CFA CFA I Exam Prep
CFA Level I Chartered Financial Analyst (Page 305 )

• Orders contains order-level information, such as the order date.
• Order Line Items contains the products, quantities, and line amounts associated with each order.
• Merging them on the order key, such as OrderID, places the order date alongside each line item. This allows you to calculate total order value and analyze it over time.
• Product attributes can remain in the Products table and be related to the resulting line-item table through ProductID.

• Merging line items with products addresses product attributes but does not first provide the order-level date and value needed for time analysis.
• DAX calculated columns or lists add unnecessary model complexity.
• Calculating order counts is not the first requirement and does not combine the required order and line-item data.

• \Pipeline1
• \Folder1\Lakehouse1

• Pipeline1 remains at the workspace root in Workspace1, so it is deployed to the root of Workspace2.
• Lakehouse1 was moved into Folder1, so its full path is preserved as \Folder1\Lakehouse1.
• Fabric deployment pipelines preserve folder paths because an item’s full path is treated as part of its name.

1. Wireless AP

1. Router

1. Firewall

1. Device placement

• File is shared externally ? Access level

• File is labeled “Internal only” ? Sensitivity label

1. Write a structured log entry to CloudWatch Logs containing:

1. Create a CloudWatch Logs metric filter that:

text 
ApiRequests 
Operation=GetOrders 
ResponseCode=500 
Version=2.4.0

• B is incorrect: CloudWatch Logs Insights queries analyze logs but do not directly publish metrics in this manner.
• C is incorrect: ALB access logs do not contain arbitrary Lambda response metadata as custom fields.
• D is incorrect: X-Ray traces and insights are not the appropriate mechanism for creating these custom, dimensioned application metrics.

• Accept: Acknowledge the risk and take no additional action.
• Transfer: Shift the risk or its financial impact to another party, such as through insurance or outsourcing.
• Mitigate: Reduce the likelihood or impact of the risk, such as by implementing security controls.
• Avoid: Eliminate the activity or exposure that creates the risk.

• A: Build a custom API — possible, but unnecessary as the primary solution and potentially more costly to develop and maintain.
• B: Use pre-built chatbots — these generally answer questions but may not support the required custom workflow and real-time actions.
• C: Fine-tune with sample data — improves model behavior but does not provide live database access.
• D: Google Cloud databases + Vertex AI — stores current inventory data and lets an AI agent retrieve it and take actions based on up-to-date information.

• Incident and problem management
• Change management
• Service-level management
• Configuration management
• Continual improvement

• Kanban: A workflow and task-visualization method; useful within service teams but not a complete service-management framework.
• Lean Six Sigma: Focuses on reducing waste and process variation; broader process-improvement methodology.
• ITSM: The overall discipline of managing IT services, not a specific framework or process model.

• Disable default accounts: Default or unused accounts may have known usernames or predictable settings, making them targets. They should be disabled, removed, or securely configured.
• Remove unnecessary services: Every running service creates potential vulnerabilities. Removing services the server does not need reduces exploitable entry points.

• Add the server to the asset inventory: Important for asset management, but not a hardening step.
• Document default passwords: Default passwords should be changed or eliminated—not documented for continued use.
• Send server logs to the SIEM: Valuable for monitoring and detection, but generally performed as part of logging/monitoring configuration.
• Join the server to the corporate domain: May be necessary operationally, but does not itself harden the server.

• A — Capacity: The system must handle all current records and anticipated future records. A system that cannot cope with volume will quickly become ineffective.
• C — Accuracy: Academic records are critical, so the new system must be at least as accurate as the existing system and comparable systems. Poor accuracy could cause serious administrative and reputational problems.
• D — Integration: Linking with the university’s financial systems supports consistency and avoids duplicate data entry, especially for registration, deregistration and fee-related transactions.

