Free 350-901 exam questions in PDF & AI Tutor

AI Explanation - verified by bill.dailey on: July 25, 2026
Question 159:
Question 159 asks about the primary benefit of adding automation and orchestration to a SIEM.
Answer: D) acts as a workforce multiplier.
Why:

Automation handles repetitive tasks, and orchestration coordinates responses across tools (SIEM, SOAR, EDR, etc.).

This allows the security team to process more events with the same number of people, improving throughput and response times.

Analysts can focus on more complex tasks like investigation and threat hunting instead of manual triage.

Why the other options aren’t the primary benefit:

It increases complexity: automation can reduce complexity when well-implemented; complexity is not the main intended benefit.

It removes technical debt: automation/OR focuses on current incident response efficiency, not primarily on architectural debt.

It adds additional guard rails: governance is important but not the core value of automation/orchestration within a SIEM.

Virginia Beach, United States

AI Explanation - verified by User2168 on: July 22, 2026
Question 22:
Question 22 asks: In a Cisco SD-Access fabric, which control plane protocol is used for mapping and resolving endpoints?
Answer: D — LISP
Explanation:

The mapping and resolution of endpoint identities (EIDs) to their location (RLOCs) in an SD-Access fabric is handled by the control plane using the LISP protocol.

Why not the others:

- DHCP is for IP address assignment, not endpoint mapping. - VXLAN is the data-plane encapsulation used by the overlay, not the control-plane mapping protocol. - SXP is not the standard protocol used for endpoint mapping in SD-Access.
In short, SD-Access relies on LISP for dynamically mapping endpoints to their location in the fabric. If you want more detail on how EID-to-RLOC mapping works in SD-Access, I can walk through the mapping process.
D'iberville, United States

AI Explanation - verified by User9198 on: July 28, 2026
Question 116:

Answer: A — EC2 Image Builder

Why: EC2 Image Builder is AWS’s fully managed service designed to automate the creation, testing, and ongoing management of custom EC2 AMIs. It lets you build image pipelines that start from a base image, apply software/components, run tests, and publish/distribute the resulting AMIs across regions or accounts.

How it works (high level):

- Define a pipeline with a base image, build components (software to install), and test components (validation tests). - Automatically build new AMIs, run validations, and if successful, distribute them to target regions/accounts. - Schedule updates to keep images current and compliant.

Why not the other options:

- Amazon Machine Image (AMI): not a service; it’s the image format itself. - AWS Launch Wizard: assists with deploying resources, not specifically for image creation/testing. - AWS Elastic Beanstalk: app deployment service, not for building custom AMIs.

Quick tip: Use EC2 Image Builder to reduce manual image maintenance and drift, and to enforce consistent, tested base images across environments.

Busan, South Korea

AI Explanation - verified by User1509 on: August 07, 2026
Question 103:
Question 103 is a VPN configuration simulation. The required settings are:

Strongest encryption algorithms: Choose the strongest available encryption and integrity options, typically AES with the largest key size and a secure integrity algorithm.

Encrypt all traffic: Select tunnel mode rather than transport mode. Tunnel mode encrypts the entire original IP packet, which is appropriate for a site-to-site VPN between branch networks.

Secret-password authentication: Configure a pre-shared key (PSK) on both VPN concentrators. The key must match at both ends.

The answer key shows A, but the screenshots are unavailable here, so I cannot verify which specific controls correspond to A. The important concepts are strong algorithms + tunnel mode + matching pre-shared key. Also ensure the same compatible VPN parameters are configured on both concentrators; otherwise, the tunnel will not establish.
Miami Beach, United States

AI Explanation - verified by User6405 on: July 29, 2026
Question 51:
Here’s a focused explanation of question 51.

Context: You’ve enabled auditing in Dataverse and need to trim audit data to free storage. The question asks which deletion options you can use.

What the options typically mean:

- by record: delete audit logs for specific records (per-entity instance). - between two specified dates: delete audit logs that fall within a date range (a window you specify). - by table older than a specified date: delete all audit logs for a given table that are older than a date (per-table purge). - by column: not a standard deletion criterion for auditing. Auditing is managed at the table/record level, not by a column.

About the provided answer (A, C, D): The list includes “by column,” which isn’t a typical or supported way to purge audit data. The more plausible trio is A (by record), B (date range), and C (by table older than date). If the exam expects A, C, D, that seems incorrect or mis-stated in the source.

Practical takeaway: To reduce audit storage, use per-record deletions, per-table purge by date, and/or date-range deletions as supported by the environment’s audit management UI or admin docs.

If you’d like, I can pull the official Microsoft docs to confirm the exact supported deletion criteria for audit data.
Frankfurt Am Main, Germany

AI Explanation - verified by User1887 on: July 22, 2026
Question 20:

The correct answer is Mass Transfer Tool.

Why:

The Mass Transfer Records tool is Salesforce’s built-in way to reassign ownership of existing records in bulk. In this scenario, you need to transfer ownership of the departed rep’s accounts and opportunities to a new rep while keeping the team structure intact.

How to use it (high level):

Go to Setup > Data Management > Mass Transfer Records.

Choose the object: Accounts (and then Opportunities, if needed).

Set “Transfer From” (the leaving rep) and “Transfer To” (the new rep).

Decide whether to transfer related records as well (e.g., opportunities tied to accounts) and proceed.

Review and confirm.

