WS-Coordination establishes a base coordination framework for which WS-Addressing and WS- Routing provide additional protocols and rules.
WS-Coordination establishes a base coordination framework for which XML Schema and WS- Addressing provide additional protocols and rules.
WS-Coordination establishes a base coordination framework for which WS-AtomicTransaction and WS-BusinessActivity provide additional protocols and rules.
WS-Coordination does not establish a base coordination framework. The name of the specification is deceiving as it actually defines a series of generic routing protocols.

Answer(s): C

Show Answer Next Question

QUESTION: 23

A WS-Policy definition can be attached to different parts of a __________________ or to multiple __________________. Select the correct answer.

service activity, service activities
service contract, service contracts
service model, service models
service line, service lines

Answer(s): B

Show Answer Next Question

QUESTION: 24

WS-BPEL is an XML-based language that can be used to define business process logic that can be carried out via the composition of SOAP-based Web services. Select the correct answer.

True
False

Answer(s): A

Show Answer Next Question

QUESTION: 25

Which of the following statements are false? SELECT ALL THAT APPLY

A service enters the service consumer role only when it initiates contact with other service consumers.
A service enters the service consumer role only when it accesses other services acting as intermediaries.
A service enters the service consumer role when it initiates contact with other services acting as service providers, including those also acting as intermediaries.
A service cannot enter the service consumer role.

Answer(s): A,B,D

Show Answer Next Question

Download PDF Next Page

Viewing page 9 of 31
Viewing questions 41 - 45 out of 150 questions

Post your Comments and Discuss Arcitura Education S90.02 exam prep with other Community members:

Comments:

Name:

S90.02 Exam Discussions & Posts
S90.02 AI Verifications

Buffer on: September 04, 2026
Wasn't feeling confident at first but the practice questions here helped me learn a ton.
Austria

Hardlink on: August 01, 2026
Wow that exam was crazy stressful. Good thing these questions were on point.
South Korea

Dnssec on: August 19, 2026
Work made me squeeze in short study sessions on the fly, so glad I passed and done with this cert.
Germany

Pids on: August 03, 2026
Exam was tough but these questions helped. Glad I used this site.
Switzerland

Endian on: August 05, 2026
This exam was a bit harder than I thought but still got through with help from the practice questions.
Taiwan

Sshd on: August 30, 2026
Saved so much time and money cramming with the practice questions on this site got me through the exam slow but sure.
United Kingdom

Vlan on: July 28, 2026
Didn't feel ready but practice questions helped.
Italy

ZeroDay on: July 04, 2026
Cramming on this site saved me time and money passed slowly but surely.
Italy

Hotfix on: July 22, 2026
Man this exam was stressful but these questions really nailed it. Feels good to be done with it.
Ireland

Daemon on: August 23, 2026
Exam was tough but if you prep right it's doable.
Slovenia

Bashrc on: July 06, 2026
This cert took forever but passed.
Switzerland

Bgp on: August 28, 2026
This website is cool because I crammed slowly and saved time and money getting through this exam.
Qatar

Deadlock on: July 07, 2026
This exam had more stuff than I thought but it was alright. The AI assistant on this site really helped me get through the extra material.
Finland

Pids on: September 14, 2026
The exam was way broader than I thought it would be but thankfully the AI assistant on this site made a difference. Didn't get stuck much since it kept giving relevant hints to help along.
Lithuania

Parity on: July 25, 2026
Was pretty stressed about the exam but the practice questions really helped calm me down. I think they were relevant and that was good.
Israel

Manpage on: July 31, 2026
At first I be real shaky but them practice questions had me feeling better.
Croatia

Zsh on: July 24, 2026
This exam had way more stuff than I thought and totally caught me off guard. Luckily the AI assistant on this site was kinda handy when I got stuck with things.
Malta

VlanId on: July 12, 2026
Cramming with this site saved me time and money got through the exam slowly but surely so it worked out good.
Belgium

Kmem on: June 25, 2026
Cramming with this site saved me time and some money since I could tackle the exam slowly but still passed it in the end.
Canada

PktLoss on: July 25, 2026
The exam was crazy stressful. The practice questions here definitely helped a lot.
Ireland

Bytecode on: August 21, 2026
This exam was trickier than I thought. The AI assistant on this site helped me figure it out though.
United States

Segfault on: July 11, 2026
This exam was harder but still okay.
Uruguay

Vlan on: August 06, 2026
This exam covered way more than I thought but wasn't too bad. The AI assistant on this site really helped me out with all those tricky parts.
Canada

Stderr on: August 12, 2026
Balancing work and study sessions for this exam was exhausting but I'm so relieved it's over.
Switzerland

Symlink on: July 15, 2026
Between hectic days at work and squeezing in short study sessions I finally knocked out this cert and feel so relieved.
Saudi Arabia

Linter on: July 19, 2026
This exam was super stressful man. The practice questions here made it better tho.
Brazil

Linter on: July 13, 2026
I cram like crazy using this site and somehow save time and money to pass the exam slow.
New Zealand

Symlink on: August 11, 2026
At first the exam felt like a mountain but working with these practice questions from this site made it manageable.
Spain

Sandbox on: June 27, 2026
This exam was tricky and covered way more stuff than I thought it would. The AI assistant on this site helped me fill in some gaps though so not too bad.
Singapore

Wai on: September 20, 2026
QUESTION: 120 Answer is SSH, not HTTPS
Yangon, Myanmar

Shebang on: August 20, 2026
This exam tough but these questions saved me.
Costa Rica

Mtu on: June 27, 2026
Exam was tough but the practice questions here got me through.
Canada

Sandbox on: September 04, 2026
I went slowly through the review time it was chill but after passing this exam I felt really accomplished.
Norway

Unicast on: August 04, 2026
This exam was so stressful but the prep material really helped me calm down. I'm glad I found this website.
Germany

Unicast on: July 19, 2026
Practice questions helped me feel confident.
Portugal

Dotfile on: September 01, 2026
This site's practice questions helped me cram fast and save money.
Singapore

Heap on: August 07, 2026
Man this exam was stressful. Thankful for the practice questions here they made it less painful.
Australia

Overclock on: June 29, 2026
The exam was tougher but doable.
Italy

Thread on: August 12, 2026
I was not feeling confident but going over relevant questions really helped me get a grip on this exam.
United States

VlanId on: August 03, 2026
The exam had more stuff than I thought it would. AI assistant on this site made prep easier.
Latvia

