Amazon Alexa-Skill-Builder Exam Prep
AWS Certified Alexa Skill Builder - Specialty (AXS-C01) (Page 3 )

• Custom domain: miami.weyland.com requires a paid App Service tier; Free and Shared are unsuitable.
• Two instances: Standard supports scaling to multiple instances.
• SSL: Standard includes SSL support.
• 12 GB storage: Basic provides only about 10 GB, so it does not meet the requirement. Standard provides substantially more storage.
• Cost minimization: Standard is the lowest tier among the choices that satisfies all requirements.

• Physical: Protects facilities or equipment, such as locks and security cameras.
• Technical: Uses technology, such as firewalls, encryption, or access controls.
• Operational: Covers day-to-day actions and processes, such as training, backups, or incident response.
• Managerial: Includes policies, standards, risk assessments, and procedures.

• User1 (user1@contoso.com) — This is an external guest in the Fabrikam tenant. Assuming the guest uses email one-time passcode authentication, Azure AD emails a passcode to user1@contoso.com.
• User2 (user2@outlook.com) — An Outlook.com address can authenticate with a Microsoft account, so Azure AD uses that account’s authentication rather than sending an email OTP. The fact that User2 has never accessed Fabrikam resources does not by itself trigger OTP.
• User3 (user3@fabrikam.com) — This is an internal Fabrikam user, so the user signs in with the organization’s normal credentials and does not receive a guest OTP.

• Discovers sensitive data in Amazon S3 buckets
• Uses machine learning and pattern matching to identify data such as personally identifiable information (PII)
• Helps assess S3 security and privacy risks
• Generates findings for potentially sensitive or exposed data

• Amazon Detective: Investigates security findings and performs root-cause analysis.
• Amazon GuardDuty: Detects threats and suspicious activity across AWS accounts and workloads.
• AWS IAM Access Analyzer: Identifies resources that are accessible from outside their intended trust zone, such as publicly accessible S3 buckets.

1. Identify the fact table

• Records something that happened, such as a sale, test, appointment, or measurement
• Contains foreign keys to other tables
• Contains measures or numeric results
• Has many rows

2. Identify a dimension table

• Describe people, products, dates, locations, or departments
• Contain descriptive columns
• Are referenced by the fact table
• Have fewer rows than the fact table

3. Identify the surrogate key

• System-generated
• Unique within the dimension
• Often named PatientKey, CustomerKey, or similar
• Usually an integer
• Not meaningful outside the model

• Documented and formally requested
• Analyzed for security, cost, and operational impact
• Reviewed and approved by the appropriate personnel
• Tested before implementation
• Tracked and reversible if problems occur

• Risk management process: Identifies and evaluates risk, but does not directly authorize design changes.
• Product design process: Applies primarily while creating or developing the product.
• Design review process: May have identified the issues, but the next step for changing an already released design is controlled change management.

• Tactics: The attacker’s overall goal, such as gaining persistence or exfiltrating data
• Techniques: The methods used to achieve that goal
• Procedures: The specific implementation or sequence of actions

• IP addresses and hash values: Useful indicators, but they can change quickly.
• Indicators of compromise: TTPs may help identify IOCs, but their main value is describing behavior.
• Tools: Attackers can replace tools or use legitimate administrative utilities.

• A valid input returns the expected result
• An invalid input raises an error
• Boundary values are handled correctly

• B: Copilot may help generate tests, but it does not automatically write all necessary tests.
• C: Writing the implementation does not verify that it works correctly.
• D: Copilot can suggest test commands or test code, but the developer or development environment must execute and validate the tests.

• File1.png — Yes: User1 can apply Label1 with the Microsoft Purview Information Protection client. The client supports labeling image files such as .png in this scenario.

• Folder2 — No: Folder2 is the root folder. The client does not allow labeling the root folder itself. Although the client can label ordinary folders, selecting one applies the label to existing files and subfolders—not automatically to future files.

• File1.docx — Yes: .docx is a supported Microsoft Word file type, so User1 can apply Label1 to it.

• Vulnerability scanner: Identifies technical weaknesses in systems, applications, or devices.
• Penetration test: Simulates attacks to determine whether vulnerabilities can be exploited.
• SCAP (Security Content Automation Protocol): Uses standardized formats and protocols for automated vulnerability, configuration, and compliance checks.
• Illumination tool: Maps and analyzes broader supply-chain exposure and third-party risk.

• A. Microsoft 365 group with Assigned membership
• C. Microsoft 365 group with Dynamic User membership

Why?

• Assigned membership: You explicitly add User1, User2, and User3.
• Dynamic User membership: Membership is automatically determined by a rule based on user attributes.

