ASQ CCQM Exam Actual Questions
Certified Construction Quality Manager (Page 9 )

• Elicited and documented customer requirements
• Converted them into clear, measurable specifications
• Validated the requirements with the customer
• Used them as the basis for design, quality checks, and acceptance

• A: Requirements should reflect the customer’s needs—not the supplier’s standards.
• B: Iteration review planning does not replace proper requirements collection.
• D: A retrospective occurs after work is completed and is mainly for process improvement, not initial requirements definition.

• A — SCIM synchronizes changes to user attributes from the identity provider to GitHub.
• B — SCIM deactivates GitHub accounts when users are removed or deactivated in the identity provider.
• D — SCIM automates user provisioning when new users are added to the identity provider.

• C: SCIM does not delete organization repositories.
• E: SCIM does not generate REST API authentication tokens.
• F: SCIM handles identity lifecycle management, not repository permission configuration based on roles.

• Correct answer: C) After installing ES on the search head(s) and running the distributed configuration management tool.

• ES requires the Splunk_TA_ForIndexes.spl add-on on indexers to apply index-time configurations. It should be deployed via the distributed configuration management (DCM) flow after ES is installed on the search heads, so the indexers receive the proper configuration in a controlled, versioned bundle.

• A) Deploying when adding apps to the deployment server isn’t the ES-specific order; it bypasses the ES-instantiated workflow.
• B) Installing Splunk_TA_ForIndexes.spl first isn’t the recommended order; ES needs to be installed on the search heads first.
• D) It isn’t limited to indexer cluster sites or cluster master commands; the standard flow uses DCM to push the TA to indexers in general.

• Progress iteratively with feedback focuses on making improvements in manageable steps and learning from feedback.
• Optimize and automate focuses on maximizing value from resources and automating suitable activities.
• Start where you are focuses on assessing the current situation and reusing what already exists.

• Authenticating websites with TLS/HTTPS
• Enabling certificate-based VPN authentication
• Signing or encrypting email
• Supporting device or user authentication

• VLAN tagging: Uses network-frame tags, such as 802.1Q; it does not rely on X.509 certificates.
• LDAP: May integrate with PKI in some environments, but X.509 certificates are not most commonly associated with LDAP itself.
• MFA: Certificates can be one authentication factor, but X.509 is fundamentally a PKI technology.

• A private IP address on the virtual network
• An associated public IP address

• Drop violating frames
• Log or alert on the violation
• Shut down or restrict the port

• Load balancer: Distributes application traffic; it does not control switch MAC learning.
• IPS: May detect some network attacks but is not the primary control for switch MAC-table exhaustion.
• NGFW: Protects traffic crossing network boundaries, while MAC flooding occurs at the switching/LAN layer.

• 25 — Traditional SMTP server-to-server mail transfer; not normally used for secure client submission.
• 110 — POP3, used to retrieve email and typically unencrypted.
• 143 — IMAP, used to access email and typically unencrypted.

• Amazon Kendra is a managed enterprise search service that can index content stored in S3 and support natural-language queries to find text inside documents (PDFs, Word files, etc.).

• Rekognition analyzes images/videos, not document text search.
• Polly is a text-to-speech service.
• Lex is a chatbot service.

• Create a Kendra index.
• Add a data source of type S3 and point it to your bucket (with an IAM role that allows access).
• Configure/document conversion if needed, then index the data.
• Use the Kendra API or console to run natural-language queries against your indexed documents.

• Answer: No (B)

• SaaS (Software as a Service) delivers applications over the internet; you don’t manage the underlying infrastructure or OS.
• Deploying Azure virtual machines requires provisioning and managing virtual machines, OS, updates, and networking—this is classic IaaS (Infrastructure as a Service).
• PaaS is for managed runtime environments (apps hosted on a platform), not for VM deployment.

• Assignment
• Decision
• Get Records
• Loop

• Screen flow: Would include a Screen element.
• Inactive version: Inactive status does not restrict the available elements.
• Activated version: Activation status also does not determine the toolbox contents.

• Business
• People
• Governance
• Platform
• Security
• Operations

• Program and project management
• Risk management
• Cloud financial management
• Data governance
• Portfolio management

• Sustainability
• Performance efficiency
• Reliability

• Correct answer: D. AWS CloudShell

• Why: AWS CloudShell is a browser-based shell that runs in the AWS Console and uses the current authenticated session. It provides a pre-authenticated, ready-to-use command-line environment directly from the Management Console, with AWS CLI and common tools installed.