Pdu on: August 16, 2026
At first I was clueless but those practice questions taught me a lot.
Netherlands

Sshd on: August 24, 2026
The exam was a bit tougher than I thought but with the practice questions from this site it felt manageable.
Switzerland

Rootkit on: July 11, 2026
Slow but got there passed it
Singapore

Quorum on: July 14, 2026
Man this exam threw more at me than I thought it would. Thankfully the AI assistant on this site was a lifesaver for understanding tricky bits.
Uruguay

Subnet on: July 02, 2026
This cert was super tough but those practice questions saved me.
Cyprus

Iptables on: July 27, 2026
Exam tough but these questions saved me.
Mexico

Namespaces on: September 07, 2026
Exam was more intense than I expected but the AI assistant here was a lifesaver. Totally helped me cram all the extra stuff they threw in there.
Belgium

Microcode on: August 29, 2026
This exam was kinda tough with stuff I didn't expect. The AI assistant on this site saved me a lot of time though.
New Zealand

Stacktrace on: June 25, 2026
Was kinda surprised how much this exam covered man it was a lot. Thank god for the AI assistant here helped me out big time.
Uruguay

Grep on: July 30, 2026
Crammed with this site and barely passed but saved me time.
United States

AI Explanation - verified by User5938 on: September 11, 2026
resuma no mesmo padrão da resposta anterior
Resposta: Standard.
O plano Standard atende aos requisitos:

Domínios personalizados.

Armazenamento suficiente.

Instâncias dedicadas.

Balanceamento de carga.

Menor custo entre os planos que atendem a tudo.

Free, Shared e Basic não atendem a todos os requisitos.
Cabo Frio, Brazil

AI Explanation - verified by User4708 on: September 23, 2026
Question 1:
Correct answer: The capacity tier.
Reasoning:

The job keeps 31 days of regular restore points. A backup from the week of January 1 is older than 31 days by March 20, so it is no longer expected to remain on the performance tier.

It is also a weekly GFS full backup, retained for 14 weeks. Therefore, it is still protected and has not been deleted.

In a Scale-out Backup Repository, older backups can be moved from the performance tier to the capacity tier—typically object storage—according to the configured offload policy.

The archive tier is not selected because the question’s configuration does not indicate that the backup has been archived there.

So, the standard retention removes the backup from normal short-term storage, while the weekly GFS retention preserves it in the capacity tier.
Buenos Aires, Argentina

AI Explanation - verified by User5548 on: September 10, 2026
Question 149:
Correct answer: D — All the statements.
Beyond Budgeting is a management approach designed to replace rigid annual budgets with more flexible, decentralized management.
Each statement fits:

Clear principles and boundaries — Employees have freedom, but decisions must remain within clear organizational values, policies and limits.

High degree of freedom — Managers are trusted to make decisions rather than seeking continual approval from senior management.

Frontline customer responsibility — Customer-facing managers should be empowered to manage customer relationships and respond quickly to needs.

Transparent and ethical information — Information should be openly available and used honestly, supporting trust and informed decision-making.

Therefore, all four statements describe Beyond Budgeting.
Maseru, Lesotho

AI Explanation - verified by User2457 on: September 10, 2026
Question 3:
Correct answer: Power BI dataset.
The existing report already contains a data model with measures. When you connect to its published Power BI dataset, you can reuse:

Existing measures

Relationships

Calculated columns

Tables and fields

Existing transformations in the model

You only need to create the new report visuals, which minimizes development effort.
Why the other options are less suitable:

SharePoint folder: Reconnects to the source files. You would likely need to recreate the model and measures.

Power BI dataflows: Primarily provide reusable data preparation and storage, but they do not automatically provide the existing semantic model and measures.

Excel workbook: Connects directly to the source file and would also require rebuilding the model and measures.

The fact that the source is an Excel file in SharePoint is not the key point. The key point is that an existing Power BI model with measures is available for reuse.
Gaborone, Botswana

AI Explanation - verified by puranikatul on: September 26, 2026
Question 146:
The correct answer is B: a spoke.
In IntegrationHub, a spoke is a ServiceNow application that packages integration content for a particular third-party system or business function. A spoke can contain:

Actions that call external APIs

Subflows

Connection and credential aliases

Supporting integration logic

For example, a Slack spoke may provide actions for sending messages or creating channels.
Why the other choices are less accurate:

Action — A reusable operation within a flow, such as “Create a record” or “Send email.”

Connection — Defines how ServiceNow authenticates and communicates with an external system.

Integration step — A general flow step, not the name for the packaged integration.

Therefore, third-party integrations provided through IntegrationHub are generally called spokes.
Bengaluru, India

AI Explanation - verified by User5476 on: October 01, 2026
Question 27:
Correct answers: B and D

B — The glass core component is encased in a cladding.

Fiber-optic cable has a glass or plastic core surrounded by cladding. The cladding has a different refractive index and helps keep the light confined within the core.

D — Light is transmitted through the core of the fiber.

Data is carried as pulses of light through the fiber’s core, not through the cladding.
Why the other options are incorrect:

BNC connectors are associated mainly with coaxial copper cabling, not standard fiber connections.

Data does not pass through the cladding; the cladding helps reflect and contain the light.

RJ-45 connectors are used with copper Ethernet cabling, not fiber-optic interfaces.

Amman, Jordan

AI Explanation - verified by User8869 on: September 07, 2026
Question 91:
Correct answer: B — Performance improvement programs are organized for all team members who were assessed.
A performance assessment identifies strengths, weaknesses, and capability gaps. When gaps remain, the project manager should ensure appropriate development or improvement actions, such as:

Training or coaching

Mentoring

Additional support or resources

Targeted performance improvement plans

Why the other options are weaker:

A: Recognition may be appropriate, but awards do not address identified gaps.

C: Rotating schedules does not necessarily improve the specific competencies that are missing.

D: Assessment results should be handled sensitively, but keeping them entirely private prevents useful feedback and development discussions.

The key exam concept is: performance assessment should lead to corrective development actions, not merely recognition or documentation.
Shah Alam, Malaysia

AI Explanation - verified by User3112 on: September 24, 2026
Question 34:
Correct answer: D — All of the choices.
An Intrusion Detection System (IDS) is commonly described using three fundamental functional components:

Information sources: Collect security-related data, such as network packets, system logs, audit records, or application events.

