Banking CRCM Exam Actual Questions
CERTIFIED REGULATORY COMPLIANCE MANAGER (CRCM) (Page 40 )

Simple explanation

• The Azure VPN gateway to connect to
• Authentication settings
• Routes for networks that the client can access

• The correct answer is Mass Transfer Tool.

• The Mass Transfer Records tool is Salesforce’s built-in way to reassign ownership of existing records in bulk. In this scenario, you need to transfer ownership of the departed rep’s accounts and opportunities to a new rep while keeping the team structure intact.

• Go to Setup > Data Management > Mass Transfer Records.
• Choose the object: Accounts (and then Opportunities, if needed).
• Set “Transfer From” (the leaving rep) and “Transfer To” (the new rep).
• Decide whether to transfer related records as well (e.g., opportunities tied to accounts) and proceed.
• Review and confirm.

• Data Loader / Data Import Wizard are for bulk import/export, not bulk reassigning ownership.
• Dataloader.io is a third-party tool; the built-in Mass Transfer tool is the standard Salesforce method for this task.

• wyjasnic istniejace pytania z tej strony,
• wskazac, dlaczego dana odpowiedz jest poprawna lub bledna (z uwzglednieniem celów egzaminu),
• omówic koncepcje zwiazane z Google Cloud AI.

• Actual filename: Document.xml.txt
• Explorer displays: Document.xml
• File type: Text Document (.txt)

text 
Document.txt ? Document.xml

• ProductSearchModel.getProductSearchHits() — option C
• ProductSearchHit.getRepresentedProducts() — option B

• ProductMgr.queryAllSiteProducts() (A) queries every product in the site, which is heavy and not scalable for large catalogs.
• Category.getProducts() (D) retrieves all products in a category; this can be slow for large categories.
• Using the search model and hits (B and C) leverages the search index, supports paging, and avoids scanning the entire catalog, making it more scalable.

• Correct answer: only new data added to the eventhouse (option E).
• Why: When you enable OneLake availability for the eventhouse, OneLake starts syncing data going forward. It does not automatically backfill or copy over data that already exists in the eventhouse before the enablement.
• What that means in practice: Any data added to the eventhouse after you enable OneLake will appear in OneLake (and be visible from OneLake file explorer). Pre-existing data in the eventhouse stays there unless you perform a separate backfill/copy operation outside the standard OneLake enablement.
• How to verify: add a small new dataset to the eventhouse after enabling OneLake availability, then check OneLake to confirm the new dataset appears.

• Workspace: Stores notebooks, libraries, jobs, and other project resources.
• Notebooks: Interactive documents containing code, queries, visualizations, and explanations. Common languages include Python, SQL, Scala, and R.
• Clusters: Groups of virtual machines that run Spark workloads. Clusters can be started, stopped, and automatically scaled.
• Data access: Databricks can read from services such as Azure Data Lake Storage, Azure Blob Storage, and Azure SQL.
• Jobs: Automate notebooks or data-processing workflows on a schedule or in response to events.

• In Azure, the typical cost approach for pay-as-you-go VMs is an Operational Expenditure (OPEX) model. You’re billed for actual usage each month.
• The term “elastic expenditure model” isn’t a standard Azure cost category. Elasticity describes scaling capacity, not the billing category itself.
• So recommending the elastic expenditure model is not correct for this goal.

• The solution does not meet the goal. Answer: No (B).

• Pay-as-you-go aligns with OPEX because costs vary with usage.
• Elasticity is about scaling resources, which affects performance and capacity, not the fundamental cost model.

• What the goal is: You want to add guest (external) users to your Azure AD tenant contoso.com, one entry per external user in a CSV.

• The proposed solution uses New-AzureADUser for each external user. Why this isn’t correct: New-AzureADUser creates a regular (internal) user in your directory. It does not create a guest/B2B user invite. So you’d end up with 500 ordinary accounts, not guest accounts with external access.

• The correct approach: Use New-AzureADMSInvitation for each external user. This invites the external user to your directory and creates a guest user (a B2B collaboration user) in your tenant. The invited user then accepts the invitation and gains access as a guest.

