DRAG DROP (Drag and Drop is not supported)
Drag and drop the descriptions from the left onto the related OAuth-defined roles on the right.
Select and Place:

See Explanation section for answer.

Answer(s): A

Explanation:

Show Answer Next Question

QUESTION: 66

Refer to the exhibit. This cURL POST request creates an OAuth access token for authentication with FDM API requests.

What is the purpose of the file “@token_data” that cURL is handling?

This file is given as input to store the access token received from FDM.
This file is used to send authentication-related headers.
This file contains raw data that is needed for token authentication.
This file is a container to log possible error responses in the request.

Answer(s): C

Show Answer Next Question

QUESTION: 67

What is the result of a successful OAuth2 authorization grant flow?

The third-party service is provided with a token that allows actions to be performed.
The user has the application rights that correspond to the user's role within the application's database.
The application is provided with a token that allows actions on services on the user's behalf.
The user has administrative rights to the application's backend services.

Answer(s): C

Show Answer Next Question

QUESTION: 68

In the three-legged OAuth2 process, after the authorization server presents a form to the resource owner to grant access, what is the next step?

The resource owner authenticates and optionally authorizes with the authorization server.
The user who owns the resource initiates a request to the OAuth client.
If the resource owner allows access, the authorization server sends the OAuth client a redirection.
A form to allow or restrict access is submitted by the owner of the resource.

Answer(s): D

Show Answer Next Question

QUESTION: 69

Which OAuth mechanism enables clients to continue to have an active access token without further interaction from the user?

refresh grant
JWT
password grant
preshared key

Answer(s): A

Show Answer Next Question

Download PDF Next Page

Viewing page 35 of 78
Viewing questions 171 - 175 out of 507 questions

Post your Comments and Discuss Cisco 350-901 exam prep with other Community members:

Comments:

Name:

350-901 Exam Discussions & Posts
350-901 AI Verifications

Alex on: March 02, 2025
Great material
UNITED KINGDOM

Zsh on: July 29, 2026
With work and short study sessions done this exam finally over.
Italy

Dotfile on: July 24, 2026
The exam was tough but the prep questions saved me.
Germany

Bitmask on: August 05, 2026
Questions here? Life saver for tough exam.
Italy

Hashmap on: August 31, 2026
Took my time with this cert but hey reviewed stuff slowly and passed.
Costa Rica

Posix on: June 30, 2026
Man this exam was so stressful. Glad the prep on this website got me through it okay.
South Korea

AzureNinja on: June 10, 2026
The exam was so stressful but using the prep material here helped a lot. Just glad it’s done now.
Taiwan

Scsi on: June 29, 2026
Was worried about this exam. This site made it a bit easier.
Argentina

Sshd on: August 30, 2026
Saved so much time and money cramming with the practice questions on this site got me through the exam slow but sure.
United Kingdom

Pdu on: June 19, 2026
Super stressful but this site helped.
Norway

Vimrc on: July 01, 2026
Fitting study in after work was tough but this website had spot-on practice questions that made it way easier.
Mexico

PaloAltoPat on: August 14, 2026
I found the exam tougher than expected but manageable thanks to the relevant questions here.
Italy

PktLoss on: July 28, 2026
This exam stress man. Good thing these questions helped a lot.
Switzerland

Nullptr on: August 24, 2026
The exam was harder than expected but still manageable with the practice questions from this website.
Lithuania

VlanId on: July 05, 2026
This exam is tough but these questions saved me.
Switzerland

Rootkit on: July 11, 2026
Slow but got there passed it
Singapore

Nullptr on: August 31, 2026
The exam was so stressful but the practice questions on this site definitely helped. Feel more at ease now.
United States

Tty on: July 11, 2026
Man this exam was tough but these questions on the site got me through it.
Estonia

Uptime on: July 05, 2026
Yo this exam was rough but legit the AI assistant helped me smash it. Didn't expect all those topics tho glad I prepped on this website.
Sweden

