CFA CFA I Exam Prep
CFA Level I Chartered Financial Analyst (Page 39 )

• Azure Cosmos DB is a globally distributed NoSQL database service. It stores and retrieves application data, but it does not provide the tools needed to build, test, and deploy predictive analytics models.
• Azure Machine Learning—including the historical Azure Machine Learning Studio—is designed for the machine-learning lifecycle:

• SAMLRequest: the SAML authentication request
• RelayState: the original destination or application state

• RedirectURL: not the standard SAML parameter for preserving the original request.
• DisplayState: not a standard SAML SSO parameter.
• StartURL: Salesforce-related terminology, but not the standard parameter used in this SAML exchange.

• B: Moving the task may affect the critical path and should not be done before evaluating the planned response and impacts.
• C: Excluding a required task is not appropriate without formal analysis and stakeholder approval.
• D: Lessons learned and the risk log should be updated, but only after or alongside managing the immediate issue; updating them is not the first action.

• A — Can help keep costs down and improve quality: The provider may have specialist expertise, efficient systems and economies of scale.
• B — There is a known fee if agreed in advance: A fixed or agreed fee can make costs more predictable and support budgeting.
• C — Allows management to focus on core operations and issues: Senior managers spend less time supervising routine finance processes and more time on strategic matters.

• Increased control: Control may decrease because the activity is performed externally.
• Increased independence: The organisation becomes dependent on the supplier.
• Increased understanding of the outsourcing business: The internal organisation usually has greater business knowledge; the provider may initially lack it.
• Increased confidentiality: Sharing financial information externally may create confidentiality risks.
• Internal expertise improved: Outsourcing can reduce opportunities to develop internal finance skills.

• Guiding principles
• Governance
• Service value chain
• Practices
• Continual improvement

• Guiding principles: Recommendations that guide decisions and actions; they do not describe the entire system.
• Four dimensions: Perspectives used to ensure a balanced approach to service management.
• Service relationship: Describes cooperation between a service provider and service consumer, rather than the whole value-creation system.

• Vertical scaling (scale up) means increasing the size of an existing VM—for example, adding CPU or RAM.
• Vertical scaling down means reducing the VM’s size when less capacity is needed.
• Horizontal scaling (scale out) means adding more VM instances rather than making one VM larger.
• Elasticity is the broader ability to automatically adjust resources based on demand; it does not specifically mean adding CPU or memory to one VM.
• Agility refers to the ability to provision or change resources quickly.

• Remote and global access: Employees can authenticate from anywhere, not just a specific location.
• Seamless login: The device can authenticate in the background, reducing repeated password or MFA prompts.
• Minimal equipment: It uses devices employees already have, rather than requiring separate hardware.

• Geotagging: Identifies location but is not a complete authentication method and can be spoofed.
• Smart cards: Can provide strong authentication, but require cards and often readers, adding equipment and user steps.
• Time-based logins: Restrict access by time but do not verify the user or device adequately.

• Accept: Acknowledge the risk and choose not to take additional action.
• Transfer: Shift the risk or its financial impact to another party, such as through insurance or outsourcing.
• Mitigate: Reduce the likelihood or impact of the risk, such as by implementing security controls.
• Avoid: Eliminate the activity or condition that creates the risk.

• Exploitability
• Attack complexity
• Required privileges
• User interaction
• Impact on confidentiality, integrity, and availability

• CVE: Identifies and tracks a specific vulnerability; it does not primarily measure severity.
• OSINT: Open-source intelligence gathered from publicly available sources.
• SOAR: Security orchestration, automation, and response technology used to automate security workflows.

json 
{ 
  "Effect": "Deny", 
  "NotAction": [ 
    "iam:*", 
    "route53:*", 
    "cloudfront:*", 
    "support:*" 
  ], 
  "Resource": "*", 
  "Condition": { 
    "StringNotEquals": { 
      "aws:RequestedRegion": "eu-west-1" 
    } 
  } 
}

• SCPs set maximum permissions; they do not grant permissions. The default SCP allows actions, so the restriction must be an explicit Deny.
• aws:RequestedRegion checks the Region targeted by an API request.
• StringNotEquals: eu-west-1 denies requests directed to every other Region.
• NotAction allows designated global services to remain usable because they do not operate in a single AWS Region.
• Attaching the SCP to the OU makes it apply to existing accounts and accounts later added to that OU.

• 800 devices ? a scalable, centralized solution is needed.
• Four hardware/vendor classes ? the tool must handle different drivers and images.
• Two user groups ? it should allow different configurations for each group.
• “Distribute custom images” ? an imaging/deployment tool is required, not just a file-copy utility.