• Why the other options aren’t correct:

• Correct answer: A — a clear business case has been established.

• The audit focus for IT procurement is ensuring there is a solid economic justification for the investment. A clear business case documents the expected benefits, costs, risks, and alignment with strategic objectives, which governs whether the investment is worth pursuing.
• The other options are important controls or project aspects, but they are secondary to ensuring the investment is justified financially and strategically:

• Amazon DynamoDB — Managed NoSQL database, not PostgreSQL.
• Amazon Athena — Serverless service for querying data in S3; intended for analytics, not OLTP.
• Amazon EMR — Managed cluster platform for big-data frameworks such as Hadoop and Spark.

• According to the provided answer key, the four options are: Upload File, User Criteria, HR Profiles, HR Criteria (options B, D, F, G).

• Upload File: Filter by a file you upload (e.g., CSV) that provides data for bulk case creation.
• User Criteria: Filter by criteria related to users (e.g., role, department) to select target users.
• HR Profiles: Filter by HR profile data associated with users.
• HR Criteria: Filter by HR-related criteria or attributes.

• SageMaker endpoint: Not required because the model is being used through Amazon Bedrock.
• SageMaker Model Registry: Used for managing SageMaker models, not for making a Bedrock custom model available.
• Grant access in Amazon Bedrock: IAM permissions may still be needed, but granting access alone does not provide the required inference capacity.

• The standard Enterprise Architecture domains are: Business, Data, Application, Technology (BDAT).

• A: Business, strategy, application and technology — includes business and application/tech but uses “strategy” instead of data.
• B: Zachman, TOGAF, Cobit, and Heath architectures — names frameworks, not domains.
• C: Business, data, infrastructure and technology — has business, data, and technology; lacks a distinct application domain (uses “infrastructure” instead).
• D: Process, database, software and technology — covers data (database), application (software), and technology, but omits business.

• The four BDAT domains (business, data, application, technology) is the conventional model you should study.
• None of the options perfectly lists all four BDAT domains. The closest are C (if you map infrastructure to technology) and D (data/application/technology but no business).

• The Well-Architected Framework has five pillars: Operational Excellence, Security, Reliability, Performance Efficiency, and Cost Optimization.
• Operational Excellence: how you run and improve your systems—monitoring, incident response, and evolving processes.
• Reliability: the ability of a workload to recover from failures, maintain uptime, and scale as demand changes.

• Availability (A) is not a pillar name; it’s an outcome that relates to Reliability.
• Scalability (C) isn’t a pillar name; scalability touches on Performance Efficiency.
• Responsive design (D) is not a pillar in the Well-Architected Framework.

• The first step in risk management is to understand objectives, constraints, and drivers from those who care about the project. This stakeholder engagement helps identify what could go wrong and what risks are most critical.
• Only after you’ve gathered input from stakeholders should you identify risks and document them in the risk register. Updating the risk register (option C) is important, but it comes after identifying and analyzing risks.
• Options B (ensure resources) and D (revise the risk management plan) are actions that may follow once risks are identified and understood; they’re not the initial step.

• Numerical flexibility: Adjusting the number of employees, such as using temporary, part-time or contract staff.
• Temporal flexibility: Varying when employees work, such as through flexitime, overtime or different working hours.
• Shift system flexibility: Changing work patterns or shift arrangements; it is not specifically about moving between tasks.

• IPsec: Protects traffic at the network layer, commonly for VPNs; it is not WPA2’s authentication protocol.
• SSL: Protects specific application sessions and has largely been replaced by TLS.
• SSH: Secures remote command-line administration.

• Answer: B — Improve employee training and awareness

• Why this is correct:

• Why the other options are less effective here:

• Quick practical note:

• Multi-pass wipe: Overwrites the drive’s existing data multiple times, making recovery much more difficult while preserving the drive’s functionality.
• Single-pass wipe: May be sufficient in some modern sanitization standards, but is presented here as less secure than multiple overwrites.
• Degaussing: Uses a strong magnetic field to disrupt data. It can render the drive unusable or unreliable, reducing its resale value.
• Pinning: Is not an appropriate data-sanitization method.

• Startup scripts run at computer startup, before any user logs on, making them ideal for machine-wide configuration on each new VM.
• They execute under the Local System account, which is appropriate for initial setup tasks.
• Linking a GPO to the OU ensures every new VM in that domain automatically receives the configuration—great for scalability.

