Free 350-901 exam questions in PDF & AI Tutor

Alex on: March 02, 2025
Great material
UNITED KINGDOM

AI Explanation - verified by User3790 on: June 08, 2026
if an asset quarantined a file how is not considered clean
Short answer: quarantining a file does not make the host clean.
Why not:

Quarantine is a containment action, not a full remediation. It stops the file from running, but it doesn’t prove the threat is gone.

There can be other indicators on the host (suspicious processes, registry changes, unusual network activity) or other infected files.

The quarantined file could be a false positive, so you still need to verify with hash reviews and further scanning.

The host may have persistence mechanisms or be part of a larger compromise (lateral movement, C2, etc.).

What to do in the drill:

Look for additional IOC on that host (outbound traffic, suspicious processes, new user accounts).

Check if other hosts show related activity.

Validate the quarantine: hash, source, and whether it’s truly malicious.

Until confirmed clean, label the host as not clean (infected or at least suspicious) and pursue full remediation.

Marine Corps Base Camp Lejeune, United States

AI Explanation - verified by User5093 on: June 08, 2026
Question 38:
Question 38 explanation:

Correct answer: A — Cost of application software licenses

Why:

In the AWS Shared Responsibility Model, AWS handles the physical infrastructure: hardware, power, and data center physical security.

The customer is responsible for what runs on top of AWS, including software licensing, configurations, data, and access control.

Therefore, after migrating, the direct cost the company bears from the options is the cost of their application software licenses. The hardware infrastructure on AWS, power for AWS servers, and physical security for the AWS data center are AWS's responsibility.

Madrid, Spain

AI Explanation - verified by User8539 on: June 08, 2026
Question 18:
Question 18 asks how to develop a streaming Speech-to-Text solution using the Speech SDK with MP3 input. In Python, you don’t feed MP3 bytes directly to the SDK. The SDK expects PCM audio (e.g., 16 kHz, mono, 16-bit). So you must decode MP3 to PCM and then push that PCM data into a streaming input.
Key approach in Python:

Decode MP3 chunks to PCM (16 kHz, mono, 16-bit).

Use a PushAudioInputStream and an AudioConfig that reads from that stream.

Feed the PCM chunks into the stream as they arrive, then run a SpeechRecognizer (continuous or single-shot).

Example (conceptual):

Install PyDub and FFmpeg for decoding: use PyDub to convert MP3 to PCM chunks.

Python code outline:

import azure.cognitiveservices.speech as speechsdk from azure.cognitiveservices.speech import audio from pydub import AudioSegment import io speech_config = speechsdk.SpeechConfig(subscription="YOUR_KEY", region="YOUR_REGION") stream = audio.PushAudioInputStream() audio_config = audio.AudioConfig(stream=stream) recognizer = speechsdk.SpeechRecognizer(speech_config=speech_config, audio_config=audio_config) def feed_mp3_chunks(mp3_chunks): for mp3 in mp3_chunks: seg = AudioSegment.from_mp3(io.BytesIO(mp3)) pcm = seg.set_frame_rate(16000).set_channels(1).set_sample_width(2) stream.write(pcm.raw_data) stream.close() recognizer.start_continuous_recognition() feed_mp3_chunks(your_mp3_stream) recognizer.stop_continuous_recognition()

Notes:

Decoding
Cary, United States

khushi on: June 08, 2026
GOOD explanation
Pune, India

AI Explanation - verified by User5184 on: June 08, 2026
Question 33:

Answer: No (B)

Why: The goal is to reduce the impact on users after migrating resources to Azure and decommissioning the on-prem data center. Requiring Azure MFA adds an extra authentication step for users, which increases login friction and can slow them down. That does not reduce user disruption; it can actually worsen it.

How to approach properly instead:

- Use Azure AD Connect with Password Hash Synchronization and enable Azure AD Seamless SSO to provide a smooth sign-on experience. - Apply Conditional Access to require MFA only under certain conditions (e.g., from untrusted networks or high-risk sign-ins), reducing unnecessary friction. - Plan phased migration and user communication so changes are predictable, with training and support.

In short: MFA is important for security, but alone it doesn’t meet the goal of reducing user impact during/after migration. A combination of SSO and selective MFA (via Conditional Access) achieves lower friction while maintaining security. If you want, I can walk through how to configure these concepts.

Pune, India

AI Explanation - verified by User3934 on: June 08, 2026
Question 82:
Question 82 explanation:

Correct answer: D. Average response time

Why:

Average response time measures end-to-end latency and directly reflects the user-perceived performance of a web application.

Other metrics serve different purposes but aren’t as direct a measure of performance:

- Server thread count indicates workload capacity/resources, not actual response speed. - Server uptime measures availability, not speed. - HTTP server error rate indicates reliability; it doesn’t quantify how fast responses are.
Note: In practice, it’s best to monitor multiple metrics (latency, error rate, throughput, resource utilization) for a full performance picture, but if you must pick one, average response time is the best single indicator of performance.
Siteki, Eswatini

AI Explanation - verified by User3934 on: June 08, 2026
Question 81:
Question 81 asks how to best gain insight into potential single-person dependencies (SOD issues).