• Disabling GPS: Affects location services, not email connectivity.
• Configuring 4G usage only: Does not enable international data access and could prevent connectivity if 4G is unavailable.
• Connecting using a hotspot: Could provide data, but it is not the most direct solution and depends on another network or device.

text 
heartrateheartrateheartrate

• Spark column objects can be multiplied, for example:

python 
  df["heartrate"] * 3

• A DataFrame itself cannot be multiplied, but the expression is referring to a column.
• It is also not primarily a Python syntax error; the code was parsed, then Spark failed while resolving the column name.

• Create a record-triggered Flow on Opportunity.
• Run it when the record is created or updated.
• Add entry criteria such as Probability > 50%.
• Use Create Records to create the related Sales Demo Request, populating its Opportunity lookup.

• Apex Trigger: Possible, but unnecessary custom code for a straightforward automation requirement.
• Workflow Rule: Cannot create a related custom record.
• Process Builder: Could create a record, but Flow is Salesforce’s preferred and more capable declarative automation tool.

• B. Users accessing Salesforce from public Wi-Fi

• C. Users choosing the same password as their Facebook password

• A: 2FA does not protect an already-authenticated, unlocked session if someone accesses an unattended laptop.
• D: Weak password-reset questions are an account-recovery weakness. 2FA primarily strengthens login authentication, not necessarily the security-question reset process.

• The servers are powered on.
• The network is functioning.
• Devices can still reach the server network.

• ARP poisoning: Redirects or intercepts local network traffic; it usually affects communication paths rather than overwhelming a service.
• Jamming: Disrupts wireless or radio signals. It would not fit a system that remains accessible from devices on the server network.
• Kerberoasting: Attempts to crack service-account credentials from Kerberos tickets; it does not normally cause an immediate outage.

• Uses on-premises data or resources
• Runs components in the cloud
• Can scale across multiple cloud environments when demand increases

• Public cloud: Resources are hosted entirely by a cloud provider.
• Private cloud: Resources are dedicated to one organization, usually in its own environment.
• Hybrid: Combines on-premises and cloud resources.

• Subject: The entity that initiates an action—here, Derrick/user account.
• Object: The resource being accessed— the file.
• Action: Reading the file.

• Voice devices ? VLAN 10
• Data devices ? VLAN 20
• SVI for VLAN 10 ? 192.168.10.1
• SVI for VLAN 20 ? 192.168.20.1

• A: Describes a physical trunk interface, not an SVI.
• B: An SVI can provide management access, but that is not its primary definition here.
• D: SVI does not compensate for insufficient physical ports; it is a logical interface.

• The files are stored in a document library, which is exposed through the SharePoint Folder connector.
• The connector returns file metadata, including Folder Path, Name, and Content.
• In Power Query, filter Folder Path so only files in the manufacturing reports folder are retained.
• You can then combine the remaining Excel files because they all have the same structure.

• SharePoint List is for SharePoint lists, not document-library files.
• Combine & Load combines files immediately, before you filter to the required folder, and may include unwanted files.
• Transform gives you the opportunity to filter the file list first, which is more efficient and targeted.

• A: Using an external OAuth 2.0 identity provider could provide unified identity, but it does not specifically address Salesforce capacity or high-volume login limits.
• B: Making the Experience Cloud community a SAML identity provider and using JIT provisioning is a possible federation pattern, but it may not be appropriate for this scale without Salesforce validation.
• C: A default account is unrelated to solving identity unification and high login throughput. Person Accounts can be supported in appropriate B2C Commerce integrations.

• Multiple AWS accounts: Create a separate account for each department or workload. This provides clear isolation and makes it easier to track each department’s usage and costs for chargeback.
• Consolidated billing: AWS Organizations can combine billing for multiple accounts into one central payer account. The company can still view costs by account while managing payment centrally.

• Placement groups: Control how EC2 instances are physically placed for networking or performance; they do not provide departmental billing separation.
• Edge locations: Infrastructure used by services such as Amazon CloudFront; unrelated to chargeback.
• AWS Config: Records and evaluates resource configurations and compliance; it is not a billing-separation mechanism.

• A. IDS attack signatures: An IDS primarily detects suspicious network activity and usually alerts rather than directly scanning and blocking uploaded files.
• C. Load balancer: Distributes traffic among servers but does not inspect files for malware.
• D. WAF: Protects web applications from attacks such as SQL injection, cross-site scripting, and some malicious requests. It is not primarily a PDF-malware scanning solution.

• Planning – identifying the need, objectives, scope and resources.
• Analysis – understanding business requirements and current problems.
• Design/development – determining how the system will work.
• Implementation – installing the system and putting it into operation.

