Banking CRCM Exam Actual Questions
CERTIFIED REGULATORY COMPLIANCE MANAGER (CRCM) (Page 33 )

• The standard Enterprise Architecture domains are: Business, Data, Application, Technology (BDAT).

• A: Business, strategy, application and technology — includes business and application/tech but uses “strategy” instead of data.
• B: Zachman, TOGAF, Cobit, and Heath architectures — names frameworks, not domains.
• C: Business, data, infrastructure and technology — has business, data, and technology; lacks a distinct application domain (uses “infrastructure” instead).
• D: Process, database, software and technology — covers data (database), application (software), and technology, but omits business.

• The four BDAT domains (business, data, application, technology) is the conventional model you should study.
• None of the options perfectly lists all four BDAT domains. The closest are C (if you map infrastructure to technology) and D (data/application/technology but no business).

• The AWS Support Concierge is a specialized team within Enterprise Support whose primary role is handling billing and account questions and helping with account setup and getting started.
• They are not the source for architecture guidance or development assistance; those services are provided by Technical Account Managers (TAMs) or Solutions Architects as part of Enterprise Support.
• For technical support cases, customers typically interact with AWS Support engineers or the TAMs, not the Concierge. The Concierge may route or coordinate related requests, but they don’t provide the technical resolution.

• What Concierge does: billing and account inquiries, onboarding help, coordination with AWS support.
• What Concierge does not do: provide architecture/design guidance or in-depth technical support case resolutions.

• A assigned without var becomes a global variable (in non-strict mode). So after myFunction(), a = 5 is accessible.
• b is declared with var inside the function, so it’s local to that function (function-scoped). It’s not defined in the outer (global) scope.

• console.log(a) prints 5.
• console.log(b) throws a ReferenceError: b is not defined.

• VPC: A logically isolated virtual network in a cloud environment; it describes networking, not shared application access.
• NFV: Replaces dedicated network appliances with virtualized network functions.
• SaaS: A cloud service model in which users consume an application without managing its infrastructure. It could describe how the application is delivered, but the question emphasizes serving multiple user groups, which points to multitenancy.

• Enable the owner dimension

• Assign a standard costing inventory model

• Batch dimension tracks batches or lots, such as expiration or production batches. It does not identify inventory ownership.
• Moving average is a costing method, but it is not the required choice for this consignment configuration.

• The explanation states that Traffic Analytics can be enabled by a user with one of these subscription-level roles:

• Question 34 — Network Contributor: Yes
• Question 35 — Owner: Yes
• Question 36 — Reader: Yes, according to the stated explanation and documentation

• Numerical flexibility: Adjusting the number of employees, such as using temporary, part-time or contract staff.
• Temporal flexibility: Varying when employees work, such as through flexitime, overtime or different working hours.
• Shift system flexibility: Changing work patterns or shift arrangements; it is not specifically about moving between tasks.

• Correct answer: D.

• Why: In a service offering, a service action is the activity performed by the service provider to deliver or support the service. A service desk agent provides support to a user is the actual action.

• Why the others aren’t service actions:

• In the AWS shared responsibility model, AWS manages the security of the “infrastructure,” including the physical hardware and underlying virtualization.
• The customer is responsible for everything else in the cloud stack: the guest OS on EC2, the NoSQL database software running on it, data, patching the OS, and configuring access controls like security groups.
• So, for a self-managed NoSQL database on EC2, AWS would handle the physical hardware, while you would patch the guest OS and manage DB availability, backups, and security.

• Azure Resource Manager templates: Use ARM templates to define the VM infrastructure and baseline configuration as code. This ensures all Windows Server 2016 VMs are created with a uniform setup, minimizing manual configuration.

• PowerShell Desired State Configuration (DSC) extension for Windows: DSC enforces a defined state across all servers and can automatically remediate drift. This keeps the VMs in the desired configuration with minimal ongoing admin effort.

• Correct answer: D) Amazon Aurora Serverless

• Aurora Serverless is serverless, so compute capacity scales automatically and can pause during idle periods. This minimizes ongoing administration and you pay only for actual usage, which is ideal for infrequent workloads.
• PostgreSQL on EC2 requires full OS and DB administration.
• RDS for PostgreSQL is managed but still involves provisioning capacity and some maintenance tasks.
• Aurora PostgreSQL (non-Serverless) is managed but requires you to manage capacity, though with some automation; it’s not as hands-off as Serverless for intermittent usage.

• Step 1: From Power BI Desktop, select Get Data, choose Folder, enter the folder path, and click OK, then choose Transform data to open Power Query Editor.

• Step 2: In Power Query Editor, expand the Attributes column.

• Step 3: From the Power Query Editor, select the Content column and use Home > Combine Files (aka “Combine binaries”) to consolidate the files.

