CIPS L5M5 Exam Prep
Managing Ethical Procurement and Supply (Page 6 )

• Each Case must follow defined support steps.
• Each step must be completed within a specified time limit.

• Case Escalation Rules: Escalate Cases based mainly on age or criteria; they do not model a complete sequence of service steps.
• Process Builder with Scheduled Actions: Can automate time-based actions but is not the standard framework for Case service-level commitments.
• Omni-Channel Routing: Routes work to agents based on capacity and priority; it does not track Case lifecycle deadlines.

• SharePoint search: Finds documents based on search terms, but it does not reliably identify every 32-character account number for DLP enforcement.
• A hunting query in Microsoft 365 Defender: Used for security investigations, not for defining sensitive content in a DLP policy.
• Azure Information Protection: Uses classification and labeling; it does not automatically identify this specific account-number pattern unless configured with a matching sensitive information type.
• RegEx pattern matching: Best suited for structured identifiers with a known format, such as account numbers, employee IDs, or policy numbers.

• Plenum: Describes a fire-resistant cable jacket rating, not a transmission medium or speed.
• Ethernet: Describes a networking technology; Ethernet can use copper or fiber, so the term alone does not identify the fastest cable type.
• DAC (Direct Attach Copper): Uses copper and is typically intended for short-distance, high-speed connections in data centers.

• The current and previous versions
• Which clauses were changed
• When each revision occurred
• Potentially, who made the changes

• Version validation: Verifies a version’s accuracy or integrity but does not primarily track revisions.
• Version changes: Not the standard name for a formal document-management process.
• Version updates: Describes updating a document, not the complete process of managing and tracking its revisions.

• Online payment fraud
• Account takeover
• Fake account creation
• Suspicious transactions

• Reviewing security objectives to ensure they support business goals.
• Ensuring security requirements are integrated consistently across business units.
• Coordinating security policies, risk management, controls, and awareness activities.

• Executive management: Provides direction, funding, and support, but usually does not manage day-to-day security integration.
• Board of directors: Provides governance and oversight, not operational security coordination.
• Steering committee: Helps coordinate and prioritize initiatives, but the CISO typically owns the overall security program and ensures its integration.

1. Which host originated the infection

1. Which remaining hosts are infected

• Continuous deployment: Automates software releases; it does not specifically test input handling.
• Static code analysis: Examines source or compiled code without executing it. It can find coding flaws but does not directly stress the application with malformed inputs.
• Manual peer review: Developers inspect code or design manually. Useful, but not the best practice specifically for testing how a live product handles invalid input.

• Unfamiliar locations or IP addresses
• Anonymous or malicious IP addresses
• Leaked credentials
• Unusual sign-in behavior

• SQL injection
• Cross-site scripting (XSS)
• Malicious or malformed web requests
• Some application-layer abuse

• Layer 4 firewall: Filters based mainly on IP addresses, ports, and connections; it lacks detailed web-request inspection.
• NGFW: Provides broader network security, but a WAF is more specialized for protecting web applications.
• UTM: Combines multiple security functions, but it is not necessarily optimized for web-application protection.

• Maintain head office control: Transfer pricing generally supports decentralisation rather than direct head-office control.
• Establish centralised decision making: This conflicts with divisional autonomy.
• Develop a top-down culture: Transfer pricing is intended to support empowered divisions and goal congruence, not impose purely top-down management.

• A — .gitignore: Controls Git tracking; it does not configure Copilot exclusions.
• B — copilot.ignore: This is not the standard GitHub Copilot Business exclusion mechanism.
• D — Renaming files: Adding _no_copilot has no recognized effect.

• Encryption to preserve confidentiality
• Integrity protection to detect alteration
• Authentication of the server through certificates

• SHA-256: A hashing algorithm; it does not encrypt data for transmission.
• SSL 3.0: Obsolete and insecure. It should not be used.
• AES-256: A strong encryption algorithm, but by itself it does not provide the complete secure communication protocol needed for data in transit.

