Checkpoint 156-836 Exam Prep
Check Point Certified Maestro Expert - R81.X (Page 8 )

• Disable high concurrency: This changes session-sharing behavior but does not provide dedicated compute or true workload separation.
• Modify the number of executors: Adjusts resources within a Spark job; it does not isolate bronze and silver processes.
• Set the default environment: Controls libraries and runtime configuration, not compute isolation.

• C: Develop the rule in the Rules Editor, define the events, match, and condition sections, then use the test rule feature. This directly validates the YARA-L rule without enabling it in production.
• A: UDM Search can help investigate data and refine filters, but it does not fully test YARA-L logic—especially complex event joins, match windows, and conditions.

• contoso.onmicrosoft.com
• contoso1.onmicrosoft.com

• onmicrosoft.com domains: Maximum of five per tenant.
• Custom domains: Domains that your organization owns and verifies in Microsoft 365.

1. Horizontal scaling — Yes

1. Vertical scaling — Yes

1. Scaling can manage costs — Yes

• Horizontal = more or fewer instances
• Vertical = larger or smaller instances

• Streams — track change data for tables or views.
• External tables — reference data stored in an external cloud storage location.

• Role — account-level security object.
• Warehouse — account-level compute resource.
• User — account-level security object.
• Share — account-level object used to share data.

• Measurement bias: Errors in how features or labels are measured, such as unreliable camera data or inconsistent labeling.
• Observer bias: A human evaluator’s subjective judgment influencing observations or labels.
• Confirmation bias: Favoring information that supports an existing belief.

• Due diligence: Investigating and evaluating a third party before entering into or continuing a business relationship.
• Attestation: An independent party provides assurance about an organization’s claims or controls. A SOC 2 examination is an example of an attestation engagement, but the analyst requesting and reviewing the report is performing due diligence.
• Internal audit: Reviews the organization’s own internal controls.
• Penetration testing: Actively tests systems for exploitable vulnerabilities.

• B: Extending credit to customers increases receivables, so more cash is tied up in working capital.
• C: Replacing obsolete inventory does not reduce the overall inventory investment; it simply changes its composition.
• D: Paying suppliers earlier reduces payables. This uses cash and therefore increases the funds tied up in working capital.

• Endpoint Manager: manages hosts and sensor-related settings.
• Falcon Investigator: supports investigation and analysis, but does not necessarily grant RTR access.
• Remediation Manager: handles remediation-related actions rather than interactive host access.

• A. IDS attack signatures: An IDS primarily detects suspicious network activity; it is not the best control for scanning uploaded documents for malware.
• C. Load balancer: Distributes traffic among servers and improves availability, but does not inspect files for malware.
• D. WAF: Protects web applications against attacks such as SQL injection and command injection. It may help secure the upload function, but malware scanning is the key requirement here.

• Virtual introductions: Team members share their role, experience, location, and working preferences.
• Online icebreakers: Short, informal activities such as “two truths and a lie.”
• Virtual coffee chats: Pair team members for informal, non-project conversations.
• Collaborative problem-solving: The team works together on an online puzzle or scenario.
• Retrospectives: The team discusses what went well, what did not, and how to improve.
• Working-agreement sessions: The team agrees on response times, meeting etiquette, communication channels, and handoffs.
• Recognition sessions: Members acknowledge one another’s contributions.
• Remote workshops: Teams jointly create plans, diagrams, or schedules using collaboration tools.

• Share files with the wrong people
• Use public links unnecessarily
• Fail to classify sensitive data
• Upload data to unauthorized services
• Misunderstand company sharing policies

• A — Step-up authentication: Helps protect administrator accounts, but does not directly address improper file sharing by users.
• C — Password complexity: Helps reduce password attacks, not accidental data disclosure.
• D — Mobile device management: Secures managed mobile devices, but does not directly control file-sharing behavior across the organization.

• A: Build a custom API — possible, but unnecessary as the primary solution and potentially more costly to develop and maintain.
• B: Use pre-built chatbots — these generally answer questions but may not support the required custom workflow and real-time actions.
• C: Fine-tune with sample data — improves model behavior but does not provide live database access.
• D: Google Cloud databases + Vertex AI — stores current inventory data and lets an AI agent retrieve it and take actions based on up-to-date information.

