CIMA P2 Exam Prep
Advanced Management Accounting (Page 11 )

1. Selling price per unit: $750
2. Required annual return:

1. Required profit per unit:

1. Target cost per unit:

• Transfer price affects the selling division’s:

• It does not affect the selling division’s item: Cost of components purchased, which is a cost for the buying division, not the selling division.

• DPP focuses on the profitability of each product by tracing direct costs to the product and allocating only the overhead costs that are caused by that product. Non-product-specific costs are not tied to a single product in the same way. The goal is to help managers decide on which products to stock, price, or discontinue.

• A. DPP should result in improved management of storage space.

• B. DPP should result in improved supplier relationships.

• C. DPP should result in improved pricing decisions.

• D. DPP requires non product-specific costs to be apportioned rather than allocated.

• E. DPP provides summary information on the profitability of each customer group.

• A is incorrect: Functional analysis is not limited to existing products nor only minimizes costs of the originally defined functions. It’s a part of value analysis/VE used to examine what functions are required and how they contribute to value, for both new and existing products.

• B is incorrect: Value engineering is not necessarily a “fundamental rethinking and radical redesign” of processes. It’s a structured approach to improve value by analyzing function and cost, not explicitly radical process redesign (that would be closer to business/process reengineering).

• C is incorrect: Target costing is determined at the design stage based on expected selling price and required profit, not a continual target during production.

• D is correct: Value analysis focuses on reducing costs while preserving the product’s purpose, reliability, and quality.

• E is correct: Kaizen costing involves ongoing, small incremental cost reductions while the product is in production.

• ADF: Automatic Document Feeder; a printer/scanner hardware component.
• USB: A short-range wired connection, not a protocol for accessing a remote shared folder.
• PCL: Printer Control Language; it describes how print jobs are formatted, not how files or printers are shared over a network.

• Compensating control: The server is end-of-life, so it may no longer receive security patches or support. Placing it on a restricted VLAN provides an alternative layer of protection by reducing who can access it and limiting its exposure.
• Technical control: VLAN segmentation and access control lists (ACLs) are technology-based mechanisms that enforce network access restrictions automatically.

• Managerial: Policies, procedures, and governance—not network configuration.
• Physical: Locks, guards, or barriers.
• Corrective: Restores systems after an incident.
• Detective: Identifies suspicious activity rather than restricting access.
• Deterrent: Discourages behavior but does not enforce access rules.

Simple explanation

• The Azure VPN gateway to connect to
• Authentication settings
• Routes for networks that the client can access

• 10 TB with maximum I/O performance: Use EC2 instance store. It provides very high-throughput, low-latency local storage suitable for temporary video-processing data. The application must tolerate data loss because instance store is ephemeral.
• 300 TB of highly durable media: Use Amazon S3, which is designed for highly durable object storage and can scale to this size.
• 900 TB of inactive archival media: Use S3 Glacier, which provides lower-cost storage for data that is rarely accessed.

• A: Amazon EBS offers high performance but is not the best fit for the question’s “maximum possible I/O” requirement compared with local instance store.
• B: Amazon EFS is durable and shared, but is generally more expensive and less suitable for very large archival storage.
• C: Uses EC2 instance store for performance, but incorrectly uses EFS for the 300-TB durable tier and S3 rather than Glacier for archival data.

• A. Modify CommunitiesSelfRegController

• C. Configure Communities registration to use a custom Visualforce page

• B. Modify the self-registration trigger — There is no standard “self-registration trigger” intended for this configuration. The registration logic is handled by the Visualforce controller.
• D. Configure a custom Apex controller — The standard approach is to modify the provided CommunitiesSelfRegController, rather than simply selecting a separate controller configuration.

• The inference container image or built-in algorithm
• The location of model artifacts in Amazon S3
• IAM permissions through the execution role
• Optional environment variables and networking settings

1. Create AWS::SageMaker::Model
2. Create an AWS::SageMaker::EndpointConfig that references the model
3. Create AWS::SageMaker::Endpoint that references the endpoint configuration

• AWS::SageMaker::Endpoint hosts a model but does not define the model itself.
• AWS::SageMaker::NotebookInstance provides a development environment.
• AWS::SageMaker::Pipeline orchestrates ML workflow steps.

• Hardware and infrastructure
• System software
• Networks and communications
• Technology platforms and services

• Business Architecture: Defines business strategy, organization, functions, and processes.
• Data Architecture: Defines the structure and management of enterprise data.
• Application Architecture: Describes application systems and how they interact to support business and data processing.

