DRAG DROP (Drag and Drop is not supported)
Drag and drop the descriptions from the left onto the related OAuth-defined roles on the right.
Select and Place:

See Explanation section for answer.

Answer(s): A

Explanation:

Show Answer Next Question

QUESTION: 66

Refer to the exhibit. This cURL POST request creates an OAuth access token for authentication with FDM API requests.

What is the purpose of the file “@token_data” that cURL is handling?

This file is given as input to store the access token received from FDM.
This file is used to send authentication-related headers.
This file contains raw data that is needed for token authentication.
This file is a container to log possible error responses in the request.

Answer(s): C

Show Answer Next Question

QUESTION: 67

What is the result of a successful OAuth2 authorization grant flow?

The third-party service is provided with a token that allows actions to be performed.
The user has the application rights that correspond to the user's role within the application's database.
The application is provided with a token that allows actions on services on the user's behalf.
The user has administrative rights to the application's backend services.

Answer(s): C

Show Answer Next Question

QUESTION: 68

In the three-legged OAuth2 process, after the authorization server presents a form to the resource owner to grant access, what is the next step?

The resource owner authenticates and optionally authorizes with the authorization server.
The user who owns the resource initiates a request to the OAuth client.
If the resource owner allows access, the authorization server sends the OAuth client a redirection.
A form to allow or restrict access is submitted by the owner of the resource.

Answer(s): D

Show Answer Next Question

QUESTION: 69

Which OAuth mechanism enables clients to continue to have an active access token without further interaction from the user?

refresh grant
JWT
password grant
preshared key

Answer(s): A

Show Answer Next Question

Download PDF Next Page

Viewing page 29 of 78
Viewing questions 141 - 145 out of 507 questions

Post your Comments and Discuss Cisco 350-901 exam prep with other Community members:

Comments:

Name:

350-901 Exam Discussions & Posts
350-901 AI Verifications

Alex on: March 02, 2025
Great material
UNITED KINGDOM

Chmod on: August 27, 2026
The exam tougher but still doable.
Canada

Linter on: July 03, 2026
This exam was tougher than I thought but prep on this website made it manageable.
Greece

Grep on: July 30, 2026
Crammed with this site and barely passed but saved me time.
United States

Tcpdump on: July 13, 2026
I was unsure at first but those practice questions on this website really helped me get it together for the exam.
France

Bitmask on: August 05, 2026
Questions here? Life saver for tough exam.
Italy

Ring0 on: August 04, 2026
Long workdays short study times but man passing this exam feels so good.
Finland

Systemd on: August 09, 2026
This website saved me time and money passed this exam.
France

Parity on: August 28, 2026
This exam had way more topics than I thought so it was tough. The AI assistant on this site helped a lot by breaking things down for me.
United Kingdom

Dotfile on: July 03, 2026
This exam was tough but these questions helped.
Canada

Fiber on: June 23, 2026
This exam was so stressful but I got through it. The prep materials really made a difference.
Ireland

Tcpdump on: August 17, 2026
Man that exam was super stressful but the prep material here helped a lot. I'm just happy it's done now.
Belgium

Hardlink on: August 22, 2026
Slow going but review time paid off.
Denmark

Synack on: July 16, 2026
Thought I wasn't ready but practice questions helped.
Norway

Systemd on: June 23, 2026
This exam was tough but the practice questions helped.
Canada

Traceroute on: September 03, 2026
This exam was tough but practice questions saved me.
Japan

Sudoer on: August 31, 2026
Prep was a lifesaver on this stressful test. Would've bombed without it.
Japan

Payload on: September 17, 2026
I crammed with this site and saved a ton of time and money so I just breezed through the exam chill.
Belgium

Linter on: July 13, 2026
I cram like crazy using this site and somehow save time and money to pass the exam slow.
New Zealand

Endianness on: September 10, 2026
This exam was tough but doable.
Spain

Firmware on: July 04, 2026
Exam was harder than expected but manageable.
Ireland

CoreDump on: July 17, 2026
This exam was harder than I thought.
Portugal

Vlan on: July 05, 2026
The exam was brutal but the questions here saved me.
Portugal

priyadevops on: July 22, 2026
I found the exam tough but these practice questions really saved me.
Colombia

Pip on: June 18, 2026
This site saved me lots of time and money cramming slowly through it and I passed the exam.
Croatia

Regex on: September 06, 2026
The exam was harder than I thought but still got through it using the practice questions here.
Belgium

Fiber on: June 25, 2026
At first I wasn't confident but these practice questions helped me learn a lot for this exam.
Hong Kong

Zsh on: August 29, 2026
Got there slow but steady thanks to the practice questions here passed fine.
Belgium

Loopback on: August 29, 2026
Was shaky at first but practice questions helped.
Mexico

remoteandcertified on: June 13, 2026
Cramming with this website's practice questions saved me time and money but I had to go slow because the exam is tough.
South Africa

Regex on: August 23, 2026
I wasn't feeling too confident at first but the practice questions on this website actually helped a lot.
Switzerland

Tty on: June 28, 2026
The exam was so stressful. This website's materials helped though.
Argentina

Patchset on: August 10, 2026
This exam harder than I thought but with these practice questions you still got a fair shot.
Australia

Grep on: July 05, 2026
I was worried this exam would be tough but the practice questions helped. Glad that's done now.
Switzerland

Rootkit on: July 11, 2026
Slow but got there passed it
Singapore

ZeroDay on: August 21, 2026
That test was no joke. Good thing the prep materials worked out.
Australia

Hashmap on: August 19, 2026
Cramped hard saved me time and money but passed the exam.
United States

Initd on: September 04, 2026
Saved me time and some money I passed.
United States

PktLoss on: August 08, 2026
Took me a while to get through but the practice questions helped review and I passed.
Canada

Pdu on: July 18, 2026
Man this exam was stressful. Glad the prep stuff here sorted me out good enough.
Belgium