• Azure AD vs directory/tenant: Azure AD is the cloud identity service. A directory (also called a tenant) is your specific instance of that service (contoso.com in your scenario). The terms are often used interchangeably in exams.
• Guest user vs internal user: A guest user is external to your organization; an internal user is created directly in your directory as a normal employee/user account.
• B2B invitation: The process of inviting external users so they can collaborate in your resources; New-AzureADMSInvitation is designed for this.

• Question 142: Security governance is MOST associated with which IT infrastructure component? Network / Application / Platform / Process
• Answer: D. Process

• Security governance is about how decisions are made, accountability, and oversight to ensure security objectives align with business goals. These are implemented through governance processes (policy development, risk management, assurance, monitoring, escalation, etc.).
• The other options (Network, Application, Platform) are concrete IT components; governance affects them, but it’s exercised primarily through the processes that govern how those components are managed and controlled.

• In governance-related questions, focus on the decision-making, accountability, and control processes rather than the underlying technology components.

• Key difference: DirectQuery leaves data in the on-prem SQL Server and queries it live. That means every visual request can trigger online processing on the source, which can be slower and adds load on the on-prem system. In contrast, Import loads data into the Power BI data model, so visuals render from the in-memory engine (faster).

• Why that helps with the requirements:

• Why not A or B: Both rely on live data via DirectQuery, which contradicts the goal to minimize online processing and visuals performance.

• Why not D: It uses Import, but refreshing hourly adds unnecessary processing and complexity when daily refresh already satisfies currency needs.

• A Storage Gateway File Gateway provides an on-premises NFS/SMB file share that's backed by objects in S3. This is exactly what you need to migrate an NFS workload: applications continue using NFS, while the actual data moves to and is stored in S3.
• It can cache frequently accessed data locally for performance, while uploads go to an S3 bucket.
• Why the other options aren’t suitable:

• VPC: A logically isolated virtual network in a cloud environment; it describes networking, not shared application access.
• NFV: Replaces dedicated network appliances with virtualized network functions.
• SaaS: A cloud service model in which users consume an application without managing its infrastructure. It could describe how the application is delivered, but the question emphasizes serving multiple user groups, which points to multitenancy.

• Correct answer: B) Context window.

• Why: The context window is the number of tokens the foundation model can process in a single inference. It sets the maximum length of the combined input (prompt) and the model’s output. A larger context window allows more content to be included in one prompt.

• How to use: Check the FM’s context window value and ensure your prompt length plus the desired completion stays within that limit. If needed, summarize or split input across multiple prompts.

• Why the other options aren’t correct:

• Quick tip: Verify the specific FM’s context window for Bedrock, since different models have different token limits.

• Assignment
• Decision
• Get Records
• Loop

• Screen flow: Would include a Screen element.
• Inactive version: Inactive status does not restrict the available elements.
• Activated version: Activation status also does not determine the toolbox contents.

• TCP is connection-oriented. It establishes a connection before data transfer using a three-way handshake (SYN, SYN-ACK, ACK), enabling reliable delivery, ordering, and flow control.

• UDP is connectionless. It sends datagrams without a prior connection and provides no guarantee of delivery, order, or protection against duplicates; any reliability is up to the application.

• B incorrectly states UDP uses acknowledgment packets; UDP has no built-in ACKs.
• C wrongly claims UDP provides reliable transfer and that TCP is connectionless.
• D misstates framing bits; neither protocol uses the listed TCP/UDP handshake bits in frames.

• Ethical red-teaming is adversarial testing aimed at uncovering weaknesses and potential exploits in an AI system before deployment.
• A (improving accuracy) is not the primary?? of red-teaming.
• B (simulate model risk scenarios) is related but narrower; red-teaming centers on finding vulnerabilities and risk exposure, not just simulating risks.
• D (ensure compliance) is not the main goal of red-teaming.

• Permanent table (E): Correct. A dropped permanent table can be restored with UNDROP TABLE during its Time Travel retention period. Permanent tables also have Fail-safe protection.
• Transient table: It can also generally be restored during its shorter Time Travel period, although it has no Fail-safe. Therefore, excluding it makes the question questionable.
• Temporary table: Usually cannot be recovered after it is dropped; its lifecycle is limited to the session.
• Materialized view (D): The answer key treats it as recoverable, but recovery behavior depends on the specific Snowflake object/version capabilities. It should not be confused with an ordinary view.