• A. A virtual network gateway
• D. A virtual network

• Azure virtual machines must be connected to an Azure virtual network (VNet). The VNet provides private IP addressing and network connectivity for the VMs.
• A virtual network gateway enables communication between the Azure VNet and the on-premises network, typically through a site-to-site VPN or ExpressRoute connection.

• Load balancer: Distributes traffic among Azure VMs; it does not connect Azure to an on-premises network.
• Application gateway: Provides web-application load balancing and Layer 7 routing; it is not the normal resource for on-premises connectivity.
• Gateway subnet: A gateway subnet is required inside the VNet when deploying a virtual network gateway, but the question’s intended two primary resources are the VNet and virtual network gateway.

• SQL injection
• Cross-site scripting (XSS)
• Malicious file uploads
• Common web-application exploits

• Layer 4 firewall: Filters primarily by IP addresses, ports, and transport protocols; it lacks detailed web-application inspection.
• NGFW: Provides advanced network filtering and may include application awareness, but a WAF is more specialized for protecting web applications.
• UTM: Combines several security functions in one device, but it is not specifically focused on web-application attacks.

yaml 
clusterIP: None

• CronJob: Runs Jobs on a schedule and normally does not need stable networking.
• Deployment: Manages interchangeable, stateless replicas and usually uses a regular Service.
• DaemonSet: Runs a Pod on selected nodes but does not inherently require stable Pod identities.

• Modelo de embeddings de texto: trabalha principalmente com texto, não sendo adequado para imagens.
• Modelo generativo multimodal: pode interpretar ou gerar conteúdo de vários tipos, mas não é a opção específica para busca por similaridade.
• Modelo de geração de imagens: cria imagens a partir de entradas, não realiza busca multimodal.

Question 3: AWS Storage Gateway File Gateway

• A: S3 bucket per user — S3 is object storage, not a traditional shared file system; mounting it requires extra tools and is less efficient.
• B: File Gateway — Provides a local file share using standard file protocols while storing files in Amazon S3. This preserves convenient local access and extends storage capacity.
• C: WorkSpaces and WorkDocs — Designed for virtual desktops and document collaboration, not large shared file storage.
• D: EC2 with EBS — EBS is attached to one EC2 instance and is not designed for direct multi-user file sharing.

• Reviewing security policies and standards checks whether controls are documented, not whether they work.
• Reviewing security logs may show that monitoring is occurring, but does not directly establish that preventive controls are effective.
• Analyzing technical security practices is broad and may assess implementation, but it is less objective than an actual controlled attack.

• Design/compliance effectiveness: policies, standards, and procedures
• Operational effectiveness: logs, records, and evidence that controls operate
• Technical security effectiveness: penetration testing or vulnerability testing

• Identity provider (IdP): Authenticates users and asserts their identity.
• Service provider (SP): The application being accessed—in this case, Salesforce/the employee portal.
• Identity store: A directory that stores user identities, such as Active Directory.
• Authentication store: A system used to validate credentials.

• Planning — identify the need, objectives, resources and feasibility.
• Analysis — determine user requirements and examine the existing system.
• Design — specify how the new system will work.
• Implementation — build, test, install and introduce the system.
• Maintenance/evaluation — monitor and improve the system after implementation.

• SharePoint search: Finds documents based on search terms, but it does not reliably identify every 32-character account number for DLP enforcement.
• A hunting query in Microsoft 365 Defender: Used for security investigations, not for defining sensitive content in a DLP policy.
• Azure Information Protection: Uses classification and labeling; it does not automatically identify this specific account-number pattern unless configured with a matching sensitive information type.
• RegEx pattern matching: Best suited for structured identifiers with a known format, such as account numbers, employee IDs, or policy numbers.

• Identifying the communication strategy: Usually part of a business continuity or incident response plan.
• Evaluating the risk management plan: Part of risk assessment and risk management activities.
• Establishing backup and recovery procedures: Usually part of disaster recovery planning.
• Developing the incident response plan: Part of incident response planning.

• Business
• People
• Governance
• Platform
• Security
• Operations

• Cloud financial management
• Portfolio management
• Data governance
• Risk management
• Compliance

• The inference container image or built-in algorithm
• The location of model artifacts in Amazon S3
• IAM permissions through the execution role
• Optional environment variables and networking settings

1. Create AWS::SageMaker::Model
2. Create an AWS::SageMaker::EndpointConfig that references the model
3. Create AWS::SageMaker::Endpoint that references the endpoint configuration

• AWS::SageMaker::Endpoint hosts a model but does not define the model itself.
• AWS::SageMaker::NotebookInstance provides a development environment.
• AWS::SageMaker::Pipeline orchestrates ML workflow steps.

