DRAG DROP (Drag and Drop is not supported)
Drag and drop the descriptions from the left onto the related OAuth-defined roles on the right.
Select and Place:

See Explanation section for answer.

Answer(s): A

Explanation:

Show Answer Next Question

QUESTION: 66

Refer to the exhibit. This cURL POST request creates an OAuth access token for authentication with FDM API requests.

What is the purpose of the file “@token_data” that cURL is handling?

This file is given as input to store the access token received from FDM.
This file is used to send authentication-related headers.
This file contains raw data that is needed for token authentication.
This file is a container to log possible error responses in the request.

Answer(s): C

Show Answer Next Question

QUESTION: 67

What is the result of a successful OAuth2 authorization grant flow?

The third-party service is provided with a token that allows actions to be performed.
The user has the application rights that correspond to the user's role within the application's database.
The application is provided with a token that allows actions on services on the user's behalf.
The user has administrative rights to the application's backend services.

Answer(s): C

Show Answer Next Question

QUESTION: 68

In the three-legged OAuth2 process, after the authorization server presents a form to the resource owner to grant access, what is the next step?

The resource owner authenticates and optionally authorizes with the authorization server.
The user who owns the resource initiates a request to the OAuth client.
If the resource owner allows access, the authorization server sends the OAuth client a redirection.
A form to allow or restrict access is submitted by the owner of the resource.

Answer(s): D

Show Answer Next Question

QUESTION: 69

Which OAuth mechanism enables clients to continue to have an active access token without further interaction from the user?

refresh grant
JWT
password grant
preshared key

Answer(s): A

Show Answer Next Question

Download PDF Next Page

Viewing page 22 of 78
Viewing questions 106 - 110 out of 507 questions

Post your Comments and Discuss Cisco 350-901 exam prep with other Community members:

Comments:

Name:

350-901 Exam Discussions & Posts
350-901 AI Verifications

Alex on: March 02, 2025
Great material
UNITED KINGDOM

Tty on: July 02, 2026
Worked around meetings squeezing study time and it paid off.
Belgium

Bgp on: July 31, 2026
This exam was tougher than I thought with way more stuff to cover. The AI assistant here actually helped a lot in understanding tricky topics quickly.
Austria

Payload on: August 18, 2026
Man this exam was tougher than I thought but with some good prep it’s totally doable.
Canada

Sshd on: July 31, 2026
At first I wasn't too confident but those practice questions really helped me get there.
Luxembourg

Sudoer on: July 21, 2026
The exam was harder than I thought but the practice questions on this website made it manageable.
Sweden

Tcpdump on: August 17, 2026
Man that exam was super stressful but the prep material here helped a lot. I'm just happy it's done now.
Belgium

Sanjay on: September 04, 2026
Ans to Question 164 should be --Integrate information security governance into corporate governance Why? The best way to align security and business strategies is to ensure that information security governance is integrated into corporate governance. This ensures that security objectives, investments, risks, and initiatives are directly linked to business goals, strategic planning, and enterprise risk management. When security governance is part of corporate governance: • Security supports business objectives. • Security risks are considered alongside business risks. • Executive management and the board provide oversight. • Security initiatives are prioritized based on business value. Why the other options are less appropriate? ? 1) Include security risk as part of corporate risk management This is important, but it addresses only the risk management aspect and not the broader alignment of security strategy with business strategy. ? 2) Develop a balanced scorecard for security A balanced scorecard helps measure performance but does not, by itself, create strategic alignment. ? 3) Establish KPIs for business through security processes KPIs measure effectiveness and performance but are a result of alignment, not the primary mechanism for achieving it. ISACA/CISM Perspective A fundamental principle of information security governance is that it should be fully integrated with corporate governance to ensure security supports business objectives and delivers value to the organization.
Bengaluru, India

Stdout on: July 30, 2026
Cramming on this website def saved me some time and cash but hey got through the exam eventually even if it took a while.
Ireland

Thread on: August 01, 2026
Cramming with this website's practice questions saved me time and money honestly I got through the exam slower than expected but passed.
Poland

Backplane on: August 16, 2026
Crammed with the AI assistant on this site saved me time and money and boom passed the exam slowly but steady.
Germany

Deadlock on: July 18, 2026
Passed after a slow start.
Canada

Bitshift on: July 20, 2026
Wow this exam was a bit harder than I expected. The AI assistant on this site was pretty handy though.
Singapore

Ring0 on: August 04, 2026
Long workdays short study times but man passing this exam feels so good.
Finland

Initd on: September 04, 2026
Saved me time and some money I passed.
United States

Pdu on: July 18, 2026
Man this exam was stressful. Glad the prep stuff here sorted me out good enough.
Belgium

ZeroDay on: September 09, 2026
After juggling work I squeezed in short study bursts and got through the exam with a big sigh of relief.
Slovenia

Zsh on: July 29, 2026
With work and short study sessions done this exam finally over.
Italy

Scsi on: June 13, 2026
This cert was tougher than I thought but using practice questions from this website made it doable.
United States

Payload on: September 20, 2026
The exam had way more in it. AI assistant on this site really helped though.
Iceland

Strace on: August 12, 2026
This exam was a bit stressful but the practice questions on this website helped. Glad it's over and done with now.
Switzerland

remoteandcertified on: June 13, 2026
Cramming with this website's practice questions saved me time and money but I had to go slow because the exam is tough.
South Africa

Osama Jat on: September 22, 2026
Me Osama Jat. Please give me provide CCNA real question. hepl in the ccna real exam.
Biratnagar, Nepal

Deadlock on: August 06, 2026
Relief finally getting it done after work.
Switzerland

Overclock on: June 29, 2026
The exam was tougher but doable.
Italy

Parity on: August 28, 2026
This exam had way more topics than I thought so it was tough. The AI assistant on this site helped a lot by breaking things down for me.
United Kingdom

Heap on: June 06, 2026
The exam was tough but man these questions were a lifesaver.
Malta