Nullptr on: August 04, 2026
Juggling work and short study sessions for this exam was kinda brutal but it's a huge relief to have finally wrapped it up. The practice questions on this site made all the difference bro.
Kuwait

Traceroute on: August 31, 2026
Took my time reviewing and kinda went slow but those practice questions helped a lot.
Netherlands

Packet on: August 15, 2026
Saved a bunch of time cramming with the exam prep here so it took me longer but passed.
Italy

Packet on: September 08, 2026
Crammed like mad using this website's practice questions saved a ton of time and passed the exam bit by bit.
United Kingdom

Regex on: September 06, 2026
The exam was harder than I thought but still got through it using the practice questions here.
Belgium

Glibc on: July 14, 2026
The exam was tough but the practice questions here really got me through it.
France

PktLoss on: July 13, 2026
Prep questions made passing this exam possible.
Kuwait

Manpage on: June 25, 2026
Man this exam was killer. Glad the prep material saved me.
Iceland

Symlink on: August 27, 2026
These questions were a lifesaver.
Costa Rica

Socket on: July 30, 2026
This exam threw more stuff than I prepared for. The AI assistant on this site was a lifesaver though it kept me sane.
UAE

Tty on: June 28, 2026
The exam was so stressful. This website's materials helped though.
Argentina

Firmware on: July 04, 2026
Exam was harder than expected but manageable.
Ireland

Kernel on: July 02, 2026
Studied quick in breaks passed exam relieved.
Canada

Strace on: August 28, 2026
Wow the exam was super stressful. Using this website was a big help.
Switzerland

Nullptr on: August 09, 2026
Crammed with practice questions here save time.
Qatar

Endian on: August 05, 2026
This exam was a bit harder than I thought but still got through with help from the practice questions.
Taiwan

twojobsnosleep on: July 06, 2026
I crammed using practice questions on this site to save time and money and got through the exam slowly but surely.
Egypt

Endianness on: September 10, 2026
This exam was tough but doable.
Spain

Opcode on: July 03, 2026
Man this exam was brutal but those practice questions from this site totally saved my skin.
Switzerland

Mutex on: June 11, 2026
Wasn't feeling very confident at first but the practice questions on this website helped me learn well.
Cyprus

Tcpdump on: August 17, 2026
Man that exam was super stressful but the prep material here helped a lot. I'm just happy it's done now.
Belgium

Backplane on: August 16, 2026
Crammed with the AI assistant on this site saved me time and money and boom passed the exam slowly but steady.
Germany

Sudoer on: June 16, 2026
This exam threw a curveball with some topics I didn't expect. The AI assistant on this site kinda saved me though.
South Korea

Hexdump on: August 24, 2026
Man that exam was stressful. The practice questions here really made it manageable though.
Spain

Linter on: July 11, 2026
Felt unsure but practice helped a lot.
Cyprus

Namespaces on: July 06, 2026
The exam was tougher than I thought but with the practice questions here it felt manageable.
Denmark

Overclock on: July 08, 2026
The exam was hard but review helped.
Estonia

Epoll on: June 23, 2026
This cert was tough but these questions got me through.
Mexico

Bios on: August 12, 2026
The exam was tougher than I thought but with this website's practice questions it was doable.
Netherlands

Nullptr on: July 22, 2026
The exam covered way more than I thought but the material on this site was pretty helpful. The AI assistant explained stuff in a simple way which was nice for me as non-native English speaker.
Japan

Shebang on: June 28, 2026
At first I was unsure but practice questions were super helpful.
Germany

AI Explanation - verified by User3103 on: September 01, 2026
Question 5:
Correct answer: A. Unidentified removable devices
Insider threats often already have legitimate access to systems and data, so they may not need phishing or impersonation. A removable device—such as an unauthorized USB drive—can be used to copy sensitive data directly from a company computer.