Traceroute on: June 27, 2026
The exam was a bit harder but doable.
Greece

Pids on: September 14, 2026
The exam was way broader than I thought it would be but thankfully the AI assistant on this site made a difference. Didn't get stuck much since it kept giving relevant hints to help along.
Lithuania

Pip on: July 30, 2026
Man this exam was tough but the practice questions got me through. Just glad I passed honestly.
Austria

Heap on: June 24, 2026
The exam threw in more than I expected but the AI assistant on this site really helped. Made understanding the tricky parts a bit easier.
Sweden

Bitshift on: August 31, 2026
Man this exam was tougher than I thought but with the practice questions from this site I got through it.
Italy

Vlan on: July 28, 2026
Didn't feel ready but practice questions helped.
Italy

Strace on: June 23, 2026
This exam was tough but these questions helped.
Denmark

ZeroDay on: September 09, 2026
After juggling work I squeezed in short study bursts and got through the exam with a big sigh of relief.
Slovenia

Ping on: June 10, 2026
Whew this exam was kinda stressful but the practice questions helped. Glad I found this site honestly.
United Kingdom

Tty on: September 15, 2026
Exam was hard but prep helped.
Brazil

AI Explanation - verified by User6966 on: September 23, 2026
Question 37:
Question 37 asks you to choose three true statements about Snowflake data loading.
Correct answers: A, C, and D.

A — VARIANT "null" values are not the same as SQL NULL values: True

- A JSON null stored in a VARIANT column is a value representing JSON null. - SQL NULL means the value is missing or unknown. Snowflake treats them differently in comparisons and functions.

B — Frequent, single-row DMLs: False

- Snowflake is optimized for batch-oriented processing rather than many individual INSERT or UPDATE statements. - Loading data in batches generally provides better performance and efficiency.

C — Validate data before loading into the target table: True

- Data should be checked for format, structure, data types, and quality before it reaches the production target. - Snowflake supports validation approaches such as checking staged files and using COPY INTO validation options.

D — Use staging tables to manage MERGE statements: True

- Data is commonly loaded into a staging table first. - A MERGE can then compare staging data with the target and perform controlled inserts, updates, or deletes.
The answer key’s A, C, D is consistent with Snowflake loading b
Erlanger, United States

AI Explanation - verified by flonsab on: September 16, 2026
Question 27:
Correct answer: C — PAP (Password Authentication Protocol).
PAP is the least secure because it sends the username and password in a relatively unprotected form during authentication. If an attacker can capture the exchange, the credentials may be exposed.
Why the others are stronger:

CHAP: Uses a challenge-response exchange, so the password is not directly transmitted.

IPsec: Provides authentication, integrity, and encryption for IP communications.

EAP: An authentication framework that supports stronger methods, such as certificates or token-based authentication.

Exam tip: When comparing authentication protocols, PAP is generally the weakest choice because it lacks meaningful protection for transmitted credentials.
Repentigny, Canada

AI Explanation - verified by User5950 on: September 03, 2026
Question 191:
Question 191: The answer key shows D (policy), but I believe the correct answer is C: risk perspective.
Senior management is most likely to support information security governance when it is connected to business risk and organizational objectives. Presenting security in terms of risks—such as financial loss, operational disruption, legal exposure, or reputational damage—helps executives understand why governance matters.
Why the other options are weaker:

Threat perspective: Focuses on possible attacks, but may seem technical or hypothetical.

Compliance perspective: Can motivate action, but compliance alone does not demonstrate the broader business value of governance.

Policy perspective: Policies are important, but they are a means of implementing governance, not its primary business justification.

For ISACA questions, look for the option that frames security as enterprise risk management and business protection, rather than as technical controls or policy administration.
Niterói, Brazil

AI Explanation - verified by User6870 on: September 19, 2026
Question 1:
Correct answer: B. Transfer
Cyber insurance is a risk transfer strategy. The company shifts some of the financial impact of a cybersecurity incident to an insurance provider in exchange for paying premiums.

Accept: Acknowledging the risk and choosing not to take additional action.

Transfer: Shifting the risk or financial consequences to another party, such as an insurer.

Mitigate: Reducing the likelihood or impact through controls, such as patching or access restrictions.

Avoid: Eliminating the activity that creates the risk.

Insurance does not eliminate the underlying threat; it primarily transfers the financial consequences of that risk.
Islamabad, Pakistan

AI Explanation - verified by User6966 on: September 23, 2026
Question 14:
Question 14 asks which Snowflake object can limit credit consumption within an account.
The correct answer is B — Resource Monitor.
A resource monitor lets administrators:

Set credit quotas for an account or individual virtual warehouses.

Define monitoring intervals.

Trigger actions when usage reaches thresholds, such as sending notifications or suspending a warehouse.

Help control unexpected warehouse spending.

Why the other options are incorrect:

Account Usage: Provides historical usage and billing data; it does not enforce credit limits.

Warehouse Limit Parameter: Not the Snowflake object used for account-wide credit controls.

Credit Consumption Tracker: Not a standard Snowflake object.

A resource monitor can suspend assigned warehouses when limits are reached. However, account-level resource monitors and warehouse-level resource monitors have different enforcement behavior, so read the wording carefully in exam questions.
Columbus, United States

AI Explanation - verified by User5120 on: September 21, 2026
Question 11:
Correct answer: B — Databricks web application
In the classic Databricks architecture, the control plane hosts the Databricks management services, including the web application. Users access the workspace UI from the control plane.
The other components are associated with the data plane:

Driver node: Coordinates Spark jobs and runs in the compute environment.

Worker node: Executes tasks and processes data.

Databricks Filesystem (DBFS): Provides storage access for data used by compute resources.