• Primary and core nodes: Use On-Demand Instances because the workload is business-critical. These nodes manage the cluster and store/process HDFS data.
• Task nodes: Use Spot Instances in an instance fleet. Task nodes are suitable for interruption because they do not hold essential cluster data and can be replaced or diversified across instance types.
• Terminate the entire cluster after processing: The job runs only about six hours each morning, and EMRFS stores data in Amazon S3. Keeping the cluster running for the rest of the day would waste money.

• A: Using Spot for primary and core nodes risks interruption of the critical cluster.
• C: All On-Demand is reliable but unnecessarily expensive; terminating the cluster helps, but Spot task nodes provide greater savings.
• D: Leaving primary and core nodes running after the task finishes continues to incur costs. Savings Plans also are less appropriate for this intermittent workload.

• Authentication — verifies who the user is.
• Authorization — determines what the authenticated user is allowed to access.
• Accounting — records session activity, such as login time and resource usage.

• CIA — confidentiality, integrity, and availability; core security objectives.
• ACL — access control list; rules that permit or deny traffic or access.
• PEM — Privacy Enhanced Mail, an older email security standard.

• VM CPU, memory, disk, and network usage
• Storage transactions and latency
• App Service response time
• Database DTU or CPU utilization

• Azure Traffic Analytics analyzes network traffic flows and security patterns; it is not the general infrastructure metrics tool.
• Azure Activity Log records subscription-level control-plane operations, such as resource creation, deletion, or configuration changes.
• Azure Advisor provides recommendations about cost, security, reliability, performance, and operational excellence, but it is not the primary tool for investigating live metrics.

text 
heartrateheartrateheartrate

• Spark column objects can be multiplied, for example:

python 
  df["heartrate"] * 3

• A DataFrame itself cannot be multiplied, but the expression is referring to a column.
• It is also not primarily a Python syntax error; the code was parsed, then Spark failed while resolving the column name.

• Azure Cosmos DB is a globally distributed NoSQL database service. It stores and retrieves application data, but it does not provide the tools needed to build, test, and deploy predictive analytics models.
• Azure Machine Learning—including the historical Azure Machine Learning Studio—is designed for the machine-learning lifecycle:

• IaaS: You manage the virtual machine’s operating system, configuration, applications, and data. Azure manages the physical infrastructure and virtualization platform.
• PaaS: You deploy applications without managing the underlying operating system or servers.
• SaaS: You consume a complete application managed by the provider, such as Microsoft 365.

• Customers access the portal without needing a full Dynamics 365 license.
• They submit case information through portal forms.
• The submitted data is stored in Dataverse tables, such as the Case table.
• Security is controlled using web roles and table permissions, so customers can access only appropriate records.

• Dynamics 365 Connector — connects apps to Dynamics 365 data but is not the portal’s underlying data platform.
• Microsoft SharePoint — useful for documents and collaboration, not the standard case-management data source for portals.
• Microsoft Azure Storage — stores files or other data, but is not the native portal business-data platform.

• Numerical flexibility: Adjusting the number of employees, such as using temporary, part-time or contract staff.
• Temporal flexibility: Varying when employees work, such as through flexitime, overtime or different working hours.
• Shift system flexibility: Changing work patterns or shift arrangements; it is not specifically about moving between tasks.

• Approve major information security policies
• Allocate funding and resources
• Set the organization’s risk appetite
• Ensure security supports business objectives

• Evaluating vendors is generally handled by security, procurement, or technical teams.
• Assessing risks is typically performed by security and risk-management professionals, with management accepting or prioritizing the risks.
• Monitoring regulatory adherence is usually handled by compliance, audit, or security functions.

• A — Add a Path for Stage: A Path lets users update the Opportunity’s Stage directly from the record page, without opening the full edit form. It can also display guidance and key fields.
• B — Use a Kanban list view: Users can move Opportunities between stages by dragging records between columns, which is ideal when Stage is the only field they normally change.

• User preferences change, so the model must learn from recent data.
• Keeping the existing data helps preserve knowledge of older patterns and provides a broader training distribution.
• Training only on new data can cause catastrophic forgetting and may overfit if the new dataset is small.
• The new data should not automatically be used as the test set, because it is needed for training and the model must still be evaluated on separate, representative data.

• A laptop
• Software access
• A password reset
• A mobile phone

• They run behind the scenes — applies more to automation or workflows.
• They are optional — catalog items are fundamental to a request-based catalog.
• They provide options — variables and variable options collect the requester’s choices for an item; they are not the catalog item itself.