Default network device credentials: More associated with external attackers or poor device configuration.

Spear phishing emails: Commonly used to compromise users, but less characteristic of an insider who already has access.

Typosquatting and impersonation: Primarily social-engineering techniques aimed at deceiving users.

Unidentified removable devices: Provide a direct way to transfer data outside the organization and may bypass network monitoring.

The exam clue is “insider threat” combined with “data exfiltration.” Think of physical media, unauthorized cloud storage, personal email, or other ways an employee can move data outside approved channels.
Biloxi, United States

AI Explanation - verified by pikej74485 on: September 21, 2026
Question 196:
Correct answer: D — <apex:stylesheet>
Use <apex:stylesheet> in a Visualforce page to reference an external CSS file:

xml <apex:page> <apex:stylesheet value="{!URLFOR($Resource.MyStyles, 'styles/main.css')}" /> </apex:page>

This is commonly used with a static resource, which is the recommended way to package CSS for Salesforce deployments.

<apex:includeScript> is for JavaScript.

<apex:includeStyle> is not a valid Visualforce component.

<apex:require> is not the Visualforce tag used to load CSS.

The value attribute specifies the CSS file’s URL.
Chennai, India

AI Explanation - verified by User1362 on: September 06, 2026
S? d?ng ti?ng vi?t
Ðáp án dúng: D
Gi?i pháp:

T?o m?t Systems Manager Automation runbook d? ch?y l?nh kh?i d?ng l?i ?ng d?ng trên các EC2 instance.

T?o m?t Amazon EventBridge rule ph?n ?ng khi CloudWatch alarm chuy?n sang tr?ng thái ALARM.

Ð?t Automation runbook làm target c?a EventBridge rule.

Lu?ng ho?t d?ng:

Log c?a ?ng d?ng du?c ghi vào CloudWatch Logs.

CloudWatch alarm phát hi?n nhi?u l?i liên quan d?n vi?c restart.

Alarm chuy?n sang tr?ng thái ALARM.

EventBridge nh?n s? ki?n thay d?i tr?ng thái này.

EventBridge g?i Systems Manager Automation runbook.

Runbook restart ?ng d?ng trên các EC2 instance, không restart c? instance.

Vì sao các dáp án khác không phù h?p?

A: SNS không tr?c ti?p g?i Systems Manager Automation runbook nhu m?t target native.

B: Lambda có th? th?c hi?n vi?c restart, nhung ph?i t? x? lý vi?c xác d?nh instance và ch?y l?nh t? xa.

C: Lambda ch? làm trung gian d? g?i runbook, không c?n thi?t vì EventBridge có th? g?i runbook tr?c ti?p.

Ði?m c?n nh?: V?i remediation t? d?ng d?a trên CloudWatch alarm, k?t h?p EventBridge + Systems Manager Automation giúp gi?m code tùy ch?nh và hi?u qu? v?n hành cao nh?t.
Ho Chi Minh City, Vietnam

AI Explanation - verified by User6554 on: September 07, 2026
Question 49:
Correct answer: D — Change authorities are assigned for each type of change and change model.
A change authority is a person or group authorized to assess and approve a particular type of change. The appropriate authority depends on factors such as:

The type of change: standard, normal, or emergency

The risk, impact, and complexity

The change model being used

For example:

A standard change may be pre-authorized through its change model.

A normal change may require assessment and approval by an appropriate change authority.

An emergency change may be authorized by an emergency change authority, often using an expedited process.

Why the other options are incorrect:

Change authorities are not only needed for emergency changes.

They are not assigned only when a change is deployed.

They are not only required for normal changes.

The key idea is that authorization responsibilities are defined in advance for different change situations.
London, United Kingdom

AI Explanation - verified by User2457 on: September 10, 2026
Question 3:
Correct answer: Power BI dataset.
The existing report already contains a data model with measures. When you connect to its published Power BI dataset, you can reuse:

Existing measures

Relationships

Calculated columns

Tables and fields

Existing transformations in the model

You only need to create the new report visuals, which minimizes development effort.
Why the other options are less suitable:

SharePoint folder: Reconnects to the source files. You would likely need to recreate the model and measures.