• Basic: No technical or architectural guidance.
• Standard: Technical support, but not the required design-assessment service.
• Professional Direct: Provides advisory and architecture guidance.
• Premier: Provides it too, but is unnecessarily expensive for this requirement.

• staff use the new system;
• transactions and reports are checked;
• problems are corrected;
• feedback is collected.

• Phased changeover: different parts or functions are introduced in stages, often according to a planned sequence.
• Pilot changeover: one representative department, branch or group acts as a test site before wider implementation.
• Parallel changeover: old and new systems operate at the same time.
• Direct changeover: the old system is stopped and the new one starts immediately.

• The explanation states that Traffic Analytics can be enabled by a user with one of these subscription-level roles:

• Question 34 — Network Contributor: Yes
• Question 35 — Owner: Yes
• Question 36 — Reader: Yes, according to the stated explanation and documentation

sql 
SELECT COUNT(*) FROM table;

• A: It does not normally need to scan all data files for this operation.
• B: Results are not simply reused from a query cache every time. Caching is separate from Delta’s metadata optimization.
• D: The relevant metadata is maintained through the Delta transaction log, not directly treated as a Parquet-file metadata operation in this context.

• Replace the keyboard: More expensive and unnecessary before simpler causes are ruled out.
• Replace the key switch: Laptop keyboards generally aren’t designed for individual switch replacement.
• Replace the circuit board: Excessive for a single nonworking key and not a cost-effective first step.

• 25 — Traditional SMTP server-to-server delivery; often restricted for client submission and not inherently encrypted.
• 110 — POP3 for retrieving email; unencrypted by default.
• 143 — IMAP for retrieving and synchronizing email; unencrypted by default.
• 587 — Authenticated SMTP submission, commonly secured with STARTTLS.

sql 
CREATE TABLE my_table 
USING CSV 
OPTIONS (path '/path/to/csv');

sql 
CREATE TABLE my_table 
USING CSV 
LOCATION '/path/to/csv';

• USING CSV specifies the file format.
• path or LOCATION specifies where the files are stored.
• USING DELTA would be used only when the source data is in Delta format.
• FROM is used in a SELECT statement, not normally as the format declaration in CREATE TABLE.

bash 
docker run -it microsoft/azure-cli:0.10.17

• docker run starts an Azure CLI container; it does not automatically connect to the AKS cluster.
• The command does not run kubectl apply.
• The container would need the appropriate Kubernetes tools and AKS credentials.
• The device or container must obtain cluster credentials, typically using an AKS credential command, before running Kubernetes commands.

bash 
az aks get-credentials --resource-group <resource-group> --name <aks-cluster> 
kubectl apply -f myapp.yaml

python 
def add_integers(a, b): 
    return a + b

• Uses def to define a function.
• Accepts two parameters, a and b.
• Uses return to send their sum back to the caller.
• Uses indentation to define the function body.

python 
result = add_integers(3, 4) 
result is 7

• 25 — Traditional SMTP server-to-server mail transfer; not normally used for secure client submission.
• 110 — POP3, used to retrieve email and typically unencrypted.
• 143 — IMAP, used to access email and typically unencrypted.

• 16 VMs: one failure loses 25 GB and 10 cores—only 6.25% of memory.
• 8 VMs: one failure loses 12.5% of memory.
• 4 VMs: one failure loses 25%.
• 1 VM: one failure loses the entire application environment.

• VM CPU, memory, disk, and network usage
• Storage transactions and latency
• App Service response time
• Database DTU or CPU utilization

• Azure Traffic Analytics analyzes network traffic flows and security patterns; it is not the general infrastructure metrics tool.
• Azure Activity Log records subscription-level control-plane operations, such as resource creation, deletion, or configuration changes.
• Azure Advisor provides recommendations about cost, security, reliability, performance, and operational excellence, but it is not the primary tool for investigating live metrics.

1. Identify every Region containing a replica.
2. Schedule deletion of the KMS key in each Region.
3. Use the minimum KMS waiting period: 7 days.

• A — Use the root user: Root access does not eliminate the need to schedule deletion for every regional replica. The problem is the multi-Region structure, not insufficient administrative permissions.

• C — Update the key policy: The policy already grants kms:* to IAM principals. Changing permissions does not delete the key or its replicas.

• D — Disable the key and schedule deletion in 30 days: Disabling can stop cryptographic use, but 30 days is slower than the permitted 7-day waiting period. It also does not address replicas in other Regions.