• The diagnostic output shows that the protocol is TCP (proto=6) and the session state is 2.
• In FortiGate’s session output, state=2 maps to SYN_SENT. This means the TCP SYN has been sent but the handshake hasn’t completed yet.
• Therefore, the session is not ESTABLISHED, FIN/ACK-related states, or other states; it’s in SYN_SENT.

• Automation handles repetitive tasks, and orchestration coordinates responses across tools (SIEM, SOAR, EDR, etc.).
• This allows the security team to process more events with the same number of people, improving throughput and response times.
• Analysts can focus on more complex tasks like investigation and threat hunting instead of manual triage.

• It increases complexity: automation can reduce complexity when well-implemented; complexity is not the main intended benefit.
• It removes technical debt: automation/OR focuses on current incident response efficiency, not primarily on architectural debt.
• It adds additional guard rails: governance is important but not the core value of automation/orchestration within a SIEM.

• The standard Enterprise Architecture domains are: Business, Data, Application, Technology (BDAT).

• A: Business, strategy, application and technology — includes business and application/tech but uses “strategy” instead of data.
• B: Zachman, TOGAF, Cobit, and Heath architectures — names frameworks, not domains.
• C: Business, data, infrastructure and technology — has business, data, and technology; lacks a distinct application domain (uses “infrastructure” instead).
• D: Process, database, software and technology — covers data (database), application (software), and technology, but omits business.

• The four BDAT domains (business, data, application, technology) is the conventional model you should study.
• None of the options perfectly lists all four BDAT domains. The closest are C (if you map infrastructure to technology) and D (data/application/technology but no business).

• Answer: A) Clear the Windows event logs

• Windows event logs (System, Security, Application) are key forensic artifacts. If an attacker clears these logs, there’s no built-in local record of actions taken, making it harder for investigators to trace what happened.

• Modify the system time: may misalign timestamps but does not erase past events and can be easily detected.
• Alter log permissions: could prevent new log entries, but it doesn’t remove existing ones and can raise alarms due to permission changes.
• Reduce log retention settings: affects only future logs; it doesn’t wipe already recorded activity.

• In real environments, defenders mitigate this risk with tamper-evident, centralized logging (remote SIEM, write-once storage, log integrity checks) to preserve evidence even if a host is compromised.

• A — conformant: Incorrect because one explicit requirement is violated.
• B — consistent: “Consistent” is not sufficient where the implementation contradicts a mandatory specification. The RPC mechanism is covered by the architecture, and the implementation differs from it.
• C — consistent: Incorrect reasoning: the RPC mechanism does have a defined architectural requirement, so conformance must be assessed.
• D — non-conformant: Correct because the implementation fails to follow the specified RPC/threading requirement.

• Active vs passive: Active assessment involves actively scanning targets by sending probes/packets to identify hosts, services, and vulnerabilities. Passive assessment observes traffic without probing.
• External vs internal: External assessment is about testing from outside the network perimeter; the scenario doesn’t specify external vantage, only that tools are identifying hosts/services across the enterprise network.

1. Ingestion Lambda receives requests from API Gateway and places messages in an SQS queue.
2. Processing Lambda is triggered by the queue and loads records into Aurora PostgreSQL.

• Decoupling: API request handling is separated from database loading.
• Buffering: SQS absorbs bursts when incoming traffic exceeds the database’s processing capacity.
• Controlled concurrency: Configure the SQS-triggered Lambda’s concurrency and batch size to avoid overwhelming Aurora or exhausting database connections.
• Automatic retries: Messages that fail processing can return to the queue and be retried. A dead-letter queue can capture persistent failures.
• Lower operational effort: The solution remains serverless and avoids managing EC2 servers or Kubernetes clusters.

• A: EC2 and Tomcat add server-management overhead.
• B: DynamoDB/DAX would require changing the database model and does not solve the Aurora ingestion design.
• C: SNS is useful for notifications and fanout, but SQS is better for durable buffering and backpressure in this producer-consumer workflow.

• IPsec: Protects traffic at the network layer, commonly for VPNs; it is not WPA2’s authentication protocol.
• SSL: Protects specific application sessions and has largely been replaced by TLS.
• SSH: Secures remote command-line administration.

