as OPEX since you pay for usage each month.
• The parallel question (Question 12) shows the correct approach is using an operational expenditure model.

• A private IP address on the virtual network
• A public IP address associated with its IP configuration

• AWS IoT Greengrass supports local ML inference using models trained in Amazon SageMaker.
• The model and inference code run on the factory’s local server, so processing continues even when internet connectivity is unavailable.
• A Greengrass component can:

• This provides low latency and avoids sending images to AWS for every inference.

• A: Uses AWS-hosted services and therefore depends on internet connectivity. It would fail during an outage.
• C: Snowball Edge is unnecessary for this use case and adds deployment complexity. A local Greengrass server is the intended edge-inference solution.
• D: Amazon Monitron is designed for monitoring industrial equipment health, not analyzing camera images with a custom SageMaker model.

• Correct answer: Day 3 (Option B)

• Why: In Engagement Studio, when the program is paused, the prospects’ wait times are also paused and do not count down. They resume from the same point when the program restarts. Here, the prospect was at day 3 of a 5-day wait when paused, so they resume on day 3 after the 1-day pause.

• Improve QA testing efficiency: A prototype may help discover defects early, but that is not its greatest benefit.
• Decrease time allocated for user testing and review: Prototyping usually requires additional user involvement and review, not less.
• Minimize scope changes: Prototypes can actually reveal new requirements or cause scope changes. However, discovering those changes early is beneficial.

• Which Security policy matches
• Which NAT rule/translation is selected
• Which PBF rule applies
• Which route is used

text 
test security-policy-match ... 
test nat-policy-match ... 
test pbf-policy-match ... 
test routing fib-lookup ...

• SQL injection (SQLi): Attacks databases by inserting malicious SQL commands.
• Cross-site scripting (XSS): Injects scripts into web pages viewed by other users.
• Sideloading: Installing an application from outside the official app store. It may install unauthorized apps, but it does not generally unlock the operating system or enable restricted system features.

• The legacy system creates a signed JWT assertion.
• Salesforce validates the assertion using a certificate configured on a Connected App.
• Salesforce issues an access token for the integration user.
• No refresh token is required; the system can request a new access token when needed.

• Web Server Flow: normally uses a client secret and authorization/refresh tokens.
• Username-Password Flow: requires storing Salesforce credentials and is discouraged for integrations where stronger options are available.
• User Agent Flow: intended for user-interactive applications, not unattended server-to-server processing.

• Developed and maintained independently
• Deployed without changing the entire application
• Scaled separately based on demand
• More resilient when another service has problems

• A: Functional testing is useful, but it is not the main practice described.
• B: Automation helps deployment, but the scenario focuses on architectural decomposition.
• C: Multiple locations improve availability, not application modularity.

sql 
GRANT ALTER ON SCHEMA::schemaA TO User1;

• TRUNCATE TABLE is a DDL operation, not a normal DELETE.
• Having DELETE permission on a table is not sufficient to truncate it.
• The minimum relevant permission is ALTER on the table.
• Granting ALTER on SCHEMA::schemaA allows the user to truncate tables within schemaA.
• It does not grant equivalent permissions on schemaB or schemaC, satisfying least privilege.

• Answer: C – netstat -an

• netstat -an lists all active connections and listening ports with numeric addresses, without resolving names. This lets you spot DoS patterns such as a flood of connections to a specific port or many connections from a single or few IPs.
• The other options don’t help as directly:

• Windows: netstat -an and look for numerous ESTABLISHED connections to a service or many SYNs to a port.
• Filter by port, e.g., netstat -an | findstr :80, or on Linux: ss -tunap | grep ':80'.

• Netstat provides a snapshot. DoS detection often benefits from continuous monitoring, flow data, and IDS/IPS logs.

• A: My Domain is required for many SSO configurations, but if SSO works, it is unlikely to be the cause of losing the target record.
• B: HTTP-POST is a valid SAML binding and does not inherently prevent redirection.
• D: An incorrect Federation ID generally causes authentication or user-matching failure—not successful login to the home page.

• Azure Resource Manager (ARM) templates define Azure resources in a declarative JSON file.
• You can deploy the same template repeatedly for each business unit, ensuring that identical resources are created consistently.
• Templates reduce manual administrative effort and support repeatable, automated deployments.
• Parameters can customize values such as names, regions, and sizes while keeping the overall resource configuration the same.

• The inference container image or built-in algorithm
• The location of model artifacts in Amazon S3
• IAM permissions through the execution role
• Optional environment variables and networking settings

1. Create AWS::SageMaker::Model
2. Create an AWS::SageMaker::EndpointConfig that references the model
3. Create AWS::SageMaker::Endpoint that references the endpoint configuration

• AWS::SageMaker::Endpoint hosts a model but does not define the model itself.
• AWS::SageMaker::NotebookInstance provides a development environment.
• AWS::SageMaker::Pipeline orchestrates ML workflow steps.