Analysis: Examines the collected data to identify suspicious activity, attacks, or policy violations.

Response: Takes or recommends action, such as generating alerts, logging the event, or supporting a protective response.

Therefore, Response, Information Sources, and Analysis are all core IDS functions, making “All of the choices” the best answer.
Addis Ababa, Ethiopia

AI Explanation - verified by ajaykamath69055 on: September 22, 2026
Question 9:
Correct answer: C — Markdown-based text boxes
In a Databricks dashboard, use a text box with Markdown to add headings, labels, descriptions, and section dividers. For example:

# Development

# Testing

# Production

This lets all three sections remain on the same dashboard while clearly identifying them.
Why the others are incorrect:

Separate endpoints: relate to compute or connectivity, not dashboard labels.

Separate queries: retrieve or transform data but do not designate visual sections.

Direct text written into the dashboard in editing mode: dashboards use text boxes, typically with Markdown formatting, rather than arbitrary text placed directly on the canvas.

Chiyoda City, Japan

AI Explanation - verified by Tholang2016 on: September 11, 2026
Question 193:
The correct answer is A — MIRR uses a more realistic reinvestment assumption than IRR.

IRR assumes that interim cash flows can be reinvested at the project’s own IRR. This may be unrealistic, especially when the IRR is very high.

MIRR assumes reinvestment at a specified rate, usually the company’s cost of capital or another realistic reinvestment rate.

The other statements are incorrect:

B: MIRR does not specifically favour projects with long payback periods.

C: MIRR and IRR can rank competing projects differently.

D: MIRR is not always higher than IRR; it may be higher or lower depending on the cash flows and reinvestment rate.

Maseru, Lesotho

AI Explanation - verified by User1726 on: September 17, 2026
Question 3:
Question 3: Correct answer — D: Host A is the ERSPAN source, and Host B is the traffic analyzer.
Key concepts:

The ERSPAN source is the device or interface whose traffic is being copied.

The ERSPAN destination is the device receiving the encapsulated copy and forwarding it to the traffic analyzer.

The local monitor session number is locally significant. Therefore, the source and destination do not need matching session IDs such as 47 or 48.

The erspan-id identifies the ERSPAN stream and must correspond between the source and destination configuration.

Thus, options claiming that session ID 47 or 48 must match are incorrect. Based on the exhibit referenced by the question, traffic flows from Host A toward Host B, making A the source and B the analyzer.
Paterson, United States

AI Explanation - verified by pikej74485 on: September 21, 2026
Question 199:
Correct answers: B and C

B — Both inner and outer classes can be declared as with sharing.

An outer class and its inner class can each explicitly specify their own sharing behavior.

C — Inner classes do not inherit sharing settings from the container class.

An inner class has an independent sharing declaration. If its behavior matters, declare with sharing or without sharing explicitly.
Example:

apex public with sharing class OuterClass { public with sharing class InnerClass { // Explicitly uses sharing rules } }

with sharing enforces record-level sharing rules, but it does not automatically enforce object permissions or field-level security.
Chennai, India

AI Explanation - verified by User8245 on: October 02, 2026
Question 16:
Correct answer: B — Peer-to-Peer (P2P) file-sharing applications
P2P applications are considered high risk because users download files directly from other users, often from unknown or untrusted sources. Those files may contain malware, viruses, spyware, or Trojan horses. P2P software can also expose internal systems or consume significant network bandwidth.
Why the others are less suitable:

Instant messaging/chat: Can be abused to send malicious links or attachments, but is not the answer most directly associated with high-risk file sharing.

E-mail: A common malware delivery method, but the question emphasizes an application type known for direct file exchange.

End-to-end applications: This describes communication protection or architecture, not a specific malware distribution risk.

A useful exam clue is that uncontrolled file sharing from unknown sources strongly points to P2P applications.
Phoenix, United States

AI Explanation - verified by User9046 on: October 02, 2026
Question 7:
The answer key appears to be incorrect. The best answers are B and D:

B — Incorporate contextual output encoding/escaping: Encode untrusted data based on its context—HTML, attribute, JavaScript, or URL—so the browser treats it as data rather than executable code.

D — Run untrusted HTML input through an HTML sanitization engine: Sanitization removes or neutralizes dangerous elements and attributes, such as script-related content, while preserving safe HTML where needed.

Why the other choices are incorrect:

A: Enabling client-side scripts does not prevent XSS. Script restrictions may reduce risk in some environments, but “enable” is not a general XSS control.

C: Cookie inspection is unrelated to preventing injected scripts.

E: The SameSite cookie attribute primarily helps mitigate CSRF, not XSS. It should not generally be described as an XSS prevention measure.

So, B and D align with standard XSS defenses, despite the stated key listing A and B.
Lagos, Nigeria

AI Explanation - verified by luckiyisrael on: September 30, 2026
Question 10:
The answer key shows D (ESP), but that is incorrect. The correct answer is C: IKE.

IKE (Internet Key Exchange) negotiates the IPsec security association, including:

- Encryption algorithms - Authentication/integrity algorithms - Shared keys and other security parameters

ESP (Encapsulating Security Payload) protects the data after negotiation by providing encryption and optionally authentication.

AH provides authentication and integrity but does not encrypt traffic.

TLS is used for protocols such as HTTPS, not for negotiating IPsec parameters.

So, remember: IKE negotiates; ESP protects and encrypts the data.
Ikeja, Nigeria

AI Explanation - verified by User6479 on: September 29, 2026
Question 43:
Correct answer: D — Identifies potential bias during data preparation.
Amazon SageMaker Clarify helps organizations evaluate bias and fairness in machine learning workflows. It can analyze:

Training data for potential bias before model training

Trained models for bias in predictions

Model features to help explain how they influence predictions

Why the others are incorrect:

A: RAG workflows are typically built using services such as Amazon Bedrock, knowledge bases, and data sources.

B: Monitoring model quality in production is primarily associated with SageMaker Model Monitor.

C: Documenting model details is handled by capabilities such as SageMaker Model Cards.

The key exam distinction is: Clarify = bias detection and model explainability.
Bangkok, Thailand

AI Explanation - verified by User6058 on: September 10, 2026
Question 143:
Correct answer: C — Reduce the level of fixed costs.
If transfer prices are set at variable cost, the supplying division recovers only the additional cost of producing the item. It earns no contribution toward its fixed costs, such as salaries, rent or machinery depreciation.
The other options provide a mechanism for the supplying division to receive additional revenue:

Share of overall contribution: part of the organization’s total contribution is allocated to the supplying division.