Why the other options are incorrect

• B and D: Security groups do not support the Microsoft 365 group expiration policy.
• E: Dynamic Device groups are intended for devices, not these users, and are also security groups.

• Correct exam answer: A — HKEY_LOCAL_MACHINE
• The relevant location is associated with HKEY_LOCAL_MACHINE\SAM.
• The SAM does not store passwords in plain text; it stores password hashes.

• HKEY_CURRENT_USER contains settings for the currently logged-in user, not the account-password database.
• HKEY_USERS contains user profiles and settings loaded for users.
• HKEY_CURRENT_CONFIGURATION contains hardware/profile configuration information.

• Azure Cosmos DB is a globally distributed NoSQL database service. It stores and retrieves application data, but it does not provide the complete environment for building, testing, and deploying predictive analytics models.
• Azure Machine Learning is the appropriate service for this requirement. It supports creating experiments, training and testing models, and deploying them for predictions.
• Azure Machine Learning Studio provides the browser-based interface for these tasks.

• Code signing: Verifies the software’s authenticity and integrity; it does not hide the source code or prevent reverse engineering.
• Tokenization: Replaces sensitive data with tokens, mainly for protecting data such as payment information—not software logic.
• Blockchain: Provides a tamper-resistant record of transactions or data; it does not protect compiled code from analysis.

• Additional running costs: $800
• Less depreciation: $300

• The $100 reduction in fixed production overhead absorbed is only an accounting reallocation. It does not represent an actual saving in total fixed overhead.

• Financial performance
• Customer perspective
• Internal business processes
• Learning and growth

• Increasing the number of indicators can make the scorecard cluttered and less useful. Measures should be limited to those that are strategically important.
• The scorecard is mainly a tool for implementing and monitoring strategy, not for formulating strategy.
• It should contain both leading indicators and lagging indicators. Leading indicators predict future performance, while lagging indicators measure results already achieved.

• netstat: Shows local network connections and listening ports, but not which WAN path carries the traffic.
• nslookup: Resolves domain names to IP addresses.
• ping: Tests reachability and latency but does not show the route.

• ARP poisoning: Redirects or intercepts local network traffic; monitoring would typically show suspicious ARP changes or man-in-the-middle behavior.
• Jamming: Interferes with wireless or radio signals. It would affect connectivity, not usually show a server-specific overload.
• Kerberoasting: Attempts to obtain and crack Kerberos service-account hashes; it does not normally cause a system outage.

• Azure Machine Learning is the overall Azure service.
• Machine Learning designer is the visual, drag-and-drop interface within Azure Machine Learning.
• Microsoft may refer to the broader product as Azure Machine Learning studio, while “Designer” remains the specific visual workflow tool.

• Azure Logic Apps: Workflow and integration automation.
• Azure Batch: Large-scale parallel or batch compute.
• Azure Cosmos DB: Globally distributed NoSQL database.

• contoso.onmicrosoft.com
• contoso1.onmicrosoft.com

• onmicrosoft.com domains: Maximum of five per tenant.
• Custom domains: Domains that your organization owns and verifies in Microsoft 365.

• Customers may boycott V’s products.
• Supermarket customers may stop buying from V.
• Investors may view V as having higher legal, ethical and reputational risk.
• V could face fines, lawsuits, contract losses and higher costs.
• Expected future profits may fall.

• Disaster recovery backups
• Long-term backup retention
• Data archiving that still needs occasional access

• Multi-Regional Storage: Intended for frequently accessed data needing broad geographic availability; it costs more.
• Regional Storage: Suitable for frequently accessed data within one region.
• Nearline Storage: Intended for data accessed roughly once per month, such as monthly backups.
• Coldline Storage: Better fit for backups accessed only during a disaster or occasional recovery event.

• Leaf switches provide access ports for servers, users, and other devices.
• Spine switches provide the backbone between leaf switches.
• Every leaf switch connects to every spine switch, creating a predictable, full-mesh fabric between the two layers.
• Leaf switches do not connect directly to other leaf switches, and spine switches do not connect directly to other spine switches.

• A: Adding both a spine and leaf is unnecessary for simply adding access ports.
• B: It focuses on uplink speed, not the scalable topology.
• D: A single spine connection creates a bottleneck and a single point of failure.

• Access controls — ensuring only authorized users can access it.
• Encryption — protecting the data if it is intercepted or exposed.

• Honeypots: Decoy systems or services made to attract attackers. Legitimate users should not interact with them, so activity there is a strong indicator of malicious behavior.
• DNS sinkholes: Redirect requests for known malicious domains to a controlled internal system. This can reveal infected hosts attempting to contact command-and-control infrastructure.

