CIPS L4M5 Exam Prep
Commercial Negotiation (Page 12 )

• Key difference: DirectQuery leaves data in the on-prem SQL Server and queries it live. That means every visual request can trigger online processing on the source, which can be slower and adds load on the on-prem system. In contrast, Import loads data into the Power BI data model, so visuals render from the in-memory engine (faster).

• Why that helps with the requirements:

• Why not A or B: Both rely on live data via DirectQuery, which contradicts the goal to minimize online processing and visuals performance.

• Why not D: It uses Import, but refreshing hourly adds unnecessary processing and complexity when daily refresh already satisfies currency needs.

• Correct choices: A and D.

• Why not B, C, or E?

• An Azure pay-as-you-go subscription follows an operational expenditure (OpEx) model.
• With OpEx, the organization pays for services as they are used, typically based on consumption.
• There is no need to purchase and maintain physical servers upfront.
• This contrasts with capital expenditure (CapEx), where the company makes a significant upfront investment in infrastructure, such as on-premises Hyper-V hosts.

• Create a record-triggered Flow on Opportunity.
• Run it when the record is created or updated.
• Add entry criteria such as Probability > 50%.
• Use Create Records to create the related Sales Demo Request, populating its Opportunity lookup.

• Apex Trigger: Possible, but unnecessary custom code for a straightforward automation requirement.
• Workflow Rule: Cannot create a related custom record.
• Process Builder: Could create a record, but Flow is Salesforce’s preferred and more capable declarative automation tool.

1. Selling price per unit: $750
2. Required annual return:

1. Required profit per unit:

1. Target cost per unit:

• A. Implement retries with exponential backoff

• C. Reduce the frequency and/or size of requests

• B. Use PutRecord instead of PutRecords — PutRecord sends one record per call and does not remove the underlying throughput limitation. It may increase request overhead.
• D. Use Amazon SNS instead — SNS is not a direct fix for Kinesis shard throttling and changes the required streaming architecture.
• E. Reduce KCL consumers — KCL consumers read from Kinesis; they do not solve producer-side PutRecords throttling.

• IKE: Negotiates security parameters for IPsec VPNs; it does not identify switch ports.
• VLAN: A logical network segmentation method, not a discovery protocol.
• netstat: Displays local network connections and listening services, but cannot identify the physical switch or port.

• Create Power Query parameters for the Azure SQL server/database—or at least the database name.
• Use the parameter in the PBIX connection.
• Publish the same PBIX separately to the relevant development, test, and production workspaces.
• Set each dataset’s parameter value in the Power BI service so it points to the corresponding Azure SQL database.

• Development dataset ? DevelopmentDB
• Test dataset ? TestDB
• Production dataset ? ProductionDB

• The same PBIX is used for every lifecycle stage.
• Each stage consumes data from its matching database.
• Deployment pipelines are not required.
• Azure SQL is a cloud source, so gateway administration is generally avoided.
• Only the parameter value differs between published datasets, reducing maintenance.

• Used for communication on the local link or LAN segment
• Automatically generated on IPv6-enabled interfaces
• Not routed by routers to other networks
• Commonly used by devices to communicate with their local IPv6 router
• Begins with FE80 through FEBF

• FC00::/7 — unique local unicast
• FE80::/10 — link-local unicast
• FF00::/8 — multicast
• 2000::/3 — global unicast

• The VM keeps its configuration, disks, IP settings, and associated resources.
• The operation may cause downtime.
• You cannot guarantee that it will move specifically to Host2; Azure selects the new host.
• Update management is for update configuration, not host relocation.
• Moving to another subscription does not move the VM to a different physical host.
• Usage location is unrelated to VM placement.

• I can’t view the images, so I can’t tell which table is labeled as A in your screenshot. But here’s how to decide:

• How to identify the fact table:

• How to identify the surrogate key in the Patient table:

• Relationship:

• AWS IoT Greengrass supports local ML inference using models trained in Amazon SageMaker.
• The model and inference code run on the factory’s local server, so processing continues even when internet connectivity is unavailable.
• A Greengrass component can:

• This provides low latency and avoids sending images to AWS for every inference.