Traceroute on: August 31, 2026
Took my time reviewing and kinda went slow but those practice questions helped a lot.
Netherlands

Glibc on: July 19, 2026
I took my time reviewing the questions but I passed this exam in the end so good enough.
Canada

chrisinfosec on: July 30, 2026
At first I wasn't sure I'd ever be ready for this cert but the practice questions on this site got me there.
United Kingdom

Scsi on: August 16, 2026
Crammed with practice questions here it helped me pass even though it took time.
Spain

Mtu on: June 18, 2026
I didn't feel confident at first but this site got me through.
UAE

ZeroDay on: August 21, 2026
That test was no joke. Good thing the prep materials worked out.
Australia

Dotfile on: July 03, 2026
This exam was tough but these questions helped.
Canada

Loopback on: August 16, 2026
Took me some time but I reviewed questions and passed.
Germany

Semlock on: August 05, 2026
Crammed using practice questions from this site and saved lots of time and money passing the exam slow but steady.
Switzerland

Shebang on: August 18, 2026
I saved time and money cramming with this website's exam prep and slowly got through it all I passed the exam.
New Zealand

Deadlock on: August 02, 2026
Between work and short study sessions I barely had time for prep but got it done so relief is real.
Switzerland

Deadlock on: September 11, 2026
The exam was broader than I thought. The AI assistant really helped me focus.
United States

Bgp on: August 23, 2026
The exam was stressful but prep helped. Glad I used this site.
Spain

Cgroups on: July 23, 2026
The exam was stressful. Glad I used this website.
France

Malloc on: July 22, 2026
This exam tougher than I thought but prep questions helped a lot.
Portugal

Replica on: July 16, 2026
Juggling work and study was a pain but using practice questions for short sessions made passing this cert a big relief.
Canada

AzureNinja on: June 10, 2026
The exam was so stressful but using the prep material here helped a lot. Just glad it’s done now.
Taiwan

Manpage on: September 14, 2026
The exam was tougher than I expected and had stuff I wasn't ready for. The AI assistant on this site really helped make sense of it all though.
Sweden

bootcampgradb on: June 06, 2026
Balancing work with study was tough but this site made short sessions easier. Done now and can say the AI assistant really helped me pass the exam.
UAE

Inode on: September 13, 2026
Honestly this exam was tough but the practice questions on this site were spot on.
Singapore

Hardlink on: August 22, 2026
Slow going but review time paid off.
Denmark

Tarball on: June 06, 2026
Studying for this exam took longer than I thought but with solid practice questions on this website I finally passed it.
Canada

Grep on: June 12, 2026
The exam was harder than I thought but still doable with enough practice questions from this website.
Norway

AI Explanation - verified by swatisharma4781 on: September 21, 2026
Question 93:
Correct answer: B. They must be uppercase.
Splunk recognizes Boolean operators when written in uppercase:

spl error AND host=WWW3 status=404 OR status=500 NOT source=access.log

Using lowercase words such as and, or, or not may cause Splunk to interpret them as search terms rather than Boolean operators.

Quotation marks are used for exact phrases or values containing spaces.

Parentheses group parts of a Boolean expression, but they are not required for every Boolean search.

The answer key’s B is correct.
Lexington, United States

AI Explanation - verified by User1028 on: September 22, 2026
Question 2:
I can’t see the hotspot image, but based on the three statements shown, the intended selections are:

Yes — Microsoft Foundry provides a secure, governed environment for building and managing generative AI applications and agents. It brings together models, data, tools, evaluation, deployment, and monitoring.

Yes — Foundry is designed for enterprise workloads and supports scaling AI applications as usage grows. Scalability comes from the underlying Azure services and managed infrastructure.

Yes — Foundry can be used in solutions involving image recognition and computer vision. Applications can use vision-capable models and Azure AI vision capabilities for tasks such as image analysis, object detection, and OCR.

The important distinction is that Foundry is the development and management platform; specific capabilities such as vision may be provided by models or integrated Azure AI services rather than by Foundry as a single standalone model.
So, for the statements provided: Yes, Yes, Yes.
Chennai, India

AI Explanation - verified by User3451 on: September 02, 2026
Question 9:
The answer key shows A, but its explanation is technically misleading.
Because the objects use SSE-S3, Amazon S3 manages the encryption keys. The Amazon Bedrock execution role does not need kms:Decrypt permission or access to a customer-managed KMS key.
The role should instead have the required Amazon S3 permissions, such as:

s3:GetObject for the relevant objects

s3:ListBucket if listing is required

Appropriate bucket and object resource permissions

Therefore, A is the closest option, but it should be interpreted as ensuring that the Bedrock role has permission to access the S3 data—not as granting KMS decryption permissions.
Why the others are wrong:

B: Making the bucket public is insecure and unnecessary.

C: Prompt engineering cannot override AWS IAM or encryption permissions.

D: Data sensitivity does not determine whether the role can access it.

If the data used SSE-KMS instead, then the role would additionally need kms:Decrypt permission on the KMS key.
Bengaluru, India

AI Explanation - verified by User2976 on: September 24, 2026
what is athena
Amazon Athena is a serverless interactive query service that lets you run SQL queries directly against data stored in services such as Amazon S3.
Key points:

No servers or database infrastructure to provision.

Uses standard SQL.

Supports formats such as JSON, CSV, Parquet, and ORC.

You typically define the table structure with AWS Glue Data Catalog or Athena’s own schema definitions.

Charges are generally based on the amount of data scanned, so partitioning and columnar formats can reduce cost.

It does not copy the data into a separate database; it reads the files in S3 when you run a query.

