CIMA F1 Exam Prep
Financial Reporting (Page 19 )

• IKE: Negotiates security parameters for IPsec VPNs; it does not identify switch ports.
• VLAN: A logical network segmentation method, not a discovery protocol.
• netstat: Displays local network connections and listening services, but cannot identify the physical switch or port.

• Cross-account access is typically implemented with an IAM role. You create a role in the target account (where the resources live) and configure a trust policy that allows principals from the source account to assume that role.
• Users in the source account then assume the role (via Switch Role in the console or STS:AssumeRole) and receive temporary credentials with the role’s permissions to access the resources.

• IAM group: Groups exist inside a single account; they don’t grant cross-account access.
• IAM tag: Tags are metadata and do not grant access.
• IAM Access Analyzer: It analyzes and identifies public or cross-account access but does not grant access itself.

• Improve QA testing efficiency: A prototype may help discover defects early, but that is not its greatest benefit.
• Decrease time allocated for user testing and review: Prototyping usually requires additional user involvement and review, not less.
• Minimize scope changes: Prototypes can actually reveal new requirements or cause scope changes. However, discovering those changes early is beneficial.

• What the dataflow options mean:

• Why C fits best:

• Basic: Self-help only; no technical support or design assessment.
• Developer/Standard: Technical support, but generally not the full proactive architecture guidance required here.
• Professional Direct: Includes proactive guidance and architecture recommendations.
• Premier: Also supports this, but is not the minimum-cost option.

• The files are stored in a document library, which is exposed through the SharePoint Folder connector.
• The connector returns file metadata, including Folder Path, Name, and Content.
• In Power Query, filter Folder Path so only files in the manufacturing reports folder are retained.
• You can then combine the remaining Excel files because they all have the same structure.

• SharePoint List is for SharePoint lists, not document-library files.
• Combine & Load combines files immediately, before you filter to the required folder, and may include unwanted files.
• Transform gives you the opportunity to filter the file list first, which is more efficient and targeted.

• Primary and core nodes: Use On-Demand Instances because the workload is business-critical. These nodes manage the cluster and store/process HDFS data.
• Task nodes: Use Spot Instances in an instance fleet. Task nodes are suitable for interruption because they do not hold essential cluster data and can be replaced or diversified across instance types.
• Terminate the entire cluster after processing: The job runs only about six hours each morning, and EMRFS stores data in Amazon S3. Keeping the cluster running for the rest of the day would waste money.

• A: Using Spot for primary and core nodes risks interruption of the critical cluster.
• C: All On-Demand is reliable but unnecessarily expensive; terminating the cluster helps, but Spot task nodes provide greater savings.
• D: Leaving primary and core nodes running after the task finishes continues to incur costs. Savings Plans also are less appropriate for this intermittent workload.

• A separate scope using a /32 subnet: A /32 identifies one host, but it is not a practical DHCP scope for this purpose.
• A static IP within the DHCP range: This can cause an IP address conflict if DHCP assigns that address to another device.
• SLAAC: Used for automatic IPv6 address configuration, not for assigning a predictable IPv4 address through DHCP.

Flat organisation

• Few levels of management
• A wide span of control—managers supervise many employees
• Shorter communication channels
• More employee autonomy and quicker decisions
• Fewer formal promotion levels

Tall organisation

• Many levels of management
• A narrow span of control—managers supervise relatively few employees
• A clear hierarchy and reporting structure
• More formal supervision and communication channels
• More obvious promotion and career stages

• Correct answer: D — AWS Migration Hub

• AWS Migration Hub provides a single location to track the progress of application migrations. It offers a centralized dashboard to view migration status across multiple tools and projects.

• AWS Application Discovery Service helps inventory and map on-prem applications and their dependencies, not a single progress tracker.
• AWS Application Migration Service (formerly SMS) performs the actual lift-and-shift migrations, but isn’t the centralized tracker itself.
• AWS Service Catalog manages catalogs of IT services for self-service deployment, not migration progress.