• Tokenization: Replaces sensitive data with non-sensitive tokens.
• CI/CD: Automates software development, testing, and deployment.
• Threat modeling: Identifies and analyzes potential threats before or during system design.
• Data obfuscation: Makes data harder to understand or interpret.

• BCP (Business Continuity Plan): Ensures the organization can continue its broader business operations during and after a disruption. It is broader than the IT-focused recovery required here.
• Communication plan: Defines how information is shared with employees, the public, and other stakeholders; it does not restore systems.
• IRP (Incident Response Plan): Handles and contains security incidents, such as malware or unauthorized access. A tornado is a disaster, not primarily a cybersecurity incident.

• 10 TB with maximum I/O performance: Use EC2 instance store. It provides very high-throughput, low-latency local storage suitable for temporary video-processing data. The application must tolerate data loss because instance store is ephemeral.
• 300 TB of highly durable media: Use Amazon S3, which is designed for highly durable object storage and can scale to this size.
• 900 TB of inactive archival media: Use S3 Glacier, which provides lower-cost storage for data that is rarely accessed.

• A: Amazon EBS offers high performance but is not the best fit for the question’s “maximum possible I/O” requirement compared with local instance store.
• B: Amazon EFS is durable and shared, but is generally more expensive and less suitable for very large archival storage.
• C: Uses EC2 instance store for performance, but incorrectly uses EFS for the 300-TB durable tier and S3 rather than Glacier for archival data.

• Crash cart: Provides local physical access, not remote access.
• Jump box: A secured intermediary used to reach devices over the normal network; it may be inaccessible if the appliance has not booted.
• Secure Shell (SSH): Requires the device’s operating system and network services to be running properly.

• C — Custom buttons display at the top and bottom of a page: Correct. In Salesforce Classic, buttons can appear in the page’s button areas, including the top and bottom of record pages.
• D — Custom buttons are available for Person Accounts: Correct. Person Accounts use the Account object, so Account custom buttons can be available on Person Account layouts.
• E — Custom buttons can reference an external app: Correct. A URL custom button can launch or navigate to an external application or website.

• A: JavaScript custom buttons are a Salesforce Classic feature and are not supported in Lightning Experience. They do not enhance Lightning Experience.
• B: The User object does not generally support custom buttons in the same way standard business objects do.

• The listener uses a virtual IP address shared by the availability-group replicas.
• Floating IP, also called Direct Server Return (DSR), allows the SQL Server nodes to respond using the listener’s IP address rather than their individual VM IP addresses.
• This is required for the availability-group listener to function correctly with an Azure internal load balancer.

• Each team’s Bedrock workflow uses a separate IAM service role.
• The role’s Amazon S3 permissions can be limited to only that team’s customer folder or objects.
• This enforces least privilege and prevents one team’s Bedrock application from accessing another team’s data.
• Access is enforced by AWS permissions, not by asking users to provide a customer name in each request.

• A single role with broad S3 access does not provide team-level isolation.
• Asking teams to specify a customer name is not an access-control mechanism.
• Redacting data does not prevent unauthorized access.
• A bucket policy alone is insufficient unless it explicitly enforces the required team-role restrictions.

• A: Describes a broad purpose and direction, but is not the specific CIMA definition.
• C: “Scoping out” activities is too vague and incomplete.
• D: Combines long-term goals, strategies and policies, but describes a wider strategic-planning statement rather than the definition of strategy itself.

• Import: Copies data into the Power BI model. It requires scheduled or manual refresh, so it may not meet the two-minute requirement.
• Live connection: Connects to an existing Power BI semantic model or Analysis Services model; it is not the appropriate choice for connecting directly to the Azure SQL database in this scenario.

• A: It allows for branching and merging...

• C: It allows multiple engineers to work against the same code and configuration files and manage differences and conflicts.

• B: Build automation and infrastructure provisioning are handled by CI/CD and automation tools, not by version control alone.
• D: User Stories and backlogs are managed by project-management tools.
• E: Version control stores and tracks code, but it does not itself ensure that developers write effective unit tests.