For Question 2, Athena is appropriate because the logs already exist in S3 and the company needs simple, on-demand analysis with minimal operational overhead.
Bengaluru, India

AI Explanation - verified by User4761 on: September 09, 2026
Question 9:
The answer key appears to be incorrect. The correct answer should be A — True.
Outside the required_providers block, Terraform configuration refers to a provider using its local name, such as:

hcl provider "aws" { region = "us-east-1" } resource "aws_s3_bucket" "example" { bucket = "my-example-bucket" }

Here, aws is the provider’s local name.
The source address—for example, hashicorp/aws—is used in the required_providers block to identify where the provider comes from:

hcl terraform { required_providers { aws = { source = "hashicorp/aws" } } }

The source address is not normally used as a provider reference in resource blocks or provider configurations. Therefore, the question’s stated B — False conflicts with standard Terraform behavior.
Agege, Nigeria

AI Explanation - verified by User4405 on: September 19, 2026
Wrong answer. You use groups to assign devices to it. The use those groups as scope in policies, effectively passing devices between policies
You’re right—the answer key’s B (Use sub-rules) is incorrect. The better answer is D: Use groups.

Assign endpoints to a group based on the result of one policy.

Use that group as the scope of another policy.

This effectively passes the endpoints from one policy’s processing flow to another.

Sub-rules create branches within a single policy; they are not the standard mechanism for transferring endpoints between separate policies.
Madrid, Spain

AI Explanation - verified by User6870 on: September 19, 2026
Question 1:
Correct answer: B. Transfer
Cyber insurance is a risk transfer strategy. The company shifts some of the financial impact of a cybersecurity incident to an insurance provider in exchange for paying premiums.

Accept: Acknowledging the risk and choosing not to take additional action.

Transfer: Shifting the risk or financial consequences to another party, such as an insurer.

Mitigate: Reducing the likelihood or impact through controls, such as patching or access restrictions.

Avoid: Eliminating the activity that creates the risk.

Insurance does not eliminate the underlying threat; it primarily transfers the financial consequences of that risk.
Islamabad, Pakistan

AI Explanation - verified by ricabrica on: September 25, 2026
Question 35:
Question 35 — correct choice: serverless API
The answer key marks D, but based on the options shown, I believe that is incorrect. The requirements describe a serverless API deployment:

Key-based authentication: Provides an endpoint secured with API keys.

Real-time REST access: Supports online inference through an HTTP/REST endpoint.

No VM vCPU quota consumption: Microsoft hosts and manages the underlying infrastructure, so your subscription’s VM quota isn’t used.

Why the other choices are unsuitable:

Batch: Intended for asynchronous, large-volume processing rather than real-time requests.

Self-hosted container: You manage the infrastructure and typically need compute resources and quota.

Standard: This is not the clearest deployment type for the stated requirements; the specific Foundry option is serverless API.

The explanation in the dump appears to describe serverless API while labeling it as “standard,” which likely caused the answer mismatch.
Munich, Germany

AI Explanation - verified by User5768 on: September 21, 2026
Why asynchronous not appropriate ?
Asynchronous inference is not necessarily impossible, but it is less appropriate for this scenario.

Asynchronous inference is designed for applications that submit individual inference requests, place them in a queue, and retrieve results later. It is useful when requests may take a long time or when traffic is intermittent.

Batch transform is designed specifically to run inference over an entire large dataset stored in Amazon S3 and produce an output dataset.

The key distinction is:

Large dataset/offline processing ? Batch transform

Large or slow individual requests processed later ? Asynchronous inference

Because the question emphasizes archived data, multiple-GB datasets, and no need for immediate predictions, the exam’s intended answer is Batch transform.
Bangkok, Thailand

AI Explanation - verified by User5120 on: September 21, 2026
Question 11:
Correct answer: B — Databricks web application
In the classic Databricks architecture, the control plane hosts the Databricks management services, including the web application. Users access the workspace UI from the control plane.
The other components are associated with the data plane:

Driver node: Coordinates Spark jobs and runs in the compute environment.

Worker node: Executes tasks and processes data.

Databricks Filesystem (DBFS): Provides storage access for data used by compute resources.

Exam tip: The control plane manages and orchestrates the workspace, while the data plane performs computation and processes data.
Charlotte, United States

AI Explanation - verified by User4935 on: September 11, 2026
Question 50:
Correct answer: A — Purchase Provisioned Throughput for the custom model.
When a company fine-tunes or customizes an Amazon Bedrock foundation model, the resulting custom model cannot generally be invoked on-demand like a standard Bedrock base model. The company must purchase Provisioned Throughput, which allocates dedicated capacity for using that custom model through Bedrock.
Why the other options are incorrect:

B. Deploy to a SageMaker endpoint: This is needed for SageMaker-hosted models, not for a model intended to be used directly in Amazon Bedrock.

C. Register with SageMaker Model Registry: SageMaker Model Registry is unrelated to invoking custom models in Bedrock.

D. Grant access in Bedrock: Access permissions may be necessary, but they do not replace the required provisioned capacity.

The key exam distinction is: Bedrock custom model ? Provisioned Throughput.
Helsinki, Finland

AI Explanation - verified by pikej74485 on: September 21, 2026
Question 81:
For the exam’s intended answer, choose A, C, and E:

A — Use a custom controller: An Apex class can contain the page’s logic.

C — Use a standard controller with extensions: The standard controller provides basic CRUD behavior, while an extension adds custom logic.

E — Use a standard controller: Useful when the page works mainly with one Salesforce object and needs standard functionality.

The key is treating a dashboard Visualforce page as requiring a controller-based implementation.
Important accuracy note: The answer key is questionable in general Visualforce terms. Visualforce can also use:

A page with no controller for static or controller-free content.

A custom controller with extensions; extensions are not limited only to standard controllers.