1. Ensure BOMs can include subcomponents ? Configure an entity relationship

1. Report changes made by engineers ? Enable auditing

• Configure entity relationship
• Configure auditing

• Review the risk register.
• Use the previously defined risk response plan, such as assigning a backup resource, reprioritizing work, or using another qualified engineer.
• Implement the response promptly because the task is on the critical path.

• B: Revising the schedule without first applying the planned response may be premature.
• C: Excluding a required task could compromise the project’s objectives and requirements.
• D: Updating the risk and lessons learned records is appropriate, but it should happen after managing the immediate issue, not as the next primary action.

• Correct options: C and D.

• The AWS Cloud Adoption Framework (CAF) security perspective focuses on capabilities to protect information and manage security risk.
• Observability (A) is primarily an operations/monitoring capability, not a core security capability under CAF.
• Incident and problem management (B) is IT service management/operations, not specifically a CAF security capability.
• Incident response (C) is a security-focused capability: detecting, containing, and recovering from security incidents.
• Infrastructure protection (D) involves applying security controls to protect the underlying infrastructure, which fits the security perspective.

• Coordinate and manage the assessment team
• Assign assessment activities
• Direct interviews, examinations, and tests
• Ensure the assessment follows the CAP

• Answer key: Lead Assessor — likely wrong
• CAP-based answer: C3PAO

• A — IDS attack signatures: An IDS generally detects suspicious network activity but does not necessarily scan uploaded PDF files or prevent them from being accepted.
• C — Load balancer: Distributes traffic among servers; it does not inspect files for malware.
• D — WAF command-injection blocking: A WAF can help block web attacks such as command injection, SQL injection, and cross-site scripting, but this option does not specifically address malicious PDF uploads.

• B — AWS DataSync: Transfers data between storage systems, such as S3, file systems, and on-premises storage. It is not a marketplace or catalog for third-party datasets.
• C — Kinesis Data Streams and CodeCommit: CodeCommit is a source-code repository, not a third-party data provider. Kinesis is for streaming data ingestion.
• D — Kinesis Data Streams and ECR: ECR stores container images, not datasets. Kinesis does not provide access to ECR data as an external dataset source.

• Users retain their existing usernames and passwords.
• Existing accounts can be used to access Azure-based resources.
• Administrators avoid manually recreating thousands of accounts.
• The transition is less disruptive before the on-premises data center is retired.

sql 
CREATE TABLE my_table 
USING CSV 
OPTIONS (path '/path/to/csv');

sql 
CREATE TABLE my_table 
USING CSV 
LOCATION '/path/to/csv';

• USING CSV specifies the file format.
• path or LOCATION specifies where the files are stored.
• USING DELTA would be used only when the source data is in Delta format.
• FROM is used in a SELECT statement, not normally as the format declaration in CREATE TABLE.

• 25 — Traditional SMTP server-to-server mail transfer; not normally used for secure client submission.
• 110 — POP3, used to retrieve email and typically unencrypted.
• 143 — IMAP, used to access email and typically unencrypted.

• Batch processing, such as scheduled data transformations
• Streaming processing, such as continuously ingesting events

• Manipulating data with multiple languages: Mainly a benefit of Databricks and Spark.
• Real-time notebook collaboration: A workspace/notebook feature.
• Alerts for query failures: A Databricks SQL or job-monitoring feature.
• Distributing complex operations: Primarily a Spark compute capability.

• Date: 2018-12-31
• Time: 08:59

• B: The original value contains the text at, so it cannot be converted directly to a date.
• A: The last characters contain the time, not the date.
• D: Extracting the first 11 characters can leave an unwanted space and does not properly separate the time component.

kusto 
Event 
| summarize make_set(EventID) by Computer

• summarize groups records.
• by Computer creates one result row per virtual machine.
• make_set(EventID) returns an array containing unique event IDs for that computer.

kusto 
| summarize make_list(EventID) by Computer

• Version control provides a single source of truth for metadata changes and tracks every modification.
• It supports branching and merging, so each feature can be developed in isolation and later merged without overwriting others.
• It allows diffs and conflict resolution, making it easier to manage dependencies across features and ensure a stable release.