The correct answer is C. Mapping IT processes to roles.

Why: It directly shows who is responsible for each step in critical processes, highlights overlap between duties, and reveals where one person could control multiple key steps. This is the most effective way to identify SOD gaps and design proper controls.

Why not the others:

- Reviewing vacation patterns: can show coverage gaps but not the actual duty assignments or overlaps. - Interviewing senior IT management: provides opinions, not concrete evidence of role assignments. - Reviewing user activity logs: shows what individuals did, but after the fact and may not reveal where duties are improperly combined.
Tip: Use process-to-role mapping to assess separation of duties, and pair with access reviews to strengthen control.
Siteki, Eswatini

AI Explanation - verified by User9431 on: June 08, 2026
Question 43:
I can’t see the image, but here’s the reasoning for Question 43.

Purpose: Merge Customer and Contacts on the Customer Name field.

Why fuzzy matching: The data isn’t sanitized, so there may be typos, extra spaces, or case differences. Fuzzy matching helps map similar names instead of missing matches.

Join type: Use a Left Outer join if you want to keep all rows from the Customer table and attach matching contact info from Contacts. If there are multiple contacts per customer, you’ll get multiple merged rows (one per match).

What to do in Power Query (Power BI Desktop):

Open Merge Queries with Customer as the primary table and Contacts as the secondary table.

Join on Customer Name.

Enable fuzzy matching (Use fuzzy matching).

Set the Join Kind to Left Outer.

Optionally adjust the similarity threshold and case/diacritic options to balance matches.

Recommendation: The best answer isn’t just “Enable fuzzy matching” but “Enable fuzzy matching and set Join Kind to Left Outer.” This preserves all customers while matching as many contacts as possible. If you want to avoid duplicate member rows, you may need to post-process the results.
Singapore, Singapore

AI Explanation - verified by User3058 on: June 08, 2026
Question 43:
Correct answer: Enable fuzzy matching.
Reasoning:

The Contacts data is not sanitized, so customer names may have typos, extra spaces, or slight variations. Exact matches would miss many valid relationships.

Enabling fuzzy matching lets Power Query align near-matches based on similarity, making the merge more robust.

How to implement:

In Power Query Editor, use Merge Queries (Customer as the left table, Contacts as the right table).

Join on Customer_Name (Customer) and Customer Name (Contacts).

Enable Use fuzzy matching (and adjust the similarity threshold if needed).

(Optional) Choose Left Outer as the join kind to keep all Customer rows, expanding to include matching Contacts data as desired.

Tip: After merging, expand the related columns you need (e.g., Contact Name, Contact Email) to complete the merged dataset.
Hyderabad, India

AI Explanation - verified by User3058 on: June 08, 2026
Question 41:

Correct answer: D. Transform the column to contain only the year.

Reasoning:

The goal is to derive just the year from a Date column with minimal effort. Splitting by delimiters or a fixed number of characters is a text-manipulation approach and brittle for dates; it’s not the right tool for date semantics.

The proper approach is to extract the year from the date using a date function or a built-in date transformation.

How to implement in Power Query Editor:

Open Power Query Editor.

Select the Date column.

Use: Transform > Date > Year (or Add Column > Date > Year) to produce a year value.

If you need only the year column, delete the original Date column after you’ve created the year column, leaving just the year values.

Concept: Use Date.Year([Date]) (via the UI as Year) to convert a date to its year component, which is the most robust and least labor-intensive method.
Hyderabad, India

AI Explanation - verified by User9732 on: June 08, 2026
Question 68:
Question 68 asks what to do when a phase takes much longer than planned and stakeholders worry about delays.

Correct answer: D. Organize a root cause analysis (RCA) workshop.

Why: Before applying fixes or increases in contingency, you should diagnose the actual causes of the delay. An RCA workshop brings the team together to identify root causes (not just symptoms) and agree on corrective actions. This supports better, targeted mitigation and helps reset expectations with stakeholders.

Why the other options are less appropriate initially:

- A. Request additional contingency from the sponsor – reactive and misaligned if you haven’t identified the causes or approved specific corrective actions. - B. Add more float to the overall project schedule – may mask the problem and doesn’t address root causes; could lead to more risk later. - C. Expedite the next phase to reduce slippage – could increase risk, cost, and quality issues without solving the underlying delay.

What to do after RCA:

- Develop and implement corrective actions. - Update the project plan and possibly the schedule baseline. - Communicate findings and revised plan to stakeholders.
In PMI terms, you’re performing root-cause analysis to inform corrective action and schedule management.
Riga, Latvia

AI Explanation - verified by User3934 on: June 08, 2026
Question 48:

Answer: C — Risk-based auditing

Why: The goal is to allocate audit resources to areas with the greatest risk and potential impact, maximizing effectiveness and efficiency. Risk-based auditing prioritizes audits of high-risk processes and controls.