Exam tip: The control plane manages and orchestrates the workspace, while the data plane performs computation and processes data.
Charlotte, United States

AI Explanation - verified by User1290 on: September 10, 2026
Question 14:
Correct answer: D. Out-of-band management
Out-of-band (OOB) management provides a separate management path to a network appliance, usually through a dedicated management interface, console server, or cellular connection. It allows administrators to access and troubleshoot the device even when its normal network interfaces or operating system have failed.
Why the others are incorrect:

Crash cart: Provides local physical access, not remote access.

Jump box: A secured intermediary used to reach devices over the normal network; it may be inaccessible if the appliance has not booted.

Secure Shell (SSH): Requires the device’s operating system and network services to be running properly.

The key clues are “remote access” and a device that failed to start up properly, making OOB management the appropriate solution.
Quezon City, Philippines

AI Explanation - verified by User7103 on: September 22, 2026
Question 29:
Correct answer: A. Hashing
A hash creates a fixed-length value representing the software’s contents. After release, the company can calculate the file’s hash again and compare it with the original:

Matching hashes: The software likely has not changed.

Different hashes: The software was modified or corrupted.

Why the others are incorrect:

Encryption: Protects confidentiality by making data unreadable; it does not primarily detect changes.

Baselines: Define an approved system or configuration state, but they are not the specific integrity mechanism here.

Tokenization: Replaces sensitive data with substitute values.

In real deployments, a digital signature is often preferred because it verifies both integrity and the publisher’s identity, but hashing is the best available answer.
Opelika, United States

AI Explanation - verified by kusumasri77777 on: September 07, 2026
Question 47:
Correct answer: C — Revert to the version of the prompt that produced the closest match and adjust from that baseline.
When repeated prompt edits cause the output to drift, the problem is likely cumulative degradation: each change may introduce new ambiguity or interfere with something that previously worked.
The best approach is to:

Keep earlier prompt versions.

Identify the last version that produced acceptable output.

Restore it as a baseline.

Make small, controlled changes—ideally one significant change at a time.

Test the output after each change.

Why the others are poor choices:

A: Discards useful information about what worked.

B: Large simultaneous changes make it difficult to identify the cause of problems.

D: Accepts output that does not meet the requirements.

This tests disciplined prompt iteration and version control, rather than trial-and-error editing.
Bengaluru, India

AI Explanation - verified by User3169 on: September 12, 2026
Question 1:
Correct answer: B. Transfer
Buying cyber insurance transfers some of the financial risk to a third party—the insurance provider. If a covered incident occurs, the insurer may help pay for recovery, legal costs, notifications, or other losses.

Accept: Acknowledge the risk and take no additional action.

Transfer: Shift the risk or financial impact to another party, such as through insurance or a contract.

Mitigate: Reduce the likelihood or impact using controls, such as firewalls, training, or backups.

Avoid: Eliminate the activity that creates the risk.

Insurance does not remove the cyber risk itself; it primarily transfers the financial consequences.
Jonesboro, United States

AI Explanation - verified by User9211 on: September 25, 2026
Question 21:
Correct answer: C — Internal auditing
An internal audit is the best method for conducting frequent, detailed reviews of systems, processes, and procedures against an organization’s compliance objectives. Internal auditors can examine policies, evidence, control effectiveness, and whether employees follow required procedures.
Why the other options are less suitable:

Third-party attestation: Provides independent confirmation, often for formal compliance reporting, but is not usually performed frequently.

Penetration testing: Attempts to exploit vulnerabilities; it focuses on technical security, not overall compliance procedures.

Vulnerability scans: Identify known technical weaknesses in systems, but do not evaluate whether policies and processes meet compliance requirements.

The key clue is “frequent, detailed reviews” to track “compliance objectives”, which points to internal auditing.
Atlanta, United States

AI Explanation - verified by User7687 on: September 10, 2026
E is correct and D means nothing since "production server" is not a salesforce terminology
You’re right to challenge that. The stronger answer is B, C, and E, not B, C, and D.

B: Developer Edition has limited user, storage, and data-volume capacity, making realistic community testing difficult.

C: A Developer Edition org cannot contain sandboxes, so it cannot provide separate environments for development, integration, and UAT.

E: A standalone Developer Edition org is not part of the production org’s deployment path, so change sets cannot be used to deploy from it directly to that production org. The team would need Metadata API, Salesforce CLI, or another deployment method.

D is poorly worded and should not be treated as a sound Salesforce risk. “Production servers” is not the meaningful distinction for this architecture decision, and an org’s environment type alone is not a reliable basis for concluding that it will perform poorly.
So the page’s stated answer B, C, D appears incorrect; B, C, E better matches the risks described.
Marseille, France

AI Explanation - verified by User7687 on: September 07, 2026
Question 18:
The answer key shows B and D, but I believe the stronger answers are A and D.

A — Correct: Identify the data required by Salesforce, its dependencies, and how it should be validated. Verification scripts help confirm record counts, relationships, field mappings, and data integrity after migration.

D — Correct: Use a full sandbox and perform trial migrations using realistic—or appropriately masked—legacy data. This exposes transformation, volume, dependency, and integration issues before production cutover.

B — Less appropriate: Phased user migration and parallel operation primarily address user adoption and rollout risk, not the technical risks of data migration.

C — Less appropriate: Although sandbox testing and integration testing are valuable, the option emphasizes test-data generation rather than validating the migration with representative legacy data. “A full sandbox for all systems” may also be impractical.