• Setup Audit Trail: only logs who/change when something happened; it doesn’t prevent overwriting or manage cross-feature dependencies.
• Change Sets: used to deploy changes between orgs, not to coordinate parallel development or prevent conflicts across ongoing sprints.

• Forecasting lets sales leaders predict revenue for upcoming fiscal periods, compare forecasts with targets, and review performance by salesperson or team.
• Opportunity Stages help determine the likelihood that opportunities will close. Each stage can have a probability, which contributes to forecast calculations.

• Sales Quotes: Used to present pricing or product proposals to customers; they do not provide revenue forecasting.
• Opportunity List View: Helps users filter and view opportunities, but it is not the forecasting tool.

• Pay-as-you-go in Azure is an operating expense (OPEX) model, not an “elastic” expenditure model.
• Elastic or scalable terms describe capacity planning, not the cost category. The cost should be treated as OPEX since you pay for usage each month.
• The parallel question (Question 12) shows the correct approach is using an operational expenditure model.

• The inference container image or built-in algorithm
• The location of model artifacts in Amazon S3
• IAM permissions through the execution role
• Optional environment variables and networking settings

1. Create AWS::SageMaker::Model
2. Create an AWS::SageMaker::EndpointConfig that references the model
3. Create AWS::SageMaker::Endpoint that references the endpoint configuration

• AWS::SageMaker::Endpoint hosts a model but does not define the model itself.
• AWS::SageMaker::NotebookInstance provides a development environment.
• AWS::SageMaker::Pipeline orchestrates ML workflow steps.

• Entradas grandes, de até aproximadamente 1 GB.
• Processamentos demorados, que podem levar até cerca de 1 hora.
• O cliente envia a solicitação e consulta o resultado depois, sem precisar manter uma conexão aberta durante todo o processamento.

• Real-time inference: indicada para respostas imediatas, com entradas menores e processamento rápido.
• Serverless inference: adequada para cargas variáveis e solicitações menores; não é ideal para processamento longo e arquivos grandes.
• Batch transform: processa grandes volumes em lote, mas não atende à necessidade de respostas próximas do tempo real.

• Assign a Teams license to a user — Licenses are assigned through the Microsoft 365 admin center, Microsoft Entra ID, or PowerShell.
• Deploy the Teams client — The Teams admin center manages Teams policies and apps, but it is not the primary tool for deploying the desktop client.
• Prevent users from creating teams — Team creation depends on controlling the creation of Microsoft 365 groups, generally configured through Microsoft Entra ID and PowerShell rather than directly in the Teams admin center.

• What the scenario asks: You have a Power BI semantic model that pulls from multiple sources (Azure SQL Database and SharePoint Online), must support a single dataset for three reports, keep data current (daily refresh by 7 AM PT), and apply RLS to limit sales data by region. You need to choose a storage mode for the tables.

• Correct choice: Dual storage mode.

• Why Dual fits:

• Key concepts:

• Multiple AWS accounts: Create a separate account for each department or workload. This provides clear isolation and makes it easier to track each department’s usage and costs for chargeback.
• Consolidated billing: AWS Organizations can combine billing for multiple accounts into one central payer account. The company can still view costs by account while managing payment centrally.

• Placement groups: Control how EC2 instances are physically placed for networking or performance; they do not provide departmental billing separation.
• Edge locations: Infrastructure used by services such as Amazon CloudFront; unrelated to chargeback.
• AWS Config: Records and evaluates resource configurations and compliance; it is not a billing-separation mechanism.