• Active-active routers: Provide redundant Internet connections/devices. Both can operate, so traffic can fail over or be load-balanced.
• Active-active firewalls: Avoid a single firewall becoming a failure point while maintaining security inspection.
• Load balancers: Distribute requests across multiple web servers. If one server fails, traffic can go to the other.
• Redundant power supplies: A server with separate power supplies should connect to independent power sources or circuits.
• UPS A and UPS B: Provide backup power and redundancy. Ideally, each power supply is connected to a different UPS.
• SONET ring: A ring topology provides alternate paths if a fiber link or segment fails.

• C. Case after-insert trigger that publishes a Platform Event

• D. Custom Apex controller that publishes a Platform Event

• A. Trigger with a callout: Salesforce triggers should not make direct synchronous callouts, and this tightly couples transaction processing to the external system.
• B. Workflow Rule with Outbound Message: This can react to record changes, but it cannot reliably capture a user clicking a menu item. It also does not provide the same flexible event-driven model as Platform Events.

• Code signing: Verifies the software’s authenticity and integrity; it does not hide the source code or prevent reverse engineering.
• Tokenization: Replaces sensitive data with tokens, mainly for protecting data such as payment information—not software logic.
• Blockchain: Provides a tamper-resistant record of transactions or data; it does not protect compiled code from analysis.

• Case Assignment Rules normalmente são avaliadas quando o caso é criado. Elas podem ser executadas novamente em uma edição somente se o usuário marcar “Assign using active assignment rules”; isso não acontece automaticamente apenas porque o caso foi fechado.
• Portanto, criar uma regra de atribuição não corrige os centenas de casos já fechados e não garante, por si só, que um caso será transferido antes de ser fechado.

• B — Usar uma ferramenta de dados: corrige os registros históricos já existentes, atualizando o Owner.
• D — Criar uma regra de validação: impede que um caso seja fechado enquanto ainda pertence a uma fila. Exemplo conceitual: se Status = Closed e o proprietário for uma fila, bloquear o salvamento.

• Feedback form: Captures opinions, not necessarily actual behavior; users may not respond.
• Questionnaire: Relies on memory and subjective judgments about usefulness.
• Interviews: Can provide valuable qualitative insights, but a sample of users may not represent overall usage accurately.

• Denial-of-service: Prevents users from accessing a service; it does not normally redirect them.
• Social engineering: Manipulates people into taking an action, such as clicking a malicious link, but does not directly alter DNS resolution.
• ARP spoofing: Associates the attacker’s MAC address with another device’s IP address on a local network. It can intercept traffic, but the described website redirection is most specifically DNS poisoning.

• Undefined or blank values
• Relationship matching problems
• Duplicate or conflicting keys
• Errors when querying the model

• Normalize all values to upper- or lowercase in the source query or Power Query.
• Add an index or surrogate key when values that differ only by case must remain distinct.

• IKE (Internet Key Exchange) negotiates the IPsec security association, including:

• ESP (Encapsulating Security Payload) protects the data after negotiation by providing encryption and optionally authentication.
• AH provides authentication and integrity but does not encrypt traffic.
• TLS is used for protocols such as HTTPS, not for negotiating IPsec parameters.

• netstat -tuln can show listening TCP ports.
• If the web service is not listening, or is bound only to 127.0.0.1, remote browsers cannot connect even though the server responds to ping.

• traceroute: Tests the path to the server, but ping already confirms basic reachability.
• tcpdump: Useful for detailed packet analysis, but it is more appropriate after checking whether a service is listening.
• arp: Helps troubleshoot local IP-to-MAC resolution, not an application-layer web connection.

• Note the question number before leaving—for example, Question 38.
• Use the exam’s question navigator or Back/Previous button to return to that number.
• If you close or refresh the page, your position may not be saved, depending on the site. Reopen the page and select the question number again.
• Avoid using the browser’s Back button if it causes the exam page to reload; use the exam’s built-in navigation instead.

• A — .gitignore: Controls Git tracking; it does not configure Copilot exclusions.
• B — copilot.ignore: This is not the standard GitHub Copilot Business exclusion mechanism.
• D — Renaming files: Adding _no_copilot has no recognized effect.

• Guest access: Controls external users invited into your teams as guests. It is not the primary setting for restricting federated communication by domain.
• Messaging policy: Controls messaging features, such as chat or message editing, rather than which organizations users can communicate with.
• Org-wide Teams settings: Contains broad Teams-wide configuration, but domain-based external communication is configured under External access.

• Input validation: Prevents malicious or malformed input within an application; it does not authenticate a software package.
• Secure cookies: Protect web-session cookies; they do not protect downloadable software.
• Fuzzing: Tests software by supplying unexpected input to find vulnerabilities; it does not verify software integrity.