Power BI dataflows: Primarily provide reusable data preparation and storage, but they do not automatically provide the existing semantic model and measures.

Excel workbook: Connects directly to the source file and would also require rebuilding the model and measures.

The fact that the source is an Excel file in SharePoint is not the key point. The key point is that an existing Power BI model with measures is available for reuse.
Gaborone, Botswana

AI Explanation - verified by User3213 on: September 24, 2026
Question 178:
Correct answer: B. Digital signatures
A digital signature supports nonrepudiation because it:

Verifies the sender’s identity using their private key.

Confirms the transaction was not altered after signing.

Provides evidence that the signer approved or originated the transaction.

Why the others are weaker:

Digital certificates: Bind an identity to a public key, but do not themselves prove that a specific transaction was signed.

Encrypted passwords: Protect confidentiality or authentication, but generally do not provide transaction-level nonrepudiation.

One-time passwords: Authenticate a user for a session or transaction, but usually do not provide durable proof of who authorized the electronic record.

In exam questions, distinguish digital certificates—which support identity validation—from digital signatures, which provide the signed evidence needed for nonrepudiation.
Johannesburg, South Africa

AI Explanation - verified by User5041 on: September 10, 2026
Question 17:
Correct answer: B — Enabling malware detection through a UTM
The company accepts PDF uploads, which creates a risk that an attacker could upload a malicious or weaponized file. A UTM (Unified Threat Management) appliance can inspect uploaded content and use antimalware/content filtering to detect and block malicious files.
Why the others are less appropriate:

A. IDS attack signatures: An IDS primarily detects suspicious network activity; it is not the best control for scanning uploaded documents for malware.

C. Load balancer: Distributes traffic among servers and improves availability, but does not inspect files for malware.

D. WAF: Protects web applications against attacks such as SQL injection and command injection. It may help secure the upload function, but malware scanning is the key requirement here.

The exam clue is “upload PDF documents”: think file-based malware detection, not just web-request filtering.
Biloxi, United States

AI Explanation - verified by User4353 on: September 22, 2026
Question 142:
Correct answer: B — Build the functionality in the software to collect operational usage data.
To evaluate delivered value accurately, the team needs objective, real-world usage data—such as which features are used, how often, and by how many users. Instrumenting the software to collect this information provides direct evidence from actual system behavior.
Why the other options are weaker:

Feedback form: Captures opinions, not necessarily actual behavior; users may not respond.

Questionnaire: Relies on memory and subjective judgments about usefulness.

Interviews: Can provide valuable qualitative insights, but a sample of users may not represent overall usage accurately.

This reflects the agile principle of using empirical data and feedback to evaluate whether the product is delivering its intended value. Privacy, security, and applicable data-protection requirements should also be considered when collecting usage data.
Hong Kong, Hong Kong

AI Explanation - verified by User1054 on: September 25, 2026
Question 1:
Correct answer: B — Create a custom pool.
A custom Apache Spark pool lets you provision dedicated Spark compute for the bronze and silver workloads. Assigning the workloads to separate pools prevents them from competing for the same shared Spark resources and provides better control over node size, autoscale settings, and workload capacity.
Why the other options are less suitable:

Disable high concurrency: This changes session-sharing behavior but does not provide dedicated compute or true workload separation.

Modify the number of executors: Adjusts resources within a Spark job; it does not isolate bronze and silver processes.

Set the default environment: Controls libraries and runtime configuration, not compute isolation.