• IaaS: You deploy and manage virtual machines, including the operating system and installed software. Azure manages the physical datacenter, hosts, and networking infrastructure.
• PaaS: Azure manages the infrastructure and operating system, while you deploy and manage your application code. Examples include Azure App Service and Azure Functions.

• Sales process: Controls which Opportunity Stage values are available.
• Record type: Associates the appropriate sales process with a business scenario and controls available picklist values.
• Page layout: Controls which fields are displayed and whether they are required or read-only.

• Energy Market Team 1 ? Record Type 1, Sales Process 1, Page Layout 1
• Energy Market Team 2 ? Record Type 2, Sales Process 2, Page Layout 2
• Services/Installation Team ? Record Type 3, Sales Process 3, Page Layout 3

• Existing measures
• Relationships
• Calculated columns
• Tables and fields
• Existing transformations in the model

• SharePoint folder: Reconnects to the source files. You would likely need to recreate the model and measures.
• Power BI dataflows: Primarily provide reusable data preparation and storage, but they do not automatically provide the existing semantic model and measures.
• Excel workbook: Connects directly to the source file and would also require rebuilding the model and measures.

• Azure Machine Learning is the overall Azure service.
• Machine Learning designer is the visual, drag-and-drop interface within Azure Machine Learning.
• Microsoft may refer to the broader product as Azure Machine Learning studio, while “Designer” remains the specific visual workflow tool.

• Azure Logic Apps: Workflow and integration automation.
• Azure Batch: Large-scale parallel or batch compute.
• Azure Cosmos DB: Globally distributed NoSQL database.

• Whether a user has a console password
• Password age and last password change
• Whether MFA is enabled
• Access key status
• Access key creation date and last-use information
• Access key age, which helps audit rotation

• IAM Access Analyzer identifies unintended access to resources; it does not report credential age or rotation.
• AWS Artifact provides AWS compliance documents and agreements, not details about your IAM users.
• AWS Audit Manager helps collect evidence for audits, but it is not the direct tool for viewing IAM credential rotation details.

• Access controls — ensuring only authorized users can access it.
• Encryption — protecting the data if it is intercepted or exposed.

• A password cracker would normally be identified by behavior such as loading password hashes or attempting dictionary/brute-force attacks.
• The question describes a routine audit, not password recovery.
• Simply encountering a protected file during an audit is characteristic of a misconfigured or insufficiently privileged FIM.

• D — Create sibling resource pools for the Production VMs and Test VMs.

• B — Configure a memory reservation on the Production resource pool.

• Shares only determine relative priority when resources are scarce; they do not guarantee memory.
• A parent resource pool alone does not provide a guarantee.
• A child pool for Test VMs does not reserve memory for Production.

CIMA P3 topics

• IT governance and systems strategy
• Systems development and implementation
• Change and project governance
• Strategic and business risk

• A — Plan for new systems: The committee should help identify and prioritise systems requirements and ensure planned systems support organisational needs.
• D — Consider competitive issues: New information systems may affect Y’s competitive position, service quality and efficiency. These strategic implications should be considered.
• E — Ensure the system meets company goals: This is a key governance responsibility. The committee should ensure the project remains aligned with Y’s objectives and delivers business value.

• B — Develop new systems: Detailed system development should be performed by IT specialists and project teams, not the steering committee.
• C — Manage the project: The project manager should handle day-to-day project management. The steering committee should provide oversight, challenge and key decisions, rather than manage daily activities.

• Azure creates a corresponding service principal in Microsoft Entra ID.
• The identity’s lifecycle is tied to the Azure resource.
• If the resource is deleted, Azure automatically deletes the identity.
• Only the associated resource can use that identity to request tokens.
• You can grant the identity permissions to access services such as Key Vault or Storage without storing credentials in code.