• A: Uses AWS-hosted services and therefore depends on internet connectivity. It would fail during an outage.
• C: Snowball Edge is unnecessary for this use case and adds deployment complexity. A local Greengrass server is the intended edge-inference solution.
• D: Amazon Monitron is designed for monitoring industrial equipment health, not analyzing camera images with a custom SageMaker model.

bash 
docker run -it microsoft/azure-cli:0.10.17

• docker run starts an Azure CLI container; it does not automatically connect to the AKS cluster.
• The command does not run kubectl apply.
• The container would need the appropriate Kubernetes tools and AKS credentials.
• The device or container must obtain cluster credentials, typically using an AKS credential command, before running Kubernetes commands.

bash 
az aks get-credentials --resource-group <resource-group> --name <aks-cluster> 
kubectl apply -f myapp.yaml

• Normalize casing in the data source—for example, convert all values to uppercase or lowercase.
• Add an index key to provide a unique, stable identifier for each row or value.

• Exploitability
• Attack complexity
• Required privileges
• User interaction
• Impact on confidentiality, integrity, and availability

• CVE: Identifies and tracks a specific vulnerability; it does not primarily measure severity.
• OSINT: Open-source intelligence gathered from publicly available sources.
• SOAR: Security orchestration, automation, and response technology used to automate security workflows.

• A: Security groups do not control traffic to an S3 gateway endpoint in this way. Gateway endpoints are configured through route tables.
• B: An S3 bucket policy may be needed for authorization, but the error specifically indicates a connectivity or endpoint-routing problem.
• C: Glue connection settings do not require a fully qualified domain name to resolve this endpoint issue.

• Low usage during the first three weeks
• Very high usage during the last week

• High availability: Keeps services running despite failures.
• High latency: Means slow response times; it is not a benefit.
• Load balancing: Distributes traffic across resources but does not specifically address scaling resources up and down.

• Authenticating websites with TLS/HTTPS
• Enabling certificate-based VPN authentication
• Signing or encrypting email
• Supporting device or user authentication

• VLAN tagging: Uses network-frame tags, such as 802.1Q; it does not rely on X.509 certificates.
• LDAP: May integrate with PKI in some environments, but X.509 certificates are not most commonly associated with LDAP itself.
• MFA: Certificates can be one authentication factor, but X.509 is fundamentally a PKI technology.

• R-squared (R²): mede quanto da variação dos valores reais é explicada pelo modelo. É mais usado em regressão, não em classificação.

• Accuracy (acurácia): mede a proporção de previsões corretas em relação ao total. É adequada para a classificação de imagens da questão.

• RMSE (Root Mean Squared Error): mede o tamanho médio dos erros entre valores previstos e reais, penalizando erros maiores. É usado principalmente em regressão.

• Learning rate (taxa de aprendizado): controla o tamanho dos ajustes feitos pelo modelo durante o treinamento. Não é uma métrica de avaliação; é um hiperparâmetro.

• Workspace: Stores notebooks, libraries, jobs, and other project resources.
• Notebooks: Interactive documents containing code, queries, visualizations, and explanations. Common languages include Python, SQL, Scala, and R.
• Clusters: Groups of virtual machines that run Spark workloads. Clusters can be started, stopped, and automatically scaled.
• Data access: Databricks can read from services such as Azure Data Lake Storage, Azure Blob Storage, and Azure SQL.
• Jobs: Automate notebooks or data-processing workflows on a schedule or in response to events.

• Coordinate and manage the assessment team
• Assign assessment activities
• Direct interviews, examinations, and tests
• Ensure the assessment follows the CAP

• Answer key: Lead Assessor — likely wrong
• CAP-based answer: C3PAO

1. Determine which host was infected first—the originating host.
2. Decide whether each other host is clean or infected based on communication and event logs.

• Compare timestamps and find the earliest suspicious event.
• Look for the host that initiated the malicious connection, file transfer, exploit, or command—not merely a host that later received traffic.
• Follow the timeline through the firewall:

• A host is likely infected if it both receives suspicious activity and then initiates related malicious traffic.
• A host may be clean if the firewall blocked the connection and there is no evidence of execution or follow-on communication.

1. Get Data ? Folder in Power BI Desktop.
2. In Power Query Editor, expand the Attributes column to expose metadata such as hidden status and other file attributes.
3. Remove the Content column (and any other data columns you do not need).

• Name
• Extension
• Date accessed
• Date modified
• Folder Path
• Attributes
• Content

• Equipment and hardware
• Facilities
• Inventory
• Backup media
• Supplies stored at an alternate or remote location

• Personal belongings of staff: Usually not organizational assets.
• DR line-item revenues: Revenue is a financial impact, not a physical asset.
• Cloud-based applications: These are primarily logical or information-processing assets, even though they depend on physical infrastructure.