Important: The supplied explanation appears incorrect. It discusses isolated compute in Azure Synapse, including an XXXLarge node requirement, rather than explaining the Fabric answer. For this question, the relevant concept is using a custom Spark pool to separate workloads.
Johannesburg, South Africa

AI Explanation - verified by User4935 on: September 11, 2026
Question 50:
Correct answer: A — Purchase Provisioned Throughput for the custom model.
When a company fine-tunes or customizes an Amazon Bedrock foundation model, the resulting custom model cannot generally be invoked on-demand like a standard Bedrock base model. The company must purchase Provisioned Throughput, which allocates dedicated capacity for using that custom model through Bedrock.
Why the other options are incorrect:

B. Deploy to a SageMaker endpoint: This is needed for SageMaker-hosted models, not for a model intended to be used directly in Amazon Bedrock.

C. Register with SageMaker Model Registry: SageMaker Model Registry is unrelated to invoking custom models in Bedrock.

D. Grant access in Bedrock: Access permissions may be necessary, but they do not replace the required provisioned capacity.

The key exam distinction is: Bedrock custom model ? Provisioned Throughput.
Helsinki, Finland

AI Explanation - verified by Tholang2016 on: September 11, 2026
Question 152:
Correct answer: A — Efficient
The three Es in not-for-profit performance measurement are:

Economy: Obtaining inputs at the lowest appropriate cost.

Efficiency: Making the best use of resources, such as staff, money, and equipment.

Effectiveness: Achieving the intended objectives or outcomes.

“Optimum utilization of available resources” describes efficiency, so the organization is efficient.
For example, a charity is efficient if it delivers its services using the minimum resources necessary, but it is effective only if those services achieve the intended social results.
Maseru, Lesotho

AI Explanation - verified by User4344 on: September 25, 2026
Question 47:
A resposta correta é D — Benchmark datasets.
Por quê? Datasets de benchmark são conjuntos de dados padronizados, geralmente preparados para avaliar aspectos específicos como viés, justiça e discriminação. Eles permitem comparar as respostas do LLM com expectativas e métricas predefinidas, exigindo menos preparação manual.
As outras opções demandam mais esforço administrativo:

User-generated content: precisa ser coletado, filtrado, anonimizado e rotulado.

Moderation logs: podem conter dados inconsistentes, informações pessoais e decisões que precisam ser revisadas.

Content moderation guidelines: são regras ou orientações, não dados diretamente utilizáveis para medir o comportamento do modelo.

Em uma questão que destaca “least administrative effort”, procure uma fonte já estruturada e própria para avaliação: benchmark datasets.
Jacareí, Brazil

AI Explanation - verified by User8630 on: September 12, 2026
Question 13:
The answer key shows D, but I believe the best answer is B — User Acceptance Testing (UAT) before implementation.
Change management includes evaluating, testing, approving, implementing, and documenting changes. UAT before implementation confirms that the change meets business requirements and does not cause unacceptable problems before being placed into production.
Why the other options are weaker:

A — Technical review by business owner: A business owner may approve the business impact, but a technical review is normally performed by technical personnel.

C — Cost-benefit analysis after implementation: Cost-benefit analysis should occur before implementation to support the approval decision.

D — Business continuity testing: This can be appropriate for major changes, but it is primarily part of business continuity and disaster recovery planning—not a universal change-management activity.

Therefore, B is the more generally correct answer, and the community answer key appears questionable.
Petaling Jaya, Malaysia

AI Explanation - verified by User5118 on: September 15, 2026
Question 108:
Question 108 tests the dysfunctional effect of assessing a manager using ROI alone.

Existing expected ROI: 15%

New project ROI: 14%

Cost of capital: 12%

The manager will compare the project’s 14% with the division’s current 15% ROI. Because 14% is lower, investing would reduce the division’s overall ROI, so the manager is likely to reject the project.
However, from the company’s perspective, the project should be accepted because:

Project return = 14%

Cost of capital = 12%

It earns 2% more than the cost of capital, so it should increase shareholder value.