So A, B, C, D, and E can be valid Visualforce configurations generally. The stated three-answer key appears to depend on a dashboard-specific exam assumption that is not clearly expressed in the question.
Chennai, India

AI Explanation - verified by 8vot4a8c9g on: September 16, 2026
Question 45:
Question 45’s stated answer appears to be wrong. The answer key selects D, but based on the equivalence classes shown in the explanation, B is the correct choice.
The four classes are:

x = -100

-100 < x < 100

100 = x < 1000

x = 1000

Option B gives:

-500 ? class 1

0 ? class 2

100 ? class 3

1000 ? class 4

Thus, it supplies one representative value from every equivalence class.
Option D (-1000; -100; 100; 1000) does not cover the second class, because -100 belongs to the first class (x = -100).
Correct answer: B, assuming the class definitions in the page explanation are accurate. The explanation’s claim that D includes 500 and 1500 also conflicts with the values actually listed for D.
Hyderabad, India

AI Explanation - verified by User1290 on: September 10, 2026
Question 14:
Correct answer: D. Out-of-band management
Out-of-band (OOB) management provides a separate management path to a network appliance, usually through a dedicated management interface, console server, or cellular connection. It allows administrators to access and troubleshoot the device even when its normal network interfaces or operating system have failed.
Why the others are incorrect:

Crash cart: Provides local physical access, not remote access.

Jump box: A secured intermediary used to reach devices over the normal network; it may be inaccessible if the appliance has not booted.

Secure Shell (SSH): Requires the device’s operating system and network services to be running properly.

The key clues are “remote access” and a device that failed to start up properly, making OOB management the appropriate solution.
Quezon City, Philippines

AI Explanation - verified by User2517 on: September 19, 2026
Question 59:
Correct answer: A — Work with the project scheduler to update the project timeline.
The team discovered an unforeseen dependency affecting a critical activity. The project manager should first determine and document the schedule impact by updating the project timeline with the scheduler.

A is correct: It establishes the revised dates and identifies the effect on the critical path.

B is premature: Stakeholders should be informed after the impact has been assessed and the updated schedule is understood.

C is not automatically appropriate: Fast-tracking may introduce additional risk and should be considered only after analyzing schedule options.

D is premature: Adding resources may not resolve a dependency and could increase costs without addressing the actual constraint.

The general sequence is: assess the impact ? update the schedule ? evaluate responses ? communicate the approved change.
Cebu City, Philippines

AI Explanation - verified by User7377 on: September 01, 2026
Question 8:
Correct answer: B — regulatory and legal requirements.
Records should primarily be retained for the period required by applicable:

Laws and regulations

Litigation holds

Industry or contractual obligations

Tax, financial, health, or privacy requirements

An organization must be able to produce records when legally required, but should not retain them indefinitely because unnecessary retention increases storage costs, discovery burden, and privacy risk.
Why the others are weaker:

Business strategy and direction: May influence retention, but cannot override legal requirements.

Storage capacity and longevity: Practical considerations, not the primary driver.

Business ease and value analysis: May support decisions after compliance obligations are identified.

Exam rule: Determine the mandatory legal and regulatory retention period first; then address business and operational requirements.
Islington, United Kingdom

AI Explanation - verified by User4708 on: September 23, 2026
Question 1:
Correct answer: The capacity tier.
Reasoning:

The job keeps 31 days of regular restore points. A backup from the week of January 1 is older than 31 days by March 20, so it is no longer expected to remain on the performance tier.

It is also a weekly GFS full backup, retained for 14 weeks. Therefore, it is still protected and has not been deleted.

In a Scale-out Backup Repository, older backups can be moved from the performance tier to the capacity tier—typically object storage—according to the configured offload policy.

The archive tier is not selected because the question’s configuration does not indicate that the backup has been archived there.

So, the standard retention removes the backup from normal short-term storage, while the weekly GFS retention preserves it in the capacity tier.
Buenos Aires, Argentina

AI Explanation - verified by User1465 on: September 20, 2026
Question 5:
The answer key shows C (Falcon Investigator), but I believe that is incorrect.
The best answer is A — Real Time Responder.
Connect to Host uses Falcon’s Real Time Response (RTR) capability, which allows an authorized user to interact with an endpoint and collect information that is not available directly in the Falcon console. The user must therefore have the appropriate Real Time Responder role or permissions.
Why the others are less suitable:

Endpoint Manager: manages hosts and sensor-related settings.

Falcon Investigator: supports investigation and analysis, but does not necessarily grant RTR access.

Remediation Manager: handles remediation-related actions rather than interactive host access.

Role names and permissions can vary by Falcon console version, so verify the exact RBAC mapping in your tenant.
Singapore, Singapore

AI Explanation - verified by User3532 on: September 25, 2026
Question 17:
Correct answer: B — Enabling malware detection through a UTM
The website accepts user-uploaded PDF files, which could contain malware or malicious code. A UTM (Unified Threat Management) appliance can inspect uploaded files using antimalware and content-filtering capabilities before they reach internal systems or users.
Why the others are less appropriate:

A. IDS attack signatures: Detects suspicious network activity, but is not primarily designed to scan uploaded files for malware.

C. Load balancer: Distributes traffic among servers and improves availability; it does not inspect files for threats.

D. WAF: Protects web applications from attacks such as SQL injection and command injection, but its primary role is not malware scanning of uploaded documents.

The key clue is PDF uploads: think file inspection and malware detection, rather than general web-application or network-traffic protection.
Chennai, India

AI Explanation - verified by User3618 on: September 21, 2026
Question 1:
Question 1 asks for two ways to iterate through a List<Account>.

A is valid:

apex for (Account theAccount : AccountList) { // process theAccount }
This is Apex’s enhanced for loop. Each element is assigned to theAccount.

D is conceptually valid, using an index:

apex for (Integer i = 0; i < AccountList.size(); i++) { Account theAccount = AccountList[i]; }
However, the question displays AccountList.Size(). Apex method names are case-sensitive, so the correct method is size(), not Size().

B is invalid because for(AccountList) is not valid loop syntax.

C is invalid because each item is an Account, not a List.

Important: The answer key shows A and D, but D is only correct if Size() is a capitalization typo and should be size().
Santos, Brazil

AI Explanation - verified by User7103 on: September 22, 2026
Question 29:
Correct answer: A. Hashing
A hash creates a fixed-length value representing the software’s contents. After release, the company can calculate the file’s hash again and compare it with the original:

Matching hashes: The software likely has not changed.