• CCTV system — Detective control: Cameras monitor and record activity, helping identify or investigate security incidents after—or while—they occur.
• Signs about being filmed — Deterrent control: The signs discourage people from attempting unauthorized or criminal activity because they know surveillance is present.

• Preventive: Stops an incident from occurring, such as a lock or access-control system.
• Corrective: Restores systems after an incident.
• Directive: Instructs people to behave in a certain way, such as a security policy.
• Compensating: Provides an alternative control when the preferred control cannot be implemented.

• C — Custom buttons display at the top and bottom of a page: Correct. In Salesforce Classic, buttons can appear in the page’s button areas, including the top and bottom of record pages.
• D — Custom buttons are available for Person Accounts: Correct. Person Accounts use the Account object, so Account custom buttons can be available on Person Account layouts.
• E — Custom buttons can reference an external app: Correct. A URL custom button can launch or navigate to an external application or website.

• A: JavaScript custom buttons are a Salesforce Classic feature and are not supported in Lightning Experience. They do not enhance Lightning Experience.
• B: The User object does not generally support custom buttons in the same way standard business objects do.

1. Create or verify cost groups

1. Set up the item model group

1. Create the costing version

1. Enter or calculate item costs

1. Activate the standard costs

• 16 VMs: one failure loses 25 GB and 10 cores—only 6.25% of memory.
• 8 VMs: one failure loses 12.5% of memory.
• 4 VMs: one failure loses 25%.
• 1 VM: one failure loses the entire application environment.

• Fileless malware: Nothing in the command indicates malware executing only in memory.
• Living-off-the-land binaries: Mimikatz is a credential-access tool, not a normal system utility used for LOLBin abuse.
• Social engineering: The command shows technical credential abuse, not manipulation of an accountant.

• Use one Azure AD directory for the organization.
• Separate divisions with subscriptions and/or resource groups.
• Assign each division’s administrator appropriate Azure role-based access control (RBAC) permissions, scoped to their subscription or resource group.

• Import — Loads data into Power BI. It requires a refresh, so it may not reflect changes within two minutes unless refresh is configured appropriately.
• Live connection — Connects to an existing Power BI semantic model or Analysis Services model; it is not the normal choice for connecting directly to an Azure SQL database.

• netstat: Shows local network connections and listening ports, but not which WAN path carries the traffic.
• nslookup: Resolves domain names to IP addresses.
• ping: Tests reachability and latency but does not show the route.

• A larger question bank with verified answers
• Explanations tied to ISACA exam domains
• Current content aligned with the exam blueprint
• Useful review or progress features

• Owner, Contributor, and Network Contributor provide sufficient management permissions.
• Reader can view Traffic Analytics data but cannot enable or configure it.

json 
{ 
  "Effect": "Deny", 
  "NotAction": [ 
    "iam:*", 
    "route53:*", 
    "cloudfront:*", 
    "support:*" 
  ], 
  "Resource": "*", 
  "Condition": { 
    "StringNotEquals": { 
      "aws:RequestedRegion": "eu-west-1" 
    } 
  } 
}

• SCPs set maximum permissions; they do not grant permissions. The default SCP allows actions, so the restriction must be an explicit Deny.
• aws:RequestedRegion checks the Region targeted by an API request.
• StringNotEquals: eu-west-1 denies requests directed to every other Region.
• NotAction allows designated global services to remain usable because they do not operate in a single AWS Region.
• Attaching the SCP to the OU makes it apply to existing accounts and accounts later added to that OU.

• s3:GetObject for the relevant objects
• s3:ListBucket if listing is required
• Appropriate bucket and object resource permissions

• B: Making the bucket public is insecure and unnecessary.
• C: Prompt engineering cannot override AWS IAM or encryption permissions.
• D: Data sensitivity does not determine whether the role can access it.

• Azure Resource Manager (ARM) templates define Azure resources in a declarative JSON file.
• You can deploy the same template repeatedly for each business unit, ensuring that identical resources are created consistently.
• Templates reduce manual administrative effort and support repeatable, automated deployments.
• Parameters can customize values such as names, regions, and sizes while keeping the overall resource configuration the same.

• A: Person Accounts cannot be merged directly with standard Contact records.
• C: There is no Account Setup option that automatically merges Person Account duplicates.
• D: Matching rules and duplicate rules can help identify or prevent duplicates, but they do not automatically merge Person Accounts. Also, relationship considerations do not change the basic merge capability.

