API API-571 Exam Prep
Corrosion and Materials Professional (Page 46 )

• A: My Domain is required for many SSO configurations, but if SSO works, it is unlikely to be the cause of losing the target record.
• B: HTTP-POST is a valid SAML binding and does not inherently prevent redirection.
• D: An incorrect Federation ID generally causes authentication or user-matching failure—not successful login to the home page.

• OpenID Connect (OIDC) is an authentication layer built on OAuth 2.0.
• It returns an ID token, normally a JWT containing identity claims such as the user’s subject, name, email, or other permitted attributes.
• The wellness application can consume those claims without needing a separate user-information call.

• JWT Bearer Token Flow: intended for server-to-server authorization and does not primarily provide an end-user ID token.
• Web Server Flow: is an OAuth authorization-code flow. It can be used with OIDC in some implementations, but “Web Server Flow” alone does not specifically guarantee an ID token.
• User Agent Flow: describes an OAuth flow, not the identity protocol itself.

• A. A virtual network gateway
• D. A virtual network

• Azure virtual machines must be connected to an Azure virtual network (VNet). The VNet provides private IP addressing and network connectivity for the VMs.
• A virtual network gateway enables communication between the Azure VNet and the on-premises network, typically through a site-to-site VPN or ExpressRoute connection.

• Load balancer: Distributes traffic among Azure VMs; it does not connect Azure to an on-premises network.
• Application gateway: Provides web-application load balancing and Layer 7 routing; it is not the normal resource for on-premises connectivity.
• Gateway subnet: A gateway subnet is required inside the VNet when deploying a virtual network gateway, but the question’s intended two primary resources are the VNet and virtual network gateway.

• Users logging in more frequently than average
• Logins occurring during non-business hours
• Patterns that may indicate compromised credentials or suspicious access

• Login History: Shows individual login attempts and basic details, but does not provide behavioral analysis or averages.
• Login Inspector: Used to troubleshoot or inspect a specific login attempt, rather than analyze organization-wide patterns.
• Login Report: May provide reportable login information, but it is not the specialized tool for forensic behavioral analysis.

• Actual filename: Document.xml.txt
• Explorer displays: Document.xml
• File type: Text Document (.txt)

text 
Document.txt ? Document.xml

• Server — provides services or resources
• Endpoint — a user device connected to the network
• Ethernet — a networking technology, not a filtering device
• Firewall — filters and controls traffic

• Approve major information security policies
• Allocate funding and resources
• Set the organization’s risk appetite
• Ensure security supports business objectives

• Evaluating vendors is generally handled by security, procurement, or technical teams.
• Assessing risks is typically performed by security and risk-management professionals, with management accepting or prioritizing the risks.
• Monitoring regulatory adherence is usually handled by compliance, audit, or security functions.

• Import: Copies data into the Power BI model. It requires scheduled or manual refresh, so it may not meet the two-minute requirement.
• Live connection: Connects to an existing Power BI semantic model or Analysis Services model; it is not the appropriate choice for connecting directly to the Azure SQL database in this scenario.

• Entradas grandes, de até aproximadamente 1 GB.
• Processamentos demorados, que podem levar até cerca de 1 hora.
• O cliente envia a solicitação e consulta o resultado depois, sem precisar manter uma conexão aberta durante todo o processamento.

• Real-time inference: indicada para respostas imediatas, com entradas menores e processamento rápido.
• Serverless inference: adequada para cargas variáveis e solicitações menores; não é ideal para processamento longo e arquivos grandes.
• Batch transform: processa grandes volumes em lote, mas não atende à necessidade de respostas próximas do tempo real.

• The current and previous versions
• Which clauses were changed
• When each revision occurred
• Potentially, who made the changes

• Version validation: Verifies a version’s accuracy or integrity but does not primarily track revisions.
• Version changes: Not the standard name for a formal document-management process.
• Version updates: Describes updating a document, not the complete process of managing and tracking its revisions.

• Generates a syslog message
• Shuts down the PoE port
• Places the port into error-disabled (err-disabled) state
• Frees the power allocation

• A device starting to draw power does not necessarily generate a syslog message.
• Monitoring does not pause data traffic while checking power.
• Drawing less than the configured minimum does not automatically mean the device has failed and should be disconnected.

• If the Facebook user is new, Salesforce invokes createUser.
• If the user already exists, Salesforce can invoke updateUser.
• The handler can read the latest data from Facebook, such as name, email, or other profile attributes, and update the corresponding Salesforce user.

• B: A scheduled job is unnecessary and would not provide real-time synchronization during authentication.
• C: A Facebook signed request is not the standard mechanism for updating Salesforce user records in this authentication-provider setup.
• D: SAML Just-in-Time provisioning applies to SAML identity providers, not Facebook OAuth authentication.