• Cutover: The old system is replaced immediately. It may be fast, but any failure can cause significant disruption.
• Phased: The system is introduced in stages, which reduces implementation risk but may prolong the transition.
• Pilot: The system is first deployed to a limited group or location. This is useful for testing but does not necessarily minimize downtime for the entire organization.

• Why this is correct: In Azure Virtual Desktop, user access to a host pool is controlled through App Groups. The default app group for a host pool publishes the full desktop, so adding members to that app group grants them sign-in and access to the desktop (and any RemoteApps in that group). This is the standard way to give users access to AVD resources.

• Why the other options are not correct:

• Practical steps (high level):

• User1 can sign in because the account is cloud-only. It does not depend on the on-premises domain.
• User3 can sign in because the account uses Password Hash Synchronization (PHS). Azure AD has a synchronized password hash and can validate the sign-in even when connectivity to on-premises Active Directory is unavailable.
• User2 cannot sign in because the account relies on Pass-through Authentication (PTA). PTA sends the authentication request to an on-premises PTA agent, which must contact a domain controller. With the internet connection from on-premises lost, that validation cannot occur.

• Self-signed certificate: Causes a certificate warning, not incorrect IP resolution.
• Nameserver record: A DNS record problem would typically affect multiple users, not just one.
• IP helper: Relays DHCP or other broadcast traffic between networks; it does not control website name resolution.

• Strongest encryption algorithms: Choose the strongest available encryption and integrity options, typically AES with the largest key size and a secure integrity algorithm.
• Encrypt all traffic: Select tunnel mode rather than transport mode. Tunnel mode encrypts the entire original IP packet, which is appropriate for a site-to-site VPN between branch networks.
• Secret-password authentication: Configure a pre-shared key (PSK) on both VPN concentrators. The key must match at both ends.

• Leadership and stakeholder commitment
• Business capability and skills
• Organizational culture
• Availability of resources
• Ability to manage and sustain change
• Impact of the proposed transformation

• How ready the organization is
• Which areas require urgent attention
• How difficult each issue may be to resolve
• Risks that could affect implementation

• A: Places the assessment in Phase B and refers vaguely to creating views; this is not the prescribed technique.
• B: An Implementation Factor Assessment and Deduction Matrix is not the primary TOGAF technique described for business transformation readiness.
• D: A Business Scenario helps identify requirements and stakeholder concerns, but it is not the main technique for assessing organizational readiness.

• Basic: Self-help only; no technical support or design assessment.
• Developer/Standard: Technical support, but generally not the full proactive architecture guidance required here.
• Professional Direct: Includes proactive guidance and architecture recommendations.
• Premier: Also supports this, but is not the minimum-cost option.

• The two correct options are:

• The two incorrect options:

• Two VMs
• Distributed across two separate availability zones

• The answer: Question 51: C — Request trigger.

• To invoke a Logic App from an external service (here, the Azure Application Insights availability test) you need a trigger that starts on an incoming HTTP request. In Logic Apps, this is the trigger that exposes an HTTP endpoint — typically shown as "When a HTTP request is received" and referred to as the Request trigger.
• The other options aren’t appropriate:

• Create a Logic App with the Request trigger to generate a URL.
• Configure Application Insights to post the degraded-availability payload to that URL.
• Add actions (e.g., send email, follow-up) in the Logic App to notify the customer services team.

• Version control provides a single source of truth for metadata changes and tracks every modification.
• It supports branching and merging, so each feature can be developed in isolation and later merged without overwriting others.
• It allows diffs and conflict resolution, making it easier to manage dependencies across features and ensure a stable release.

• Setup Audit Trail: only logs who/change when something happened; it doesn’t prevent overwriting or manage cross-feature dependencies.
• Change Sets: used to deploy changes between orgs, not to coordinate parallel development or prevent conflicts across ongoing sprints.

• A. Number ? Decimal — Correct. Salesforce Number fields are represented in Apex as Decimal.
• D. Date/Time ? Datetime — This is correct conceptually, but “Dateline” is not an Apex type. If the option literally says “Dateline,” it is incorrect.
• E. Checkbox ? Boolean — Correct. A checkbox contains true or false.

• Number ? Integer — A Number field maps to Decimal, even when its scale is zero.
• Text Area ? List<String> — A text area maps to a single String, not a list.