• B — Sales staff will tender for riskier contracts:

• C — Sales staff will encroach on other territories:

• D — Sales staff will look for new jobs:

• Which host first communicated with the suspected malicious source
• Whether that host initiated suspicious traffic or merely received it
• Which other hosts show evidence of infection, such as connections from the originating host
• Which hosts have no related suspicious activity and are therefore clean

• An outbound connection to a suspicious external address
• A downloaded or executed malicious file
• Later lateral connections from that host to other internal systems
• Firewall logs showing the direction and timing of the traffic

1. Define Power Platform DLP policies

1. Add custom prompt modifications

1. Conduct adversarial testing

• Initial Intrusion: The compromised VPN account and stolen phishing credentials describe how the attacker first gained access, but that happened months earlier.
• Persistence: The scheduled tasks and recurring C2 connections show how the attacker maintained and automated continued access.
• Search and Exfiltration: This would involve locating and transferring data. The scenario does not primarily describe data discovery or theft.
• Cleanup: Cleanup involves removing evidence or covering tracks. Obfuscated scripts may make detection harder, but the main behavior here is maintaining access.

• Employees can work from any location, including remote sites and offices worldwide.
• Login can be relatively seamless after the device is registered.
• It does not require distributing additional physical authentication equipment.

• Geotagging: Identifies location, but location alone is not a strong authentication method and may prevent legitimate remote access.
• Smart cards: Provide strong authentication but require card readers and physical cards, increasing equipment and management requirements.
• Time-based logins: Typically involve one-time codes that users must enter, making the experience less seamless and potentially requiring a token or authenticator app.

• Honeypots: Deliberately vulnerable or attractive systems designed to lure attackers. Legitimate users should not access them, so activity on a honeypot is a strong indicator of compromise.
• DNS sinkholes: Redirect requests for known malicious domains to a controlled internal system instead of allowing the connection. This can identify infected hosts attempting to contact command-and-control infrastructure.

• Tokenization: Replaces sensitive data with non-sensitive tokens; it protects data but does not primarily detect attackers.
• CI/CD: Automates software development and deployment processes.
• Threat modeling: Identifies potential threats and weaknesses before or during system design.
• Data obfuscation: Makes data harder to understand, but it is not an attacker-detection method.

• Prevention costs: Avoiding defects, such as staff training and improved product design. The company has invested in these.
• Appraisal costs: Detecting defects before products reach customers, such as inspection and testing. The planned batch sampling has not been implemented.
• Internal failure costs: Correcting defects found before delivery.
• External failure costs: Dealing with defects after delivery, such as refunds, replacements, complaints and lost sales.

• Gaia Portal: Controlled by Gaia administration settings, not SmartConsole Trusted Clients.
• SSH: Controlled by Gaia or operating-system SSH access settings.
• Security Gateway(s): SmartConsole connects to the Security Management Server, not directly to gateways for this purpose.

• GPS coordinates
• Date and time the image was taken
• Camera or device information
• Image dimensions and software used

• Log data: Records generated by systems or applications, not normally embedded in image files.
• Encrypted data: Information intentionally encoded to prevent unauthorized access.
• Sensitive data: A broad classification, not the specific type of information being extracted.

• Encryption to preserve confidentiality
• Integrity protection to detect alteration
• Authentication of the server through certificates

• SHA-256: A hashing algorithm; it does not encrypt data for transmission.
• SSL 3.0: Obsolete and insecure. It should not be used.
• AES-256: A strong encryption algorithm, but by itself it does not provide the complete secure communication protocol needed for data in transit.

• You can configure different pre-shared keys for different device groups.
• All cameras could use one key.
• All scanners could use another key.
• Each key can be associated with an appropriate role or access policy.

1. Select Exchange email as a location.
2. Use the built-in Azure Storage Account key sensitive information type as the condition.
3. Configure the DLP action to encrypt the email—for example, using Microsoft Purview Message Encryption.

• Data loss prevention (DLP): Helps detect or prevent sensitive data from being copied or transmitted, but it does not primarily protect a stolen laptop’s stored data.
• Operating system hardening: Reduces vulnerabilities and attack surface but does not encrypt files if the device is stolen.
• Boot security: Helps ensure that only trusted software starts, but it does not fully protect the drive if an attacker accesses it offline.

• Existing measures
• Relationships
• Calculated columns
• Tables and fields
• Existing transformations in the model

• SharePoint folder: Reconnects to the source files. You would likely need to recreate the model and measures.
• Power BI dataflows: Primarily provide reusable data preparation and storage, but they do not automatically provide the existing semantic model and measures.
• Excel workbook: Connects directly to the source file and would also require rebuilding the model and measures.

• SQL injection
• Cross-site scripting (XSS)
• Malicious or malformed web requests
• Some application-layer abuse

• Layer 4 firewall: Filters based mainly on IP addresses, ports, and connections; it lacks detailed web-request inspection.
• NGFW: Provides broader network security, but a WAF is more specialized for protecting web applications.
• UTM: Combines multiple security functions, but it is not necessarily optimized for web-application protection.