1. Identify the fact table

• Records something that happened, such as a sale, test, appointment, or measurement
• Contains foreign keys to other tables
• Contains measures or numeric results
• Has many rows

2. Identify a dimension table

• Describe people, products, dates, locations, or departments
• Contain descriptive columns
• Are referenced by the fact table
• Have fewer rows than the fact table

3. Identify the surrogate key

• System-generated
• Unique within the dimension
• Often named PatientKey, CustomerKey, or similar
• Usually an integer
• Not meaningful outside the model

• What information each stakeholder needs
• When and how often it should be communicated
• Which format or channel should be used
• Who is responsible for communicating it

• A: The team should not decide stakeholder communications without first checking the established plan and CEO’s needs.
• B: An executive summary may be appropriate, but choosing a solution before reviewing the plan is premature.
• D: The stakeholder engagement plan addresses how to engage stakeholders, but this is primarily a communication planning issue.

• Reviewing and validating generated code
• Checking security, licensing, and quality concerns
• Testing the implementation
• Making the final design and coding decisions

• A: Copilot is not a complete replacement for developers.
• C: Human input, review, and oversight are still required.
• D: Copilot Chat supports many tasks beyond debugging, including explanation, generation, refactoring, and testing assistance.

• Input feature distributions differ from training data ? Analyze dataset drift metrics

• Model accuracy drops without code changes ? Analyze dataset drift metrics

• Endpoint latency increases under load ? Investigate scaling and infrastructure metrics

• SAML: Enables federated authentication and single sign-on between the IdP and SaaS providers.
• OAuth tokens: Allow delegated application access; OAuth is not primarily the first step for employee SSO.
• Password vaulting: Stores or autofills multiple passwords but does not eliminate the separate credentials or provide true federation.

• Gaia Portal: Controlled by Gaia administration settings, not SmartConsole Trusted Clients.
• SSH: Controlled by Gaia or operating-system SSH access settings.
• Security Gateway(s): SmartConsole connects to the Security Management Server, not directly to gateways for this purpose.

• Supervised learning requires labeled examples to learn how to classify customers.
• Reinforcement learning learns through actions, rewards, and penalties, which is not the main task here.
• RLHF uses human feedback to improve model behavior, typically for generative AI, not customer segmentation.

• Identity provider (IdP): Authenticates users and asserts their identity.
• Service provider (SP): The application being accessed—in this case, Salesforce/the employee portal.
• Identity store: A directory that stores user identities, such as Active Directory.
• Authentication store: A system used to validate credentials.

• Third-party enterprise application with embedded AI: The provider manages most security controls. The customer mainly manages users, data, and configuration.
• Application using an existing third-party FM: The customer controls the application and its inputs/outputs, but the provider controls the underlying model and infrastructure.
• Fine-tuning a third-party FM: The customer has additional responsibility for training data, data protection, and model behavior, but still depends on the provider’s base model and platform.
• Building and training a model from scratch: The customer controls the model, training data, application, deployment, and many security safeguards. This creates the greatest security ownership.

• Azure Resource Manager (ARM) templates
• Or, in newer Azure terminology, Bicep files

sql 
CREATE PROCEDURE dbo.usp_CreateOrder 
AS 
BEGIN 
    SET NOCOUNT ON; 
    SET XACT_ABORT ON; 


    BEGIN TRY 
        BEGIN TRANSACTION; 


        INSERT INTO dbo.Orders (/ columns /) 
        VALUES (/ values /); 


        SET @OrderID = SCOPE_IDENTITY(); 


        COMMIT TRANSACTION; 
    END TRY 
    BEGIN CATCH 
        IF @@TRANCOUNT > 0 
            ROLLBACK TRANSACTION; 


        THROW; 
    END CATCH; 
END;

• BEGIN TRY contains the transactional work.
• SCOPE_IDENTITY() retrieves the identity generated by the INSERT; it belongs after the insert, not as the error-handling logic.
• COMMIT runs only if all statements succeed.
• BEGIN CATCH handles failures.
• IF @@TRANCOUNT > 0 prevents attempting a rollback when no transaction is active.
• ROLLBACK undoes partial changes.
• THROW re-raises the original error with consistent details for the application.
• SET XACT_ABORT ON ensures many run-time errors automatically terminate and roll back the transaction.

• MAC flooding: Overwhelms a switch’s MAC address table, potentially causing traffic to be broadcast.
• DNS spoofing: Provides false DNS responses to redirect users.
• ARP poisoning: Sends false ARP information to associate an attacker’s MAC address with another device’s IP address.