Dual pricing: the supplying division may record a higher transfer price while the receiving division records a lower price, with central accounts absorbing the difference.

A centrally imposed price range: this may allow the transfer price to be set above variable cost, helping the supplying division recover fixed costs.

Simply reducing fixed costs lowers the amount to be recovered but does not change the fact that variable-cost pricing provides no recovery of those costs. Unless fixed costs are eliminated entirely, the underlying problem remains.
Maseru, Lesotho

AI Explanation - verified by User8043 on: September 11, 2026
Question 57:
Correct answer: A. Non-credentialed scan
A non-credentialed vulnerability scan examines systems from an external perspective without using a system account or login credentials. It identifies weaknesses that an unauthenticated attacker might discover on internet-facing web servers.
Why the others are incorrect:

Packet capture: Collects and analyzes network traffic; it does not describe the scan type.

Privilege escalation: Attempts to gain higher permissions after obtaining access.

System enumeration: Identifies systems, services, or resources, but is not specifically defined by the lack of credentials.

Passive scan: Observes traffic without actively probing systems. A vulnerability scan is generally an active assessment.

A credentialed scan would use an account to inspect the operating system and applications in greater depth.
Upland, United States

AI Explanation - verified by User9267 on: September 24, 2026
Question 55:
Correct answer: B — Ramen
Why:

Ramen is a Linux worm associated with Red Hat Linux 6.2 and 7.0 systems.

It spreads by scanning randomly generated IP addresses using tools such as synscan.

It exploits vulnerable network services, including web-related services, and may leave malicious files or altered web content.

The tar.gz file is also a clue because it is a common Linux archive/package format.

Why the others are incorrect:

Code Red: Primarily targeted Microsoft IIS servers running Windows.

LoveLetter: Spread mainly through email attachments.

Nimda: A Windows-based worm that spread through email, web servers, and network shares.

Therefore, the answer key’s B is correct.
Kuala Lumpur, Malaysia

AI Explanation - verified by lucas.eu on: October 01, 2026
Question 177:
Correct answer: Azure policies (option C, based on the listed choices).
The answer key shows B, but that appears incorrect. Resource groups are containers for related Azure resources, usually within a single subscription. They are not the primary tool for enforcing or evaluating compliance across multiple subscriptions.
Azure Policy lets you:

Enforce organizational rules, such as allowed regions or required tags

Audit resources for compliance

Deny noncompliant deployments

Aggregate compliance results across subscriptions

Policies can be assigned at different scopes, including a management group, subscription, resource group, or resource. A management group can contain multiple subscriptions and is often used as the scope for applying policies, but the service that manages compliance is Azure Policy.
Singapore, Singapore

AI Explanation - verified by User1638 on: September 11, 2026
Question 20:
Correct answer: A — Determine an appropriate format for the presentation.
Before presenting requirements, Gary should consider:

The audience and stakeholders

The complexity and type of requirements

The communication method and level of detail needed

Whether to use diagrams, models, documents, demonstrations, or slides

This supports the BABOK task Communicate Business Analysis Information, which requires tailoring the presentation format and content to the stakeholders.
Why the others are less suitable:

B: Authority to host the presentation is not the key preparation activity.

C: Stakeholder sign-off may occur later; presenting requirements does not always require formal approval beforehand.

D: A scribe may be useful in a meeting, but hiring one is not a core preparation requirement for presenting.

Madala, Nigeria

AI Explanation - verified by User3350 on: September 20, 2026
Question 18:
Correct answer: C — try to expand its customer base to avoid becoming dependent on the corporation.
The passage warns that a minority-owned business may become dependent on one large corporate customer. If that customer reduces its orders or ends the relationship, the small business could suffer serious financial problems. The business might also become complacent and stop seeking other opportunities.
Therefore, it should develop relationships with additional customers, even though it may have to compete with larger, established companies.
Why the other choices are wrong:

A: Not expanding would increase its dependence.

B: More business from the same corporation would make dependence worse.

D: Passing work to other minority businesses does not solve its own dependence.

E: The passage does not suggest that it can force or influence the corporation to give work to others.

Lagos, Nigeria

AI Explanation - verified by User8874 on: September 17, 2026
Question 11:
Correct answer: A — False positive
A false positive occurs when a security tool reports a vulnerability or threat that does not actually exist on the scanned system.
In this question:

The vulnerability scan identifies a vulnerability.

The administrator verifies that the vulnerability is not present.

Therefore, the scan produced a false positive.

For comparison:

True positive: A vulnerability is reported and genuinely exists.

False negative: A vulnerability exists, but the scan fails to detect it.

True negative: No vulnerability exists, and the scan correctly reports no issue.

Woodbridge, United States

AI Explanation - verified by swatisharma4781 on: September 21, 2026
Question 93:
Correct answer: B. They must be uppercase.
Splunk recognizes Boolean operators when written in uppercase:

spl error AND host=WWW3 status=404 OR status=500 NOT source=access.log

Using lowercase words such as and, or, or not may cause Splunk to interpret them as search terms rather than Boolean operators.

Quotation marks are used for exact phrases or values containing spaces.

Parentheses group parts of a Boolean expression, but they are not required for every Boolean search.

The answer key’s B is correct.
Lexington, United States

AI Explanation - verified by lucas.eu on: October 01, 2026
Question 179:
Question 179 tests your understanding of Azure subscriptions.
The correct selections are:

Yes — One account can manage multiple subscriptions

A user account can have access to several Azure subscriptions. You can create additional subscriptions and assign permissions across them.

No — You cannot merge two subscriptions into one

Azure does not provide a general subscription-merge operation. However, you may be able to move supported resources between subscriptions, subject to the relevant limitations.