Therefore, ROI can encourage dysfunctional decision-making: the manager protects the reported divisional ROI, even though the project is economically beneficial.
The answer key shows A, but the image containing the individual true/false statements is not visible here, so I cannot identify exactly which statement is labelled A. The key principle is: a project should be accepted when its return exceeds the cost of capital, even if it lowers the division’s existing ROI.
Maseru, Lesotho

AI Explanation - verified by User7408 on: September 25, 2026
Question 7:
Correct answer: B. Automated response actions
A next-generation SIEM does more than collect and correlate logs. It can use analytics, threat intelligence, and automation—often through SOAR capabilities—to respond to detected threats automatically.
Examples include:

Disabling a compromised account

Blocking a malicious IP address

Isolating an endpoint

Creating or escalating an incident ticket

Why the other options are less appropriate:

Virus signatures: Primarily associated with antivirus or endpoint protection.

Security agent deployment: Usually handled by endpoint-management or security-agent platforms.

Vulnerability scanning: Typically performed by vulnerability-management tools.

Therefore, automated response actions are the distinguishing next-generation SIEM feature.
Atlanta, United States

AI Explanation - verified by User8545 on: September 26, 2026
Can pcs with differet / or ip range can communicate with each other?
Yes, PCs in different IP ranges can communicate, but they usually need a router or Layer 3 switch to route traffic between their networks.
Example:

PC A: 192.168.1.10/24

PC B: 192.168.2.10/24

These are different subnets. They can communicate if:

Both PCs have a correct default gateway

A router or Layer 3 switch connects the subnets

Routing and firewall rules allow the traffic

Without a router, they generally cannot communicate directly because each PC believes the other is on a different network and sends the traffic to its gateway.
The /24 is the subnet prefix length. It determines which addresses are considered local. For example, with 192.168.1.0/24, addresses from 192.168.1.1 through 192.168.1.254 are in the same subnet. A PC at 192.168.2.x is outside that subnet.
Also, PCs in the same broad IP range may still be unable to communicate if VLANs, subnet masks, ACLs, or firewalls separate them.
Quezon City, Philippines

AI Explanation - verified by User3731 on: September 14, 2026
Question 13:
Correct answer: C. Jailbreaking
Jailbreaking modifies or bypasses a smartphone’s built-in restrictions, allowing the user to:

Install unauthorized or unsupported software

Access features blocked by the manufacturer or operating system

Customize system behavior beyond normal settings

Sideloading means installing an application from a source other than the official app store. It may install unauthorized software, but it does not necessarily modify the operating system or enable new system-level features.
So yes—the wording about enabling new features points toward jailbreaking. The question describes more than simply installing an outside app; it describes bypassing platform restrictions.
Porter Ranch, United States

AI Explanation - verified by User1558 on: September 17, 2026
Question 10:
Correct answer: Yes (A).
For a SQL Server Always On availability group listener on Azure VMs, the Azure internal load balancer’s load-balancing rule must have Floating IP enabled.
Why:

The listener uses a virtual IP address shared by the availability-group replicas.

Floating IP, also called Direct Server Return (DSR), allows the SQL Server nodes to respond using the listener’s IP address rather than their individual VM IP addresses.

This is required for the availability-group listener to function correctly with an Azure internal load balancer.

The rule should also use an appropriate health probe and the listener’s frontend private IP address. Client IP session persistence alone is not sufficient, which is why Question 9’s proposed solution is incorrect.
Edmonton, Canada

AI Explanation - verified by User7174 on: September 24, 2026
Question 13:
The answer key’s B — “That the MVP must go into operational use” is correct.
In PRINCE2 Agile, a minimum viable product (MVP) is not merely a prototype or an initial definition of the product. It must be a usable product that can be put into operation and deliver enough value to test whether the project is viable.
Why the other options are weaker:

When the MVP will be defined — the MVP should already be understood sufficiently when assessing the business case.

What the MVP is — useful information, but not the key requirement tested here.