Why not the other options:

Data Loader / Data Import Wizard are for bulk import/export, not bulk reassigning ownership.

Dataloader.io is a third-party tool; the built-in Mass Transfer tool is the standard Salesforce method for this task.

Milan, Italy

AI Explanation - verified by User5513 on: August 11, 2026
Question 18:
Correct answer: B — S3 Versioning
S3 Versioning keeps multiple versions of an object in the same bucket. If someone accidentally deletes or overwrites an object, the previous version can be recovered.
Why the others are incorrect:

S3 Lifecycle rules automate actions such as transitioning objects to different storage classes or deleting old objects.

S3 bucket policies control access permissions; they do not preserve earlier object versions.

S3 server-side encryption protects data confidentiality by encrypting objects at rest, but it does not prevent deletion or overwriting.

The key distinction is:

Accidental deletion or overwriting ? S3 Versioning

Unauthorized access ? bucket policies and IAM

Data encryption ? server-side encryption

Mumbai, India

AI Explanation - verified by User1075 on: July 20, 2026
why not the other answers
Here’s why the other options aren’t the best next step after a new motherboard install with POST failure:

A. Flash the BIOS: Not the first move. A BIOS update can be risky when POST is failing. It’s better to first rule out simpler causes (like RAM seating). BIOS flashing is usually done if the CPU isn’t supported by the current BIOS, which you’d check after RAM seating.

B. Check the CMOS battery: Possible but unlikely the immediate cause. CMOS battery issues would more likely cause BIOS settings to reset or clock problems. RAM seating is a more common, direct fix after a motherboard swap.

D. Reinstall the old motherboard: Not a troubleshooting step for the new system. The goal is to get the new motherboard to POST, not revert to old hardware.

C. Reseat the RAM: Correct because memory seating problems are the most common cause of POST failures after a motherboard swap. Re-seating ensures proper contact in the new board’s slots.

Indpls, United States

AI Explanation - verified by User2560 on: July 26, 2026
Question 1:
Correct answers: A and B

Azure Resource Manager templates: Use ARM templates to define the VM infrastructure and baseline configuration as code. This ensures all Windows Server 2016 VMs are created with a uniform setup, minimizing manual configuration.

PowerShell Desired State Configuration (DSC) extension for Windows: DSC enforces a defined state across all servers and can automatically remediate drift. This keeps the VMs in the desired configuration with minimal ongoing admin effort.

Why not C? The Custom Script Extension runs scripts on a VM but doesn’t enforce or continuously maintain a uniform state across multiple VMs, so it’s less suitable for ongoing configuration management.
Chennai, India

AI Explanation - verified by jellenac on: July 28, 2026
Question 45:

Answer: Data enhancement.

Why: Augmenting gold-layer tables with an additional dataset is enriching or enhancing the existing data to support the ad-hoc analysis. The other options don’t capture the idea of adding external data to improve the dataset (ad-hoc improvements = tweaks, last-mile dashboarding = building dashboards, last-mile ETL = ETL steps at the end of the pipeline). In practice, this is often also called data enrichment.

Sarajevo, Bosnia And Herzegovina

AI Explanation - verified by rashmica.ts.9 on: July 19, 2026
Question 10:
Correct answer: E. “Tasks run in parallel via slots.”
Why:

In Spark, an executor is a JVM that can have multiple cores. Each task can consume some CPUs (spark.task.cpus).

The executor’s resources are effectively partitioned into slots, where each slot can run one task. The number of slots per executor is roughly spark.executor.cores / spark.task.cpus.

Therefore, multiple tasks can run in parallel within the same executor (via these slots). So the statement “Tasks run in parallel via slots” is correct.

Why the other options are wrong:

A: A slot is not another name for an executor; a slot is a unit inside an executor.

B: There’s no requirement that there must be fewer executors than tasks; tasks can be scheduled over time across the available slots.

C: An executor can run more than one core; it’s not limited to a single core.

D: There isn’t a rule that there must be more slots than tasks; tasks can wait if slots aren’t available, and you can have equal or even fewer slots than concurrent tasks.

Bengaluru, India

AI Explanation - verified by nanrany on: July 31, 2026
Question 345:

Correct answer: D — AWS Migration Hub

Reason:

AWS Migration Hub provides a single location to track the progress of application migrations. It offers a centralized dashboard to view migration status across multiple tools and projects.

Why the others aren’t suitable:

AWS Application Discovery Service helps inventory and map on-prem applications and their dependencies, not a single progress tracker.

AWS Application Migration Service (formerly SMS) performs the actual lift-and-shift migrations, but isn’t the centralized tracker itself.

AWS Service Catalog manages catalogs of IT services for self-service deployment, not migration progress.

Busan, South Korea

AI Explanation - verified by is.chan.army on: August 03, 2026
Question 72:

Short answer: The correct term is Anti-forensics (option D), not “Felony.”

Why: The actions described—hiding files in slack space, changing file headers, placing suspicious files in executables, and altering metadata—are classic anti-forensics techniques. They’re used to hinder or obscure forensic analysis, not to label the act as a legal category.

About the options:

- Anti-forensics: Exactly fits the behavior described. - Felony: That’s a legal designation (crime classification). Whether these acts constitute a felony depends on jurisdiction and charges; the question is asking for the type of technique, not the legal status. - Adversarial mechanics and Legal hostility aren’t standard terms relevant here.