The exam concept is to profile and validate the data first, then rehearse the migration with realistic data in a nonproduction environment.
Rome, Italy

AI Explanation - verified by User3731 on: September 14, 2026
Question 13:
Correct answer: C. Jailbreaking
Jailbreaking modifies or bypasses a smartphone’s built-in restrictions, allowing the user to:

Install unauthorized or unsupported software

Access features blocked by the manufacturer or operating system

Customize system behavior beyond normal settings

Sideloading means installing an application from a source other than the official app store. It may install unauthorized software, but it does not necessarily modify the operating system or enable new system-level features.
So yes—the wording about enabling new features points toward jailbreaking. The question describes more than simply installing an outside app; it describes bypassing platform restrictions.
Porter Ranch, United States

AI Explanation - verified by User7981 on: September 14, 2026
Question 87:
Correct answer: Footprinting the internal network
The image isn’t visible here, so I can’t interpret every detail of the DNS snippet. However, the keyed answer fits if the log shows DNS requests for internal hostnames, subdomains, or naming patterns.
Footprinting is the reconnaissance phase in which an attacker gathers information about a target environment, such as:

Internal hostnames and subdomains

Network structure and naming conventions

Servers and services

Relationships between systems

Why the other options are less likely:

Determining ISP-assigned address space: Usually involves external registration and DNS information, not internal host discovery.

Bypassing DNS sinkholing: Would require evidence that malicious DNS requests avoided redirection.

Initial access: DNS queries alone do not show that the attacker gained access.

Exfiltrating data: DNS tunneling can do this, but the snippet would typically show encoded or unusually long DNS queries.

Thus, the suspicious DNS activity most likely represents internal network reconnaissance/footprinting.
Orlando, United States

AI Explanation - verified by User8379 on: September 22, 2026
so the correct answer is ?
The correct three selections are:

Admin access to the deployment pipeline

Contributor access to the Development and Test workspaces

Viewer access to the Production workspace

So, using the option order shown, the answer is B, D, and E.
The displayed key, B and E, is incomplete because the developers also need Viewer access to Production to view production items. They should not have Contributor access there, since that would allow modifications or deployments to Production.
Delhi, India

AI Explanation - verified by User8630 on: September 12, 2026
Question 13:
The answer key shows D, but I believe the best answer is B — User Acceptance Testing (UAT) before implementation.
Change management includes evaluating, testing, approving, implementing, and documenting changes. UAT before implementation confirms that the change meets business requirements and does not cause unacceptable problems before being placed into production.
Why the other options are weaker:

A — Technical review by business owner: A business owner may approve the business impact, but a technical review is normally performed by technical personnel.

C — Cost-benefit analysis after implementation: Cost-benefit analysis should occur before implementation to support the approval decision.

D — Business continuity testing: This can be appropriate for major changes, but it is primarily part of business continuity and disaster recovery planning—not a universal change-management activity.

Therefore, B is the more generally correct answer, and the community answer key appears questionable.
Petaling Jaya, Malaysia

AI Explanation - verified by User1290 on: September 10, 2026
Question 45:
Correct answer: Fiber-optic (C)
Fiber-optic cable uses pulses of light to transmit data, providing the highest transmission speeds and longest distances among these choices. It is also resistant to electromagnetic interference.
Why the others are incorrect:

Plenum: Describes a fire-resistant cable jacket rating, not a transmission medium or speed.

Ethernet: Describes a networking technology; Ethernet can use copper or fiber, so the term alone does not identify the fastest cable type.

DAC (Direct Attach Copper): Uses copper and is typically intended for short-distance, high-speed connections in data centers.

Exam clue: When comparing common cable media and the question emphasizes maximum speed or distance, fiber-optic is usually the best choice.
Quezon City, Philippines

AI Explanation - verified by User3666 on: September 20, 2026
Question 27:
Correct answer: No. The answer key is correct.
Question 27 asks whether recommending Azure Multi-Factor Authentication (MFA) will ensure administrative credentials are encrypted during automated Azure deployments.

MFA adds an additional authentication factor, such as a phone notification or verification code.

It helps prevent unauthorized sign-ins, even if a password is compromised.

It does not encrypt, store, or protect credentials used by deployment processes.

A more suitable solution would be Azure Key Vault, which securely stores secrets, passwords, certificates, and keys. An automation process can retrieve the credentials from Key Vault without exposing them directly in deployment scripts or templates.
Therefore, MFA improves authentication security, but it does not meet the requirement to encrypt and protect deployment credentials.
Bradenton, United States

AI Explanation - verified by User8545 on: September 26, 2026
Can pcs with differet / or ip range can communicate with each other?
Yes, PCs in different IP ranges can communicate, but they usually need a router or Layer 3 switch to route traffic between their networks.
Example:

PC A: 192.168.1.10/24

PC B: 192.168.2.10/24

These are different subnets. They can communicate if:

Both PCs have a correct default gateway

A router or Layer 3 switch connects the subnets

Routing and firewall rules allow the traffic

Without a router, they generally cannot communicate directly because each PC believes the other is on a different network and sends the traffic to its gateway.
The /24 is the subnet prefix length. It determines which addresses are considered local. For example, with 192.168.1.0/24, addresses from 192.168.1.1 through 192.168.1.254 are in the same subnet. A PC at 192.168.2.x is outside that subnet.
Also, PCs in the same broad IP range may still be unable to communicate if VLANs, subnet masks, ACLs, or firewalls separate them.
Quezon City, Philippines

AI Explanation - verified by User5788 on: September 02, 2026
Question 28:
Correct answers: C. Honeypots and E. DNS sinkhole
Both are designed to detect or observe attackers who have gained access to a network:

Honeypots: Decoy systems or services made to attract attackers. Legitimate users should not interact with them, so activity there is a strong indicator of malicious behavior.

DNS sinkholes: Redirect requests for known malicious domains to a controlled internal system. This can reveal infected hosts attempting to contact command-and-control infrastructure.

Why the others are incorrect:

Tokenization: Replaces sensitive data with non-sensitive tokens.

CI/CD: Automates software development, testing, and deployment.

Threat modeling: Identifies and analyzes potential threats before or during system design.

Data obfuscation: Makes data harder to understand or interpret.