• The diagnostic output shows that the protocol is TCP (proto=6) and the session state is 2.
• In FortiGate’s session output, state=2 maps to SYN_SENT. This means the TCP SYN has been sent but the handshake hasn’t completed yet.
• Therefore, the session is not ESTABLISHED, FIN/ACK-related states, or other states; it’s in SYN_SENT.

• Correct answer: S3 Versioning

• Why the other options aren’t suitable for this protection:

• Quick tip: For enhanced protection, enable Versioning (and consider related features like Object Lock for write-once scenarios in specific compliance cases).

• IaaS: You deploy and manage virtual machines, operating systems, disks, and networking. Azure manages the physical datacenter and host infrastructure.
• PaaS: Azure manages the operating system and runtime so you can focus on deploying applications, such as with Azure App Service or Azure Functions.
• SaaS: You consume a complete, provider-managed application.

• Startup scripts run at computer startup, before any user logs on, making them ideal for machine-wide configuration on each new VM.
• They execute under the Local System account, which is appropriate for initial setup tasks.
• Linking a GPO to the OU ensures every new VM in that domain automatically receives the configuration—great for scalability.

• A) SetupComplete.cmd runs only once, right after Windows Setup, not on every boot, so it isn’t ideal for provisioning multiple VMs consistently.
• B) Logon scripts run per user, not per machine, so they aren’t reliable for initial VM configuration before a user signs in.
• D) Placing scripts in a VHD doesn’t automatically execute them.

• Context: You’ve enabled auditing in Dataverse and need to trim audit data to free storage. The question asks which deletion options you can use.

• What the options typically mean:

• About the provided answer (A, C, D): The list includes “by column,” which isn’t a typical or supported way to purge audit data. The more plausible trio is A (by record), B (date range), and C (by table older than date). If the exam expects A, C, D, that seems incorrect or mis-stated in the source.

• Practical takeaway: To reduce audit storage, use per-record deletions, per-table purge by date, and/or date-range deletions as supported by the environment’s audit management UI or admin docs.

• The correct answer is Mass Transfer Tool.

• The Mass Transfer Records tool is Salesforce’s built-in way to reassign ownership of existing records in bulk. In this scenario, you need to transfer ownership of the departed rep’s accounts and opportunities to a new rep while keeping the team structure intact.

• Go to Setup > Data Management > Mass Transfer Records.
• Choose the object: Accounts (and then Opportunities, if needed).
• Set “Transfer From” (the leaving rep) and “Transfer To” (the new rep).
• Decide whether to transfer related records as well (e.g., opportunities tied to accounts) and proceed.
• Review and confirm.

• Data Loader / Data Import Wizard are for bulk import/export, not bulk reassigning ownership.
• Dataloader.io is a third-party tool; the built-in Mass Transfer tool is the standard Salesforce method for this task.

• L2TP uses UDP port 1701 for the L2TP control channel.
• The destination port is 1701; the source port is a dynamically chosen ephemeral port on the client (not 1701).
• Therefore the statement that both source and destination ports are 1710 is incorrect (and 1710 is not the standard L2TP port).

• The destination port should be 1701, not 1710.
• The source port should be an ephemeral port chosen by the client, not 1701.

• Correct answer: D – Do not enable default administrative accounts to ensure accountability.

• A – Do not use encryption methods … backups and sensitive information: Encryption helps protect data; not using it increases risk, not reduces insider threats.
• B – Do not allow administrators to use unique accounts during installation: We actually want unique admin accounts, not the opposite.
• C – Do not control the access to administrators and privileged users: Failing to control access directly enables misuse.

• Sustainability is not a CAF perspective (it's not one of the CAF perspectives).
• Performance efficiency and Reliability are pillars of the AWS Well-Architected Framework, not CAF.

• Quick context: In a three-tier network (Access, Distribution, Core), roles are:

• Why A is correct: The Distribution layer runs Layer 2 and Layer 3 technologies. It often handles VLAN access (L2) and can perform inter-VLAN routing or connect to the core (L3). So it makes sense for the distribution layer to support both L2 and L3.

• Why B is correct: The Core layer is designed to maintain continuous connectivity when devices fail. It is built for high availability and redundancy, providing multiple paths so the network remains reachable even if some components fail.

• Why the others are not correct:

• Correct answer: A — The degradation of a service.

• Why: A service request is a formal request from a user for something that is pre-approved and routine (e.g., provisioning a laptop, replacing a toner cartridge). Those are typical service request actions. The degradation of a service, however, is an incident: it describes a problem affecting service quality or availability and is handled by Incident Management (and possibly Problem Management), not as a standard service request.