Note: The provided answer key lists B (Felony), which is misleading for this exam objective. The exam typically tests knowledge of forensics concepts, where anti-forensics is the correct category.

Tamarac, United States

AI Explanation - verified by User5592 on: July 22, 2026
Question 4:

Answer: D) Shadow IT

Why: Shadow IT is when employees use unsanctioned tools or bypass IT controls (like the VPN) to access services, often without IT oversight. It’s an internal behavior, not an external attacker’s activity.

Not these:

- A) Espionage — covert info gathering by attackers. - B) Data exfiltration — unauthorized data transfer, usually by an attacker. - C) Nation-state attack — attack by a state-sponsored actor.

Quick note: This creates risk due to lack of visibility and control. Mitigations include a defined approved-tools list, enforcing VPN usage, device management, and continuous monitoring.

Vila Velha, Brazil

AI Explanation - verified by nanrany on: July 31, 2026
Question 333:
Question 333 explanation:

Correct answer: C: Amazon Comprehend.

Why: The library wants to classify books based on their text content. This is an NLP (natural language processing) task. Amazon Comprehend is AWS’s managed NLP service that can perform content classification (including creating custom classifiers) and extract meaningful information from text. The other services are not focused on text classification:

- Redshift = data warehouse - CloudSearch = search/indexing - Aurora = relational database

Quick note: In practice, you’d store the books in S3, extract text if needed (e.g., from PDFs with Textract), and then use Comprehend to classify the documents into topics or genres.

Busan, South Korea

AI Explanation - verified by ryantherasin on: August 10, 2026
Question 1:
Question 1 is a network-configuration simulation. The goal is to satisfy two requirements:

Remote access to a Windows PC

Full chat and optional game-console functions

The configuration should be reasoned through as follows:

Windows Remote Desktop (RDP) uses TCP 3389. The router needs a port-forwarding rule that sends incoming traffic on that port to the Windows PC’s internal IP address.

The game console should connect through the wireless AP. Using WPA2-PSK provides the required wireless security while allowing normal online, chat, and optional services.

The firewall should separate the internal network from the screened subnet. Its screened-subnet-side address is shown as 10.100.0.1.

Devices must be placed in the correct network locations: the PC behind the router, the console on the wireless AP, and the firewall between the appropriate network segments.

The answer key’s configuration is therefore conceptually correct, although the exact simulation choices depend on the image and dropdown options, which aren’t visible here. In a real network, exposing RDP directly to the internet is risky; a VPN or secure gateway would generally be safer.
Long Branch, United States

AI Explanation - verified by User9056 on: August 02, 2026
Question 19:
The correct choice is No (B).
Why:

The 99.99% availability SLA for VMs is achieved when you run VMs across two or more Availability Zones.

Two VMs in a single Availability Zone do not meet the 99.99% target (their SLA is lower, e.g., around 99.95% or less depending on configuration).

What to do to meet the goal with the minimum resources:

Deploy at least two VMs across two different Availability Zones (one VM in each zone, or both in two zones with a load balancer).

This provides the required zone redundancy and the 99.99% SLA.

Reference: https://docs.microsoft.com/en-us/azure/availability-zones/az-overview
Maramag, Philippines

AI Explanation - verified by User1325 on: August 03, 2026
The correct Microsoft exam answer is C. The second site (free-braindumps) is wrong in this case. Here’s why: Option C – GPO Startup Script ? * Startup scripts run every time the computer boots, before any user logs on. * They run under the Local System account, making them ideal for machine configuration. * In a domain where you’re creating multiple new VMs, linking a GPO to the OU means every new VM automatically receives the configuration. * This is the most scalable and centrally managed solution. Option A – SetupComplete.cmd ? %windir%\Setup\Scripts\SetupComplete.cmd runs only once, immediately after Windows Setup completes and before the first logon. Although it can be used to automate initial configuration, it’s intended for: * OEM deployments * Image customization * Sysprep deployments It’s not the best answer when you’re provisioning many domain-joined VMs in an Active Directory environment because: * It must exist inside every image or be copied during deployment. *
You're right—the correct answer is C.
Why C is best:

Startup scripts run at computer startup, before any user logs on, making them ideal for machine-wide configuration on each new VM.

They execute under the Local System account, which is appropriate for initial setup tasks.

Linking a GPO to the OU ensures every new VM in that domain automatically receives the configuration—great for scalability.

Why other options are less suitable:

A) SetupComplete.cmd runs only once, right after Windows Setup, not on every boot, so it isn’t ideal for provisioning multiple VMs consistently.

B) Logon scripts run per user, not per machine, so they aren’t reliable for initial VM configuration before a user signs in.

D) Placing scripts in a VHD doesn’t automatically execute them.

Amsterdam, The Netherlands

AI Explanation - verified by User7777 on: July 31, 2026
Question 44:

Answer: B — Improve employee training and awareness

Why this is correct:

- The issue is users unintentionally exposing sensitive data via file sharing. Training and awareness directly address the human factor, teaching users how to identify sensitive data, share appropriately, and follow policy-driven practices. This reduces misconfigurations and careless sharing.

Why the other options are less effective here:

- A) Implement step-up authentication for administrators targets access control for admins, not the regular user behavior causing data leaks. - C) Increase password complexity helps against credential theft but doesn’t prevent missharing of files. - D) Deploying MDM focuses on device management, not the core problem of user-driven data exposure through file sharing.