Yes — A resource belongs to only one subscription

An Azure resource instance has one subscription association. It cannot simultaneously belong to multiple subscriptions. You can sometimes move it to another subscription, but it is still associated with only one at a time.
Remember: a subscription is both a resource-management boundary and a billing boundary.
Singapore, Singapore

AI Explanation - verified by User4550 on: September 08, 2026
Question 29:
Question 29: Yes — Azure AD Identity Protection is appropriate.
Azure AD Identity Protection (now Microsoft Entra ID Protection) detects risky sign-ins, including sign-ins from:

Unfamiliar locations or IP addresses

Anonymous or malicious IP addresses

Leaked credentials

Unusual sign-in behavior

You can configure a sign-in risk policy to respond automatically when a risky sign-in is detected. One possible control is require password change, typically for high-risk sign-ins.
Therefore, the answer key’s A (Yes) is correct.
Why not Privileged Identity Management (PIM)? Azure AD Privileged Identity Management manages and monitors privileged administrative roles. It does not evaluate users’ sign-in risk or automatically force password changes based on an unfamiliar IP address.
Norwich, United Kingdom

AI Explanation - verified by User5041 on: September 10, 2026
Question 17:
Correct answer: B — Enabling malware detection through a UTM
The company accepts PDF uploads, which creates a risk that an attacker could upload a malicious or weaponized file. A UTM (Unified Threat Management) appliance can inspect uploaded content and use antimalware/content filtering to detect and block malicious files.
Why the others are less appropriate:

A. IDS attack signatures: An IDS primarily detects suspicious network activity; it is not the best control for scanning uploaded documents for malware.

C. Load balancer: Distributes traffic among servers and improves availability, but does not inspect files for malware.

D. WAF: Protects web applications against attacks such as SQL injection and command injection. It may help secure the upload function, but malware scanning is the key requirement here.

The exam clue is “upload PDF documents”: think file-based malware detection, not just web-request filtering.
Biloxi, United States

AI Explanation - verified by User7687 on: September 10, 2026
E is correct and D means nothing since "production server" is not a salesforce terminology
You’re right to challenge that. The stronger answer is B, C, and E, not B, C, and D.

B: Developer Edition has limited user, storage, and data-volume capacity, making realistic community testing difficult.

C: A Developer Edition org cannot contain sandboxes, so it cannot provide separate environments for development, integration, and UAT.

E: A standalone Developer Edition org is not part of the production org’s deployment path, so change sets cannot be used to deploy from it directly to that production org. The team would need Metadata API, Salesforce CLI, or another deployment method.

D is poorly worded and should not be treated as a sound Salesforce risk. “Production servers” is not the meaningful distinction for this architecture decision, and an org’s environment type alone is not a reliable basis for concluding that it will perform poorly.
So the page’s stated answer B, C, D appears incorrect; B, C, E better matches the risks described.
Marseille, France

AI Explanation - verified by User7609 on: September 07, 2026
Question 58:
Correct answer: A. MITRE ATT&CK
MITRE ATT&CK is a real-world knowledge base that documents adversary tactics, techniques, and procedures (TTPs). A security administrator can use it to understand how attackers operate and select appropriate hardening measures and mitigations.
Why the others are incorrect:

CSIRT: A Computer Security Incident Response Team that handles and coordinates incident response.

CVSS: A scoring system used to rate the severity of vulnerabilities.

SOAR: Security Orchestration, Automation, and Response technology used to automate security workflows.

The key clue is “real-world knowledge base for adversary behavior,” which directly describes MITRE ATT&CK.
Baltimore, United States

AI Explanation - verified by zaher.sono93 on: September 25, 2026
Question 25:
Question 25 asks how RouterOS evaluates entries in the wireless Access List and Connect List.
The answer key shows B: By interface name, but that appears incorrect. The correct answer is C: In sequence order.
RouterOS evaluates these list entries from top to bottom. The first rule whose conditions match is applied, so rule order matters. For example, a permitting rule placed above a rejecting rule can prevent the rejecting rule from being reached.

Access List: controls whether a client is allowed or denied.

Connect List: controls which wireless networks/APs a station may connect to.

The interface name may be one of the matching conditions, but it does not determine the overall processing order.
Beirut, Lebanon

AI Explanation - verified by User2188 on: September 10, 2026
Question 492:
Correct answer: C — “Adjacency Segment must be configured manually.”
An Adjacency Segment in Segment Routing represents a specific link or adjacency from one network device to a neighbor. It is identified by an Adjacency Segment ID (Adj-SID).
Why C is wrong:

An Adj-SID does not necessarily need manual configuration.

It can often be dynamically allocated by the router, although manual configuration may also be possible.

The adjacency information is advertised through the IGP, such as IS-IS or OSPF.

The other statements are essentially correct:

It is identified by an Adj-SID.

It represents a particular adjacency of a node.

Its meaning is generally local to the advertising node; unlike a Node-SID, it is not a globally reusable instruction across the network.

Setúbal, Portugal

AI Explanation - verified by User6537 on: September 28, 2026
Question 13:
The correct answer is C: The Layer 2 switch floods the frame to all ports except the receiving port in the same VLAN.
When a switch receives a frame:

It examines the source MAC address and learns it on the incoming port.

It examines the destination MAC address.

If the destination MAC is already in the MAC/CAM table, it forwards the frame only through the associated port.

If the destination MAC is unknown, it performs unknown-unicast flooding:

- Sends the frame out every other port in the same VLAN. - Does not send it back out the port where it arrived.
The switch does not normally add the unknown destination MAC address to its table. It can learn that address later when a frame arrives with it as the source address.
Minato, Japan

AI Explanation - verified by User6058 on: September 10, 2026
Question 141:
Correct answer: C — The high level of external failure costs is the result of a lack of expenditure on appraisal costs.
Quality costs include:

Prevention costs: Avoiding defects, such as staff training and improved product design. The company has invested in these.

Appraisal costs: Detecting defects before products reach customers, such as inspection and testing. The planned batch sampling has not been implemented.

Internal failure costs: Correcting defects found before delivery.

External failure costs: Dealing with defects after delivery, such as refunds, replacements, complaints and lost sales.

Because the company is not carrying out the planned inspections, faulty products reach customers. This creates high external failure costs, including refunds, replacements and reputational damage.
Therefore, C is the best answer. The issue is not primarily a lack of prevention spending; it is the failure to implement appraisal activities that would detect defects before dispatch.
Maseru, Lesotho

AI Explanation - verified by n.brahm85b on: September 12, 2026
Question 291:
Correct answer: A. Static
Static analysis examines a file without executing it. A security engineer can quickly inspect:

File hashes

Strings and metadata

Binary or code structure

Known malicious patterns

Embedded indicators or signatures

This is appropriate when the goal is to identify a signature from a known malicious file.
Why the others are less suitable:

Sandbox: Executes the file in an isolated environment; useful for observing behavior, but usually slower.

Network traffic analysis: Examines communications generated by a system or application, not the file itself.