1. Create a custom Sensitive Information Type (SIT) in the Microsoft Purview portal.
2. Use a regular expression to match the 32-character alphanumeric account number.
3. Reference that SIT in the DLP policy protecting SharePoint Online.

• Format-based data ? custom SIT with RegEx
• Built-in sensitive data ? Microsoft-provided SIT
• Document classification/protection ? sensitivity labels
• Security investigation queries ? Advanced Hunting, not DLP detection

1. Identify the fact table

• Records something that happened, such as a sale, test, appointment, or measurement
• Contains foreign keys to other tables
• Contains measures or numeric results
• Has many rows

2. Identify a dimension table

• Describe people, products, dates, locations, or departments
• Contain descriptive columns
• Are referenced by the fact table
• Have fewer rows than the fact table

3. Identify the surrogate key

• System-generated
• Unique within the dimension
• Often named PatientKey, CustomerKey, or similar
• Usually an integer
• Not meaningful outside the model

• Confirm the required columns and data types
• Identify the target/label column
• Handle missing or duplicate records if present
• Transform data into a suitable format
• Split it into training and validation/test datasets

1. Prepare the training data
2. Select an algorithm or configure AutoML
3. Train the model
4. Evaluate its performance
5. Tune hyperparameters if needed
6. Deploy the model

• IaaS: You deploy and manage virtual machines, operating systems, disks, and networking. Azure manages the physical datacenter and host infrastructure.
• PaaS: Azure manages the operating system and runtime so you can focus on deploying applications, such as with Azure App Service or Azure Functions.
• SaaS: You consume a complete, provider-managed application.

• Leaf switches provide access ports for servers, endpoints, and other devices.
• Spine switches form the fabric’s backbone.
• Every leaf connects to every spine, creating a predictable, high-bandwidth, low-latency path.

• A: Adding both a spine and leaf is unnecessary for simply adding access ports.
• B: Adding a spine does not directly provide endpoint access ports.
• D: A single connection to one spine creates a bottleneck and a single point of failure.

• AWS Budgets lets you create a cost or usage budget and configure alerts when actual or forecasted spending reaches a threshold. Notifications can be sent through email or Amazon SNS.
• Amazon CloudWatch can monitor AWS billing metrics and trigger an alarm when estimated charges exceed a specified amount.

• Amazon SQS is a message queue, not a cost-monitoring service.
• Cost Explorer analyzes spending but does not directly provide threshold notifications.
• AWS Cost and Usage Report delivers detailed billing data for analysis; it does not itself send threshold alerts.

• Modelo de embeddings multimodal: transforma texto e imagens em vetores no mesmo espaço semântico. Isso permite comparar uma consulta textual com imagens, ou uma imagem com textos relacionados.
• Modelo generativo multimodal: interpreta diferentes modalidades e gera conteúdo, mas não é a escolha específica para indexação e busca vetorial.
• Modelo de geração de imagens: cria imagens, portanto é inadequado.
• Modelo de embeddings de texto: não atende consultas com imagens.

• staff use the new system;
• transactions and reports are checked;
• problems are corrected;
• feedback is collected.

• Phased changeover: different parts or functions are introduced in stages, often according to a planned sequence.
• Pilot changeover: one representative department, branch or group acts as a test site before wider implementation.
• Parallel changeover: old and new systems operate at the same time.
• Direct changeover: the old system is stopped and the new one starts immediately.

1. Start with the 48-bit MAC address.
2. Split it into two 24-bit halves.
3. Insert FF:FE between the halves, creating a 64-bit value.
4. Invert the U/L bit—the seventh bit from the left in the first MAC byte.

text 
MAC:       00:1A:2B:3C:4D:5E 
EUI-64:    02:1A:2B:FF:FE:3C:4D:5E

• FE80 is the prefix commonly used for an IPv6 link-local address, not part of the EUI-64 interface ID.
• The interface ID is not random.
• The MAC address is modified by inserting FF:FE and changing the U/L bit.

• A single Construction Job can use multiple Machinery records.
• A single Machinery record may be used on multiple Construction Jobs.
• This is a many-to-many relationship, which Salesforce models using a junction object.
• The junction object can contain fields such as:

• Master-detail to Machinery
• Master-detail to Construction Job
• Date and cost fields

• Restarting the device: May fix software glitches, but would not usually make cable orientation matter.
• Swollen battery: A safety concern, but it would not typically cause recognition only in one cable orientation.
• Failing cable: Possible, but less likely because the problem occurs with this particular device and not other devices of the same type.

• A. Microsoft 365 group with Assigned membership
• C. Microsoft 365 group with Dynamic User membership

Why?

• Assigned membership: You explicitly add User1, User2, and User3.
• Dynamic User membership: Membership is automatically determined by a rule based on user attributes.