• The CSV contains the external users’ email addresses.
• The bulk invitation feature supports inviting many guest users in one operation.
• Each invited user becomes a guest account in contoso.com.

• A — If there is no demand, there should be no production.

• B — Not all sales equal profit.

• C — Stocking up on inventory is bad for business.

• D — All costs, except materials, are considered fixed.

• E — Departments should operate at full capacity regardless of bottlenecks.

• What information each stakeholder needs
• When and how often it should be communicated
• Which format or channel should be used
• Who is responsible for communicating it

• A: The team should not decide stakeholder communications without first checking the established plan and CEO’s needs.
• B: An executive summary may be appropriate, but choosing a solution before reviewing the plan is premature.
• D: The stakeholder engagement plan addresses how to engage stakeholders, but this is primarily a communication planning issue.

• \Pipeline1
• \Folder1\Lakehouse1

• Pipeline1 remains at the workspace root in Workspace1, so it is deployed to the root of Workspace2.
• Lakehouse1 was moved into Folder1, so its full path is preserved as \Folder1\Lakehouse1.
• Fabric deployment pipelines preserve folder paths because an item’s full path is treated as part of its name.

• Accept: Acknowledges the risk without taking additional action.
• Transfer: Shifts the risk or financial impact to another party, such as an insurer.
• Mitigate: Reduces the likelihood or impact through controls like patching, MFA, or segmentation.
• Avoid: Eliminates the activity that creates the risk.

• nmap - 10.11.1.130 — a network scanning command; mitigated with controls such as firewalls, monitoring, or access restrictions.
• “Click this link to get your free gift card.” — a phishing or social-engineering message; addressed through user awareness, email filtering, and authentication controls.
• “Your connection is not private.” — indicates a certificate or TLS validation problem; addressed by correcting the certificate or secure-connection configuration.

• Microsoft manages the physical datacenter, hardware, and virtualization.
• You manage the virtual machine’s operating system, installed software, configuration, and data.
• You choose the VM size, storage, networking, and scaling options.

• SaaS: You consume a complete application managed by the provider, such as Microsoft 365.
• PaaS: You deploy applications without managing the underlying operating system or VM infrastructure, such as Azure App Service.

• Rights issue: Raises new equity from existing shareholders. It does not increase debt or gearing, so it is least likely to breach the covenant.
• Retained earnings: Also equity finance, but the amount available may be insufficient for the required $800 million.
• Private placement of a bond: Creates additional debt and would worsen gearing, increasing the risk of breaching the covenant.
• Bank overdraft: Also debt finance, usually short-term and potentially expensive; it would still increase financial risk and gearing.

• Access List: controls whether a client is allowed or denied.
• Connect List: controls which wireless networks/APs a station may connect to.

• Create a CodeCommit repository in the secondary Region.
• Use CodeBuild to run a Git mirror operation from the primary repository to the secondary repository.
• Use EventBridge to detect relevant repository events, such as a pull request being merged.
• Invoke a Lambda function, which starts the CodeBuild project.

• B: Amazon S3 is object storage, not a Git repository that developers can use as a CodeCommit remote.
• C: CodeArtifact is intended for packages and artifacts, not source-code repository mirroring.
• D: An AWS Cloud9 environment is not an appropriate automated replication mechanism and would require manual or persistent infrastructure management.

• Least privilege: Limits users to only the access necessary for their job.
• Background checks: Help identify potentially risky individuals before employment.
• Separation of duties: Ensures that one person cannot complete a sensitive process alone, reducing fraud and abuse.

xml 
<apex:page> 
    <apex:stylesheet value="{!URLFOR($Resource.MyStyles, 'styles/main.css')}" /> 
</apex:page>

• <apex:includeScript> is for JavaScript.
• <apex:includeStyle> is not a valid Visualforce component.
• <apex:require> is not the Visualforce tag used to load CSS.

• Employees can work from any location, including remote sites and offices worldwide.
• Login can be relatively seamless after the device is registered.
• It does not require distributing additional physical authentication equipment.

• Geotagging: Identifies location, but location alone is not a strong authentication method and may prevent legitimate remote access.
• Smart cards: Provide strong authentication but require card readers and physical cards, increasing equipment and management requirements.
• Time-based logins: Typically involve one-time codes that users must enter, making the experience less seamless and potentially requiring a token or authenticator app.