• A) SetupComplete.cmd runs only once, right after Windows Setup, not on every boot, so it isn’t ideal for provisioning multiple VMs consistently.
• B) Logon scripts run per user, not per machine, so they aren’t reliable for initial VM configuration before a user signs in.
• D) Placing scripts in a VHD doesn’t automatically execute them.

• What the scenario asks: You have a Power BI semantic model that pulls from multiple sources (Azure SQL Database and SharePoint Online), must support a single dataset for three reports, keep data current (daily refresh by 7 AM PT), and apply RLS to limit sales data by region. You need to choose a storage mode for the tables.

• Correct choice: Dual storage mode.

• Why Dual fits:

• Key concepts:

• Basic: billing/subscription support only; no technical support requests can be opened.
• Developer, Standard, Professional Direct, and Premier: include technical support and allow opening new support requests.

• If option A corresponds to “Developer, Standard, Professional Direct, Premier,” that is the correct choice.
• If the option text is really “Premier only,” that would be incorrect per current Azure docs.

• The missing piece is to configure an event source mapping between the DynamoDB stream and the Lambda function. Enabling DynamoDB Streams alone doesn’t trigger the function—you must wire the stream to Lambda so events invoke the function.
• Note that changing StreamViewType (A) only affects what data is delivered (e.g., NEW_IMAGE) and does not trigger invocations. Options C and D are not required for invocation: you don’t need SNS, and increasing the timeout won’t enable the trigger.

• Equipment and hardware
• Facilities
• Inventory
• Backup media
• Supplies stored at an alternate or remote location

• Personal belongings of staff: Usually not organizational assets.
• DR line-item revenues: Revenue is a financial impact, not a physical asset.
• Cloud-based applications: These are primarily logical or information-processing assets, even though they depend on physical infrastructure.

• Answer: Internal load balancers (ILB) — option C.

• An ILB has a frontend IP address that must be a private IP within the subnet’s address space. You pick this IP when you create the ILB, and it can be Static or Dynamic.
• Other options don’t require a per-subnet IP:

• MFA verifies a user’s identity using additional authentication factors, such as a phone prompt or security token.
• It helps prevent unauthorized access even if a password is compromised.
• It does not provide secure storage or encryption of credentials used during automated deployment.

• Mapping:

• Why:

• Quick note: If you were to host a website on a VM, it would be IaaS; if you used a platform service instead of a VM, it would be PaaS. CaaS (containers) isn’t shown here.

• Answer: No.

• Why: Microsoft Managed Desktop (MD) is a managed service for end-user desktops (Windows devices used by people), not a service for provisioning, managing, or lifecycle-managing large fleets of virtual machines. It won’t help automate weekly creation and deletion of many VMs, especially with mixed OS (Windows and Linux).

• Relevant concept: To reduce administrative effort for rapidly provisioning and tearing down VMs, an Azure service like Azure DevTest Labs is appropriate. DevTest Labs lets you:

• Takeaway: The proposed solution (MD) does not meet the goal; the correct approach is to use a lab-oriented service such as Azure DevTest Labs for frequent, ephemeral VM deployments.

• You provision the virtual machine.
• You manage the guest operating system, applications, and configuration.
• Azure manages the physical servers, datacenter, and underlying virtualization infrastructure.

• Answer: D) Shadow IT

• Why: Shadow IT is when employees use unsanctioned tools or bypass IT controls (like the VPN) to access services, often without IT oversight. It’s an internal behavior, not an external attacker’s activity.

• Not these:

• Quick note: This creates risk due to lack of visibility and control. Mitigations include a defined approved-tools list, enforcing VPN usage, device management, and continuous monitoring.

• Each statement is evaluated as True (Yes) or False (No) independently.
• Key Azure facts to recall:

• The Balanced Scorecard translates an organization’s vision and strategy into a set of concrete objectives and metrics across four perspectives (financial, customer, internal processes, learning & growth). This framework explicitly links IT goals to business goals and provides a way to measure and monitor alignment over time.

• Enterprise architecture (EA): Great for governance, standards, and roadmaps to ensure IT assets support business needs, but it’s more about structure and alignment at design time rather than directly measuring ongoing alignment of goals.
• KPIs: Useful metrics, but they don’t by themselves provide a full framework to ensure IT goals are aligned with organizational strategy.
• Enterprise dashboard: A visualization tool for metrics; it helps report status but doesn’t inherently establish or assess alignment.

• Correct answer: C: Amazon Comprehend.