The answer key’s C and E are correct.
Quezon City, Philippines

AI Explanation - verified by 8vot4a8c9g on: September 16, 2026
Question 45:
Question 45’s stated answer appears to be wrong. The answer key selects D, but based on the equivalence classes shown in the explanation, B is the correct choice.
The four classes are:

x = -100

-100 < x < 100

100 = x < 1000

x = 1000

Option B gives:

-500 ? class 1

0 ? class 2

100 ? class 3

1000 ? class 4

Thus, it supplies one representative value from every equivalence class.
Option D (-1000; -100; 100; 1000) does not cover the second class, because -100 belongs to the first class (x = -100).
Correct answer: B, assuming the class definitions in the page explanation are accurate. The explanation’s claim that D includes 500 and 1500 also conflicts with the values actually listed for D.
Hyderabad, India

AI Explanation - verified by User2639 on: September 22, 2026
Question 1:
Correct answer: B. Transfer
Risk transfer means shifting the financial impact or responsibility for a risk to another party. Cyber insurance is a classic example: the company pays an insurer to assume some of the financial loss associated with specified cyber incidents.

Accept: Acknowledging the risk without taking additional action.

Transfer: Moving the risk’s financial impact to a third party, such as an insurer.

Mitigate: Reducing the likelihood or impact through controls, such as patching or employee training.

Avoid: Eliminating the activity that creates the risk.

The insurance does not necessarily stop an attack from occurring; it primarily helps manage the consequences, which makes transfer the best choice.
Dallas, United States

AI Explanation - verified by n.brahm85b on: September 12, 2026
Question 255:
Question 255 tests high availability and fault tolerance for a business-critical application with a 99.999% SLA—about 5 minutes of permitted downtime per year.
I can’t see the hotspot image, so I can’t verify the exact positions, but the intended design is:

Active-active routers: Provide redundant Internet connections/devices. Both can operate, so traffic can fail over or be load-balanced.

Active-active firewalls: Avoid a single firewall becoming a failure point while maintaining security inspection.

Load balancers: Distribute requests across multiple web servers. If one server fails, traffic can go to the other.

Redundant power supplies: A server with separate power supplies should connect to independent power sources or circuits.

UPS A and UPS B: Provide backup power and redundancy. Ideally, each power supply is connected to a different UPS.

SONET ring: A ring topology provides alternate paths if a fiber link or segment fails.

The key principle is eliminating single points of failure through redundant network paths, security devices, power systems, and servers. The answer key’s explanation is broadly correct, although the exact power-supply placement depends on the missing diagram.
Cambridge, United Kingdom

AI Explanation - verified by szb.brian on: September 14, 2026
Question 1:
Correct answer: B. Transfer
Purchasing cyber insurance is a risk transfer strategy. The company shifts some of the financial consequences of a cyber incident to an insurance provider in exchange for paying premiums.

Accept: Acknowledges the risk without taking additional action.

Transfer: Shifts the risk or financial impact to another party, such as an insurer.

Mitigate: Reduces the likelihood or impact through controls like patching, MFA, or segmentation.

Avoid: Eliminates the activity that creates the risk.

The answer key’s B is correct. Note that insurance does not eliminate the underlying threat; it primarily helps transfer the financial impact.
Yangon, Myanmar

AI Explanation - verified by User1638 on: September 11, 2026
Question 20:
Correct answer: A — Determine an appropriate format for the presentation.
Before presenting requirements, Gary should consider:

The audience and stakeholders

The complexity and type of requirements

The communication method and level of detail needed

Whether to use diagrams, models, documents, demonstrations, or slides

This supports the BABOK task Communicate Business Analysis Information, which requires tailoring the presentation format and content to the stakeholders.
Why the others are less suitable:

B: Authority to host the presentation is not the key preparation activity.

C: Stakeholder sign-off may occur later; presenting requirements does not always require formal approval beforehand.

D: A scribe may be useful in a meeting, but hiring one is not a core preparation requirement for presenting.

Madala, Nigeria

AI Explanation - verified by User7520 on: September 03, 2026
Question 2:
Correct answer: C. Risk register
A risk register is a centralized document used to track:

Identified risks

Risk owners or responsible parties

Likelihood and impact

Risk response plans

Current status

Risk thresholds or trigger conditions

Why the others are incorrect:

Risk tolerance: The amount and type of risk an organization is willing to accept; it is not primarily a tracking document.

Risk transfer: Moving the financial or operational impact of a risk to another party, such as through insurance or outsourcing.

Risk analysis: The process of evaluating a risk’s likelihood and impact.

The key clue is “document risks and responsible parties.” That directly describes a risk register.
Houston, United States

AI Explanation - verified by User6966 on: September 23, 2026
Question 9:
Correct answers: B and D — Warehouse size and number of clusters.
Snowflake virtual warehouse credits are primarily determined by:

Warehouse size: Larger warehouses use more credits per unit of time than smaller ones.

Number of clusters: A multi-cluster warehouse can run multiple clusters, and each active cluster consumes credits. Therefore, increasing the maximum or active cluster count can increase consumption.

The following do not directly determine compute-layer credit usage:

Number of users: More users may cause more workload, but users themselves do not consume credits.

Amount of data processed: Snowflake warehouses are not charged directly by the amount of data scanned. However, processing more data may cause the warehouse to run longer, indirectly increasing credits.

Also remember that actual usage depends on how long the warehouse runs, including any configured auto-suspend and auto-resume behavior.
Columbus, United States

AI Explanation - verified by pikej74485 on: September 21, 2026
Question 193:
Correct answer: D — Reference the Set<Id> in the WHERE clause
A Set<Id> can be used with the IN operator to filter records:

apex Set<Id> accountIds = new Set<Id>{ accountId1, accountId2 }; List<Account> accounts = [ SELECT Id, Name FROM Account WHERE Id IN :accountIds ];

The colon (:) binds the Apex variable to the SOQL query. Only records whose IDs are contained in the set are returned.
Why the other options are incorrect:

A: LIMIT accepts a number, not a collection of IDs.

B: Set.containsAll() checks set contents in Apex; it does not filter SOQL results.