Why the other options are incorrect

• B and D: Security groups do not support the Microsoft 365 group expiration policy.
• E: Dynamic Device groups are intended for devices, not these users, and are also security groups.

• 25 — Traditional SMTP server-to-server mail transfer; not normally used for secure client submission.
• 110 — POP3, used to retrieve email and typically unencrypted.
• 143 — IMAP, used to access email and typically unencrypted.

• The listener has a virtual IP address on the load balancer.
• The active SQL Server replica must respond using the listener’s IP address, not its own VM IP.
• Floating IP allows the listener IP to be preserved and returned by the active replica.
• This is required for the SQL Always On listener configuration.

• A health probe for the SQL listener/cluster role
• The SQL Server listener port, commonly 1433
• Appropriate backend pool membership

• A laptop
• Software access
• A password reset
• A mobile phone

• They run behind the scenes — applies more to automation or workflows.
• They are optional — catalog items are fundamental to a request-based catalog.
• They provide options — variables and variable options collect the requester’s choices for an item; they are not the catalog item itself.

• Honeypots: Decoy systems or services designed to attract attackers. Legitimate users should not access them, so activity on a honeypot is a strong indicator of unauthorized activity. Security teams can also observe attacker behavior.

• DNS sinkhole: Redirects requests for known malicious domains to a controlled internal server or blocks them. If an infected workstation attempts to contact command-and-control infrastructure, the sinkhole records the request and helps identify the compromised device.

• Tokenization: Protects sensitive data by replacing it with tokens.
• CI/CD: Automates software development and deployment.
• Threat modeling: Identifies potential risks before or during system design.
• Data obfuscation: Makes data harder to understand, but does not detect intruders.

• A — Increasing the minimum password length to 14 characters: Longer passwords have more possible combinations, making them harder to guess or crack through brute force.
• F — Requiring at least one special character: This increases password complexity and expands the possible character combinations.

• MD5 to SHA-512: Improves password-hash resistance, but does not stop users from choosing easy-to-guess passwords. Also, modern systems should use a password-specific hashing algorithm such as bcrypt, scrypt, or Argon2.
• Increasing maximum age to 120 days: Leaves weak passwords in use longer.
• Reducing minimum length to 10: Makes guessing easier.
• Reducing minimum age to zero: Allows immediate password changes but does not make the password itself harder to guess.

• S3 Lifecycle rules automate actions such as transitioning objects to different storage classes or deleting old objects.
• S3 bucket policies control access permissions; they do not preserve earlier object versions.
• S3 server-side encryption protects data confidentiality by encrypting objects at rest, but it does not prevent deletion or overwriting.

• Accidental deletion or overwriting ? S3 Versioning
• Unauthorized access ? bucket policies and IAM
• Data encryption ? server-side encryption

• Amazon S3 — Object storage, not a database.
• Amazon DynamoDB — Fully managed NoSQL key-value and document database.
• Amazon Redshift — Managed data warehouse designed for analytics, not primarily transactional MySQL workloads.

• B — AWS DataSync: Transfers data between storage systems, such as S3, file systems, and on-premises storage. It is not a marketplace or catalog for third-party datasets.
• C — Kinesis Data Streams and CodeCommit: CodeCommit is a source-code repository, not a third-party data provider. Kinesis is for streaming data ingestion.
• D — Kinesis Data Streams and ECR: ECR stores container images, not datasets. Kinesis does not provide access to ECR data as an external dataset source.

• tag=Priv searches the tag field for values beginning with Priv. The wildcard can match the remaining characters, so it matches Privileged.
• tag=Priv would search for the exact tag Priv, not Privileged.
• tag=priv* uses lowercase priv; tag matching is treated as case-sensitive here, so it may not match the tag Privileged.
• tag=privileged uses the wrong capitalization for the exact tag.

• 6-phone boxes: 6x
• 8-phone boxes: 8x

• Sending calls to available agents quickly
• Balancing interactions across agents
• Preventing calls from being handled manually one at a time

• Workforce Management: Forecasts demand and schedules enough staff; it supports wait-time reduction but does not directly distribute calls.
• Skill-based Routing: Routes calls based on agent skills and may improve the customer experience, but the question is asking about the core feature that distributes calls efficiently.
• IVR: Lets callers navigate menus and self-service options; it does not primarily assign calls to agents.

• Use private connectivity from a cloud provider
• Set up SSO for federated authentication

• Private connectivity—such as a cloud provider’s private endpoint—keeps Snowflake access within the company’s private network path instead of exposing access over the public internet. This fits the VPN/VDI requirement.
• SSO for federated authentication allows Snowflake users to authenticate using the credentials already managed by the company’s identity provider—the same identity system used for VDI—eliminating separate Snowflake passwords.