Quick contrasts:

- Agile auditing: faster, iterative approach, but not the primary method for prioritizing resource use across the program. - Continuous auditing: automated, ongoing monitoring; helps efficiency but isn’t the overarching prioritization framework. - Outsourced auditing: shifts work outside the organization; doesn’t by itself optimize internal resource allocation.
Siteki, Eswatini

AI Explanation - verified by User9732 on: June 08, 2026
Question 64:
Question 64 asks which three actions help ensure proper stakeholder involvement when new stakeholders express interest. Correct choices: A, B, E.
Why these are correct:

A. Prioritize stakeholders based on the project phase and need

Focuses involvement where and when it’s most needed, preventing overload and ensuring key stakeholders are engaged at the right time (aligns with Plan Stakeholder Engagement).

B. Perform a stakeholder assessment to align with the project objectives

Ensures engagement supports objectives and identifies who should be involved and how deeply.

E. Develop a stakeholder impact/influence matrix to determine the level of engagement

Uses a structured view (influence/impact) to tailor engagement strategies; a common PM practice for stakeholder analysis.
Why others aren’t correct:

C. Classify and rank stakeholders based on their positions in the organization

Position alone isn’t a reliable driver of engagement level; influence and impact matter more.

D. Include all stakeholders in the stakeholder engagement plan and provide the same level of communication

Engagement must be tailored; not every stakeholder requires the same communication or level of involvement.
Riga, Latvia

AI Explanation - verified by User3058 on: June 08, 2026
Question 22:
Question 22 is about building a Country dimension with unique country values.
Correct answers: D and E
Why:

D (Delete the City column): The City column isn’t part of the Country dimension and would introduce unnecessary granularity. Removing it helps focus the table on country values.

E (Remove duplicates from the Country column): After removing City, you need one row per country. Removing duplicates from the Country column yields a distinct list of countries suitable for a dimension.

What the other options do:

A: Delete the Country column would eliminate the key you need for the dimension.

B: Remove duplicates from the table is too broad and may remove needed data beyond just creating a country list.

C: Remove duplicates from the City column would not produce a unique country list (countries could still repeat).

Implementation tip: In Power Query Editor, first delete the City column, then use Remove Duplicates on the Country column (or group by Country and keep the Country key) to obtain a distinct list.
Hyderabad, India

AI Explanation - verified by User6002 on: June 08, 2026
Question 1:
I can’t view the image that shows the table, but the answer key for Q1 is B: all five groups (Group1, Group2, Group3, Group4, and Group5).
Why B is correct (conceptual):

This question tests group-based licensing in Azure AD. You can assign a license directly to a group (security group or Microsoft 365 group), and all current and future members of that group receive the license.

If the table indicates that Groups 1–5 are configured as license-enabled groups, you can assign the Office 365 Enterprise E5 license to each of those groups. The license then applies to every member in those groups.

The presence of a device or individual users doesn’t matter for group-based licensing—the license is granted to the group, and members inherit it.

Notes:

Ensure the groups you license are of a type that supports licensing (security or Microsoft 365 groups) and that the SKU includes the E5 features you expect.

To assign, use the Licenses area in the Azure AD or Microsoft 365 admin center and select the groups to license.

Delhi, India

AI Explanation - verified by User7024 on: June 08, 2026
Question 6:
Question 6 asks you to pick two true statements about routing vs forwarding tables.

Correct answers: A and D

Why:

A: The routing table is used by the RE (Routing Engine) to select the best route. The RE considers all learned routes and chooses the best one.

D: The routing table stores all routes and prefixes learned from all routing protocols. It aggregates routes from every protocol.

Why the other options are false:

B is incorrect because the forwarding table does not store all routes and prefixes from all protocols; it contains the active routes that have been chosen for forwarding.

C is incorrect because the forwarding table is used by the PFE (Packet Forwarding Engine) to forward packets, not by the RE to select the best route.

In short, the routing table is for route selection and protocol-wide storage, while the forwarding table holds the active routes used for actual forwarding.
Tashkent, Uzbekistan

AI Explanation - verified by User2969 on: June 08, 2026
Question 1:
For Question 1, the destination is 10.10.13.10/32. A /32 is a single host, so the route type used to reach that host is a host route (C).
Why:

A host route is a route to a single IP address (destination 10.10.13.10/32).

A network route would be something like 10.10.13.0/24, which covers a subnet—not just one host.

The default route (0.0.0.0/0) is used for destinations not in the routing table.

A floating static route is a static route with a higher administrative distance used as a backup, not the primary route to a specific host.

Note: The page shows Answer: B (network route), which is incorrect for a /32 host destination.
Sur, Oman

AI Explanation - verified by User7945 on: June 07, 2026
Question 8:
No. The plan to use several Azure AD directories (tenants) does not meet the goal of segmenting by division with minimal admin effort.
Why:

Each division would live in a separate Azure AD tenant, which creates separate identities, policies, and administration. Cross-tenant management is more complex and costly than needed.

What to do instead (in a single tenant):

Use a single Azure AD tenant.

Structure divisions with subscriptions and/or Management Groups to isolate resources by division.

Apply RBAC (role-based access control) at the division scope (subscription or management group) so admins only manage their division’s resources.

Use Azure Policy and governance to enforce standards across divisions.

If cross-tenant access is truly required, consider Azure Lighthouse for delegated administration, but be aware it adds complexity.