• B — Parallel running: This is a useful implementation and risk-control technique, but it is not an essential feature of the system itself. It may also be expensive and time-consuming.
• E — Internet access for all information: This creates significant confidentiality and security risks. External access might be needed for selected services, but unrestricted access to all information is not essential and would be inappropriate for student records.

• Customer needs: Primary focus in agile; guides prioritization and decision-making.
• Organization’s needs: Important constraints, but processes should be tailored when they create waste.
• Agile lead/project manager: Their role is to facilitate value delivery, not prioritize their own preferences.

Box 1: No

• configure_azure_monitor() configures Azure Monitor and the OpenTelemetry pipeline.
• LangChain requires its own instrumentation or callback tracer, such as AzureAIOpenTelemetryTracer.
• You must pass the tracer to the LangChain execution configuration so chains, tools, prompts, and model calls become spans in Application Insights.

Box 2: Yes

text 
OTEL_SERVICE_NAME=customer-agent 
OTEL_SERVICE_NAME=invoice-agent

Correct reasoning

• Create storage5 as a General-purpose v2 (StorageV2) account.
• Configure Blob object replication from storage5 to an existing compatible storage account.
• The destination must support object replication—typically another StorageV2 or premium block blob account.
• Blob versioning must be enabled on both accounts.
• Blob change feed must be enabled on the source account.
• The accounts must meet Azure’s object-replication requirements, including being in supported regions and having compatible configuration.

• Form layout
• Related lists
• Dictionary settings
• UI policies
• Client scripts
• Views and field visibility

• Personalization usually affects only the individual user.
• System configuration can affect other users, depending on its scope and conditions.

• To identify the number of errors: select Column quality. It shows the percentage and count of Valid, Error, and Empty values for each column.
• To resolve errors: use the appropriate error transformation:

• Remote and global work: Access is based on the approved device, not a specific office or geographic location.
• Seamless login: Users may not need to repeatedly enter credentials on a recognized device.
• Limited equipment: It uses devices employees already have rather than requiring separate hardware.

• Geotagging: Restricts access based on location and may prevent legitimate remote work.
• Smart cards: Require issuing and managing additional physical equipment.
• Time-based logins: Limit access by time and do not provide a seamless authentication experience.

• Sets a high initial price for a new product.
• Targets customers willing to pay more, often called early adopters.
• Gradually reduces the price to attract more price-sensitive customers as the product becomes less novel and competition increases.

• Penetration pricing: starts with a low price to gain market share quickly.
• Premium pricing: maintains a high price to communicate superior quality or status; it does not necessarily involve later price reductions.
• Loss leader pricing: sells one product at a very low price, sometimes below cost, to attract customers who may buy other products.

• Deterrent control: The signs warning that people may be filmed can discourage unauthorized activity. They do not physically prevent the activity, but they may influence behavior.
• Detective control: CCTV detects or records activity so security personnel can identify incidents and investigate them later.

• Preventive: Stops an incident from occurring, such as a locked door.
• Corrective: Restores systems after an incident, such as backups.
• Directive: Instructs people what to do, such as security policies or warning instructions.
• Compensating: Provides an alternative control when the preferred control cannot be used.

• Lead investigator: Coordinates the investigation and directs the response.
• Information security representative: Provides security expertise and helps assess the incident.
• Technical representative: Preserves system evidence, takes forensic backups, and supports technical analysis.
• Legal representative: Advises on legal, regulatory, privacy, and evidence-handling requirements.

• B: Extending credit to customers increases receivables, so more cash is tied up in working capital.
• C: Replacing obsolete inventory does not reduce the overall inventory investment; it simply changes its composition.
• D: Paying suppliers earlier reduces payables. This uses cash and therefore increases the funds tied up in working capital.

DAX 
Sales % of Total = 
DIVIDE( 
    [Total Sales], 
    CALCULATE( 
        [Total Sales], 
        ALLSELECTED(Products) 
    ) 
)

DAX 
Total Sales = 
SUM(Sales[SalesAmount])

Why ALLSELECTED is required

• The numerator, [Total Sales], is evaluated for the current product.
• ALLSELECTED(Products) removes the current product’s visual filter when calculating the denominator.
• It preserves filters applied at the report, page, or slicer level.