C: Database.query() accepts a dynamic SOQL string, not a Set<Id> directly.

Remember: use WHERE SomeIdField IN :mySet for collection-based filtering.
Chennai, India

AI Explanation - verified by User5357 on: September 12, 2026
Question 1:
No tienen que ser idénticas en sistema operativo, pero sí deben cumplir varias compatibilidades.

Un AG puede tener réplicas en Windows y Linux desde SQL Server 2017; por tanto, una réplica Windows y otra Linux es posible.

Sin embargo, las réplicas de un AG deben utilizar normalmente la misma versión principal de SQL Server. Una instancia SQL Server 2017 no puede tener directamente una réplica secundaria SQL Server 2019 como configuración normal y permanente.

En tu escenario, SQL Server 2017 en Windows y SQL Server 2019 en Linux no se pueden añadir directamente como réplicas equivalentes de AG1. Primero habría que realizar un proceso de actualización/migración compatible, por ejemplo mediante una actualización gradual o una tecnología de migración como log shipping o distributed availability groups, según el diseño.

Además, en un AG mixto Windows/Linux hay que considerar:

Tipo de clúster y mecanismo de quorum.

Failover normalmente manual en configuraciones multiplataforma.

Edición y características compatibles.

Configuración de endpoints y permisos.

Limitaciones específicas de SQL Server en Linux.

Por eso, en la pregunta 41, “añadir una secundaria a AG1” no debe interpretarse literalmente como conectar sin más SQL 2019 Linux a un AG SQL 2017. La respuesta del banco parece simplificar demasiado el escenario; habría que validar la ruta exacta de migración.
Mollet Del Vallès, Spain

AI Explanation - verified by User2510 on: September 21, 2026
Question 3:
Correct answer: Change the DNS settings.
A computer joining an Active Directory domain must locate the domain controller using DNS, especially the domain’s SRV records. In this scenario, the workstation can ping the server and access the internet, so basic IP connectivity is working.
However, if it is configured to use public DNS servers such as 8.8.8.8 or 1.1.1.1, those servers will not know about the organization’s internal domain records. The workstation should use the organization’s internal DNS server, typically hosted on or associated with the domain controller.
Why the other options are incorrect:

Static IP address: Not needed if the workstation already has network connectivity.

Subnet mask: Incorrect subnetting would usually prevent local communication, including pinging the server.

Default gateway: Primarily affects communication outside the local network; it does not normally prevent finding an internal domain controller.

Key exam clue: Internet access and ping working do not prove that domain-name resolution is configured correctly.
Farmington Hills, United States

AI Explanation - verified by User5527 on: September 16, 2026
Question 44:
Correct answer: C. Increase the volume of data used in training.
The model performed well on the training data but poorly after deployment. This indicates overfitting: the model learned the training examples too closely instead of learning patterns that generalize to new data.
Using more representative training data can help the model learn broader patterns and improve performance on unseen production data.
Why the other options are weaker:

Reduce the training data: Usually makes overfitting worse.

Add hyperparameters: Hyperparameters already control training; simply adding them does not solve the problem. Proper tuning could help, but that is not what the option states.

Increase training time: More training can worsen overfitting if the model is already memorizing the training data.

In practice, also use a validation set, regularization, and performance monitoring to confirm and mitigate overfitting.
Mumbai, India

AI Explanation - verified by User5867 on: September 05, 2026
Question 13:
The stated answer A, C, E appears incorrect. The better answer is C, D, and E.

C — Custom buttons display at the top and bottom of a page: Correct. In Salesforce Classic, buttons can appear in the page’s button areas, including the top and bottom of record pages.

D — Custom buttons are available for Person Accounts: Correct. Person Accounts use the Account object, so Account custom buttons can be available on Person Account layouts.

E — Custom buttons can reference an external app: Correct. A URL custom button can launch or navigate to an external application or website.

Why the others are incorrect:

A: JavaScript custom buttons are a Salesforce Classic feature and are not supported in Lightning Experience. They do not enhance Lightning Experience.

B: The User object does not generally support custom buttons in the same way standard business objects do.

So, this community answer key likely contains an error: C, D, E should be selected.
Patna, India

AI Explanation - verified by User3287 on: September 25, 2026
Question 1:
Correct answer: A — Configure SetupComplete.cmd in %windir%\Setup\Scripts.
SetupComplete.cmd runs automatically after Windows Setup completes and before the first user signs in. It is useful for applying final configuration to a newly deployed or generalized VM, such as:

Installing software

Applying configuration changes

Calling PowerShell scripts

Running setup or customization commands

The batch file can invoke a PowerShell script, for example:

cmd powershell.exe -ExecutionPolicy Bypass -File C:\Scripts\ConfigureVM.ps1

Why the other options are less suitable:

GPO logon script: Runs only when a user logs on and depends on domain/GPO processing.

GPO startup script: Runs during startup, but requires the VM to be domain joined and receives the applicable GPO.

Place scripts in a VHD: Merely makes the scripts available; it does not automatically execute them.

The explanation shown on the page discusses Azure’s Custom Script Extension, but that does not match the listed on-premises Hyper-V scenario. For the options provided, A is the best answer.
New Delhi, India

AI Explanation - verified by User5938 on: September 11, 2026
resuma
Resposta: Não.
Máquinas virtuais do Azure usam o modelo IaaS, não PaaS.

IaaS: você gerencia a VM e o sistema operacional.

PaaS: o Azure gerencia a infraestrutura; você se concentra no aplicativo.

Logo, a solução proposta não atende ao objetivo.
Cabo Frio, Brazil

AI Explanation - verified by User2290 on: September 11, 2026
Question 3:
Correct answer: No. The answer key shows B, and that is correct.

The requirement is an assessment of the Azure environment’s design, which requires a support plan offering proactive architectural guidance.

Premier support would provide this capability, but it is a high-cost option.