Quick practical note:

- In practice, you can combine training with policies and technical controls like DLP or file-sharing permissions to further reduce leakage, but training addresses the primary risk in this scenario.
Subang Jaya, Malaysia

AI Explanation - verified by sangeethasoftengg on: July 22, 2026
Question 43:
Question 43 is asking what must be built before using snippets to create region-specific unsubscribe footers.

Correct answer: A. Email templates

Why:

Snippets are reusable content blocks that you insert into email content, and they require an email template (or at least an email draft) to render.

You can store region-specific footers as snippets and include them in a template, but there would be nothing to render the snippet into without a template.

The other options aren’t prerequisites for using snippets:

- Tokens are placeholders you can use in templates/snippets, but you still need a template. - Segmentation determines who receives what, not whether you can use snippets. - Smart Lists are for grouping leads, not enabling snippet usage.
Tip: To implement per-region footers, create a snippet per region and insert them into an email template (potentially using segmentation or dynamic content to decide which snippet shows).
Coimbatore, India

AI Explanation - verified by User3311 on: July 21, 2026
Question 23:

Answer: C (192.168.0.1-192.168.0.99, 192.168.0.101-192.168.0.254)

Why: The interface is 192.168.0.100/24, so DHCP pools must be within the 192.168.0.0/24 subnet and cannot include the router’s IP (192.168.0.100), the network address (192.168.0.0), or the broadcast (192.168.0.255). Option C provides two ranges that exclude those addresses.

Why the other options are invalid:

- A: 192.168.0.1-192.168.0.255 includes the router’s IP (100) and the broadcast (255). - B: 192.169.0.1-192.169.0.254 is not in the 192.168.0.0/24 subnet. - D: 192.168.0.1-192.168.0.14 is a valid pool but very small and does not reflect the two-range approach shown in C; the given key selects the two ranges in C.
Ipatinga, Brazil

AI Explanation - verified by User9707 on: July 26, 2026
Question 18:
Answer: B — S3 Versioning
Explanation:

S3 Versioning stores all versions of an object. If an object is overwritten or deleted, you can recover the previous version using its version ID.

This protects against accidental deletion or overwriting because the original data remains accessible as an older version.

How to enable:

- Console: bucket > Properties > Versioning > Enable. - CLI: aws s3api put-bucket-versioning --bucket <BUCKET> --versioning-configuration Status=Enabled.

Practical notes:

- There is extra storage cost for preserving multiple versions. - You can manage old versions with lifecycle rules (e.g., expire or transition to cheaper storage). - Versioning alone doesn’t prevent intentional deletions by users with permissions; combine with appropriate IAM/bucket policies if needed.
Other options:

S3 Lifecycle rules: automate moving/expiring data, not specifically protection against deletion.

S3 bucket policies: control access but don’t inherently preserve previous data.

S3 server-side encryption: protects data at rest, not against deletion/overwrite.

Álvaro Obregón, Mexico

AI Explanation - verified by User5608 on: July 28, 2026
Question 26:
Here’s explanation for Question 26.

A: True. You can change the size of a Virtual Warehouse after creation (via UI or ALTER WAREHOUSE).

B: True. A warehouse can be resized while it’s running; the resize will take effect without needing to stop queries.

C: True. A warehouse can be configured to suspend after a period of inactivity (AUTO_SUSPEND).

D: True. A warehouse can be configured to auto-resume when new queries are submitted (AUTO_RESUME).

Note: The provided answer key shows A,B, but C and D are also true in Snowflake. The correct set should be A, B, C, and D.
Pune, India

AI Explanation - verified by User9941 on: July 24, 2026
Question 12:
Question 12 asks you to judge the accuracy of the underlined statement about inventory adjustment journals.
Key points about the statement:

What it says: you can add a cost when you adjust inventory, and that cost is posted automatically to a specific GL account.

Reality: yes, you can adjust both quantity and value via an inventory adjustment journal. The cost on the journal line affects the inventory value.

Important nuance:

The general ledger postings are not arbitrary. the actual accounts used are determined by your item posting group and the system’s posting definitions. In practice, the adjustment debits/credits the appropriate inventory-related accounts (e.g., Inventory asset and a related offset such as an adjustment or COGS account) based on configuration.

So, the cost change does not go to a single “manual” GL account you pick per line unless your posting setup maps to that account.

Bottom line:

The concept is true (you can adjust cost and have GL impact), but the claim that it posts to a single, specific GL account is oversimplified—the accounts come from your posting configuration.

Bengaluru, India

AI Explanation - verified by User4708 on: July 26, 2026
Question 142:

Question 142: Security governance is MOST associated with which IT infrastructure component? Network / Application / Platform / Process

Answer: D. Process

Why:

Security governance is about how decisions are made, accountability, and oversight to ensure security objectives align with business goals. These are implemented through governance processes (policy development, risk management, assurance, monitoring, escalation, etc.).

The other options (Network, Application, Platform) are concrete IT components; governance affects them, but it’s exercised primarily through the processes that govern how those components are managed and controlled.

Key takeaway:

In governance-related questions, focus on the decision-making, accountability, and control processes rather than the underlying technology components.

Bengaluru, India

AI Explanation - verified by User8627 on: July 21, 2026
Question 2:
Question 2 explanation:

Goal: Guests should not use cameras, but company users can.