• Amazon S3 as the origin for static content
• Application Load Balancer (ALB) as the origin for dynamic content
• Amazon Route 53 configured to point the company’s domain name to CloudFront

• /static/* ? S3 origin; cache content at edge locations
• Dynamic paths such as /api/* ? ALB origin; forward requests to the EC2 application

text 
user<TAB>action<TAB>status

text 
user|action|status

• Colons: Although colons commonly appear in log data, they are not a supported delimiter choice in the FX workflow described by this exam question.
• Spaces: Spaces are not treated as a supported delimiter for this extraction method; ordinary text often contains variable spacing.

1. The original app version exists.
2. You create and publish a new version, so there are now two versions.
3. When you restore the previous version, Power Apps does not delete or overwrite the newer version. Instead, it creates another version based on the restored one.

• Original version
• Newly created and published version
• New version created by the restore operation

• A — Use a custom controller: An Apex class can contain the page’s logic.
• C — Use a standard controller with extensions: The standard controller provides basic CRUD behavior, while an extension adds custom logic.
• E — Use a standard controller: Useful when the page works mainly with one Salesforce object and needs standard functionality.

• A page with no controller for static or controller-free content.
• A custom controller with extensions; extensions are not limited only to standard controllers.

• One physical NIC is active and carries traffic.
• Another NIC remains on standby.
• If the active uplink fails, traffic switches to the backup uplink.
• This provides redundancy without requiring special switch-side link aggregation configuration.

• Balance-SLB: Distributes traffic based on source load balancing; not the default.
• Balance-TCP: Uses dynamic TCP traffic balancing and generally requires appropriate network-switch configuration.
• No Uplink Bond: Incorrect because vs0 is normally configured with redundant uplinks.

Why this is correct

• Each user authenticates with their own Google account.
• Google manages the user’s SSH key association.
• IAM controls who can access instances.
• Access can be audited by user identity, so security can determine who accessed a VM.
• Granting the role to a Google group avoids managing permissions individually.

Why the others don’t apply

• A: A shared private key is difficult to distribute securely and cannot reliably identify which employee used it.
• B: Manually collecting and deploying keys on every instance is operationally inefficient and complicates auditing.
• D: A project-wide shared key has the same identity and key-management problems as option A. It also does not provide per-user accountability.

• The connected switch
• The switch’s port/interface
• Device and port descriptions
• Sometimes VLAN or management information

• IKE: Establishes security associations for IPsec VPNs.
• VLAN: Defines logical network segmentation; it does not identify a physical switch port.
• netstat: Displays local network connections and statistics, not the upstream switch and port.

• The server accepts unauthenticated image uploads, which creates an opportunity for an attacker to upload a malicious script disguised as an image or using an unexpected file type.
• A web shell is a malicious script placed on a web server that gives an attacker remote command execution through web requests.
• The suspicious process and outbound connection to a low-reputation IP are consistent with the attacker using the web shell to execute commands or establish communication with command-and-control infrastructure.

• Worm: Usually self-propagates across multiple systems; the scenario focuses on the upload page.
• Cryptocurrency mining: Possible, but there is no indication of resource-intensive mining activity or insider involvement.
• Rootkit Trojan over RDP: The evidence points to the vulnerable upload functionality, not an exposed RDP service.

• An Adj-SID does not necessarily need manual configuration.
• It can often be dynamically allocated by the router, although manual configuration may also be possible.
• The adjacency information is advertised through the IGP, such as IS-IS or OSPF.

• It is identified by an Adj-SID.
• It represents a particular adjacency of a node.
• Its meaning is generally local to the advertising node; unlike a Node-SID, it is not a globally reusable instruction across the network.

• Amazon EC2 instances — ???????? ?? ?? ??????? CPU, memory ??? instance size ???????? ???????
• AWS Lambda functions — memory configuration ?????????? ???????
• Amazon EBS volumes — volume type ?? size optimize ???? ???????
• ??????? ECS workloads — resource configuration ? cost optimization-?? ???????

• Memory ? compute usage ?????????? ???? custom code ????? ???? development ? maintenance ??????
• Cost allocation tags ???? ????? ??? ?????? ???? ??????? ???; inefficient resource ??????? ?? recommendation ???? ???
• CloudTrail resource ???? ?? API activity ??????, resource utilization ????

• 255.255.255.128 = /25: 128 total, 126 usable
• 255.255.255.192 = /26: 64 total, 62 usable
• 255.255.255.224 = /27: 32 total, 30 usable
• 255.255.255.240 = /28: 16 total, 14 usable

• One for the network address
• One for the broadcast address

• 8 total addresses
• 6 usable addresses
• Mask: 255.255.255.248