Package monitoring: Tracks software packages or installations and is not the primary method for examining malware signatures.

A useful exam distinction is: static analysis = inspect without execution; dynamic analysis/sandboxing = observe while executing.
Cambridge, United Kingdom

AI Explanation - verified by permits_patties.0z on: September 12, 2026
For this question the answer is wrong, it should be C
If you’re referring to Question 5, you’re right: C is the better answer, and the provided key showing A appears incorrect.

C: Develop the rule in the Rules Editor, define the events, match, and condition sections, then use the test rule feature. This directly validates the YARA-L rule without enabling it in production.

A: UDM Search can help investigate data and refine filters, but it does not fully test YARA-L logic—especially complex event joins, match windows, and conditions.

D is less appropriate because setting a rule live, even without alerting, can still involve production execution and is not the intended controlled testing workflow.
Riyadh, Saudi Arabia

AI Explanation - verified by User6298 on: September 22, 2026
Question 279:
Correct answer: D — Data changes are independently reviewed by another group.
In an environment where responsibilities are shared, the strongest detective control is independent review. A separate group can compare changes against authorized requests, approvals, and business requirements, helping identify unauthorized or inappropriate modifications.
Why the others are weaker:

A. Periodically rotate responsibilities: May reduce some risks, but it does not directly detect unauthorized changes.

B. Review segregation-of-duties conflicts: Identifies incompatible access combinations, not whether a specific data change was unauthorized.

C. Log changes in an outside application: Logs provide evidence, but someone must review and analyze them. Logging alone does not detect misuse.

D. Independent review: Directly detects unauthorized changes and reduces the risk that the person making the change can conceal it.

The key exam concept is that independence strengthens detective controls, especially when duties and access are shared.
Hyderabad, India

AI Explanation - verified by pikej74485 on: September 21, 2026
Question 81:
For the exam’s intended answer, choose A, C, and E:

A — Use a custom controller: An Apex class can contain the page’s logic.

C — Use a standard controller with extensions: The standard controller provides basic CRUD behavior, while an extension adds custom logic.

E — Use a standard controller: Useful when the page works mainly with one Salesforce object and needs standard functionality.

The key is treating a dashboard Visualforce page as requiring a controller-based implementation.
Important accuracy note: The answer key is questionable in general Visualforce terms. Visualforce can also use:

A page with no controller for static or controller-free content.

A custom controller with extensions; extensions are not limited only to standard controllers.

So A, B, C, D, and E can be valid Visualforce configurations generally. The stated three-answer key appears to depend on a dashboard-specific exam assumption that is not clearly expressed in the question.
Chennai, India

AI Explanation - verified by mengwalcien on: September 26, 2026
Question 285:
Question 285 has an issue: the answer key says B (255.255.255.192, /26), but C (255.255.255.224, /27) is the best answer if the goal is three subnets with 30 hosts each.

/27 (255.255.255.224)

- 32 total addresses per subnet - 30 usable host addresses - Creates 8 subnets from the original /24 - Exactly fits the requirement of 30 hosts per subnet

/26 (255.255.255.192)

- 64 total addresses per subnet - 62 usable hosts - Creates only 4 subnets - It can technically support three subnets, but wastes address space
The other choices do not fit:

/25: Creates only 2 subnets, not 3

/28: Provides only 14 usable hosts per subnet

Best exam answer: C, /27. The stated answer B is technically capable of supporting the hosts, but it is not the most efficient or precise choice.
Quezon City, Philippines

AI Explanation - verified by User2654 on: September 11, 2026
Question 27:
Correct answer: A. Trusted devices
A trusted device solution recognizes an enrolled device—such as an employee’s laptop or phone—and can allow authentication with minimal user interaction. It fits the requirements because:

Employees can work from any location, including remote sites and offices worldwide.

Login can be relatively seamless after the device is registered.

It does not require distributing additional physical authentication equipment.

Why the others are less suitable:

Geotagging: Identifies location, but location alone is not a strong authentication method and may prevent legitimate remote access.

Smart cards: Provide strong authentication but require card readers and physical cards, increasing equipment and management requirements.

Time-based logins: Typically involve one-time codes that users must enter, making the experience less seamless and potentially requiring a token or authenticator app.

The answer key’s “Trusted devices” is reasonable for these stated requirements, although in a real environment it should ideally be combined with another factor because a compromised trusted device could enable account access.
Anonymous

AI Explanation - verified by User8089 on: September 21, 2026
Question 4:
The correct answer is the Licenses blade in the Azure AD admin center.
Why:

The users currently have Office 365 Enterprise E3 licenses assigned directly.

Assigning Microsoft 365 Enterprise E5 through a group does not automatically remove their directly assigned E3 licenses.

From the Licenses blade, you can select the E3 product and remove it from all assigned users in one operation. This requires less effort than editing 2,500 users individually.

Why the other options are incorrect:

Identity Governance manages access reviews, entitlement management, and related governance—not bulk license removal.

Set-AzureAdUser does not remove product licenses.

Set-WindowsProductKey applies Windows product keys and is unrelated to Microsoft 365 licensing.

A PowerShell command such as Set-MsolUserLicense could also remove licenses, but it is not one of the listed choices.
Kingston, Jamaica

AI Explanation - verified by User1823 on: September 23, 2026
so the answer is NNY
Yes — NNY is correct if User1’s department is Engineer, not Engineering.

Box 1: No — The rule requires user.department to equal Engineering. Engineer does not match, so User1 is not in AU1. Admin1 cannot reset User1’s password.

Box 2: No — Admin1’s role is scoped to AU1 and cannot manage users outside that AU.

Box 3: Yes — Admin2 is a Global Administrator and can reset User3’s password.

The issue is not capitalization. Engineering and Engineer are different department values.
Singapore, Singapore

AI Explanation - verified by User6966 on: September 23, 2026
Question 19:
Correct answer: A, B, C, D, and E — all listed options.
Snowflake supports MFA authentication through:

JDBC

SnowSQL

Snowflake Web Interface (UI)

ODBC

Python connector

MFA adds a second verification factor, such as a passcode from an authenticator app, in addition to the username and password. The exact setup can differ by client—for example, the UI may prompt interactively, while connectors may use an MFA token cache or authenticator configuration.
The key exam point is that MFA is not limited to browser logins; Snowflake supports it across these major connection methods.
Columbus, United States

AI Explanation - verified by francis4fnc on: September 13, 2026
Question 108:
Correct answer: C — A script that contains a series of public cloud CLI commands.
Infrastructure as Code (IaC) means defining and provisioning infrastructure through repeatable, version-controlled code rather than manually using a graphical interface.