• staff use the new system;
• transactions and reports are checked;
• problems are corrected;
• feedback is collected.

• Phased changeover: different parts or functions are introduced in stages, often according to a planned sequence.
• Pilot changeover: one representative department, branch or group acts as a test site before wider implementation.
• Parallel changeover: old and new systems operate at the same time.
• Direct changeover: the old system is stopped and the new one starts immediately.

• Residual neural network (ResNet): Primarily used for computer vision tasks such as image classification.
• Support vector machine (SVM): Commonly used for classification and regression, not natural-language query generation.
• WaveNet: Designed mainly for generating or modeling audio and speech.

• Product Owner: May attend, but is not required unless also working as a Developer.
• Scrum Master: May attend to help facilitate or coach, but is not required.
• Developers: Must participate because the event is specifically for them.

1. Determine which host was infected first—the originating host.
2. Decide whether each other host is clean or infected based on communication and event logs.

• Compare timestamps and find the earliest suspicious event.
• Look for the host that initiated the malicious connection, file transfer, exploit, or command—not merely a host that later received traffic.
• Follow the timeline through the firewall:

• A host is likely infected if it both receives suspicious activity and then initiates related malicious traffic.
• A host may be clean if the firewall blocked the connection and there is no evidence of execution or follow-on communication.

• Whether a user has a console password
• Password age and last password change
• Whether MFA is enabled
• Access key status
• Access key creation date and last-use information
• Access key age, which helps audit rotation

• IAM Access Analyzer identifies unintended access to resources; it does not report credential age or rotation.
• AWS Artifact provides AWS compliance documents and agreements, not details about your IAM users.
• AWS Audit Manager helps collect evidence for audits, but it is not the direct tool for viewing IAM credential rotation details.

• principal represents the source or initiating system.
• principal.port is the source port.
• target represents the destination system.
• target.port is the destination port.

text 
principal.port = 5555

• network.ApplicationProtocol = HTTP identifies HTTP traffic but not the backdoor specifically.
• target.port = 5555 finds traffic going to port 5555, rather than originating from it.
• network.ip_protocol = TCP is too broad because many services use TCP.

• Árvores de decisão: usam regras sequenciais, como “se característica X > valor, siga para este ramo”. São fáceis de visualizar e explicar. Atendem bem a problemas de classificação e regressão com alta interpretabilidade.

• Regressão linear: prevê um valor numérico contínuo, como preço, custo ou temperatura. Não é a escolha principal para classificar genes em categorias.

• Regressão logística: calcula a probabilidade de uma categoria. Pode atender à classificação, inclusive multiclasses, mas sua explicação costuma ser menos intuitiva que uma árvore para documentar decisões.

• Redes neurais: atendem a tarefas complexas, como imagens, texto e padrões não lineares. Porém, são menos interpretáveis, funcionando mais como uma “caixa-preta”.

• Reusing features across different models and teams
• Consistent feature definitions
• Managing feature versions and metadata
• Using features for both training and inference

• SageMaker Data Wrangler: Prepares and transforms data; it is not primarily a shared feature repository.
• SageMaker Clarify: Helps detect bias and explain model predictions.
• SageMaker Model Cards: Documents models, including intended use, risks, and evaluation results.

• A. Configure prompt modifications to enforce tone, disclaimers, and refusal behavior at the system level.

• D. Configure Power Platform DLP policies to restrict unauthorized data connectors.

• B: Manual topic-by-topic disclaimer edits are specifically discouraged.
• C: Channel settings do not replace agent-level Responsible AI controls.
• E: Publishing before enabling safety filters violates the stated deployment sequence. Responsible AI filters should be enabled before publication, not afterward.

Flat organisation

• Few levels of management
• A wide span of control—managers supervise many employees
• Shorter communication channels
• More employee autonomy and quicker decisions
• Fewer formal promotion levels

Tall organisation

• Many levels of management
• A narrow span of control—managers supervise relatively few employees
• A clear hierarchy and reporting structure
• More formal supervision and communication channels
• More obvious promotion and career stages

• Filtering or reshaping columns
• Joining with an analysis-specific dataset
• Creating calculated fields
• Applying business logic for a particular project

• Data blending: Combining different data sources, not specifically the final processing step.
• Data enhancement: A broad term for enriching data.
• Data testing: Checking data quality or pipeline correctness.
• Last-mile ETL: The precise term for additional transformations performed after the main pipeline, often directly before analytics or reporting.

• The files are stored in a document library, which is exposed through the SharePoint Folder connector.
• The connector returns file metadata, including Folder Path, Name, and Content.
• In Power Query, filter Folder Path so only files in the manufacturing reports folder are retained.
• You can then combine the remaining Excel files because they all have the same structure.