Why not ALL(Products)?

DAX 
CALCULATE([Total Sales], ALL(Products))

• Accept: Acknowledging the risk without taking additional action.
• Transfer: Moving the risk’s financial impact to a third party, such as an insurer.
• Mitigate: Reducing the likelihood or impact through controls, such as patching or employee training.
• Avoid: Eliminating the activity that creates the risk.

• Technical platform interfaces: Important for integration and interoperability, but they should support—not drive—the architecture.
• Scalability of the network: Valuable as the organization grows, but a scalable solution is ineffective if it does not meet business or security needs.
• Development methodologies: Relevant to implementation, but they do not define the organization’s fundamental security requirements.

• If the attachment is safe, it is released to the user.
• If malware is detected, the attachment is blocked or removed according to the policy.
• This reduces delivery delays without disabling malware scanning.

• Replace removes the original attachment and replaces it with a text file explaining that it was blocked. It does not primarily optimize delivery time.
• Block and Enable redirect blocks messages with suspicious attachments and can redirect them for review; it does not provide the required faster delivery experience.
• Monitor and Enable redirect is for observation and does not reliably block malicious attachments.

• Suporta domínios personalizados.
• Oferece 50 GB de armazenamento — suficiente para os 10 GB de cada aplicação.
• Usa instâncias de computação dedicadas.
• Inclui balanceamento de carga entre instâncias.
• É o plano mais econômico entre as opções que atendem a todos esses requisitos.

• The selling division receives a credit based on a favourable transfer price, often market price or full cost plus a profit margin.
• The receiving division is charged a lower amount, such as marginal cost or another agreed price.
• The difference is accounted for centrally by head office or a corporate adjustment.

• Products ? OrderHistory: Products is 1, OrderHistory is many (1:*)

• Date ? OrderHistory: Date is 1, OrderHistory is many (1:*)

• Formatting: May remove file-system references but often leaves recoverable data.
• Degaussing: Uses a magnetic field to erase data, but can damage or make magnetic drives unusable.
• Defragmentation: Rearranges data for performance; it does not securely erase information.

• Sustainability
• Performance efficiency
• Reliability

• Penetration test: Tests for exploitable vulnerabilities; it does not provide a broad opinion on whether security controls operate effectively.
• Annual self-assessment: Not independent, so it provides less assurance.
• Allow each client the right to audit: Inefficient because every customer may conduct a separate audit, creating duplicated effort and disruption.

• Information sources: Collect security-related data, such as network packets, system logs, audit records, or application events.
• Analysis: Examines the collected data to identify suspicious activity, attacks, or policy violations.
• Response: Takes or recommends action, such as generating alerts, logging the event, or supporting a protective response.

• up ? down ? up
• Often happens rapidly or intermittently

• Faulty or loose cable or connector
• Failing transceiver, NIC, or switch port
• Speed/duplex or auto-negotiation problems
• Power or hardware instability
• Layer 1 interference

• Nothing plugged in: the port is simply down
• Latency: does not directly trigger err-disable
• shutdown: administratively disables the port, but that is not the same as an automatically detected err-disabled condition

• Shared capacity

• Fabric capacity — F SKUs

• Fabric trial capacity

• Existing Power BI Premium — P SKUs

• Create a CodeCommit repository in the secondary Region.
• Use CodeBuild to run a Git mirror operation from the primary repository to the secondary repository.
• Use EventBridge to detect relevant repository events, such as a pull request being merged.
• Invoke a Lambda function, which starts the CodeBuild project.

• B: Amazon S3 is object storage, not a Git repository that developers can use as a CodeCommit remote.
• C: CodeArtifact is intended for packages and artifacts, not source-code repository mirroring.
• D: An AWS Cloud9 environment is not an appropriate automated replication mechanism and would require manual or persistent infrastructure management.