• Code suggestions: Inline completions as you write code, such as lines, functions, or blocks.
• Chat: An interactive interface for asking questions, explaining code, generating code, and helping with debugging.

• Knowledge Base: Not listed as a standard Copilot Individual IDE feature in this context.
• Pull Request Diff Analysis: More closely associated with GitHub-based code review or pull-request features, not the core Individual IDE extension capabilities.

• Multiple nodes: Data is replicated several times in the primary region.
• Separate geography: A copy is asynchronously replicated to a secondary Azure region.
• Readable secondary: RA-GRS provides read-only access to the secondary replica, even when the primary region is available.

• GRS: Replicates to another region but the secondary copy isn’t normally readable.
• ZRS: Replicates across availability zones in the same region, not a separate geographic region.
• LRS: Keeps replicas within a single datacenter or region and provides no geographic redundancy.

• Virtual machine disks
• Databases
• Storage accounts
• File systems

• Site-to-site VPN: protects data moving between networks
• HTTPS: protects data moving between a client and website
• Encrypted email: generally protects the message while being transmitted

• At rest = stored data
• In transit = moving data
• In use = data currently being processed by a system

• Aggregation happens once, during the scheduled job.
• Dashboard users query a relatively small, precomputed table.
• Repeated users do not trigger expensive aggregations against the detailed sales table.
• Overwriting is appropriate because the summary is rebuilt for the reporting period.

• B: Structured Streaming is unnecessary for data that only needs daily refreshes and adds operational/compute overhead.
• C: A view recomputes the aggregation at query time, increasing latency and query cost.
• D: Delta caching may improve reads but does not replace the need to materialize the expensive aggregation, and cache availability is not the main design guarantee.

• Regional leads — Customer Community Plus

• Capacity planners — External Identity

• Customer Community does not provide the enhanced reporting/dashboard access required by regional leads.
• An Identity license is generally for internal Salesforce identity use and does not fit the external capacity-planning users as well as External Identity.

• Open or insecure ports
• Enabled legacy or insecure protocols
• Known vulnerabilities and misconfigurations
• Weak services and outdated software

• curl tests web requests and HTTP-based services.
• Wireshark captures and analyzes network traffic; it does not normally scan servers for weaknesses.
• netcat can test connectivity to individual ports and sometimes grab service banners, but it is not a comprehensive vulnerability scanner.

• The legacy system creates a signed JWT assertion.
• Salesforce validates the assertion using a certificate configured on a Connected App.
• Salesforce issues an access token for the integration user.
• No refresh token is required; the system can request a new access token when needed.

• Web Server Flow: normally uses a client secret and authorization/refresh tokens.
• Username-Password Flow: requires storing Salesforce credentials and is discouraged for integrations where stronger options are available.
• User Agent Flow: intended for user-interactive applications, not unattended server-to-server processing.

1. Define Power Platform DLP policies

1. Add custom prompt modifications

1. Conduct adversarial testing

• Leaf switches provide access ports for servers, endpoints, and other devices.
• Spine switches form the fabric’s backbone.
• Every leaf connects to every spine, creating a predictable, high-bandwidth, low-latency path.

• A: Adding both a spine and leaf is unnecessary for simply adding access ports.
• B: Adding a spine does not directly provide endpoint access ports.
• D: A single connection to one spine creates a bottleneck and a single point of failure.

• Business
• People
• Governance
• Platform
• Security
• Operations

• Cloud financial management
• Portfolio and program management
• Risk management
• Data governance
• Compliance and oversight

• SQL injection (SQLi): Attacks databases by inserting malicious SQL commands.
• Cross-site scripting (XSS): Injects scripts into web pages viewed by other users.
• Sideloading: Installing an application from outside the official app store. It may install unauthorized apps, but it does not generally unlock the operating system or enable restricted system features.

• A: My Domain is required for many SSO configurations, but if SSO works, it is unlikely to be the cause of losing the target record.
• B: HTTP-POST is a valid SAML binding and does not inherently prevent redirection.
• D: An incorrect Federation ID generally causes authentication or user-matching failure—not successful login to the home page.

• Customize Opportunity Contact Role

• Add the Opportunity Contact Role related list to the Opportunity page layout

• Campaign Member Role relates contacts or leads to campaigns, not opportunities.
• Campaign Member related list would expose campaign participation, not the stakeholders for the opportunity.
• Customize Campaign Role also concerns campaigns.