• 800 devices ? a scalable, centralized solution is needed.
• Four hardware/vendor classes ? the tool must handle different drivers and images.
• Two user groups ? it should allow different configurations for each group.
• “Distribute custom images” ? an imaging/deployment tool is required, not just a file-copy utility.

1. Clear principles and boundaries — Employees have freedom, but decisions must remain within clear organizational values, policies and limits.
2. High degree of freedom — Managers are trusted to make decisions rather than seeking continual approval from senior management.
3. Frontline customer responsibility — Customer-facing managers should be empowered to manage customer relationships and respond quickly to needs.
4. Transparent and ethical information — Information should be openly available and used honestly, supporting trust and informed decision-making.

• Replaces the verbal message — this describes non-verbal communication being used instead of words.
• Substitutes for verbal communication — similar; it means communicating without speech.
• Confuses the verbal message — this occurs when non-verbal signals contradict or obscure the spoken message.

• The requirement is to obtain an assessment of the Azure environment’s design.
• The proposed solution is the Premier support plan.
• Premier can provide this type of guidance, but it is a higher-tier, more expensive option.
• The question specifically says to keep costs to a minimum. A lower tier—typically Professional Direct in the support-plan model used by this question—provides architectural/design guidance.

• Espionage: Stealing confidential information, often for a competitor or government.
• Data exfiltration: Unauthorized transfer of data outside the organization. This could occur, but the question focuses on using unapproved access methods.
• Nation-state attack: An attack sponsored or conducted by a government.
• Shadow IT: Employees using technology or access methods outside the organization’s approved security controls.

• Reviewing security policies and standards checks whether controls are documented, not whether they work.
• Reviewing security logs may show that monitoring is occurring, but does not directly establish that preventive controls are effective.
• Analyzing technical security practices is broad and may assess implementation, but it is less objective than an actual controlled attack.

• Design/compliance effectiveness: policies, standards, and procedures
• Operational effectiveness: logs, records, and evidence that controls operate
• Technical security effectiveness: penetration testing or vulnerability testing

• Matching hashes suggest the file has not changed.
• Different hashes indicate that the file was modified, whether authorized or unauthorized.

• Backup: Helps recover the previous version but does not identify or stop unauthorized changes.
• File labels: Classify or mark files; they do not verify integrity.
• Security audit: May discover weaknesses or improper changes, but is periodic and not a direct technical integrity control.

• Laws and regulations
• Litigation holds
• Industry or contractual obligations
• Tax, financial, health, or privacy requirements

• Business strategy and direction: May influence retention, but cannot override legal requirements.
• Storage capacity and longevity: Practical considerations, not the primary driver.
• Business ease and value analysis: May support decisions after compliance obligations are identified.

• Restrict a port to a defined number of MAC addresses
• Use statically assigned or “sticky” MAC addresses
• Shut down or restrict the port when violations occur

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect suspicious network activity, but is not the primary control for limiting switch MAC entries.
• NGFW: Filters traffic at the network boundary; it does not directly prevent MAC table flooding on access switches.

• VLAN 10 for data
• VLAN 20 for voice

• A: Describes physical trunking or logical switch ports, not an SVI.
• B: An SVI can provide management access, but that is only one use—not the best description here.
• D: SVI use is not related to running out of physical ports.

• Restrict a port to a defined number of MAC addresses
• Use statically configured or “sticky” MAC addresses
• Shut down or restrict the port when violations occur

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect suspicious traffic but is not the primary control for switch-port MAC limits.
• NGFW: Filters routed network traffic, not the switch’s CAM/MAC address table directly.

• Microservices: An application-design approach that divides an application into smaller services. It does not inherently reduce the number of operating systems.
• Virtualization: Creates virtual machines, but each VM generally requires its own complete operating system. This improves isolation but does not minimize OS instances as effectively.
• Infrastructure as code: Uses code to automate infrastructure deployment and configuration. It improves consistency but does not determine how many operating systems are used.