A script of cloud CLI commands: IaC because the commands can be saved, reviewed, versioned, and rerun consistently.

Manually run curl commands: Not necessarily IaC; they are manual actions unless organized into an automated script.

A sequence of REST requests passed to an API: Could represent automation, but the wording does not explicitly say they are stored and executed as reusable code.

Commands entered into a cloud console: Manual operation, not IaC.

The key distinction is repeatable automation expressed as code, not simply using a command or API once.
Lagos, Nigeria

AI Explanation - verified by User3138 on: October 03, 2026
Question 2:
Correct answer: D — Empowered the team to improve their processes, tools, and interactions.
The team is completing sprints, but delivery is suffering through reduced scope and poor quality. This indicates that simply increasing speed—such as fast-tracking every feature—is making the problem worse.
In an agile environment, the project leader or Scrum Master should act as a servant leader by helping the team inspect and adapt:

Allow the team to identify the causes of delays.

Encourage improvements to processes, tools, and collaboration.

Help remove impediments without dictating solutions.

Protect quality and maintain a sustainable pace.

Why the other options are weaker:

A: An impediment log may help track issues, but merely recording them does not resolve the root causes.

B: Directing teams toward solutions conflicts with the agile principle of a self-managing team.

C: Adding impediments to the product backlog may delay their resolution and incorrectly treats them as product features.

The key exam concept is that agile leaders enable and empower the team to solve problems, rather than forcing the team to work faster or prescribing every solution.
Kwai Chung, Hong Kong

AI Explanation - verified by User7445 on: September 28, 2026
Question 3:
Correct answer: False (B).
A Snowflake database belongs to a specific Snowflake account. The same database object cannot simultaneously exist in multiple accounts.
However, Snowflake supports database replication, which can copy a database to another account. The copy is a separate database in the destination account, not the original database existing in both accounts.
Also, Secure Data Sharing can let other accounts access shared database objects without physically copying the database. This still does not mean the database exists in multiple accounts.
City Of London, United Kingdom

AI Explanation - verified by User3136 on: September 27, 2026
Question 97:
Correct answer: B. netstat
The administrator should first verify that the web server is listening on the expected TCP port and on the correct IP address/interface.

netstat -tuln can show listening TCP ports.

If the web service is not listening, or is bound only to 127.0.0.1, remote browsers cannot connect even though the server responds to ping.

Why the others are less appropriate:

traceroute: Tests the path to the server, but ping already confirms basic reachability.

tcpdump: Useful for detailed packet analysis, but it is more appropriate after checking whether a service is listening.

arp: Helps troubleshoot local IP-to-MAC resolution, not an application-layer web connection.

The question uses netstat; on many modern Linux systems, ss provides similar functionality.
Khulm, Afghanistan

AI Explanation - verified by User5924 on: September 19, 2026
Question 16:
Answer: B — child table only.
When you change a field’s label while working with a child table, ServiceNow applies the change to that table’s version of the field. It does not automatically change the label on:

Base table — the table containing common inherited fields

Parent table — the table directly extended by the child

Other tables in the hierarchy

This is possible because inherited fields can have table-specific configurations, commonly through a Dictionary Override. For example, if short_description is labeled “Issue summary” on a child table, its label can remain “Short description” on the parent and base tables.
So the answer key’s B is correct, assuming the question refers to configuring the label for the child table rather than editing the original field definition on the parent/base table.
Bengaluru, India

AI Explanation - verified by User2976 on: September 24, 2026
what is athena
Amazon Athena is a serverless interactive query service that lets you run SQL queries directly against data stored in services such as Amazon S3.
Key points:

No servers or database infrastructure to provision.

Uses standard SQL.

Supports formats such as JSON, CSV, Parquet, and ORC.

You typically define the table structure with AWS Glue Data Catalog or Athena’s own schema definitions.

Charges are generally based on the amount of data scanned, so partitioning and columnar formats can reduce cost.

It does not copy the data into a separate database; it reads the files in S3 when you run a query.

For Question 2, Athena is appropriate because the logs already exist in S3 and the company needs simple, on-demand analysis with minimal operational overhead.
Bengaluru, India

AI Explanation - verified by Tholang2016 on: September 11, 2026
Question 114:
The correct answers are A, C and E:

Future costs — Only costs occurring in the future can be affected by the investment decision. Past costs are sunk and irrelevant.

Incremental costs — These are additional costs caused by choosing the investment. They are relevant because they differ between alternatives.

Cash flows — Capital investment decisions are based on future cash inflows and outflows, usually discounted to present value.

The other options are incorrect:

Committed costs have already been agreed or incurred and generally cannot be changed by the decision.

Unavoidable costs will arise regardless of which option is selected, so they do not affect the choice.

A useful test is: a relevant cost must be a future cash flow that differs between alternatives.
Maseru, Lesotho

AI Explanation - verified by User6133 on: September 20, 2026
Which of the following is a feature of a next-generation SIEM system?
Correct answer: B. Automated response actions
A next-generation SIEM combines log collection and correlation with advanced capabilities such as:

Behavioral and anomaly detection

Threat intelligence integration

User and entity behavior analytics

Automated response actions, often through SOAR integration

Why the others are less appropriate:

Virus signatures: Associated primarily with antivirus or endpoint protection.

Security agent deployment: Usually an endpoint-management or EDR function.

Vulnerability scanning: Typically performed by vulnerability-management tools, though a SIEM may integrate their results.

The key distinction is that a next-generation SIEM can help detect and automatically respond to threats, rather than only recording and displaying events.
Kissimmee, United States

Arcitura Education S90.02: Skills Tested, Job Roles, and Study Tips

The S90.02 SOA Technology Concepts exam is designed for IT professionals who are responsible for the design, development, and implementation of service-oriented architecture solutions. Individuals who pursue this Arcitura Education certification typically work as software architects, systems analysts, or enterprise integration specialists. These roles require a deep understanding of how various service-oriented technologies interact within a complex enterprise environment. Employers value this certification because it demonstrates that a candidate possesses the technical knowledge necessary to navigate the complexities of modern service-oriented computing. By validating these skills, professionals can better position themselves for roles that involve designing scalable and interoperable software systems.