• State is stored remotely in Terraform Cloud/Enterprise, not as a local file.
• Terraform runs (plan/apply) can be executed on remote infrastructure, with results visible in the remote workspace UI.
• Supports workspace-based organization, state locking, and concurrency control.
• Useful for team collaboration, centralized governance, and auditable logs.

• In your configuration, you use a backend block like backend "remote" { ... }.
• You still run terraform init to configure/migrate to the remote backend.
• After setup, terraform plan/terraform apply may be executed remotely, and the outputs/logs appear in the Terraform Cloud/Enterprise UI rather than (only) in your local terminal.

• Other backends store state remotely but typically do not provide remote execution; with the remote backend you get remote runs and a collaborative UI, not just remote state storage.

• A private IP address on the virtual network
• An associated public IP address

• What it’s asking: In an ARM template, for an Availability Set, what value should you set for the property platformFaultDomainCount to maximize availability during fabric failures or maintenance?

• Key concept: Fault domains are groups of hardware that can fail independently. By spreading VMs across more fault domains, you reduce the risk that a single hardware fault takes out many VMs.

• Important detail: For managed Availability Sets, the number of fault domains you can use varies by region — typically 2 or 3.

• What to choose: Set platformFaultDomainCount to the maximum supported in your region. In most regions this is 3, which gives you the best resilience. If your region only supports 2, you’d use 2.

• Answer: 3 (Max Value). In ARM template syntax, this would appear as "platformFaultDomainCount": 3 (within the Availability Set resource).

• A: True. You can change the size of a Virtual Warehouse after creation (via UI or ALTER WAREHOUSE).

• B: True. A warehouse can be resized while it’s running; the resize will take effect without needing to stop queries.

• C: True. A warehouse can be configured to suspend after a period of inactivity (AUTO_SUSPEND).

• D: True. A warehouse can be configured to auto-resume when new queries are submitted (AUTO_RESUME).

• Amazon GuardDuty: Detects suspicious activity and threats using security-related data sources; it is not primarily a software vulnerability scanner.
• Amazon Detective: Helps investigate and analyze the root cause of security findings after an event.
• Amazon Cognito: Provides user authentication and authorization for applications.

• The connecting host keeps the private key securely.
• The destination host stores the corresponding public key in its authorized keys.
• Authentication can occur without a person entering credentials each time.
• SSH also provides encrypted communication and host authentication.

• Biometric: Requires a human user and is difficult to automate.
• Smart card: Often requires user interaction or card access.
• Hard-coded password: Unsafe because passwords stored in scripts or applications can be exposed, reused, or difficult to manage securely.

• AWS IoT Greengrass supports local ML inference using models trained in Amazon SageMaker.
• The model and inference code run on the factory’s local server, so processing continues even when internet connectivity is unavailable.
• A Greengrass component can:

• This provides low latency and avoids sending images to AWS for every inference.

• A: Uses AWS-hosted services and therefore depends on internet connectivity. It would fail during an outage.
• C: Snowball Edge is unnecessary for this use case and adds deployment complexity. A local Greengrass server is the intended edge-inference solution.
• D: Amazon Monitron is designed for monitoring industrial equipment health, not analyzing camera images with a custom SageMaker model.

• D. Provide public endpoints to store and retrieve data

• E. Manage the infrastructure layer and the operating system

• Classifying data
• Configuring access permissions, such as IAM policies
• Selecting or configuring available encryption options, depending on the requirement

sql 
GRANT ALTER ON SCHEMA::schemaA TO User1;

• TRUNCATE TABLE is a DDL operation, not a normal DELETE.
• Having DELETE permission on a table is not sufficient to truncate it.
• The minimum relevant permission is ALTER on the table.
• Granting ALTER on SCHEMA::schemaA allows the user to truncate tables within schemaA.
• It does not grant equivalent permissions on schemaB or schemaC, satisfying least privilege.