Bottom line: The exam answer is No because a single-tenant approach with RBAC/management groups provides segmentation with far less administrative overhead than multiple tenants.
Hyderabad, India

AI Explanation - verified by User7945 on: June 07, 2026
Question 7:
Question 7 asks which Azure web tier to host 10 web apps with specific constraints. The stated answer is A: Standard.
Why Standard fits (brief reasoning):

Excludes Free and Shared: both use shared compute and do not meet “dedicated compute” and likely not all requirements (custom domains, load balancing, storage).

Basic can provide dedicated compute and custom domains, but has limited scale/storage compared to Standard (e.g., fewer instances and smaller storage quotas). With 10 apps each needing 10 GB, Basic may not meet storage/scale needs.

Standard offers more robust compute (more instances), built-in load balancing, and higher storage quotas, which aligns with hosting multiple apps with custom domains and the required storage, at a lower cost than Premium.

Important caveat:

If you truly need strict per-app isolation (one dedicated instance per app), you’d typically use separate App Service Plans per app (potentially Basic or Standard), which increases cost. The exam question often treats “dedicated compute” at the plan level rather than per app, so Standard is considered the minimal tier meeting all listed requirements.

Hyderabad, India

AI Explanation - verified by User3971 on: June 07, 2026
Question 16:
Answer: C — Import mode selected and schedule a daily refresh.
Explanation:

Why not A or B (DirectQuery): DirectQuery keeps hitting the on-prem SQL server for each user query, which keeps online processing and render times high. The Enhanced Dataflows Compute Engine helps, but it doesn’t eliminate the live query cost.

Why not D (Import with hourly refresh): Hourly refresh adds more processing workload and doesn’t improve end-user render times during reports. You want fewer online operations, not more frequent refreshes.

Why C fits: Import mode loads data into the Power BI service (reducing online queries during visuals), and a daily refresh keeps data updated while meeting the “current year up to previous day” window. The Enhanced Dataflows Compute Engine further optimizes dataflow processing for these loads.

Note: For on-prem data sources, a gateway is typically required to refresh, but the option that matches the scenario best is Import mode with daily refresh.
Shah Alam, Malaysia

cham on: June 07, 2026
I appreciate you in Korea
Osan, South Korea

AI Explanation - verified by mitu.ashish on: June 07, 2026
Question 5:
Here’s how to approach Question 5.

Correct options: B, C, E.

Why:

Enable column profile (B) turns on statistics collection for each column (including min and max).

Show column profile in details pane (C) tells the UI to display those statistics in the column’s profile area.

Enable details pane (E) makes the details pane visible so you can actually see the column profile information.

What the other options do (not required for min/max):

Show column value distribution: shows value distribution (histogram), not specifically min/max.

Show column quality details: shows data quality metrics, not min/max.

Note: The exam text shows only B and E as the answer, but to view min/max per column, you typically also need to show the profile in the details pane (i.e., include C). If you don’t see the profile, ensure the details pane is enabled and that the column profile is being displayed there.
Sydney, Australia

AI Explanation - verified by User5339 on: June 07, 2026
Question 58:

Answer: NS records

Why: NS records specify the authoritative name servers for a domain. To change where the outside DNS records are hosted, you delegate the domain to the new DNS provider by updating the NS records at the registrar to point to the new provider’s name servers. This tells the internet which servers are authoritative for your domain.

Why the other options are incorrect:

- SOA (Start of Authority) contains zone metadata (primary name server, admin email, serial, timers) but does not delegate hosting. - PTR is for reverse DNS lookups (IP to domain), not for delegating where a domain’s DNS is hosted. - CNAME creates an alias for a domain name; it does not control where DNS for the domain is hosted.

Quick steps to perform:

1. Obtain the new provider’s NS records (e.g., ns1.newhost.com, ns2.newhost.com). 2. At the domain registrar, update the domain’s NS records to the new values. 3. Allow for DNS propagation (can take up to 24–48 hours). 4. Ensure the new DNS zone has all necessary records (A/AAAA, MX, etc.) and verify using DNS lookup tools (e.g., dig or nslookup).
Wesley Chapel, United States

AI Explanation - verified by User8187 on: June 07, 2026
Question 31:
Question 31 asks whether including a Network Security Group (NSG) in your Azure design to control the connection types between web servers and database servers meets the goal.

Correct answer: A (Yes)

Why:

NSGs are the primary tool to filter network traffic in Azure. You can apply them at the subnet level or to individual network interfaces (NICs).

To control traffic between web and database tiers, put the web servers in one subnet and the database servers in another, then create NSG rules that:

- Inbound: allow traffic from the Web subnet to the DB subnet on the database port(s) (for example, TCP 1433 for SQL Server). - Optionally restrict or deny other traffic between the two subnets. - Ensure outbound rules align with the desired traffic flow.

This setup prevents undesired access while permitting only the approved connection types between tiers.

Practical steps:

Create NSG.

Add inbound rule: source = WebSubnet, destination = DBSubnet, port = DB port, action = Allow.

Add any necessary outbound rules and place the NSG on the DB subnet or on DB NICs.