Different hashes: The software was modified or corrupted.

Why the others are incorrect:

Encryption: Protects confidentiality by making data unreadable; it does not primarily detect changes.

Baselines: Define an approved system or configuration state, but they are not the specific integrity mechanism here.

Tokenization: Replaces sensitive data with substitute values.

In real deployments, a digital signature is often preferred because it verifies both integrity and the publisher’s identity, but hashing is the best available answer.
Opelika, United States

AI Explanation - verified by User2474 on: September 10, 2026
Question 30:
Correct answer: D — Building and training a generative AI model from scratch using customer-owned data.
The Generative AI Security Scoping Matrix reflects how much control—and therefore security responsibility—the customer has:

Third-party enterprise application with embedded AI: The provider manages most security controls. The customer mainly manages users, data, and configuration.

Application using an existing third-party FM: The customer controls the application and its inputs/outputs, but the provider controls the underlying model and infrastructure.

Fine-tuning a third-party FM: The customer has additional responsibility for training data, data protection, and model behavior, but still depends on the provider’s base model and platform.

Building and training a model from scratch: The customer controls the model, training data, application, deployment, and many security safeguards. This creates the greatest security ownership.

This does not mean the customer manages every physical infrastructure control—the cloud provider still handles its underlying infrastructure responsibilities. It means the customer has the broadest scope of application, model, data, and deployment security responsibilities.
Kenitra, Morocco

AI Explanation - verified by User3107 on: September 17, 2026
Question 44:
Correct answer: C — AWS Organizations
AWS Organizations can be used at no additional charge. It lets you centrally manage multiple AWS accounts, organize them into groups, apply service control policies, and consolidate billing.
Why the others are not best:

Amazon SageMaker — charges apply for compute, storage, and other resources used.

AWS Config — generally charges for configuration recording and rule evaluations.

Amazon CloudWatch — has a limited free tier, but many metrics, logs, alarms, and API usage can incur charges.

The key wording is “at no additional cost”, meaning the service itself does not charge a separate fee. Resources or services managed through Organizations may still generate normal AWS charges.
Bengaluru, India

AI Explanation - verified by User2510 on: September 21, 2026
Question 1:
Question 1 tests basic network device placement, wireless security, and port forwarding.
The intended configuration is:

Wireless AP

- LAN IP: 192.168.10.1 - Security: WPA2-PSK - The game console connects through the AP so wireless access is secured and its chat/online services can function.

Router

- Create a port-forwarding rule allowing TCP port 3389. - Port 3389 is used by Remote Desktop Protocol (RDP). - The rule forwards incoming RDP traffic to the Windows PC, allowing remote access from outside the network.

Firewall

- Configure the screened-subnet-side IP as 10.100.0.1. - A screened subnet (often called a DMZ) separates publicly accessible or specially routed systems from the trusted internal LAN.

Device placement

- Put the Windows PC behind the router, because the RDP port-forward rule targets it. - Put the game console on the Wireless AP. - Place the firewall in front of the screened subnet.
The key clues are RDP = TCP 3389, WPA2-PSK = secured wireless, and screened subnet = firewall-segregated network.
Farmington Hills, United States

AI Explanation - verified by User1638 on: September 11, 2026
Question 20:
Correct answer: A — Determine an appropriate format for the presentation.
Before presenting requirements, Gary should consider:

The audience and stakeholders

The complexity and type of requirements

The communication method and level of detail needed

Whether to use diagrams, models, documents, demonstrations, or slides

This supports the BABOK task Communicate Business Analysis Information, which requires tailoring the presentation format and content to the stakeholders.
Why the others are less suitable:

B: Authority to host the presentation is not the key preparation activity.

C: Stakeholder sign-off may occur later; presenting requirements does not always require formal approval beforehand.

D: A scribe may be useful in a meeting, but hiring one is not a core preparation requirement for presenting.

Madala, Nigeria

AI Explanation - verified by User4025 on: September 01, 2026
Question 27:
Correct answer: A. Trusted devices
A trusted device solution allows access only from registered or managed devices. Once a device is enrolled and trusted, the employee can usually log in with minimal additional interaction, providing a seamless experience.
It best meets the requirements because:

Employees can use approved devices from remote locations or worldwide offices.

Users do not need to carry or insert extra hardware.

It helps prevent account takeovers from unknown devices.

Why the others are less suitable:

Geotagging: Restricts access based on location, which could interfere with remote work and travel.

Smart cards: Require additional physical equipment and card readers.

Time-based logins: Limit access according to time but do not strongly bind access to an authorized user device.

Nashville, United States

AI Explanation - verified by kusumasri77777 on: September 07, 2026
Question 47:
Correct answer: C — Revert to the version of the prompt that produced the closest match and adjust from that baseline.
When repeated prompt edits cause the output to drift, the problem is likely cumulative degradation: each change may introduce new ambiguity or interfere with something that previously worked.
The best approach is to:

Keep earlier prompt versions.

Identify the last version that produced acceptable output.

Restore it as a baseline.

Make small, controlled changes—ideally one significant change at a time.

Test the output after each change.

Why the others are poor choices:

A: Discards useful information about what worked.

B: Large simultaneous changes make it difficult to identify the cause of problems.

D: Accepts output that does not meet the requirements.

This tests disciplined prompt iteration and version control, rather than trial-and-error editing.
Bengaluru, India

AI Explanation - verified by User2510 on: September 21, 2026
Question 3:
Correct answer: Change the DNS settings.
A computer joining an Active Directory domain must locate the domain controller using DNS, especially the domain’s SRV records. In this scenario, the workstation can ping the server and access the internet, so basic IP connectivity is working.
However, if it is configured to use public DNS servers such as 8.8.8.8 or 1.1.1.1, those servers will not know about the organization’s internal domain records. The workstation should use the organization’s internal DNS server, typically hosted on or associated with the domain controller.
Why the other options are incorrect:

Static IP address: Not needed if the workstation already has network connectivity.