• Quick note on the other options:

• Port 515: LPD/LPR line-printer service
• Port 631: IPP — Internet Printing Protocol
• Port 9100: JetDirect/RAW printing, commonly used by network printers

• Linux machine: Linux could run these services, but the three printer-specific ports strongly indicate a printer.
• Router: Routers may use Telnet and HTTP, but normally would not expose ports 515, 631, and 9100 together.
• Windows machine: Windows can share printers, but this particular service combination is more characteristic of a network printer’s embedded operating system.

• Interactive development and exploration
• Small datasets
• Lightweight transformations or testing
• Avoiding the overhead and cost of multiple workers

• Automated reports: Jobs may benefit from job clusters or SQL warehouses.
• Working with SQL in Databricks SQL: Databricks SQL warehouses are the relevant compute option.
• Automatically scaling for larger data: A multi-node cluster with autoscaling is more suitable.
• Large amounts of data: Distributed worker nodes are generally needed.

• A. Implement retries with exponential backoff

• C. Reduce the frequency and/or size of requests

• B. Use PutRecord instead of PutRecords — PutRecord sends one record per call and does not remove the underlying throughput limitation. It may increase request overhead.
• D. Use Amazon SNS instead — SNS is not a direct fix for Kinesis shard throttling and changes the required streaming architecture.
• E. Reduce KCL consumers — KCL consumers read from Kinesis; they do not solve producer-side PutRecords throttling.

• You provision the virtual machine.
• You manage the guest operating system, applications, and configuration.
• Azure manages the physical servers, datacenter, and underlying virtualization infrastructure.

• Correct options: C and D.

• The AWS Cloud Adoption Framework (CAF) security perspective focuses on capabilities to protect information and manage security risk.
• Observability (A) is primarily an operations/monitoring capability, not a core security capability under CAF.
• Incident and problem management (B) is IT service management/operations, not specifically a CAF security capability.
• Incident response (C) is a security-focused capability: detecting, containing, and recovering from security incidents.
• Infrastructure protection (D) involves applying security controls to protect the underlying infrastructure, which fits the security perspective.

• Batch processing, such as scheduled data transformations
• Streaming processing, such as continuously ingesting events

• Manipulating data with multiple languages: Mainly a benefit of Databricks and Spark.
• Real-time notebook collaboration: A workspace/notebook feature.
• Alerts for query failures: A Databricks SQL or job-monitoring feature.
• Distributing complex operations: Primarily a Spark compute capability.

• On-prem you generalize and capture the VM as a VHD.
• Upload the VHD to Azure with Add-AzVhd.
• Register the VHD as an image in Azure with Add-AzImage (or New-AzImage) so it appears as a selectable image.
• Create new VMs from that image (e.g., with New-AzVM -Image ...).

• Correct answer: D — AWS Migration Hub

• AWS Migration Hub provides a single location to track the progress of application migrations. It offers a centralized dashboard to view migration status across multiple tools and projects.

• AWS Application Discovery Service helps inventory and map on-prem applications and their dependencies, not a single progress tracker.
• AWS Application Migration Service (formerly SMS) performs the actual lift-and-shift migrations, but isn’t the centralized tracker itself.
• AWS Service Catalog manages catalogs of IT services for self-service deployment, not migration progress.

• Correct answer: C: Amazon Comprehend.

• Why: The library wants to classify books based on their text content. This is an NLP (natural language processing) task. Amazon Comprehend is AWS’s managed NLP service that can perform content classification (including creating custom classifiers) and extract meaningful information from text. The other services are not focused on text classification:

• Quick note: In practice, you’d store the books in S3, extract text if needed (e.g., from PDFs with Textract), and then use Comprehend to classify the documents into topics or genres.

• A (training data, hyperparameters, stakeholder feedback) focuses on training provenance; these details are important but are typically part of pre-deployment/training records, not the primary post-deployment documentation.
• B (encountered issues, monitoring process, risks) relates to governance and monitoring rather than the core documentation you’d publish about the deployed model itself.
• C (licensing information, the team, business goals) covers governance context but not the technical traceability and performance-based record needed for ongoing maintenance.

• Assign users or their team an appropriate security role.
• Ensure the role has the required table privileges, such as read, create, write, and append.
• Share the app with that security role in the app designer.

• Dynamics administration center: Used for environment and service administration, not routine app access configuration.
• Manage Roles: Not the specific Dataverse area used to define app and data permissions.
• Security Roles: Define what users can access and which operations they can perform.

Simple explanation

• The Azure VPN gateway to connect to
• Authentication settings
• Routes for networks that the client can access

• A separate scope using a /32 subnet: A /32 identifies one host, but it is not a practical DHCP scope for this purpose.
• A static IP within the DHCP range: This can cause an IP address conflict if DHCP assigns that address to another device.
• SLAAC: Used for automatic IPv6 address configuration, not for assigning a predictable IPv4 address through DHCP.