So NSGs effectively meet the requirement of controlling connections between web and database servers.
Pune, India

AI Explanation - verified by User6833 on: June 07, 2026
Question 3:
I can’t view the hotspot image in Question 3, but I can explain how to approach it and what the scoring is looking for.
How to approach a network infection hotspot:

Collect and review all logs from hosts and the firewall (timestamps, destinations, ports, process names, user logins).

Sort by time to find the earliest suspicious event. The origin host is typically the first system that shows a foothold or initiates activity toward others.

Look for indicators of compromise across hosts that share the same IoCs (malware hash, C2 domains/IPs, beacon patterns, or suspicious executables).

Determine each remaining host’s status:

- Infected: shows matching IoCs, lateral movement activity, or persistence artifacts. - Clean: no matching IoCs and no anomalous activity after isolating the suspected origin.

Document findings and containment steps (isolate infected hosts, reset credentials, block C2 IPs).

If you can describe or paste key log entries (timestamps, src/dst IPs, ports, event types, or any malware indicators), I can help pinpoint the origin and classify hosts more precisely.
Thabazimbi, South Africa

AI Explanation - verified by User8281 on: June 07, 2026
Question 3:
Question 3 asks whether the given year-end configuration meets these goals:

Q1 adjustments can post to the previous year’s Period 13.

The year-end can be run again, but only the most recent closing entry remains.

All P&L dimensions carry into retained earnings.

All past and future periods are On Hold.

What the solution sets:

Delete close of year transactions: No

Create closing transactions during transfer: No

Fiscal year status permanently closed: No

Year-end close template: defined

Retained earnings main account: designated

Opening transactions option for financial dimensions: No

Transfer profit and loss dimensions: Close All

All prior and future ledger periods: On Hold

Why this does not meet the goal:

The key requirement to allow re-running the year-end with only the latest closing entry means you should be able to delete older closing entries. Setting "Delete close of year transactions" to Yes is typically needed; with No, older closing entries would remain.

Similarly, “Create closing transactions during transfer” should usually be Yes so a new closing can be created during the transfer step.

Opening transactions should likely be Yes to ensure P&L dimensions flow into retained earnings; No may prevent carrying those dimensions.

The rest (retained earnings main account, On Hold for prior/future, and transferring P&L dims) align with the goals.

Recommended: set Delete close of year transactions to Yes, Create closing transactions during transfer to Yes, Opening transactions to Yes, keep Fi
Cebu City, Philippines

Pradeep on: June 07, 2026
Yes, I am experienced Azure admin but this dump helps me to assess myself and able to regain confidence.
Dubai, United Arab Emirates

Kapil on: June 06, 2026
Good to get idea of question asked
Udaipur, India

AI Explanation - verified by User6119 on: June 06, 2026
Question 8:

Answer: No.

Why: The health probe for an Azure internal load balancer must match the protocol the service uses. SQL Server listens over TCP (default port 1433) and does not speak HTTP. An HTTP health probe on port 1433 will fail, causing the load balancer to mark the backend as unhealthy. Use a TCP health probe on the listener port (typically port 1433, or the port you configured for the AG listener) so the LB can correctly determine health. Also ensure the port is allowed through firewalls on the VMs.

Hyderabad, India

AI Explanation - verified by giri2685 on: June 06, 2026
Question 308:
Correct answers: C and D

Why: To allow a role to SELECT from all current tables in a schema, you grant:

- GRANT SELECT ON ALL TABLES IN SCHEMA DB1.SCHEMA TO ROLE MYROLE;

To cover future tables created in that schema, you grant:

- GRANT SELECT ON FUTURE TABLES IN SCHEMA DB1.SCHEMA TO ROLE MYROLE;

Why the others are incorrect:

- A/B try to grant USAGE on tables (not a valid privilege for tables—USAGE is used at schema/warehouse level, not on table objects). - E/F target the entire database, not just the schema, which isn’t what the question asks.
Bengaluru, India

AI Explanation - verified by User2042 on: June 06, 2026
what is the process of elimination

The process of elimination is a test-taking strategy to improve your odds by discarding clearly wrong options.

How to use it:

Read the stem carefully to know exactly what’s being asked.

Rule out options that are obviously incorrect based on your knowledge or the question’s focus.

Look for distractors: absolute terms (always/never), or statements that don’t align with the goal.

Compare the remaining options and choose the one that best fits the objective or policy in question.

If you must guess, pick among the remaining choices that have the strongest justification.

Applied to Question 1 (first step in developing an information security plan):

A: Vulnerabilities assessment—eliminate because it’s a technical activity that comes after understanding strategy.

C: Business impact analysis—eliminate because it’s about continuity planning, not the first step in strategy development.

D: Security awareness assessment—eliminate because it supports training, not the initial strategy alignment.

B: Analyze the current business strategy—keep as the best choice since governance must be driven by business direction.