Achieving this certification serves as a benchmark for technical proficiency in the SOA domain. It signals to hiring managers that a candidate has moved beyond theoretical knowledge and understands the practical application of service-oriented principles. Organizations that rely on Arcitura Education standards often look for this credential when staffing teams for digital transformation projects or large-scale system integrations. Consequently, earning this certification can be a significant factor in career advancement for those working in architecture and development tracks. It provides a common language and framework for technical teams to communicate effectively about service-oriented design patterns and technology implementations.

What the S90.02 Exam Covers

The S90.02 exam focuses on the foundational technologies that enable service-oriented architecture, requiring candidates to demonstrate a clear understanding of how these components function in real-world scenarios. The curriculum covers the essential mechanics of service composition, service-oriented design patterns, and the underlying infrastructure that supports these architectures. Candidates must be able to apply their knowledge of service-oriented computing to solve specific architectural challenges, which is why working through practice questions is essential for success. These practice questions help bridge the gap between abstract concepts and the concrete application of technology, ensuring that candidates are prepared for the technical depth of the exam. Mastery of these topics is critical for anyone aiming to design robust and maintainable service-oriented systems.

The most technically demanding aspects of the exam often involve the nuanced application of service-oriented design patterns and the specific requirements for service interoperability. Candidates are frequently tested on their ability to distinguish between various architectural approaches and select the most appropriate technology for a given business requirement. This requires a strong grasp of how different service models impact system performance, scalability, and security. Because the exam tests the ability to apply these concepts rather than just define them, candidates must be prepared to analyze complex scenarios. Success in this area depends on a thorough understanding of how service-oriented principles translate into functional, high-performance software architectures.

Are These Real S90.02 Exam Questions?

Our practice questions are sourced and verified by the community, consisting of IT professionals and recent test-takers who have sat for the actual exam. While we do not provide leaked or confidential material, our questions reflect what appears on the real exam because they are sourced from the community. If you have been searching for S90.02 exam dumps or braindump files, our community-verified practice questions offer something more valuable. Each question is verified and explained by IT professionals who recently passed the exam, ensuring that the content remains relevant and accurate. This approach provides a reliable way to gauge your readiness without relying on unauthorized or unethical study materials.

Community verification works by allowing users to discuss answer choices, flag potentially incorrect information, and share context from their recent exam experience. When a user encounters a difficult topic, they can rely on the collective knowledge of peers who have already navigated the certification exam. This collaborative environment ensures that the explanations provided are not only technically accurate but also reflect the current focus of the exam. By engaging with these discussions, you gain insights into the logic behind the questions, which is far more effective than rote memorization. This process makes our practice questions a highly reliable tool for your exam preparation.

How to Prepare for the S90.02 Exam

Effective exam preparation for the S90.02 requires a combination of hands-on practice and a deep understanding of core service-oriented concepts. Candidates should spend time in a sandbox or development environment to see how these technologies behave in practice, rather than relying solely on textbooks. It is important to build a consistent study schedule that allows for regular review of the official Arcitura Education documentation. Every practice question includes a free AI Tutor explanation that breaks down the reasoning behind the correct answer, so you understand the concept, not just the answer. This AI Tutor is designed to help you identify gaps in your knowledge and reinforce your understanding of complex architectural principles.

A common mistake candidates make is attempting to memorize answers instead of understanding the underlying logic of the service-oriented concepts. Because the S90.02 exam often uses scenario-based questions, rote memorization will not be sufficient to pass. You must be able to apply your knowledge to new situations, which requires a firm grasp of the "why" behind each design pattern or technology choice. Additionally, many candidates struggle with time management during the exam because they spend too long on complex scenarios. By practicing with our questions, you can develop the ability to quickly analyze a scenario and identify the correct architectural solution, which is a vital skill for the actual certification exam.

What to Expect on Exam Day

On the day of your S90.02 exam, you should be prepared for a rigorous assessment that tests your technical knowledge through various question formats. While the specific format can vary, Arcitura Education certification exams typically include multiple-choice questions and scenario-based problems that require you to select the best architectural approach. You will have a set amount of time to complete the exam, and it is important to manage your pace carefully to ensure you have enough time to review your answers. The exam is administered in a professional testing environment, often through a secure platform like Pearson VUE, which ensures the integrity of the testing process. Being familiar with the types of questions you will face is a key part of your overall exam prep strategy.

The testing environment is designed to be distraction-free, allowing you to focus entirely on the questions presented. You should arrive prepared to demonstrate your knowledge of service-oriented computing in a high-pressure setting. Because the exam covers a broad range of technical concepts, you should be ready to switch between different topics quickly. Maintaining a calm and focused mindset is just as important as your technical preparation. By simulating the exam experience with our practice questions, you can reduce test-day anxiety and approach the certification exam with confidence.

Who Should Use These S90.02 Practice Questions

These practice questions are intended for software architects, systems analysts, and developers who are actively pursuing the Arcitura Education certification. Typically, these candidates have several years of experience in IT and are looking to formalize their expertise in service-oriented architecture. Whether you are aiming for a promotion or looking to transition into a more specialized architectural role, this certification exam is a valuable step in your career. Using our resources as part of your exam preparation will help you identify your strengths and weaknesses, allowing you to focus your study time where it is needed most. This targeted approach is essential for busy professionals who need to balance their work responsibilities with their certification goals.

To get the most out of these practice questions, you should avoid simply reading the correct answer and moving on. Instead, engage deeply with the AI Tutor explanation to understand the reasoning behind each choice, and read the community discussions to see how others approached the same problem. If you get a question wrong, flag it and revisit it later to ensure you have mastered the concept. This iterative process of learning and testing is the most effective way to prepare for the certification exam. Browse the questions above and use the community discussions and AI Tutor to build real exam confidence.

AI Tutor 👋 I’m here to help!

Arcitura Education S90.02 Exam Prep SOA Technology Concepts (Page 9 )

QUESTION: 21

QUESTION: 22

QUESTION: 23

QUESTION: 24

QUESTION: 25

Arcitura Education S90.02: Skills Tested, Job Roles, and Study Tips

What the S90.02 Exam Covers

Are These Real S90.02 Exam Questions?

How to Prepare for the S90.02 Exam

What to Expect on Exam Day

Who Should Use These S90.02 Practice Questions

Arcitura Education S90.02 Exam Prep
SOA Technology Concepts (Page 9 )