Subnet mask: Incorrect subnetting would usually prevent local communication, including pinging the server.

Default gateway: Primarily affects communication outside the local network; it does not normally prevent finding an internal domain controller.

Key exam clue: Internet access and ping working do not prove that domain-name resolution is configured correctly.
Farmington Hills, United States

AI Explanation - verified by User4573 on: September 18, 2026
Question 66:
The answer key appears incorrect. I believe the correct answer is: Yes.
The Bulk invite users operation in Microsoft Entra ID is designed to invite multiple external users from a CSV file. It creates guest user objects in the tenant and sends invitation emails to the listed addresses.
Why:

The CSV contains the external users’ email addresses.

The bulk invitation feature supports inviting many guest users in one operation.

Each invited user becomes a guest account in contoso.com.

The explanation given in the question is also misleading. New-AzureADMSInvitation creates an invitation for an individual user, but it could be run repeatedly in a script; it is not required when using the portal’s bulk operation.
Therefore, assuming the CSV follows the required Microsoft Entra bulk-invitation format, the proposed solution does meet the goal.
Noida, India

AI Explanation - verified by examspl on: September 20, 2026
Question 110:
Question 110: The best answer is C.
> Enable the collection and storage of Einstein Generative AI Audit Data on the Einstein Feedback setup page.
To validate Data Masking in the Einstein Trust Layer, the specialist first needs to ensure that the relevant Einstein Generative AI Audit Data is being collected and stored. This audit information can then be reviewed to confirm which values were masked before being sent to the model.

A is incorrect: Flow Debugger is for debugging Salesforce Flows, not Trust Layer masking.

B is incomplete/misleading: Requesting audit data may be part of reviewing the results, but collection and storage must first be enabled.

C is correct: It describes the initial validation step.

Note: The provided explanation is internally inconsistent: it says the answer is C but describes option B. The answer choice itself—C—is the stronger answer for “begin validating.”
Nepean, Canada

AI Explanation - verified by User9738 on: September 22, 2026
Question 84:
A resposta correta é C: configurar o SageMaker para usar uma VPC com um endpoint do Amazon S3.
O endpoint permite que os notebooks do Amazon SageMaker Studio acessem os dados armazenados no Amazon S3 por uma conexão privada dentro da AWS. Assim, o tráfego pode permanecer na rede da AWS, sem precisar passar pela internet pública.
Isso ajuda a:

Controlar o fluxo de dados entre S3 e SageMaker;

Aplicar regras de segurança por meio da VPC;

Reduzir a exposição dos dados;

Permitir acesso privado ao bucket do S3.

As outras opções não atendem ao requisito:

Amazon Inspector: avalia vulnerabilidades, mas não gerencia o fluxo de dados.

Amazon Macie: ajuda a descobrir e proteger dados sensíveis no S3, mas não cria a conexão com o SageMaker.

S3 Glacier Deep Archive: é uma classe de armazenamento para arquivamento, não uma solução de conectividade.

São Paulo, Brazil

AI Explanation - verified by molnarsignup2002 on: September 01, 2026
Question 228:
Correct answer: B — Azure Machine Learning Designer.
The name is not necessarily outdated, although Microsoft’s naming can be confusing:

Azure Machine Learning is the overall Azure service.

Machine Learning designer is the visual, drag-and-drop interface within Azure Machine Learning.

Microsoft may refer to the broader product as Azure Machine Learning studio, while “Designer” remains the specific visual workflow tool.

Designer lets you build machine-learning pipelines by connecting datasets, data-transformation steps, training modules, evaluation modules, and deployment components without writing all the code manually. It supports building, testing, and deploying predictive models.
The other options do different jobs:

Azure Logic Apps: Workflow and integration automation.

Azure Batch: Large-scale parallel or batch compute.

Azure Cosmos DB: Globally distributed NoSQL database.

Be careful not to confuse current Azure Machine Learning Designer with the older Azure Machine Learning Studio (classic), which was a separate legacy offering.
Budapest, Hungary

AI Explanation - verified by User8379 on: September 22, 2026
so the correct answer is ?
The correct three selections are:

Admin access to the deployment pipeline

Contributor access to the Development and Test workspaces

Viewer access to the Production workspace

So, using the option order shown, the answer is B, D, and E.
The displayed key, B and E, is incomplete because the developers also need Viewer access to Production to view production items. They should not have Contributor access there, since that would allow modifications or deployments to Production.
Delhi, India

AI Explanation - verified by User3698 on: September 22, 2026
Question 44:
Question 44: Answer B — Improve employee training and awareness
The issue is sensitive information being exposed through file-sharing services, often because users:

Share files with the wrong people

Use public links unnecessarily

Fail to classify sensitive data

Upload data to unauthorized services

Misunderstand company sharing policies

Training and awareness can teach employees how to handle sensitive data, verify recipients, configure sharing permissions, and use approved file-sharing platforms.
Why the others are weaker:

A — Step-up authentication: Helps protect administrator accounts, but does not directly address improper file sharing by users.

C — Password complexity: Helps reduce password attacks, not accidental data disclosure.

D — Mobile device management: Secures managed mobile devices, but does not directly control file-sharing behavior across the organization.

In a real environment, technical controls such as DLP, cloud access security controls, and restrictive sharing defaults could be stronger solutions, but they are not options here. Therefore, B is the best available answer.
Guará, Brazil

AI Explanation - verified by User6688 on: September 23, 2026
Question 43:
Correct answer: D — To ensure non-repudiation
S/MIME digital signatures use the sender’s private key to sign an email. The recipient can verify the signature with the sender’s public key, helping prove:

The message came from the claimed sender (authentication)

The message was not altered (integrity)

The sender cannot easily deny sending it (non-repudiation)

Why not C — To block phishing attacks?
A digital signature does not block phishing. It may help a recipient identify whether an email is genuinely signed by a trusted sender, but:

Attackers can send unsigned phishing emails.