• Why: The library wants to classify books based on their text content. This is an NLP (natural language processing) task. Amazon Comprehend is AWS’s managed NLP service that can perform content classification (including creating custom classifiers) and extract meaningful information from text. The other services are not focused on text classification:

• Quick note: In practice, you’d store the books in S3, extract text if needed (e.g., from PDFs with Textract), and then use Comprehend to classify the documents into topics or genres.

• On-prem you generalize and capture the VM as a VHD.
• Upload the VHD to Azure with Add-AzVhd.
• Register the VHD as an image in Azure with Add-AzImage (or New-AzImage) so it appears as a selectable image.
• Create new VMs from that image (e.g., with New-AzVM -Image ...).

• The correct setting to configure is the Enrollment Status Page (ESP) profile.
• Why: ESP tracks the enrollment progress and logs during Autopilot provisioning. You can enable log collection within the ESP policy so that, if ESP times out, the user can collect and share the logs with support.
• Optional enhancement: In the ESP policy (or the Autopilot diagnostics settings), you can enable:

• Automatic enrollment settings: control how devices auto-enroll, not log collection.
• Windows Autopilot deployment profile: controls deployment steps but not ESP log collection.
• Device configuration profile: applies settings but doesn’t provide ESP log collection mechanics.

• A — conformant: Incorrect because one explicit requirement is violated.
• B — consistent: “Consistent” is not sufficient where the implementation contradicts a mandatory specification. The RPC mechanism is covered by the architecture, and the implementation differs from it.
• C — consistent: Incorrect reasoning: the RPC mechanism does have a defined architectural requirement, so conformance must be assessed.
• D — non-conformant: Correct because the implementation fails to follow the specified RPC/threading requirement.

cmd 
powershell.exe -ExecutionPolicy Bypass -File C:\Scripts\Configure-VM.ps1

• GPO logon script: Runs only when a user logs on, so configuration may be delayed and is user-dependent.
• GPO startup script: Can work, but requires the VMs to be domain-joined and introduces GPO dependency. It is not specifically tied to Windows deployment.
• Place scripts in a VHD: Merely makes the files available; it does not execute them.

• A) You can only apply a single template BOM to a service object.

• C) You can modify or delete lines in a BOM template regardless of whether the template has been associated to a service object, or not.

• B) You can apply many template BOMs to a service object — false; typically only one template per service object.
• D) You can modify/delete lines only if not associated — false; you can modify templates even after association (per C).

• Correct answer: B — A reservation for the server based on the MAC address.

• Why this is the best choice:

• Why the other options are less suitable:

• Quick takeaway: Use a DHCP reservation to give the file server a fixed IP while still benefiting from centralized DHCP management.

Simple explanation

• The Azure VPN gateway to connect to
• Authentication settings
• Routes for networks that the client can access

• Leadership and stakeholder commitment
• Business capability and skills
• Organizational culture
• Availability of resources
• Ability to manage and sustain change
• Impact of the proposed transformation

• How ready the organization is
• Which areas require urgent attention
• How difficult each issue may be to resolve
• Risks that could affect implementation

• A: Places the assessment in Phase B and refers vaguely to creating views; this is not the prescribed technique.
• B: An Implementation Factor Assessment and Deduction Matrix is not the primary TOGAF technique described for business transformation readiness.
• D: A Business Scenario helps identify requirements and stakeholder concerns, but it is not the main technique for assessing organizational readiness.

• A: True. You can change the size of a Virtual Warehouse after creation (via UI or ALTER WAREHOUSE).

• B: True. A warehouse can be resized while it’s running; the resize will take effect without needing to stop queries.

• C: True. A warehouse can be configured to suspend after a period of inactivity (AUTO_SUSPEND).

• D: True. A warehouse can be configured to auto-resume when new queries are submitted (AUTO_RESUME).

• Correct answer: S3 Versioning

• Why the other options aren’t suitable for this protection:

• Quick tip: For enhanced protection, enable Versioning (and consider related features like Object Lock for write-once scenarios in specific compliance cases).

• A (training data, hyperparameters, stakeholder feedback) focuses on training provenance; these details are important but are typically part of pre-deployment/training records, not the primary post-deployment documentation.
• B (encountered issues, monitoring process, risks) relates to governance and monitoring rather than the core documentation you’d publish about the deployed model itself.
• C (licensing information, the team, business goals) covers governance context but not the technical traceability and performance-based record needed for ongoing maintenance.