Tip: Use this approach to quickly narrow options on ISACA-style questions by prioritizing alignment with business goals and governance, not just technical details.
Amsterdam, Netherlands

AI Explanation - verified by User6195 on: June 06, 2026
Question 26:
Question 26 asks for characteristics of an LSP (Label Switched Path) and you’re to choose two.
Correct: A and D

A. It is unidirectional. An LSP is a unidirectional tunnel from a head-end to a tail-end. If you need bidirectional traffic, you typically have a separate LSP in the reverse direction (or a true bidirectional LSP in some implementations).

D. It provides a specific tunnel for a FEC through the network. An LSP carries a Forwarding Equivalence Class (FEC) along a defined path, i.e., a dedicated tunnel.

Why the other options aren’t correct generally:

B. It is bidirectional. Not inherently true; LSPs are defined per direction (a reverse path would be a separate LSP unless a bidirectional LSP is explicitly configured).

C. It must always have a secondary path. A secondary (protect) path is optional; LSPs can exist without protection.

E. It always follows the IGP best path. Path selection can be influenced by explicit routing constraints or RSVP/TE settings; it isn’t guaranteed to always follow the “best” IGP path.

Helsinki, Finland

AI Explanation - verified by User2713 on: June 06, 2026
Question 26:

A /26 subnet mask is 255.255.255.192.

It provides 64 total IP addresses, of which 62 are usable (2 addresses are reserved for network and broadcast).

So, /26 would work, but it’s not efficient for a network needing no more than 30 hosts because you’d be wasting 32 addresses (62 usable vs. 30 needed). The most efficient choice for exactly up to 30 hosts is /27 (255.255.255.224), which gives 32 total addresses and 30 usable.
Vacoas, Mauritius

AI Explanation - verified by xitshembisorejo on: June 06, 2026
Question 1:

Answer: A

Why this is the best choice:

- The Lambda logs already contain the API operation name, app version, and the response code. CloudWatch Logs metric filters can parse log events and increment a metric for each match, allowing you to create a metric that has dimensions for operationName, version, and responseCode. This gives you per-operation, per-version, per-response-code metrics automatically in CloudWatch.

Why the other options are less suitable:

- B (Logs Insights): It’s great for ad-hoc analysis, but not a continuous, automatically updated metric feed a for dashboards/alarms. You’d still need to export results to metrics, which is more indirect. - C (ALB logs to CloudWatch + response metadata): Adds unnecessary steps and doesn’t leverage the existing Lambda log lines; not as straightforward for per-operation metrics. - D (X-Ray): Overhead and tracing-focused; not the simplest path to per-operation metrics by version and status code.
Cape Town, South Africa

AI Explanation - verified by User8104 on: June 05, 2026
Question 7:
Here's why Question 7 points to D and how to think about it.

Correct answer: D

Why D is the best fit:

- SNS with multiple SQS subscriptions creates a fan-out architecture. The single message published by the producer is delivered to many independent queues, allowing each consumer group to scale separately. - This decouples producers from consumers, handles burst traffic, and provides buffering and retry handling, which is ideal for variable and high message rates (up to 100k/s).

Why the other options are weaker:

- A: Kinesis Data Analytics is for real-time analytics, not for decoupling and fan-out to multiple independent consumers. - B: EC2 Auto Scaling based on CPU doesn't provide intrinsic decoupling or flood control; it couples processing to the ingestion path and requires bespoke scaling logic. - C: Kinesis Data Streams with a single shard can become a throughput bottleneck and still lacks built-in fan-out to multiple independent consumers.

Quick nuance: If ordering is important, you could use SNS with SQS FIFO queues, but the core idea—decoupled, scalable fan-out—remains the key benefit.

Pune, India

AI Explanation - verified by User9637 on: June 05, 2026
Question 2:
Question 2 is about how coalesced (coalesce) fields work during a data import.
Key idea:

Coalesce fields are the set of fields used to identify an existing record to update instead of creating a duplicate.

Why the other options are incorrect:

If no match is found using the coalesce fields, a new record is created (not “no transform map”; the import will create a new row).

If a match is found, the record is updated, not created anew.

The statement about not creating a Transform Map when no match is found is incorrect; Transform Maps still apply during the import.

Correct concept:

A: If a match is found using the coalesce fields, the existing record is updated with the information being imported.

Example:

Importing users by email as coalesce fields. If a row’s email already exists, update that user; if not, create a new user.

Hyderabad, India

AI Explanation - verified by User7556 on: June 05, 2026
Question 9:
Here's why for Question 9 we use append instead of merge:

Goal: produce a single column containing all products from Table1 and Table2, with duplicates removed. This is a classic union of two lists.

- Use: append — stacks rows from both tables into one table (same schema), then remove duplicates to get a unique list.

Why not merge: merge is for bringing in related data by matching on a key (a join). It creates additional columns (e.g., matching columns from both tables) rather than collapsing into one column. To achieve a single-column list with no duplicates, you’d still need extra steps after a merge, which is unnecessary.

What to do in Power Query:

Use Append Queries (as New) to combine Table1 and Table2.

Then Remove Duplicates on the resulting column.

Rename the column if needed.