• Tri-Secret Secure protects encryption keys; it does not provide private network access or credential reuse.
• A proxy Snowflake account outside the VPN conflicts with the requirement that Snowflake have no internet visibility and is not the normal solution for federated login reuse.

• Prevent connections to malware command-and-control servers
• Identify infected systems making those DNS requests
• Collect information for incident response

• A: Attackers do not normally use sinkholes to map a company’s domain structure.
• B: Redirecting employees from legitimate sites to attacker-owned sites describes malicious DNS manipulation, not a defensive sinkhole.
• D: Attracting attackers away from real resources is more closely associated with a honeypot or deception system.

• B. Data loss prevention (DLP): Helps prevent sensitive data from being copied, emailed, or exfiltrated. It is not the primary control for protecting a stolen laptop’s stored data.
• C. Operating system hardening: Reduces vulnerabilities by disabling unnecessary services and applying secure settings, but it does not necessarily protect the files if the disk is accessed directly.
• D. Boot security: Helps ensure the device starts only through trusted software or approved processes. It supports platform integrity but does not itself encrypt stored files.

• Identifying the communication strategy: Usually part of a business continuity or incident response plan.
• Evaluating the risk management plan: Part of risk assessment and risk management activities.
• Establishing backup and recovery procedures: Usually part of disaster recovery planning.
• Developing the incident response plan: Part of incident response planning.

• Mesh: WAPs communicate wirelessly with one another, often to extend coverage without wired connections. It does not specifically describe centralized WLC management.
• Point-to-point: Connects two specific devices or locations.
• Ad hoc: Wireless devices communicate directly with one another without an access point.

• BIOS language support: Useful for usability, but not whether the PC can operate electrically.
• Supply chain security: Concerns procurement and hardware trust, not deployment across countries.
• Power efficiency: Important for energy usage, but it does not ensure compatibility with local power systems.

• Secure: uses encryption, such as HTTPS or SFTP.
• Cross-platform: supported by many languages and operating systems.
• Internet-friendly: designed to communicate across networks, usually using standard Internet protocols.

• JSON/REST over HTTPS — widely supported, secure, and Internet-friendly.
• SOAP over HTTPS — also secure and highly cross-platform, though more heavyweight.
• XML over SFTP — secure file-based exchange, but it is not an API-style interface.

• Microsoft Teams: Connects to Teams-related data, but it isn’t the primary connector for the Power Apps data tables.
• Personal Analytics: Provides personal productivity insights, not application data.
• SQL Server database: Only applies if the app explicitly uses SQL Server as its data source.
• Dataflows: Used for preparing and centralizing data, not as the normal direct connection to a Power Apps app.

• Aggregation happens once, during the scheduled job.
• Dashboard users query a relatively small, precomputed table.
• Repeated users do not trigger expensive aggregations against the detailed sales table.
• Overwriting is appropriate because the summary is rebuilt for the reporting period.

• B: Structured Streaming is unnecessary for data that only needs daily refreshes and adds operational/compute overhead.
• C: A view recomputes the aggregation at query time, increasing latency and query cost.
• D: Delta caching may improve reads but does not replace the need to materialize the expensive aggregation, and cache availability is not the main design guarantee.

• Review the risk register.
• Use the previously defined risk response plan, such as assigning a backup resource, reprioritizing work, or using another qualified engineer.
• Implement the response promptly because the task is on the critical path.

• B: Revising the schedule without first applying the planned response may be premature.
• C: Excluding a required task could compromise the project’s objectives and requirements.
• D: Updating the risk and lessons learned records is appropriate, but it should happen after managing the immediate issue, not as the next primary action.

• A: Allow SAN certificates — SANs are used to identify valid hostnames in a certificate. They do not bypass trust validation.
• C: Open the secure LDAP port — A blocked port would normally cause a timeout or connection-refused error, not certificate errors.
• D: Increase the TLS version on the RA — The issue concerns certificate trust, not the organization’s registration authority.

• Authentication — verifies who the user is.
• Authorization — determines what the authenticated user is allowed to access.
• Accounting — records session activity, such as login time and resource usage.

• CIA — confidentiality, integrity, and availability; core security objectives.
• ACL — access control list; rules that permit or deny traffic or access.
• PEM — Privacy Enhanced Mail, an older email security standard.

• Authentication: Verifies a user’s identity, such as username and password.
• Authorization: Determines what the authenticated user is allowed to access.
• Accounting: Records connection and usage details, such as login time or session duration.

• CIA: Confidentiality, integrity, and availability are broad security objectives, not a specific RADIUS function.
• ACL: An access control list contains permit/deny rules on systems or network devices. RADIUS can support access decisions but is not itself an ACL.
• PEM: Privacy-Enhanced Mail is also associated with certificate and key encoding formats; it is unrelated to RADIUS’s primary purpose.