• In Microsoft Teams Phone System, a single Auto Attendant can handle multiple time-based greetings by using separate schedules for office hours, after hours, weekends, and holidays.
• You can configure one Auto Attendant with four distinct greetings mapped to:

• Open the Teams admin center > Voice > Auto attendants, edit or create an Auto Attendant.
• Under Time-based routing, define four rules:

• Create a Holiday schedule with the relevant dates (e.g., Easter, Christmas) and assign the Holiday greeting.
• Save the configuration.

• If your environment cannot separate weekend from after-hours within a single Auto Attendant, you might technically need more than one Auto Attendant.

• Planning – identifying the need, objectives, scope and resources.
• Analysis – understanding business requirements and current problems.
• Design/development – determining how the system will work.
• Implementation – installing the system and putting it into operation.

• B: Moving the task may affect the critical path and should not be done before evaluating the planned response and impacts.
• C: Excluding a required task is not appropriate without formal analysis and stakeholder approval.
• D: Lessons learned and the risk log should be updated, but only after or alongside managing the immediate issue; updating them is not the first action.

• A: My Domain is required for many SSO configurations, but if SSO works, it is unlikely to be the cause of losing the target record.
• B: HTTP-POST is a valid SAML binding and does not inherently prevent redirection.
• D: An incorrect Federation ID generally causes authentication or user-matching failure—not successful login to the home page.

• B — Single customer login across properties: Customer 360 Identity provides centralized identity services, allowing an organization to recognize a customer across multiple digital properties and applications. This helps UC understand authenticated activity as part of a broader customer identity.

• C — Multi-brand support: Customer 360 Identity can support multiple brands and user experiences. Identity services can remain centralized while correlating a customer’s activity across different corporate brands or channels.

• A: Customer 360 Identity does not automatically populate all data into Customer 360 Data Manager and Customer 360 Audiences. Integration and data configuration are still required.
• D: Tracking anonymous activity and linking it after sign-up may be possible through broader customer-data and tracking implementations, but it is not the primary Customer 360 Identity benefit tested here. Identity focuses mainly on authentication, registration, and cross-property identity correlation.

• Customize Opportunity Contact Role

• Add the Opportunity Contact Role related list to the Opportunity page layout

• Campaign Member Role relates contacts or leads to campaigns, not opportunities.
• Campaign Member related list would expose campaign participation, not the stakeholders for the opportunity.
• Customize Campaign Role also concerns campaigns.

Question 3: AWS Storage Gateway File Gateway

• A: S3 bucket per user — S3 is object storage, not a traditional shared file system; mounting it requires extra tools and is less efficient.
• B: File Gateway — Provides a local file share using standard file protocols while storing files in Amazon S3. This preserves convenient local access and extends storage capacity.
• C: WorkSpaces and WorkDocs — Designed for virtual desktops and document collaboration, not large shared file storage.
• D: EC2 with EBS — EBS is attached to one EC2 instance and is not designed for direct multi-user file sharing.

• Developed and maintained independently
• Deployed without changing the entire application
• Scaled separately based on demand
• More resilient when another service has problems

• A: Functional testing is useful, but it is not the main practice described.
• B: Automation helps deployment, but the scenario focuses on architectural decomposition.
• C: Multiple locations improve availability, not application modularity.

• A — Custom Button: A button can launch a flow, typically by passing the flow’s URL and record context.
• D — From a Process: A Process can invoke a flow using an Apex action configured for flow invocation. However, this is automation-triggered, not directly accessed by a user.
• B — Quick Action: In current Salesforce functionality, a Flow Quick Action can launch a screen flow directly from a record page. This makes B a valid modern method.
• C — Visual Workflow Launcher: This is not generally listed as a standard access method in current Salesforce terminology; Salesforce commonly uses the Flow component on Lightning pages instead.

• S3 Lifecycle rules automate actions such as transitioning objects to different storage classes or deleting old objects.
• S3 bucket policies control access permissions; they do not preserve earlier object versions.
• S3 server-side encryption protects data confidentiality by encrypting objects at rest, but it does not prevent deletion or overwriting.

• Accidental deletion or overwriting ? S3 Versioning
• Unauthorized access ? bucket policies and IAM
• Data encryption ? server-side encryption

• Progress iteratively with feedback focuses on making improvements in manageable steps and learning from feedback.
• Optimize and automate focuses on maximizing value from resources and automating suitable activities.
• Start where you are focuses on assessing the current situation and reusing what already exists.

• Answer: No

• Why: Using several Azure AD directories (tenants) would create separate identity stores for each division, which significantly increases administrative overhead. You’d need cross-tenant access management, separate governance, and duplicated admin efforts, which goes against the goal of minimizing administrative work.