Hyderabad, India

AI Explanation - verified by fahmiidolx on: June 05, 2026
Question 10:
Correct answer: D. Anti-spyware

Why: The Anti-spyware profile provides DNS-based protections, including DNS sinkholing and detection of suspicious DNS activity. These features give real-time protection against threats that exploit DNS infrastructure misconfigurations and redirect traffic to malicious domains.

How it differs from other profiles:

- Antivirus: focuses on malware/signatures on endpoints, not DNS behavior. - URL Filtering: blocks access to malicious URLs after DNS resolution, but isn’t specifically DNS-misconfiguration protection. - Vulnerability Protection: guards against exploits of software vulnerabilities, not DNS misuse.

Practical note: Enabling DNS-based protections in Anti-spyware helps prevent data exfiltration or C2 traffic that relies on DNS, by intercepting or sinkholing suspicious queries.

Jakarta, Indonesia

AI Explanation - verified by User9274 on: June 05, 2026
what is cloud formation
AWS CloudFormation is an AWS service that lets you model and provision resources using code instead of manual setup. It uses templates (written in JSON or YAML) to declare your infrastructure.
Key concepts:

A template defines Resources, Parameters, Outputs, Mappings, and Conditions.

A Stack is a running set of resources created from a template. You can create, update, or delete stacks.

Change Sets show what will change before you apply it.

StackSets let you deploy the same template across multiple AWS accounts and regions.

Execution runs under an IAM role; supports drift detection and rollback on failure.

Typical workflow:

Write a template that describes your resources (e.g., EC2 instances, VPCs).

Create a stack (optionally with Parameters for values like instance types).

Update the stack to modify resources; delete the stack to remove them.

Example (high level):

Template includes Resources for an EC2 instance and a Parameters block for InstanceType.

Use !Ref InstanceType in the EC2 resource.

If you want, I can show a small YAML snippet.
Kochi, India

AI Explanation - verified by User9274 on: June 05, 2026
Question 1:
The correct answer is C.
Why C meets the requirements with least overhead:

Secrets Manager with a customer-managed KMS key provides encryption at rest (via the CMK) and encryption in transit (TLS) without custom code.

A resource-based policy on the secret allows access from other AWS accounts, so the EC2 app in another account can retrieve the token securely.

The EC2 instance role only needs secretsmanager permissions to retrieve the secret; no extra data stores or encryption/decryption logic is needed.

Secrets Manager is a managed service, reducing maintenance compared with managing DynamoDB/S3 keys or Parameter Store policies across accounts.

Why the other options are less favorable:

A (Parameter Store) can store SecureString but cross-account access policies are more fiddly; adds more management overhead to enable cross-account read.

B (DynamoDB with KMS) requires managing a table and IAM/KMS permissions across accounts; more operational work than Secrets Manager.

D (S3 with KMS) is not ideal for secret storage; more steps to manage encryption, access, and retrieval of secrets; generic S3 access risks.

In short, Secrets Manager with a cross-account resource policy and a CMK offers secure, scalable, least-maintenance secret storage and retrieval for this use case.
Kochi, India

Wandras on: June 05, 2026
Study material was very useful.
Brandwag, South Africa

AI Explanation - verified by User3934 on: June 05, 2026
Question 23:
The correct answer is D.

Why: A post-implementation review (PIR) assesses whether the project delivered the expected outcomes and benefits, i.e., whether the organization’s objectives were met as planned. This aligns with governance and value realization responsibilities of IS auditors.

Why not A, B, or C:

- A (vendor payments) is a contractual/financial close activity, not the primary focus of a PIR. - B (assessing project team performance) is useful for management improvement but not the main purpose of verifying achieved objectives. - C (ROI guidance) is important, but ROI is a subset of benefits realization. PIRs aim to confirm whether objectives and benefits were realized, of which ROI may be one metric.

Practical view: If a critical IT project promised a 30% reduction in processing time, the PIR would verify the actual reduction and determine why any gap exists, informing future projects and governance.

If you want, I can walk through how to apply this concept to another example or compare it with related ISACA objectives.
Siteki, Eswatini

AI Explanation - verified by User1180 on: June 05, 2026
Question 113:

Question 113 asks which formats are supported for unloading data from Snowflake (choose two).

In Snowflake, unloading can target multiple file formats defined via CREATE FILE FORMAT. The formats include:

- Delimited (CSV, TSV, etc.) - JSON - Avro - ORC - Parquet

The provided answer of A (Delimited) and C (JSON) is incomplete. Snowflake supports all of the above, so B (Avro) and D (ORC) are also valid choices (and Parquet is another common option).

Key takeaway: for UNLOAD, you can output to several formats; you’re not limited to just JSON and CSV.

Hyderabad, India

AI Explanation - verified by User1180 on: June 05, 2026
Question 106:
Answer: False
Reason:

An Internal Stage is a Snowflake-managed storage location. Data stored here counts toward Snowflake storage usage, and you’re billed for that storage.

An External Stage is a reference to data in external cloud storage (e.g., S3, Azure Blob, Google Cloud Storage). The data stays in the external storage and is billed by the external cloud provider, not by Snowflake.

Snowflake does not charge storage fees to you for data that remains in an external stage; you’re billed by the cloud provider for that storage. Snowflake charges for its own storage (internal stages, tables) and for compute (e.g., when loading data), but not for external-stage storage itself.