• What it’s asking: In an ARM template, for an Availability Set, what value should you set for the property platformFaultDomainCount to maximize availability during fabric failures or maintenance?

• Key concept: Fault domains are groups of hardware that can fail independently. By spreading VMs across more fault domains, you reduce the risk that a single hardware fault takes out many VMs.

• Important detail: For managed Availability Sets, the number of fault domains you can use varies by region — typically 2 or 3.

• What to choose: Set platformFaultDomainCount to the maximum supported in your region. In most regions this is 3, which gives you the best resilience. If your region only supports 2, you’d use 2.

• Answer: 3 (Max Value). In ARM template syntax, this would appear as "platformFaultDomainCount": 3 (within the Availability Set resource).

• Amazon S3 — Object storage, not a database.
• Amazon DynamoDB — Fully managed NoSQL key-value and document database.
• Amazon Redshift — Managed data warehouse designed for analytics, not primarily transactional MySQL workloads.

• Control plane: Managed by Databricks and contains the Databricks web application, workspace services, cluster management, and job orchestration.
• Data plane: Runs in your cloud account and contains compute resources such as:

• Worker node: Data plane compute.
• Driver node: Data plane compute.
• JDBC data source: Usually an external data system.
• Databricks Filesystem (DBFS): Provides storage access and is backed by cloud object storage rather than being entirely part of the control plane.

• Storage accounts: storage1, storage2, and storage3
• Log Analytics workspace: Analytics3

• Azure Backup reports can send the AzureBackupReports diagnostic log to eligible storage accounts. The storage account’s subscription and region do not have to match the Recovery Services vault, so all three listed storage accounts are valid.
• The Log Analytics workspace must be in the same region as the Recovery Services vault for this configuration. Vault1 and Analytics3 are both in West Europe, making Analytics3 the valid workspace.

• IPv6 address types:

• The block FF00::/12 is a subset of the multicast space, so it represents multicast addresses.
• Therefore, this block forwards packets to a multicast address (to multiple receivers) rather than to a single unicast address.
• The other prefixes are unicast and would deliver to a single interface.

• Amazon DynamoDB — Managed NoSQL database, not PostgreSQL.
• Amazon Athena — Serverless service for querying data in S3; intended for analytics, not OLTP.
• Amazon EMR — Managed cluster platform for big-data frameworks such as Hadoop and Spark.

• Options:

• Answer: The correct choice is A (800-61r3).

• NIST SP 800-61 Rev. 3 is the dedicated guide for incident handling/response and reflects the latest guidance on the incident response lifecycle (preparation, detection/analysis, containment, eradication, recovery, post-incident activity).
• 800-61r2 is an older revision of the same incident response guide.
• 800-53 covers security and privacy controls, not a specific incident response standard.
• 800-171 focuses on protecting CUI in non-federal systems and networks, not incident response guidance.

• Business
• People
• Governance
• Platform
• Security
• Operations

• Cloud financial management
• Portfolio and program management
• Risk management
• Data governance
• Compliance and oversight

• A. IDS attack signatures: An IDS primarily detects suspicious network activity and usually alerts rather than directly scanning and blocking uploaded files.
• C. Load balancer: Distributes traffic among servers but does not inspect files for malware.
• D. WAF: Protects web applications from attacks such as SQL injection, cross-site scripting, and some malicious requests. It is not primarily a PDF-malware scanning solution.

• Startup scripts run at computer startup, before any user logs on, making them ideal for machine-wide configuration on each new VM.
• They execute under the Local System account, which is appropriate for initial setup tasks.
• Linking a GPO to the OU ensures every new VM in that domain automatically receives the configuration—great for scalability.

• A) SetupComplete.cmd runs only once, right after Windows Setup, not on every boot, so it isn’t ideal for provisioning multiple VMs consistently.
• B) Logon scripts run per user, not per machine, so they aren’t reliable for initial VM configuration before a user signs in.
• D) Placing scripts in a VHD doesn’t automatically execute them.

• Why: After listing all resources, you need to assign who is responsible for each task. A RACI chart (Responsible, Accountable, Consulted, Informed) documents these roles for every activity.

• What RACI means:

• Why the others aren’t suitable here:

• Quick example: Task "Create user authentication module" — Responsible: Developer, Accountable: Tech Lead, Consulted: Security Architect, Informed: PM.