Attackers may compromise a legitimate account and send signed malicious emails.

Users may still be tricked by a validly signed message.

S/MIME encryption protects confidentiality, while S/MIME signing primarily provides authentication, integrity, and non-repudiation. In this question, non-repudiation is the best and most specific answer.
Vacoas, Mauritius

AI Explanation - verified by User5938 on: September 11, 2026
resuma no mesmo padrão da resposta anterior
Resposta: Standard.
O plano Standard atende aos requisitos:

Domínios personalizados.

Armazenamento suficiente.

Instâncias dedicadas.

Balanceamento de carga.

Menor custo entre os planos que atendem a tudo.

Free, Shared e Basic não atendem a todos os requisitos.
Cabo Frio, Brazil

AI Explanation - verified by User3039 on: September 14, 2026
Question 13:
Correct answer: No
The answer key shows B, and it is correct.

Azure Cosmos DB is a globally distributed NoSQL database service. It stores and retrieves application data, but it does not provide the complete environment for building, testing, and deploying predictive analytics models.

Azure Machine Learning is the appropriate service for this requirement. It supports creating experiments, training and testing models, and deploying them for predictions.

Azure Machine Learning Studio provides the browser-based interface for these tasks.

Therefore, recommending Azure Cosmos DB does not meet the requirement.
Wan Chai, Hong Kong

AI Explanation - verified by User5548 on: September 10, 2026
Question 109:
Correct answer: A — To achieve divisional autonomy.
A transfer pricing system sets the price for goods or services transferred between divisions of the same organisation. A well-designed system allows divisions to make decisions independently, negotiate or respond to market conditions, and be assessed as separate performance units.
Why the other options are incorrect:

Maintain head office control: Transfer pricing generally supports decentralisation rather than direct head-office control.

Establish centralised decision making: This conflicts with divisional autonomy.

Develop a top-down culture: Transfer pricing is intended to support empowered divisions and goal congruence, not impose purely top-down management.

Transfer pricing should also encourage goal congruence—decisions that benefit an individual division should ideally also benefit the organisation as a whole.
Maseru, Lesotho

AI Explanation - verified by User5753 on: September 09, 2026
Question 17:
Correct answer: B — unique local
An IPv6 Unique Local Address (ULA) uses the range FC00::/7 (commonly FD00::/8 in practice). It is intended for private communication within an organization or site, including communication between different subnets, but it is not routed across the public Internet.
Why the others are incorrect:

Link-local — FE80::/10; valid only on the local link/subnet and not routed by routers.

Multicast — FF00::/8; identifies a group of interfaces rather than a private address range.

Global unicast — 2000::/3; publicly routable IPv6 addressing.

The key distinction is that ULA addresses can be routed internally between subnets, while link-local addresses cannot be routed beyond the local link.
Midrand, South Africa

AI Explanation - verified by bmaxcollins on: September 03, 2026
Question 866:
Correct answer: B — Chief information security officer (CISO).
The CISO’s primary responsibility is to direct and coordinate the organization’s information security program. This includes:

Reviewing security objectives to ensure they support business goals.

Ensuring security requirements are integrated consistently across business units.

Coordinating security policies, risk management, controls, and awareness activities.

Why the others are less appropriate:

Executive management: Provides direction, funding, and support, but usually does not manage day-to-day security integration.

Board of directors: Provides governance and oversight, not operational security coordination.

Steering committee: Helps coordinate and prioritize initiatives, but the CISO typically owns the overall security program and ensures its integration.

The key distinction is between governance and execution: senior leadership and the board govern and support security, while the CISO manages and integrates the security program.
Kampala, Uganda

AI Explanation - verified by User5924 on: September 19, 2026
Question 16:
Answer: B — child table only.
When you change a field’s label while working with a child table, ServiceNow applies the change to that table’s version of the field. It does not automatically change the label on:

Base table — the table containing common inherited fields

Parent table — the table directly extended by the child

Other tables in the hierarchy

This is possible because inherited fields can have table-specific configurations, commonly through a Dictionary Override. For example, if short_description is labeled “Issue summary” on a child table, its label can remain “Short description” on the parent and base tables.
So the answer key’s B is correct, assuming the question refers to configuring the label for the child table rather than editing the original field definition on the parent/base table.
Bengaluru, India

AI Explanation - verified by User5651 on: September 01, 2026
Question 23:
Correct answer: D. Version control
Version control tracks changes made to a document over time. It can identify:

The current and previous versions

Which clauses were changed

When each revision occurred

Potentially, who made the changes

This is important for contracts because it prevents confusion about which revision is authoritative and provides an audit trail.
Why the others are incorrect:

Version validation: Verifies a version’s accuracy or integrity but does not primarily track revisions.

Version changes: Not the standard name for a formal document-management process.

Version updates: Describes updating a document, not the complete process of managing and tracking its revisions.

The key clue is “track revisions,” which directly indicates version control.
Dundalk, United States

AI Explanation - verified by User9460 on: September 22, 2026
Question 6:
Correct answer: B. SLA (Service-Level Agreement)
An SLA defines the expected level of service between a customer and a vendor. It commonly specifies:

How quickly the vendor must respond to incidents or requests

Availability or uptime requirements

Resolution time targets

Performance expectations and penalties for failing to meet them

Why the others are incorrect:

SOW (Statement of Work): Describes the work, deliverables, scope, and schedule.

MOA (Memorandum of Agreement): Documents an agreement in which parties commit to specific responsibilities.

MOU (Memorandum of Understanding): Records a general intention to cooperate; it may not be legally binding.

Therefore, the agreement that defines the vendor’s required response time is an SLA.
Dallas, United States

AI Explanation - verified by User4549 on: September 16, 2026
Question 6:
Correct answer: B. SLA (Service-Level Agreement)
An SLA is an agreement that defines the level of service a vendor must provide, including the time frame for responding to support requests. It may also specify:

Maximum response and resolution times

Expected uptime or availability

Performance requirements

Escalation procedures

Consequences for failing to meet requirements

Why the others don’t fit:

SOW: Defines a project’s scope, tasks, deliverables, and schedule.