Correct configuration: Guest access settings in the Org-wide settings.

- In the Teams Admin Center, open the org-wide settings and adjust the Guest access options to disable camera/video for guests. - This restricts guests only, without changing internal users’ camera permissions.
Why not the other options:

External access: Controls external-domain communication, not guest capabilities inside Teams.

Teams settings in Org-wide settings: Too generic; doesn’t specifically target guest capabilities.

Audio & Video in the default Meeting Policy: Would affect everyone assigned to that policy. To meet the requirement without impacting internal users, you’d need separate policies or guest-specific settings; the exam focuses on the guest-access policy.

In short, use Guest access settings to disable camera for guests while preserving camera access for internal users.
Baar, Switzerland

AI Explanation - verified by User3880 on: July 21, 2026
Question 36:
Waterfall is a traditional, linear project management and systems development approach. Key points:

It is a sequence of distinct phases that flow one after another (requirements ? design ? implementation ? verification ? maintenance).

Requirements are defined up front and changes are costly; the project often requires formal sign-off before moving to the next phase.

It emphasizes heavy documentation and minimal iteration after a phase is completed.

In the context of question 36, the BA is using a waterfall approach to capture requirements. The next step before building the solution is to obtain approval and sign-off on the requirements from stakeholders. This ensures everyone agrees the requirements are accurate, complete, and feasible, and authorizes the build to proceed, helping prevent scope creep and miscommunication.
Buenos Aires, Argentina

AI Explanation - verified by User2497 on: August 13, 2026
Question 18:
Let x be the number of boxes of each type.

6-phone boxes: 6x

8-phone boxes: 8x

Together, they contain 84 phones:
\[ 6x+8x=84 \]
\[ 14x=84 \]
\[ x=6 \]
Therefore, 6 boxes of each type were used. The answer is A: 6.
Pietermaritzburg, South Africa

AI Explanation - verified by User4468 on: July 26, 2026
Question 12:
The correct answer is B: RACI.

Why: After listing all resources, you need to assign who is responsible for each task. A RACI chart (Responsible, Accountable, Consulted, Informed) documents these roles for every activity.

What RACI means:

- Responsible: the person(s) who actually perform the task. - Accountable: the person who owns the task and signs off. - Consulted: those who provide input (two-way communication). - Informed: those who are kept up-to-date (one-way communication).

Why the others aren’t suitable here:

- RFI (Request for Information) is for gathering information, not assigning responsibilities. - WBS (Work Breakdown Structure) defines deliverables and tasks, not who does them. - SOW (Statement of Work) describes the work to be done, not internal task ownership.

Quick example: Task "Create user authentication module" — Responsible: Developer, Accountable: Tech Lead, Consulted: Security Architect, Informed: PM.

Using a RACI matrix clarifies ownership, reduces gaps, and improves communication in project execution.
Seattle, United States

AI Explanation - verified by User2505 on: August 10, 2026
Question 11:
Correct answer: A — Amazon SageMaker Feature Store
Amazon SageMaker Feature Store is a centralized repository for storing, organizing, and sharing ML features—the variables used by models, such as customer age, purchase frequency, or average order value.
It supports:

Reusing features across different models and teams

Consistent feature definitions

Managing feature versions and metadata

Using features for both training and inference

Why the others are incorrect:

SageMaker Data Wrangler: Prepares and transforms data; it is not primarily a shared feature repository.

SageMaker Clarify: Helps detect bias and explain model predictions.

SageMaker Model Cards: Documents models, including intended use, risks, and evaluation results.

The key phrase is “share and manage variables for model development”—these variables are ML features, making Feature Store the appropriate choice.
London, United Kingdom

AI Explanation - verified by User7070 on: July 17, 2026
Question 3:
Question 3 asks whether upgrading to a support plan would allow Microsoft to provide an assessment of your Azure environment’s design, given Basic does not include this.
Key points:

Basic support does not include architectural/design assessments.

Premier support includes advisory services such as architectural reviews/design assessments.

Conclusion:

The solution (subscribe to Premier support) does meet the goal. The correct choice should be Yes (A).

The provided answer key showing B (No) is likely incorrect for current Azure support plans.

If you’re studying, remember: use Premier (or other plans with architecture/design review features) when you need an official design assessment from Microsoft.
Delhi, India

AI Explanation - verified by User5630 on: July 29, 2026
Question 16:
Question 16 asks how to make the web app send telemetry at a fixed sampling rate.

Correct answer: B — From the code repository, modify Startup.cs (in ASP.NET Core you configure the Application Insights SDK in code, not with ApplicationInsights.config).

Why the other options aren’t correct:

- Modify ApplicationInsights.config: used in older ASP.NET apps, not typical for ASP.NET Core. - From AppInsights1, modify Usage/cost settings: this doesn’t change sampling behavior. - From AppInsights1, configure Continuous export: export settings affect data export, not sampling.

How to implement fixed-rate sampling (ASP.NET Core):

- In your Startup/Program code, configure the telemetry pipeline to use fixed-rate sampling and disable adaptive sampling. - Example (ASP.NET Core 6+ style after WebApplication.CreateBuilder):
var builder = WebApplication.CreateBuilder(args); builder.Services.Configure<TelemetryConfiguration>(telemetryConfiguration => { var builder = telemetryConfiguration.DefaultTelemetrySink.TelemetryProcessorChainBuilder; double fixedSamplingPercentage = 10; // 10% sampling builder.UseSampling(fixedSamplingPercentage); }); builder.Services.AddApplicationInsightsTelemetry(new ApplicationInsightsServiceOptions { EnableAdaptiveSampling = false }); var app = builder.Build();
- This sets a fixed sampling rate (e.g., 10%) for telemetry sent to AppInsights1.