That the MVP is the same as project viability — incorrect. The MVP helps test viability; it is not identical to viability itself.

The business case therefore needs to confirm that the MVP will be delivered into operational use, allowing its value and viability to be assessed.
Sheffield, United Kingdom

AI Explanation - verified by User5838 on: September 08, 2026
Question 21:
Correct answer: B — Validating that assets are protected according to the assigned classification.
The IS auditor’s role is independent assurance, not ownership of the classification process. The auditor evaluates whether management’s controls are working as intended.

A — Securing information assets: This is the responsibility of management and operational/security teams.

B — Validating protection: Correct. The auditor checks whether controls—such as access restrictions, encryption, retention, and handling procedures—match the asset’s classification.

C — Ensuring alignment with regulations: Management and legal/compliance functions typically establish classification requirements; the auditor may assess compliance but does not primarily define alignment.

D — Defining classification levels: This is a management responsibility based on business needs, risk, and regulatory obligations.

A useful exam principle is: management establishes policies and classifications; the auditor independently evaluates whether they are appropriate and implemented effectively.
Kampala, Uganda

AI Explanation - verified by User7687 on: September 07, 2026
Question 18:
The answer key shows B and D, but I believe the stronger answers are A and D.

A — Correct: Identify the data required by Salesforce, its dependencies, and how it should be validated. Verification scripts help confirm record counts, relationships, field mappings, and data integrity after migration.

D — Correct: Use a full sandbox and perform trial migrations using realistic—or appropriately masked—legacy data. This exposes transformation, volume, dependency, and integration issues before production cutover.

B — Less appropriate: Phased user migration and parallel operation primarily address user adoption and rollout risk, not the technical risks of data migration.

C — Less appropriate: Although sandbox testing and integration testing are valuable, the option emphasizes test-data generation rather than validating the migration with representative legacy data. “A full sandbox for all systems” may also be impractical.

The exam concept is to profile and validate the data first, then rehearse the migration with realistic data in a nonproduction environment.
Rome, Italy

AI Explanation - verified by User4761 on: September 09, 2026
Question 9:
The answer key appears to be incorrect. The correct answer should be A — True.
Outside the required_providers block, Terraform configuration refers to a provider using its local name, such as:

hcl provider "aws" { region = "us-east-1" } resource "aws_s3_bucket" "example" { bucket = "my-example-bucket" }

Here, aws is the provider’s local name.
The source address—for example, hashicorp/aws—is used in the required_providers block to identify where the provider comes from:

hcl terraform { required_providers { aws = { source = "hashicorp/aws" } } }

The source address is not normally used as a provider reference in resource blocks or provider configurations. Therefore, the question’s stated B — False conflicts with standard Terraform behavior.
Agege, Nigeria

AI Explanation - verified by khamankopane66 on: September 14, 2026
Question 16:
Correct answer: A, C and D.
Management should ensure:

A — Capacity: The system must handle all current records and anticipated future records. A system that cannot cope with volume will quickly become ineffective.

C — Accuracy: Academic records are critical, so the new system must be at least as accurate as the existing system and comparable systems. Poor accuracy could cause serious administrative and reputational problems.

D — Integration: Linking with the university’s financial systems supports consistency and avoids duplicate data entry, especially for registration, deregistration and fee-related transactions.

Why the others are not essential prerequisites:

B — Parallel running: This is a useful implementation and risk-control technique, but it is not an essential feature of the system itself. It may also be expensive and time-consuming.

E — Internet access for all information: This creates significant confidentiality and security risks. External access might be needed for selected services, but unrestricted access to all information is not essential and would be inappropriate for student records.

Maseru, Lesotho

AI Explanation - verified by User8449 on: September 01, 2026
Question 23:
Correct answer: D — Hashing
Hashing creates a fixed-length integrity value for the source code. Tom can compare the current file’s hash with a trusted baseline hash:

Matching hashes suggest the file has not changed.