• Workspace: Stores notebooks, libraries, jobs, and other project resources.
• Notebooks: Interactive documents containing code, queries, visualizations, and explanations. Common languages include Python, SQL, Scala, and R.
• Clusters: Groups of virtual machines that run Spark workloads. Clusters can be started, stopped, and automatically scaled.
• Data access: Databricks can read from services such as Azure Data Lake Storage, Azure Blob Storage, and Azure SQL.
• Jobs: Automate notebooks or data-processing workflows on a schedule or in response to events.

• Import mode loads the data into the Power BI model. Visuals query the in-memory model, which generally provides faster calculation and rendering than DirectQuery.
• Import mode also minimizes online processing because report interactions do not send queries back to the dataflow or SQL Server.
• A daily refresh can load data through the previous day, satisfying the freshness requirement without unnecessary hourly processing.

• DirectQuery keeps querying the data source or dataflow during report use, increasing online processing and potentially slowing visuals.
• Adding a gateway enables connectivity for on-premises sources, but it does not remove the performance disadvantages of DirectQuery.
• An hourly Power Automate refresh is unnecessary when the requirement is only data through the previous day and creates additional processing overhead.

• View/inspect configuration: Possible.
• Modify the installed application or its S-Controls: Typically restricted in a test-drive org.

• Domeny tworza restrykcjony razem z typem. Wykorzystujesz je w kolumnach, aby miec spójna walidacje danych w wielu miejscach.
• To nie jest pelny niestandardowy typ z wlasnym input/output funkcjonowaniem. Aby stworzyc typ z wlasnym I/O i operacjami, uzylbys CREATE TYPE (lub rozszerzen w C). Domeny to uproszczona forma ograniczen na istniejacy typ.

• CREATE DOMAIN positive_int AS integer NOT NULL CHECK (VALUE > 0);
• CREATE TABLE orders (id serial, qty positive_int);

• latwo wymuszaja wspólne reguly dla wielu kolumn/naglówków,
• zmiana regul w jednym miejscu (domena) automatycznie wplywa na wszystkie kolumny ja uzywajace.

• Correct answer: A. System characterization

• Why the other options are not correct:

• Answer: C (192.168.0.1-192.168.0.99, 192.168.0.101-192.168.0.254)

• Why: The interface is 192.168.0.100/24, so DHCP pools must be within the 192.168.0.0/24 subnet and cannot include the router’s IP (192.168.0.100), the network address (192.168.0.0), or the broadcast (192.168.0.255). Option C provides two ranges that exclude those addresses.

• Why the other options are invalid:

• VMs without NGT: Not clearly a migration blocker on its own; NGT (Nutanix Guest Tools) status isn’t the typical gating factor for live migration during maintenance.
• VMs marked as an Agent: Not a standard, widely-known migration blocker; agents aren’t the typical reason a VM can’t be migrated.
• Memory Overcommitted VMs: While memory pressure can affect placement, memory overcommitment isn’t a fundamental reason a VM would be labeled non-migratable during maintenance.
• VMs with attached Volume Groups: This is the strongest candidate. A Volume Group is a set of volumes bound to a VM; moving the VM would entail relocating and reattaching those volumes, which can complicate or block live migration during maintenance.

• Correct answer: A: The ITIL service value system (SVS).

• The SVS explains how all components (governance, the service value chain, practices, guiding principles, information and technology, partners and resources, and continual improvement) work together to enable value creation from demand to outcomes.

• B: The ITIL guiding principles describe aspirational guidance for decision-making, not how all components/activities interact.
• C: The four dimensions of service management explain areas to consider (organizations/people, information/technology, partners/suppliers, value streams/processes) but don’t describe the integrated system itself.
• D: A service relationship defines the relationship between provider and consumer, not the overall system of components and activities creating value.

• MFA verifies a user’s identity using additional authentication factors, such as a phone prompt or security token.
• It helps prevent unauthorized access even if a password is compromised.
• It does not provide secure storage or encryption of credentials used during automated deployment.

• 6-phone boxes: 6x
• 8-phone boxes: 8x

• CAPWAP (Control And Provisioning of Wireless Access Points) creates a tunnel between the AP and the Wireless LAN Controller over the IP network. The AP and WLC communicate via this CAPWAP tunnel, which can traverse Layer 2 or Layer 3 networks.
• The AP does not have to be on the same switch as the WLC. It can connect to any switch in the network, as long as there is IP reachability between the AP and the WLC. This is why option D is correct.
• The other options are incorrect:

• IPv6 address types:

• The block FF00::/12 is a subset of the multicast space, so it represents multicast addresses.
• Therefore, this block forwards packets to a multicast address (to multiple receivers) rather than to a single unicast address.
• The other prefixes are unicast and would deliver to a single interface.

• A) configure matching hold and delay timers

• B) configure matching key-strings

• C) configure matching priority values

• D) configure unique virtual IP addresses