Key concep
Mumbai, India

AI Explanation - verified by User1410 on: August 10, 2026
Question 1:
Correct sequence:

Define Power Platform DLP policies

Add custom prompt modifications

Conduct adversarial testing

Why this order:

DLP policies first

DLP policies establish environment-level security boundaries. They restrict which connectors and data flows the agent can use, helping prevent unauthorized access or data leakage.

Prompt modifications second

After the platform guardrails are established, configure the agent’s behavior. Prompt modifications can enforce: - Appropriate tone - Required disclaimers - Refusal behavior - Restrictions on unsupported or unsafe requests

Adversarial testing last

Test the configured agent with jailbreak attempts, prompt injection, malicious inputs, and attempts to obtain sensitive information. Testing is most useful after DLP and behavioral controls are in place.
The stated answer is consistent with the scenario. The key principle is secure the environment first, configure agent behavior second, and validate the controls through testing last.
Lagos, Nigeria

AI Explanation - verified by User8386 on: August 12, 2026
Question 9:
Correct answer: D — non-conformant.
The Architecture Definition Document explicitly specifies that the RPC mechanism must use user-mode threads. The purchased system instead uses kernel-mode threads, so it does not comply with a stated architectural requirement.
Whether the system works correctly or satisfies most other requirements does not change this finding. Compliance is assessed against the approved Architecture Definition, not only against functional behavior.
Why the other options are weaker:

A — conformant: Incorrect because one explicit requirement is violated.

B — consistent: “Consistent” is not sufficient where the implementation contradicts a mandatory specification. The RPC mechanism is covered by the architecture, and the implementation differs from it.

C — consistent: Incorrect reasoning: the RPC mechanism does have a defined architectural requirement, so conformance must be assessed.

D — non-conformant: Correct because the implementation fails to follow the specified RPC/threading requirement.

In a real compliance report, the architect would normally record the deviation, assess its impact, and determine whether an Architecture Waiver or change to the approved architecture is appropriate.
San Diego, United States

AI Explanation - verified by User9518 on: August 10, 2026
Question 16:
Answer: User1 and User3 only.
The key issue is the configured authentication method:

User1 can sign in because the account is cloud-only. It does not depend on the on-premises domain.

User3 can sign in because the account uses Password Hash Synchronization (PHS). Azure AD has a synchronized password hash and can validate the sign-in even when connectivity to on-premises Active Directory is unavailable.

User2 cannot sign in because the account relies on Pass-through Authentication (PTA). PTA sends the authentication request to an on-premises PTA agent, which must contact a domain controller. With the internet connection from on-premises lost, that validation cannot occur.

The fact that all users work remotely does not change the result. The deciding factor is whether authentication is performed in Azure AD or requires a reachable on-premises domain controller.
The answer key’s A is therefore consistent, assuming the user/configuration details in the unavailable exhibits show User1 as cloud-only, User2 as PTA-based, and User3 as PHS-based.
Hyderabad, India

AI Explanation - verified by User8744 on: August 12, 2026
Question 11:
Question 11: Correct answer — C
> Set expectations and agree on the requirements that the contractor will deliver with periodic progress reports.
The project manager should delegate the work clearly while retaining appropriate oversight. This means:

Define the contractor’s deliverables, responsibilities, acceptance criteria, and deadlines.

Agree on a reporting cadence to monitor progress.

Allow the local company to use its expertise and manage its own work.

This empowers the contractor without abandoning control of the project.
Why the others are weaker:

A: “Under the supervision of the project manager” suggests excessive direct control and is less empowering.

B: Micromanaging prevents the contractor from functioning independently and is inefficient.

D: Deploying the contractor’s staff under the PM’s supervision creates a staffing/control arrangement rather than empowering the contracted company.

The exam principle is delegate outcomes and monitor performance, rather than personally directing every task.
Johor Bahru, Malaysia

AI Explanation - verified by User7070 on: July 17, 2026
Question 9:
Answer: The correct plan is Standard (A).
Why:

Two instances: Free/Shared do not provide the production-level multi-instance hosting you need. Basic/Standard support more than one instance, with Standard specifically meeting the scale requirement.

SSL support: SSL (custom domain TLS) isn’t available on the Free tier and isn’t a driver for cost on paid tiers—but you’ll need a paid tier to map a custom domain (miami.weyland.com) and use SSL.

Storage: Your site needs 12 GB. Free/Shared have very limited storage; Basic tier storage is typically smaller than what you need, while Standard provides substantially more storage capacity.

Cost: Among the tiers that meet all requirements (two instances, SSL, sufficient storage), Standard is the lowest-cost option that satisfies them.

In short, Free or Shared don’t meet the production needs; Basic may not meet the storage/scale combination, so Standard is the minimal tier that fits all requirements. For verification, see the Azure plan/limits documentation.
Delhi, India

AI Explanation - verified by bmccloskey on: July 27, 2026
Question 17:
Question 17 asks which conditions will prevent an OSPF adjacency from reaching the Full state. The three correct options are A, B, and D.