• Storage accounts: storage1, storage2, and storage3
• Log Analytics workspace: Analytics3

• Azure Backup reports can send the AzureBackupReports diagnostic log to eligible storage accounts. The storage account’s subscription and region do not have to match the Recovery Services vault, so all three listed storage accounts are valid.
• The Log Analytics workspace must be in the same region as the Recovery Services vault for this configuration. Vault1 and Analytics3 are both in West Europe, making Analytics3 the valid workspace.

• Honeypots: Decoy systems or services designed to attract attackers. Legitimate users should not access them, so activity on a honeypot is a strong indicator of unauthorized activity. Security teams can also observe attacker behavior.

• DNS sinkhole: Redirects requests for known malicious domains to a controlled internal server or blocks them. If an infected workstation attempts to contact command-and-control infrastructure, the sinkhole records the request and helps identify the compromised device.

• Tokenization: Protects sensitive data by replacing it with tokens.
• CI/CD: Automates software development and deployment.
• Threat modeling: Identifies potential risks before or during system design.
• Data obfuscation: Makes data harder to understand, but does not detect intruders.

• Answer: False. Agents and managers CAN create knowledge articles from Community questions.

• Why: In ServiceNow, a Community question can be converted into a Knowledge article using the Create Knowledge (or Convert to Knowledge) action. This allows what customers asked to become a reusable article for others.

• How it works (high level):

• Permissions: This ability depends on having the right roles/permissions (e.g., agents or knowledge managers). If you don’t see the option, check your role assignments or the knowledge-management configuration.

• Quick take: If a question in Community is valuable for others, a trained agent can turn it into a Knowledge article, making it available for self-service.

• Post-Incident Review (A) is the after-action step used to capture lessons learned, identify process gaps, and drive improvements across the incident response lifecycle. This directly supports process maturity and a stronger security posture.
• Incident Analysis (D) focuses on investigating root causes during/after an incident, which is important but more of a diagnostic activity than a standalone baseline improvement to maturity.
• Fast Eradication (B) and Incident Containment (C) are tactical actions aimed at stopping the incident, not on maturing the process.

• Create Power Query parameters for the Azure SQL server/database—or at least the database name.
• Use the parameter in the PBIX connection.
• Publish the same PBIX separately to the relevant development, test, and production workspaces.
• Set each dataset’s parameter value in the Power BI service so it points to the corresponding Azure SQL database.

• Development dataset ? DevelopmentDB
• Test dataset ? TestDB
• Production dataset ? ProductionDB

• The same PBIX is used for every lifecycle stage.
• Each stage consumes data from its matching database.
• Deployment pipelines are not required.
• Azure SQL is a cloud source, so gateway administration is generally avoided.
• Only the parameter value differs between published datasets, reducing maintenance.

• A. Number ? Decimal — Correct. Salesforce Number fields are represented in Apex as Decimal.
• D. Date/Time ? Datetime — This is correct conceptually, but “Dateline” is not an Apex type. If the option literally says “Dateline,” it is incorrect.
• E. Checkbox ? Boolean — Correct. A checkbox contains true or false.

• Number ? Integer — A Number field maps to Decimal, even when its scale is zero.
• Text Area ? List<String> — A text area maps to a single String, not a list.

• Why: Table.Profile returns a per-column profile that includes statistics such as count, null count, distinct count, and standard deviation. It also provides min/max and average where applicable, which matches the requested metrics (Count, Average, Null count, Distinct count, Standard deviation).
• Syntax: Table.Profile(table as table, optional additionalAggregates as nullable list) as table
• How it helps: After running Table.Profile on your table, you can extract the per-column stats you need and display them in your semantic model or report.

• S3 Lifecycle rules automate actions such as transitioning objects to different storage classes or deleting old objects.
• S3 bucket policies control access permissions; they do not preserve earlier object versions.
• S3 server-side encryption protects data confidentiality by encrypting objects at rest, but it does not prevent deletion or overwriting.

• Accidental deletion or overwriting ? S3 Versioning
• Unauthorized access ? bucket policies and IAM
• Data encryption ? server-side encryption