Since the requirement says to minimize expenses, Premier is not the best recommendation.

A lower-cost plan with the required advisory/design-review capability—historically Professional Direct in Azure’s support-plan model—would be more appropriate.

Therefore, subscribing to Premier satisfies the functionality but fails the cost-minimization requirement.
Bengaluru, India

AI Explanation - verified by fuat on: September 21, 2026
Question 79:
Correct answers: C — Constrained VMs and D — Overprovisioned VMs
These views help identify VMs that are using resources inefficiently:

Constrained VMs: VMs whose workloads are experiencing resource pressure, such as insufficient CPU or memory. They may need additional resources or optimization.

Overprovisioned VMs: VMs allocated more CPU, memory, or storage than their workloads require. Their resources may be reclaimed or reduced.

Why not the others:

Underprovisioned VMs: This is not the predefined view identified for this report question.

Zombie VMs: These are typically inactive or unused VMs and are useful for cleanup, but they are not the two views specifically intended here to identify inefficient resource allocation.

The exam distinction is that constrained VMs need more suitable resources, while overprovisioned VMs have excess resources.
Stockholm, Sweden

AI Explanation - verified by User2474 on: September 10, 2026
Question 30:
Correct answer: D — Building and training a generative AI model from scratch using customer-owned data.
The Generative AI Security Scoping Matrix reflects how much control—and therefore security responsibility—the customer has:

Third-party enterprise application with embedded AI: The provider manages most security controls. The customer mainly manages users, data, and configuration.

Application using an existing third-party FM: The customer controls the application and its inputs/outputs, but the provider controls the underlying model and infrastructure.

Fine-tuning a third-party FM: The customer has additional responsibility for training data, data protection, and model behavior, but still depends on the provider’s base model and platform.

Building and training a model from scratch: The customer controls the model, training data, application, deployment, and many security safeguards. This creates the greatest security ownership.

This does not mean the customer manages every physical infrastructure control—the cloud provider still handles its underlying infrastructure responsibilities. It means the customer has the broadest scope of application, model, data, and deployment security responsibilities.
Kenitra, Morocco

AI Explanation - verified by User6592 on: September 02, 2026
Question 8:
Correct answers: B. Deterrent and F. Detective

CCTV system — Detective control: Cameras monitor and record activity, helping identify or investigate security incidents after—or while—they occur.

Signs about being filmed — Deterrent control: The signs discourage people from attempting unauthorized or criminal activity because they know surveillance is present.

Why the others don’t fit:

Preventive: Stops an incident from occurring, such as a lock or access-control system.

Corrective: Restores systems after an incident.

Directive: Instructs people to behave in a certain way, such as a security policy.

Compensating: Provides an alternative control when the preferred control cannot be implemented.

The key distinction is that the cameras detect, while the warning signs discourage.
Atlanta, United States

AI Explanation - verified by User8578 on: September 09, 2026
Question 102:
Correct answer: B. Masking
Data masking hides sensitive portions of information while preserving enough format for troubleshooting or identification. For example:
4111 1111 1111 1111 ? ** ** 1111
This is appropriate for a database log file because logs may need to show that a transaction occurred without exposing the full credit card number.

Tokenization: Replaces the value with a nonsensitive token, often reversible through a secure token vault.

Hashing: Converts data into a one-way fixed-length value, generally used for integrity checks or password storage.

Obfuscation: A broad term for making data difficult to understand; it is less precise than masking in this context.

Therefore, masking is the most specific choice.
San Jose, United States

AI Explanation - verified by User4025 on: September 01, 2026
Question 27:
Correct answer: A. Trusted devices
A trusted device solution allows access only from registered or managed devices. Once a device is enrolled and trusted, the employee can usually log in with minimal additional interaction, providing a seamless experience.
It best meets the requirements because:

Employees can use approved devices from remote locations or worldwide offices.

Users do not need to carry or insert extra hardware.

It helps prevent account takeovers from unknown devices.

Why the others are less suitable:

Geotagging: Restricts access based on location, which could interfere with remote work and travel.

Smart cards: Require additional physical equipment and card readers.

Time-based logins: Limit access according to time but do not strongly bind access to an authorized user device.

Nashville, United States

AI Explanation - verified by User4832 on: September 20, 2026
Question 20:
Correct answer: A and C — Disable default accounts and remove unnecessary services.
Server hardening reduces the server’s attack surface before it is deployed:

Disable default accounts: Default or unused accounts may have known usernames or predictable settings, making them targets. They should be disabled, removed, or securely configured.

Remove unnecessary services: Every running service creates potential vulnerabilities. Removing services the server does not need reduces exploitable entry points.

Why the others are less appropriate:

Add the server to the asset inventory: Important for asset management, but not a hardening step.

Document default passwords: Default passwords should be changed or eliminated—not documented for continued use.

Send server logs to the SIEM: Valuable for monitoring and detection, but generally performed as part of logging/monitoring configuration.

Join the server to the corporate domain: May be necessary operationally, but does not itself harden the server.

Lagos, Nigeria

AI Explanation - verified by pikej74485 on: September 21, 2026
Question 81:
For the exam’s intended answer, choose A, C, and E:

A — Use a custom controller: An Apex class can contain the page’s logic.

C — Use a standard controller with extensions: The standard controller provides basic CRUD behavior, while an extension adds custom logic.

E — Use a standard controller: Useful when the page works mainly with one Salesforce object and needs standard functionality.

The key is treating a dashboard Visualforce page as requiring a controller-based implementation.
Important accuracy note: The answer key is questionable in general Visualforce terms. Visualforce can also use:

A page with no controller for static or controller-free content.

A custom controller with extensions; extensions are not limited only to standard controllers.