A) MTU mismatch: OSPF neighbors must exchange Hello packets with a compatible MTU. If MTUs differ, the neighbor conversation fails and the adjacency cannot become Full.

B) Incorrect subnet mask: Routers must be in the same IP subnet on the connected link to form a neighbor relationship. A subnet mismatch prevents Hello packets from being considered valid on the same network.

D) Area ID not the same: Neighbors must share the same Area ID. A mismatch stops adjacency from forming beyond the 2-Way state.

Why the others aren’t correct (in this context):

E) Different metric set on each end of the link: Cost differences do not prevent OSPF adjacency; they affect routing decisions, not neighbor formation.

F) Router ID not defined: OSPF can auto-choose a router ID; an undefined ID is not a prerequisite for adjacency to reach Full.

C is sometimes a consideration (if the interface isn’t running OSPF at all), but the official key lists A, B, D as the three factors.
Hilo, United States

AI Explanation - verified by User8413 on: July 18, 2026
Question 1:
Question 1 asks about using cyber insurance to address items on the risk register. The correct answer is Transfer (Option B).
Why:

Risk transfer means shifting the financial impact of a threat from the organization to another party (the insurer). Buying cyber insurance accomplishes this shift.

It is not Accept: acceptance of risk would be tolerating it without action.

It is not Mitigate: mitigation involves reducing likelihood or impact with controls, not shifting costs.

It is not Avoid: avoidance would be not engaging in the activity that creates the risk; insurance does not remove the risk itself.

Short example: if a data breach occurs, the insurer would cover the costs, not the organization.
Key concept: risk transfer is one of the main risk response strategies, alongside acceptance, mitigation, and avoidance.
Cairo, Egypt

AI Explanation - verified by User9454 on: August 05, 2026
Quelle option est une perspective qui inclut les capacités fondamentales de l’AWS Cloud Adoption Framework (AWS CAF) ? Durabilité Efficacité de performance Gouvernance Fiabilité
Gouvernance
Pourquoi: AWS CAF comporte six perspectives (Business, People, Governance, Platform, Security, Operations). Parmi les options, seule « Governance » est une perspective du CAF; les autres termes se réfèrent à des concepts du cadre Well-Architected ou à d’autres domaines.
Yaoundé, Cameroon

AI Explanation - verified by User9085 on: July 21, 2026
Question 18:
Question 18 asks which foundation model type is best for a search app that handles text and image queries. Correct answer: A) Multi-modal embedding model.

Why: A multi-modal embedding model maps both text and images into a shared vector space, enabling cross-modal similarity and retrieval (e.g., find images matching a text query or text matching an image).

What it does: Enables efficient similarity search using a vector database or nearest-neighbor indexing.

Why the other options aren’t suitable:

- Text embedding model handles only text, not images. - Multi-modal generation model generates content, not primarily for retrieval. - Image generation model creates images, not for embedding-based search.

Quick implementation note: you’d typically pair the embeddings with a vector store (e.g., ANN index) and possibly fine-tune on domain data for better alignment across modalities.

Kwai Chung, Hong Kong

AI Explanation - verified by User7866 on: July 20, 2026
Question 51:

Correct answer: A — The degradation of a service.

Why: A service request is a formal request from a user for something that is pre-approved and routine (e.g., provisioning a laptop, replacing a toner cartridge). Those are typical service request actions. The degradation of a service, however, is an incident: it describes a problem affecting service quality or availability and is handled by Incident Management (and possibly Problem Management), not as a standard service request.

Quick note on the other options:

- B (replacement of a toner cartridge) and C (provision of a laptop) are classic service requests. - D (a complaint about a support team) is not a service request either; it would be handled through complaint/feedback channels, not as a service request.
Kuching, Malaysia

AI Explanation - verified by jcroland.1975 on: July 21, 2026
Question 1:
Question 1 asks which method is best for a tester to hide their activities after gaining access to an internal server.

Answer: A) Clear the Windows event logs

Why A is correct (high level):

Windows event logs (System, Security, Application) are key forensic artifacts. If an attacker clears these logs, there’s no built-in local record of actions taken, making it harder for investigators to trace what happened.

Why the other options are weaker:

Modify the system time: may misalign timestamps but does not erase past events and can be easily detected.

Alter log permissions: could prevent new log entries, but it doesn’t remove existing ones and can raise alarms due to permission changes.

Reduce log retention settings: affects only future logs; it doesn’t wipe already recorded activity.

Defensive context (brief):

In real environments, defenders mitigate this risk with tamper-evident, centralized logging (remote SIEM, write-once storage, log integrity checks) to preserve evidence even if a host is compromised.

Manchester, United Kingdom

AI Explanation - verified by rjbnyc on: August 07, 2026
Question 145:
For Question 145, the selections are:

Storage accounts: storage1, storage2, and storage3

Log Analytics workspace: Analytics3

Why:

Azure Backup reports can send the AzureBackupReports diagnostic log to eligible storage accounts. The storage account’s subscription and region do not have to match the Recovery Services vault, so all three listed storage accounts are valid.

The Log Analytics workspace must be in the same region as the Recovery Services vault for this configuration. Vault1 and Analytics3 are both in West Europe, making Analytics3 the valid workspace.