MOA: Documents specific responsibilities agreed upon by two parties.

MOU: Records a general understanding or intent to cooperate.

For exam questions involving vendor response times or service commitments, choose SLA.
Broomfield, United States

AI Explanation - verified by User8896 on: September 07, 2026
Question 99:
Question 99 tests communication between two VRFs using static routes and the global routing table.
Answer A is correct:

text ip route vrf Customer1 172.16.1.0 255.255.255.0 172.16.1.1 global ip route vrf Customer2 192.168.1.200 255.255.255.255 192.168.1.1 global ip route 192.168.1.0 255.255.255.0 Vlan10 ip route 172.16.1.0 255.255.255.0 Vlan20

Why:

The route in Customer1 VRF provides a path back to the Customer2 subnet, 172.16.1.0/24.

The route in Customer2 VRF provides a path to the FTP server, 192.168.1.200.

The keyword global tells the router to resolve the next hop using the global routing table, enabling controlled route leaking between the VRF and global table.

The global routes identify the VLAN interfaces used to reach each customer network.

The other options either omit the required global keyword, use an incorrect prefix length, or specify another VRF as the next-hop table rather than using the global table.
Blantyre, Malawi

AI Explanation - verified by User3731 on: September 14, 2026
Question 13:
Correct answer: C. Jailbreaking
Jailbreaking modifies or bypasses a smartphone’s built-in restrictions, allowing the user to:

Install unauthorized or unsupported software

Access features blocked by the manufacturer or operating system

Customize system behavior beyond normal settings

Sideloading means installing an application from a source other than the official app store. It may install unauthorized software, but it does not necessarily modify the operating system or enable new system-level features.
So yes—the wording about enabling new features points toward jailbreaking. The question describes more than simply installing an outside app; it describes bypassing platform restrictions.
Porter Ranch, United States

AI Explanation - verified by User4843 on: September 18, 2026
Question 12:
Correct answer: B. Port security
A MAC flooding attack overwhelms a switch’s CAM/MAC address table with many fake source MAC addresses. When the table is full, the switch may treat unknown destinations like broadcast traffic and forward frames out many ports, allowing an attacker to capture traffic.
Port security mitigates this by limiting which MAC addresses can appear on a switch port and how many are allowed. The switch can then shut down, restrict, or alert on violations.
Why the others are less suitable:

Load balancer: Distributes application traffic; it does not protect switch MAC tables.

IPS: May detect some attack traffic, but it is not the primary control for switch-port MAC learning.

NGFW: Protects at network boundaries but does not directly limit MAC addresses learned on access ports.

Look for the clue: an attack targeting a switch’s MAC/CAM table is best addressed with a Layer 2 switch-control feature, especially port security.
Biloxi, United States

AI Explanation - verified by n.brahm85b on: September 12, 2026
Question 255:
Question 255 tests high availability and fault tolerance for a business-critical application with a 99.999% SLA—about 5 minutes of permitted downtime per year.
I can’t see the hotspot image, so I can’t verify the exact positions, but the intended design is:

Active-active routers: Provide redundant Internet connections/devices. Both can operate, so traffic can fail over or be load-balanced.

Active-active firewalls: Avoid a single firewall becoming a failure point while maintaining security inspection.

Load balancers: Distribute requests across multiple web servers. If one server fails, traffic can go to the other.

Redundant power supplies: A server with separate power supplies should connect to independent power sources or circuits.

UPS A and UPS B: Provide backup power and redundancy. Ideally, each power supply is connected to a different UPS.

SONET ring: A ring topology provides alternate paths if a fiber link or segment fails.

The key principle is eliminating single points of failure through redundant network paths, security devices, power systems, and servers. The answer key’s explanation is broadly correct, although the exact power-supply placement depends on the missing diagram.
Cambridge, United Kingdom

AI Explanation - verified by User3451 on: September 03, 2026
Question 17:
Correct answer: B — Unsupervised learning.
The customer data is unlabeled, meaning there are no predefined tier labels such as “premium,” “standard,” or “basic.” Unsupervised learning can analyze the data and identify natural groups based on similarities, such as purchase history, spending, or engagement. The company can then assign those groups to advertising tiers.
Why the other options are incorrect:

Supervised learning requires labeled examples to learn how to classify customers.

Reinforcement learning learns through actions, rewards, and penalties, which is not the main task here.

RLHF uses human feedback to improve model behavior, typically for generative AI, not customer segmentation.

The key clue is “unlabeled customer data” combined with grouping customers into tiers.
Bengaluru, India

AI Explanation - verified by User1494 on: September 13, 2026
Question 6:
Correct answer: B. SLA (Service-Level Agreement)
An SLA defines the expected level of service between a customer and vendor. It commonly specifies:

Required response and resolution times

Availability or uptime targets

Performance standards

Support obligations

Remedies or penalties for failing to meet the terms

Why the others are incorrect:

SOW (Statement of Work): Defines the project’s scope, tasks, deliverables, and schedule.

MOA (Memorandum of Agreement): Describes agreed responsibilities between parties, often for a specific activity.

MOU (Memorandum of Understanding): Records a mutual understanding or intention, usually less formal than a contract.

Therefore, the agreement that defines how quickly a vendor must respond is an SLA.
New Orleans, United States

AI Tutor 👋 I’m here to help!

Cisco 350-901 Exam Prep Developing Applications using Cisco Core Platforms and APIs (DEVCOR) (Page 22 )

QUESTION: 65

Explanation:

QUESTION: 66

QUESTION: 67

QUESTION: 68

QUESTION: 69

Cisco 350-901 Exam Prep
Developing Applications using Cisco Core Platforms and APIs (DEVCOR) (Page 22 )