• Act as the default gateway for devices in that VLAN
• Route traffic between different VLANs
• Provide management access to the switch

text 
interface vlan 10 
 ip address 192.168.10.1 255.255.255.0

• The users currently have Office 365 Enterprise E3 licenses assigned directly.
• Assigning Microsoft 365 Enterprise E5 through a group does not automatically remove their directly assigned E3 licenses.
• From the Licenses blade, you can select the E3 product and remove it from all assigned users in one operation. This requires less effort than editing 2,500 users individually.

• Identity Governance manages access reviews, entitlement management, and related governance—not bulk license removal.
• Set-AzureAdUser does not remove product licenses.
• Set-WindowsProductKey applies Windows product keys and is unrelated to Microsoft 365 licensing.

1. The specific table — for example, incident
2. The parent table — for example, task
3. The wildcard table — *, which applies broadly

• D — Managers focus on keeping costs low in the short term to maximise profits.

• E — Managers are given incentives to meet or undercut budgets.

• F — Managers delegate responsibility simply to reduce their workload.

• One network address
• Two usable host addresses—one for each router
• One broadcast address

• Router A: 10.2.1.1
• Router B: 10.2.1.2

• Existing Eventhouse data: remains available only in the KQL database.
• Data ingested after enabling the feature: is copied to OneLake and can be accessed through OneLake file explorer.
• New databases: are irrelevant; the setting applies to the selected KQL database.

• 10 minutes have elapsed, or
• 20 MB of accounting data has accumulated

• JobTitle: User1 and User3 only
• UsageLocation: User1, User2, and User3

• For a user whose source of authority is Windows Server Active Directory, attributes such as JobTitle are synchronized to Microsoft Entra ID. You must change them in on-premises AD; editing them in Entra ID is not allowed or will be overwritten.
• UsageLocation is a cloud-managed attribute used mainly for licensing and service availability. It can be set or changed in Microsoft Entra ID, including for synchronized users.

• SQL injection: Manipulates database queries through application input.
• XML external entities (XXE): Abuses XML parsers to access files, internal systems, or other resources.
• Cross-Site Request Forgery (CSRF): Tricks an already authenticated user’s browser into sending an unwanted request. It generally does not steal session cookies.

• Data source: Folder
• Transformation: Remove the Content column (or keep only the file-metadata columns)

Why

• File name
• Extension
• Date modified
• Folder path
• Content — the binary contents of the file

• A — Technical review by business owner: A business owner may approve the business impact, but a technical review is normally performed by technical personnel.
• C — Cost-benefit analysis after implementation: Cost-benefit analysis should occur before implementation to support the approval decision.
• D — Business continuity testing: This can be appropriate for major changes, but it is primarily part of business continuity and disaster recovery planning—not a universal change-management activity.

• Amazon SageMaker — charges apply for compute, storage, and other resources used.
• AWS Config — generally charges for configuration recording and rule evaluations.
• Amazon CloudWatch — has a limited free tier, but many metrics, logs, alarms, and API usage can incur charges.

• A local network gateway represents an on-premises network—its address space and VPN device information—for an Azure Site-to-Site VPN connection.
• It does not control which connection types are allowed between Azure web servers and database servers.
• It is also unnecessary when both server groups are in the same Azure virtual network.

• Internal audit: Reviews the organization’s own controls and processes.
• Penetration testing: Actively tests systems for exploitable vulnerabilities.
• Attestation: A SOC 2 report is an attestation product issued by an independent auditor, but the analyst is not performing the attestation. They are reviewing it as part of vendor evaluation.

• A: Knowledge of IT platforms, networks, and methodologies — Useful technical knowledge, but the CISO does not need to be the deepest technical expert.
• C: Regulatory and project management knowledge — Important, but compliance and projects must still support the organization’s broader needs.
• D: Managing people and resources — Essential for execution, but effective management of the wrong security priorities will not produce good results.