• SharePoint List is for SharePoint lists, not document-library files.
• Combine & Load combines files immediately, before you filter to the required folder, and may include unwanted files.
• Transform gives you the opportunity to filter the file list first, which is more efficient and targeted.

• A: Security groups do not control traffic to an S3 gateway endpoint in this way. Gateway endpoints are configured through route tables.
• B: An S3 bucket policy may be needed for authorization, but the error specifically indicates a connectivity or endpoint-routing problem.
• C: Glue connection settings do not require a fully qualified domain name to resolve this endpoint issue.

• Correct answer: Power BI dataset

• The scenario says the data model already contains several measures and you want to create a report from the existing data with minimal development. Reusing a published Power BI dataset lets you inherit the existing measures and data model, so you don’t have to recreate them.
• How to do it: In Power BI Desktop, use the connector Power BI datasets (Get Data > Power BI datasets) and connect to the existing dataset, then build visuals using the pre-defined measures.
• Why the other options are less suitable:

• I can’t view the images, so I can’t tell which table is labeled as A in your screenshot. But here’s how to decide:

• How to identify the fact table:

• How to identify the surrogate key in the Patient table:

• Relationship:

1. Create a custom Sensitive Information Type (SIT) in the Microsoft Purview portal.
2. Use a regular expression to match the 32-character alphanumeric account number.
3. Reference that SIT in the DLP policy protecting SharePoint Online.

• Format-based data ? custom SIT with RegEx
• Built-in sensitive data ? Microsoft-provided SIT
• Document classification/protection ? sensitivity labels
• Security investigation queries ? Advanced Hunting, not DLP detection

• Context: You’re configuring a Windows Autopilot deployment profile (Profile1) for Windows 11 devices. The hotspot asks you to pick the correct behavior for two statements based on the profile’s settings.

• Box 1: “can modify the desktop settings only for themselves”

• Box 2: “Cortana settings” with options like computer name, keyboard layout, etc.

• BCP: Maintains essential business operations during and after disruption. It is broader than IT recovery, but the question focuses on restoring the destroyed data center.
• Communication plan: Defines how the organization communicates with staff, the public, and other stakeholders.
• IRP: Handles security incidents such as malware, unauthorized access, or data breaches—not physical disaster recovery.

• D. Provide public endpoints to store and retrieve data

• E. Manage the infrastructure layer and the operating system

• Classifying data
• Configuring access permissions, such as IAM policies
• Selecting or configuring available encryption options, depending on the requirement

• A. Tuning system software: This is a corrective action, not an analysis method. Tuning should be based on measured performance data.
• B. User dissatisfaction reports: Useful as an indicator, but subjective and insufficient for diagnosing the cause.
• D. Off-peak utilization and response time: This may hide problems occurring during peak periods. Performance analysis should cover representative or peak workloads.

• Use private connectivity from a cloud provider
• Set up SSO for federated authentication

• Private connectivity—such as a cloud provider’s private endpoint—keeps Snowflake access within the company’s private network path instead of exposing access over the public internet. This fits the VPN/VDI requirement.
• SSO for federated authentication allows Snowflake users to authenticate using the credentials already managed by the company’s identity provider—the same identity system used for VDI—eliminating separate Snowflake passwords.

• Tri-Secret Secure protects encryption keys; it does not provide private network access or credential reuse.
• A proxy Snowflake account outside the VPN conflicts with the requirement that Snowflake have no internet visibility and is not the normal solution for federated login reuse.

1. Get Data ? Folder in Power BI Desktop.
2. In Power Query Editor, expand the Attributes column to expose metadata such as hidden status and other file attributes.
3. Remove the Content column (and any other data columns you do not need).

• Name
• Extension
• Date accessed
• Date modified
• Folder Path
• Attributes
• Content

• A: Using an external OAuth 2.0 identity provider could provide unified identity, but it does not specifically address Salesforce capacity or high-volume login limits.
• B: Making the Experience Cloud community a SAML identity provider and using JIT provisioning is a possible federation pattern, but it may not be appropriate for this scale without Salesforce validation.
• C: A default account is unrelated to solving identity unification and high login throughput. Person Accounts can be supported in appropriate B2C Commerce integrations.

• Drop violating frames
• Log or alert on the violation
• Shut down or restrict the port

• Load balancer: Distributes application traffic; it does not control switch MAC learning.
• IPS: May detect some network attacks but is not the primary control for switch MAC-table exhaustion.
• NGFW: Protects traffic crossing network boundaries, while MAC flooding occurs at the switching/LAN layer.

• The explanation states that Traffic Analytics can be enabled by a user with one of these subscription-level roles:

• Question 34 — Network Contributor: Yes
• Question 35 — Owner: Yes
• Question 36 — Reader: Yes, according to the stated explanation and documentation