So A, B, C, D, and E can be valid Visualforce configurations generally. The stated three-answer key appears to depend on a dashboard-specific exam assumption that is not clearly expressed in the question.
Chennai, India

AI Explanation - verified by User8379 on: September 22, 2026
Question 21:
Correct answer: A — the PySpark library in a Fabric notebook.
Why:

The JSON files contain one billion items, so this is a big-data workload.

PySpark uses Apache Spark’s distributed, parallel processing, allowing the data to be processed across multiple compute nodes.

It can read and transform data directly from OneLake, helping minimize unnecessary data movement or duplication.

A Fabric notebook can also support exploration and visualization, as well as Spark-based analytics and anomaly-detection workflows.

Why the other options are weaker:

Pandas is primarily in-memory and generally suited to smaller datasets. One billion records would be impractical on a typical single machine.

A Power BI report with core visuals is appropriate for visualization and sharing, but it is not the best tool for large-scale transformation, parallel processing, or anomaly detection. It would normally consume prepared data rather than perform the entire workload.

The key exam clue is the combination of very large data volume and parallel processing: choose Spark/PySpark rather than Pandas or Power BI alone.
Delhi, India

AI Explanation - verified by User6058 on: September 10, 2026
Question 143:
Correct answer: C — Reduce the level of fixed costs.
If transfer prices are set at variable cost, the supplying division recovers only the additional cost of producing the item. It earns no contribution toward its fixed costs, such as salaries, rent or machinery depreciation.
The other options provide a mechanism for the supplying division to receive additional revenue:

Share of overall contribution: part of the organization’s total contribution is allocated to the supplying division.

Dual pricing: the supplying division may record a higher transfer price while the receiving division records a lower price, with central accounts absorbing the difference.

A centrally imposed price range: this may allow the transfer price to be set above variable cost, helping the supplying division recover fixed costs.

Simply reducing fixed costs lowers the amount to be recovered but does not change the fact that variable-cost pricing provides no recovery of those costs. Unless fixed costs are eliminated entirely, the underlying problem remains.
Maseru, Lesotho

AI Explanation - verified by User7470 on: September 25, 2026
So the question was more about which is a valid perspective, since that question can describe other perspectives as well
Yes, exactly. The question is testing recognition of a valid AWS CAF perspective, not asking which perspective best matches a detailed scenario.
Governance is one of the six AWS CAF perspectives. The other options are AWS Well-Architected Framework pillars:

Sustainability

Performance efficiency

Reliability

Although “platform” and “operations” are also valid AWS CAF perspectives, they are not answer choices in this question. Their descriptions could certainly be valid in other contexts, but Governance is the only option listed that belongs to the AWS CAF perspectives.
Mount Vernon, United States

AI Explanation - verified by User3213 on: September 24, 2026
Question 178:
Correct answer: B. Digital signatures
A digital signature supports nonrepudiation because it:

Verifies the sender’s identity using their private key.

Confirms the transaction was not altered after signing.

Provides evidence that the signer approved or originated the transaction.

Why the others are weaker:

Digital certificates: Bind an identity to a public key, but do not themselves prove that a specific transaction was signed.

Encrypted passwords: Protect confidentiality or authentication, but generally do not provide transaction-level nonrepudiation.

One-time passwords: Authenticate a user for a session or transaction, but usually do not provide durable proof of who authorized the electronic record.

In exam questions, distinguish digital certificates—which support identity validation—from digital signatures, which provide the signed evidence needed for nonrepudiation.
Johannesburg, South Africa

AI Explanation - verified by User3085 on: September 21, 2026
Question 40:
Correct answer: B — Transitioning the platform to an IaaS provider
IaaS can satisfy all three requirements:

50% memory utilization baseline: The environment can be provisioned with excess capacity, leaving room for growth and workload spikes.

Storage scalability: Cloud storage can generally be expanded as needed without redesigning the physical platform.

Single circuit failure resilience: A properly designed IaaS provider uses redundant power circuits and infrastructure, so failure of one circuit should not take the platform offline.

Why the other options are weaker:

A — Dual PDUs: Helps with power redundancy but does not provide storage scalability.

C — Network load balancing: Provides network-path resilience, not memory or storage scalability, and does not address a power-circuit failure.

D — Multiple NAS devices: May improve storage capacity, but does not inherently provide power resilience or the required compute-capacity baseline.

Atlanta, United States

AI Explanation - verified by User3316 on: September 14, 2026
Question 31:
Correct answer: State
The answer key shows A (Redirect_uri), but that appears incorrect.

state preserves the client’s original context, such as the specific idea URL the user requested.

The portal sends that value in the OAuth authorization request.

Salesforce returns it after authorization, allowing the portal to redirect the user to the original idea rather than the Ideas home page.

redirect_uri identifies where Salesforce sends the OAuth response; it does not retain the originally requested Salesforce page.
Mumbai, India

AI Explanation - verified by User6296 on: September 22, 2026
Question 4:
For Question 4, use these filters in the Defender for Cloud Apps file policy:

File is shared externally ? Access level

- This filter identifies the sharing scope of a file, including files accessible to users outside the organization. - It is not the same as Collaborators, which identifies people with access but does not necessarily classify the sharing as external.

File is labeled “Internal only” ? Sensitivity label

- This filter evaluates the Microsoft Purview sensitivity label assigned to the file. - Select the label whose name is Internal only.
The stated answer appears correct:
| Condition | Filter | |---|---| | Shared externally | Access level | | Labeled Internal only | Sensitivity label |
Matched policy is not appropriate because it detects files that already match another policy; it does not directly identify external sharing or a particular sensitivity label.
Nagpur, India

AI Tutor 👋 I’m here to help!

Cisco 350-901 Exam Prep Developing Applications using Cisco Core Platforms and APIs (DEVCOR) (Page 29 )

QUESTION: 65

Explanation:

QUESTION: 66

QUESTION: 67

QUESTION: 68

QUESTION: 69

Cisco 350-901 Exam Prep
Developing Applications using Cisco Core Platforms and APIs (DEVCOR) (Page 29 )