• How to meet the goal instead:

• Drops packets when traffic exceeds a certain bitrate: This describes traffic policing, not shaping.
• Fragments large packets and queues them: Shaping does not fragment packets as its primary congestion-control action.
• Drops packets randomly from lower-priority queues: Packet dropping may occur if a shaping queue becomes full, but it is not the defining behavior.

• Shaping: buffers and delays excess traffic.
• Policing: drops or marks traffic that exceeds the configured rate.

• Basic: Self-help only; no technical support or design assessment.
• Developer/Standard: Technical support, but generally not the full proactive architecture guidance required here.
• Professional Direct: Includes proactive guidance and architecture recommendations.
• Premier: Also supports this, but is not the minimum-cost option.

• What the scenario asks: You have a Power BI semantic model that pulls from multiple sources (Azure SQL Database and SharePoint Online), must support a single dataset for three reports, keep data current (daily refresh by 7 AM PT), and apply RLS to limit sales data by region. You need to choose a storage mode for the tables.

• Correct choice: Dual storage mode.

• Why Dual fits:

• Key concepts:

• Modelo de embeddings multimodal: transforma texto e imagens em vetores no mesmo espaço semântico. Isso permite comparar uma consulta textual com imagens, ou uma imagem com textos relacionados.
• Modelo generativo multimodal: interpreta diferentes modalidades e gera conteúdo, mas não é a escolha específica para indexação e busca vetorial.
• Modelo de geração de imagens: cria imagens, portanto é inadequado.
• Modelo de embeddings de texto: não atende consultas com imagens.

• Options:

• Answer: The correct choice is A (800-61r3).

• NIST SP 800-61 Rev. 3 is the dedicated guide for incident handling/response and reflects the latest guidance on the incident response lifecycle (preparation, detection/analysis, containment, eradication, recovery, post-incident activity).
• 800-61r2 is an older revision of the same incident response guide.
• 800-53 covers security and privacy controls, not a specific incident response standard.
• 800-171 focuses on protecting CUI in non-federal systems and networks, not incident response guidance.

• The files are stored in a document library, which is exposed through the SharePoint Folder connector.
• The connector returns file metadata, including Folder Path, Name, and Content.
• In Power Query, filter Folder Path so only files in the manufacturing reports folder are retained.
• You can then combine the remaining Excel files because they all have the same structure.

• SharePoint List is for SharePoint lists, not document-library files.
• Combine & Load combines files immediately, before you filter to the required folder, and may include unwanted files.
• Transform gives you the opportunity to filter the file list first, which is more efficient and targeted.

• Who performed the action
• What action occurred
• When it occurred
• Where it originated
• Whether it succeeded or failed

• Investigating suspicious activity: Important, but investigation depends on having adequate audit data first.
• Storage allocation: Necessary for retention, but storage does not help if the records lack meaningful details.
• Actions after audit failure: Part of operational planning, not the primary assessment of the application’s audit capability.

• Multi-pass wipe: Overwrites the drive’s existing data multiple times, making recovery much more difficult while preserving the drive’s functionality.
• Single-pass wipe: May be sufficient in some modern sanitization standards, but is presented here as less secure than multiple overwrites.
• Degaussing: Uses a strong magnetic field to disrupt data. It can render the drive unusable or unreliable, reducing its resale value.
• Pinning: Is not an appropriate data-sanitization method.

• Prevent connections to malware command-and-control servers
• Identify infected systems making those DNS requests
• Collect information for incident response

• A: Attackers do not normally use sinkholes to map a company’s domain structure.
• B: Redirecting employees from legitimate sites to attacker-owned sites describes malicious DNS manipulation, not a defensive sinkhole.
• D: Attracting attackers away from real resources is more closely associated with a honeypot or deception system.

• Inherent risk: Risk that exists before controls are implemented.
• Avoided risk: Risk eliminated by choosing not to perform the risky activity.
• Operational risk: Risk arising from failures in processes, people, systems, or daily operations.

• Permanent table (E): Correct. A dropped permanent table can be restored with UNDROP TABLE during its Time Travel retention period. Permanent tables also have Fail-safe protection.
• Transient table: It can also generally be restored during its shorter Time Travel period, although it has no Fail-safe. Therefore, excluding it makes the question questionable.
• Temporary table: Usually cannot be recovered after it is dropped; its lifecycle is limited to the session.
• Materialized view (D): The answer key treats it as recoverable, but recovery behavior depends on the specific Snowflake object/version capabilities. It should not be confused with an ordinary view.