Hyderabad, India

AI Explanation - verified by User8678 on: June 05, 2026
Question 14:
The correct answer is LightGBM.

Why: LightGBM is a gradient boosting algorithm well-suited for tabular data and binary classification. It captures non-linear relationships that often exist in fraud signals and can handle class imbalance effectively via built-in weighting options, which helps when the positive (fraud) class is rare.

Why the others aren’t suitable here:

- Linear Learner: a linear model; may underfit fraud patterns that are non-linear. - K-means clustering: unsupervised; not designed for binary fraud classification. - Neural Topic Model (NTM): designed for topic modeling in text, not for structured tabular fraud detection.
So for a SageMaker built-in algorithm on imbalanced tabular data, LightGBM is the appropriate choice.
Lagos, Nigeria

AI Explanation - verified by User1113 on: June 05, 2026
Question 1:

Answer: B (False)

Explanation: The terraform.tfstate file is a snapshot Terraform uses to map your configuration to real resources. It does not always stay perfectly in sync with the live infrastructure. Drift can occur if resources are changed outside Terraform or manipulated directly. You can reconcile this with commands like terraform plan (to see what would change) and terraform refresh (to update the state). The state stored in a backend reflects the last known state, not a guaranteed real-time reflection of reality. See Terraform state documentation for details.

Gurugram, India

AI Explanation - verified by User1654 on: June 04, 2026
Question 13:
The correct choice is Multitenancy.
Why:

Multitenancy means a single instance of the application in the cloud serves multiple tenants (in this case, internal and third-party users). It enables shared resources while isolating each tenant’s data and settings.

Why the others are less appropriate:

VPC: focuses on network isolation, not on hosting a single app for many users.

NFV: about virtualizing network functions, not application hosting.

SaaS: describes the delivery model (software as a service). Multitenancy is a characteristic often used by SaaS, but the question specifically points to the architecture of serving many users from one app instance, which is multitenancy.

Pasig, Philippines

AI Explanation - verified by User3580 on: June 04, 2026
ich versteh nicht, wofür der ganze kram ist?
Kurz gesagt: Der ganze Kram dient dazu, sensible Daten zu schützen, Risiken zu minimieren und Compliance sicherzustellen, ohne dass Systeme unbrauchbar werden.

Masking: Daten in Logs/UIs sichtbar machen, aber unlesbar (z. B. 4111-**-**-1111). Zweck: Diagnose erlaubt, sensible Daten bleiben geschützt.

Verschlüsselung: Daten im Speicher oder beim Transfer schützen. Wiederherstellung nur mit dem richtigen Schlüssel. Einsatz: Datenbanken, Backups, TLS-Verbindung.

Tokenisierung: Echte Daten bleiben in einem sicheren Vault; im System wird nur ein Token verwendet. Falls Daten gestohlen werden, sind sie nutzlos.

Hashing: Einweg-Transformation, z. B. Passwörter; abgleich über Hash, aber Originaldaten nicht abrufbar.

Obfuskation: Daten oder Code absichtlich schwer verständlich machen; kein starker Sicherheitsmechanismus, eher Verwirrung oder Schutz vor casual Inspection.

Warum mehrere Techniken? Weil Daten in unterschiedlichen Phasen geschützt werden müssen (vor Ort, unterwegs, in Nutzung) und verschiedene Anforderungen (Audit, Support, Privacy) bestehen. Layered defense ( defense in depth ) erhöht den Schutz.
Wenn du willst, fasse ich das auf eine konkrete Anwendungs-Szene zusammen.
Bedburg, Germany

odin on: June 04, 2026
these questions are more scenario based rather than "what does this service do" which makes me think more of how do things fall into place to suite the question
Tel Aviv, Israel

AI Explanation - verified by User3646 on: June 04, 2026
passive scan?

Passive scan: A non-intrusive method that listens to network traffic or watches systems without sending any probes to the target. It can reveal some exposures, but it cannot actively test or exploit vulnerabilities.

How it differs from other options in the scenario:

- vs Non-credentialed (active) scan: The attacker scans from outside without credentials but still actively probes targets to find vulnerabilities. This is more likely for internet-facing servers than a passive approach. - vs Packet capture: This is about capturing traffic, not scanning for vulnerabilities. - vs Privilege escalation / System enumeration: These occur after gaining access or with credentials, not during external scanning. - vs Passive scan: While safe, it may miss active vulnerabilities that require probing.
Bottom line: In that scenario, a passive scan is not the most likely method; an active, non-credentialed external scan is typically used to identify vulnerabilities on internet-facing web servers.
Kannapolis, United States

Cisco 350-901 Exam Questions
Developing Applications using Cisco Core Platforms and APIs (DEVCOR) (Page 3 )

QUESTION: 6

QUESTION: 7

QUESTION: 8

QUESTION: 9

QUESTION: 10

Explanation:

350-901 Exam Discussions & Posts (Share your experience with others)

Cisco 350-901 Exam Questions Developing Applications using Cisco Core Platforms and APIs (DEVCOR) (Page 3 )