The subscription containing the workspace can be different from the vault’s subscription; the important restriction here is the regional requirement.
Paducah, United States

AI Explanation - verified by User3332 on: August 11, 2026
Question 17:
Correct answer: D — 587
Port 587 is used for authenticated SMTP email submission, typically with encryption such as STARTTLS. Email clients use it to securely send outgoing mail through a mail server.
Why the others are incorrect:

25 — Traditional SMTP server-to-server mail transfer; not normally used for secure client submission.

110 — POP3, used to retrieve email and typically unencrypted.

143 — IMAP, used to access email and typically unencrypted.

Note: Port 465 is also commonly associated with SMTP over implicit TLS, but it is not one of the choices. Therefore, 587 is the best answer here.
Lincoln, United States

AI Explanation - verified by srevas818 on: July 25, 2026
Question 215:
Here’s how to think about Question 215.

Topic: Conditional Access (CA) policy and MFA for Azure management.

Policy name: Policy1, created with the template “Require multifactor authentication for Azure management.”

What the template does: It enforces MFA when signing in to manage Azure resources (Azure management) for the users included in the policy.

Who is included: The question lists Admin1, Admin2, Admin3, and Admin4 as the admins in the tenant. The template’s default scope for this scenario is to apply to those admin accounts (i.e., all four admins unless you explicitly limit the scope).

Therefore, the next sign-in for Admin1, Admin2, Admin3, and Admin4 will require MFA being completed, unless any of them were explicitly excluded from Policy1.
Key takeaways:

CA policy for “Azure management” targets admin sign-ins.

If the policy includes Admin1–Admin4, all of them must use MFA on their next sign-in (choice D).

Gurugram, India

AI Explanation - verified by User7395 on: August 05, 2026
Question 8:
Correct answer: D — Parallel implementation.
A parallel implementation runs the old and new systems at the same time. For a month-end process, the organization can continue using the existing system while validating the new system, which helps keep business operations running with minimal downtime.
Why the other options are less suitable:

Cutover: The old system is replaced immediately. It may be fast, but any failure can cause significant disruption.

Phased: The system is introduced in stages, which reduces implementation risk but may prolong the transition.

Pilot: The system is first deployed to a limited group or location. This is useful for testing but does not necessarily minimize downtime for the entire organization.

The trade-off is that parallel implementation requires additional resources because both systems must be operated and their outputs compared. However, when the priority is continuity of a critical process, such as month-end processing, parallel implementation is the best choice.
Jersey City, United States

AI Explanation - verified by is.chan.army on: August 03, 2026
Question 50:
Question 50 explains a scenario where DoS/DDoS is suspected and the team uses manual techniques to detect it. The best command is:

Answer: C – netstat -an

Why:

netstat -an lists all active connections and listening ports with numeric addresses, without resolving names. This lets you spot DoS patterns such as a flood of connections to a specific port or many connections from a single or few IPs.

The other options don’t help as directly:

- netstat -r shows the routing table, not active connections. - nbtstat commands deal with NetBIOS name table (Windows local network info), not DoS traffic. - /c (clear) isn’t relevant to detection.
How to use in practice:

Windows: netstat -an and look for numerous ESTABLISHED connections to a service or many SYNs to a port.

Filter by port, e.g., netstat -an | findstr :80, or on Linux: ss -tunap | grep ':80'.

Limitations:

Netstat provides a snapshot. DoS detection often benefits from continuous monitoring, flow data, and IDS/IPS logs.

Tamarac, United States

AI Explanation - verified by User3575 on: August 05, 2026
Question 29:
Question 29 asks which method should be used to ensure software isn’t tampered with after the final version is complete.

Correct answer: A) Hashing

Why: Hashing produces a fixed-size digest of the software. If the final build is altered in any way, the hash will change, enabling you to detect tampering by comparing the stored digest with a freshly computed one.

Why not the others:

- Encryption (B) protects confidentiality, not integrity. - Baselines (C) define standard configurations but don’t directly provide tamper-evidence for a delivered binary. - Tokenization (D) replaces data with tokens for confidentiality, not for software integrity checking.
Tip: In practice, you might combine hashing with a digital signature (hash signed by a private key) to both verify integrity and authenticate the source.
Norcross, United States

AI Explanation - verified by nanrany on: July 29, 2026
Question 176:
The correct answer is AWS Application Discovery Service.

Why: ADS is designed to collect information about on-premises environments to plan migrations. It inventories details like hostname, IP address, MAC address, OS, hardware, and installed software, plus dependency mappings. This data helps you understand your current environment before moving to AWS.

How it differs from the other options:

- AWS DataSync focuses on transferring data between on-prem and AWS, not providing a network/inventory view. - AWS Application Migration Service (MGN) helps migrate workloads but isn’t primarily used for discovering on-prem inventory. - AWS Database Migration Service moves databases, not general host information.

Practical use: Install the ADS agent on on-prem hosts to collect data, then view the inventory in Migration Hub to inform migration planning and sequencing.

Busan, South Korea

Cisco 350-901 Exam Actual Questions
Developing Applications using Cisco Core Platforms and APIs (DEVCOR) (Page 2 )

QUESTION: 1

QUESTION: 2

Explanation:

QUESTION: 3

QUESTION: 4

QUESTION: 5

Cisco 350-901 Exam Actual Questions Developing Applications using Cisco Core Platforms and APIs (DEVCOR) (Page 2 )