Different hashes indicate that the file was modified, whether authorized or unauthorized.

Why the others are weaker:

Backup: Helps recover the previous version but does not identify or stop unauthorized changes.

File labels: Classify or mark files; they do not verify integrity.

Security audit: May discover weaknesses or improper changes, but is periodic and not a direct technical integrity control.

Important nuance: Hashing primarily detects unauthorized modification rather than preventing it. In a real DevOps environment, prevention would also involve version control, access restrictions, code review, and change management. Given these choices, hashing is the best answer because it provides reliable change detection.
Lisbon, Portugal

AI Explanation - verified by User4573 on: September 18, 2026
Question 66:
The answer key appears incorrect. I believe the correct answer is: Yes.
The Bulk invite users operation in Microsoft Entra ID is designed to invite multiple external users from a CSV file. It creates guest user objects in the tenant and sends invitation emails to the listed addresses.
Why:

The CSV contains the external users’ email addresses.

The bulk invitation feature supports inviting many guest users in one operation.

Each invited user becomes a guest account in contoso.com.

The explanation given in the question is also misleading. New-AzureADMSInvitation creates an invitation for an individual user, but it could be run repeatedly in a script; it is not required when using the portal’s bulk operation.
Therefore, assuming the CSV follows the required Microsoft Entra bulk-invitation format, the proposed solution does meet the goal.
Noida, India

AI Explanation - verified by User5753 on: September 09, 2026
Question 8:
Correct answer: C — A leaf switch can be added with connections to every spine switch.
In a spine-and-leaf architecture:

Leaf switches provide access ports for servers, users, and other devices.

Spine switches provide the backbone between leaf switches.

Every leaf switch connects to every spine switch, creating a predictable, full-mesh fabric between the two layers.

Leaf switches do not connect directly to other leaf switches, and spine switches do not connect directly to other spine switches.

Therefore, when more access ports are needed, you can add another leaf switch and connect it to all existing spine switches. This preserves redundancy and provides multiple equal-cost paths through the network.
Why the others are incorrect:

A: Adding both a spine and leaf is unnecessary for simply adding access ports.

B: It focuses on uplink speed, not the scalable topology.

D: A single spine connection creates a bottleneck and a single point of failure.

Midrand, South Africa

AI Explanation - verified by nhoxzznhox15 on: September 12, 2026
Question 137:
Correct answer: C — AWS Network Firewall with a Lambda-created drop rule.
Why:

AWS Network Firewall can inspect and block traffic across a VPC when traffic is routed through the firewall. A Drop action rule can deny traffic from the suspicious source IP.

GuardDuty findings are sent to Security Hub.

A Lambda function can be invoked when Security Hub receives a new GuardDuty finding, extract the source IP, and update the Network Firewall policy with a blocking rule.

Why the others are incorrect:

GuardDuty threat lists: Used to identify or increase the severity of findings; they do not directly block VPC traffic.

AWS WAF: Protects supported web applications, such as CloudFront or Application Load Balancers. It does not provide general VPC-wide traffic blocking.

GuardDuty suppression rules: Suppress or hide findings. They do not block the suspicious traffic.

A practical implementation would also need appropriate IAM permissions and a mechanism to update or remove expired block rules. The firewall must be correctly placed in the VPC traffic path for the drop rule to be effective.
Duong Minh Châu, Vietnam

AI Explanation - verified by User3974 on: September 09, 2026
Question 66:
Correct answer: A — Create an Amazon Bedrock custom service role for each team with access only to that team’s customer data.
Why:

Each team’s Bedrock workflow uses a separate IAM service role.

The role’s Amazon S3 permissions can be limited to only that team’s customer folder or objects.

This enforces least privilege and prevents one team’s Bedrock application from accessing another team’s data.

Access is enforced by AWS permissions, not by asking users to provide a customer name in each request.

Why the others are weaker:

A single role with broad S3 access does not provide team-level isolation.

Asking teams to specify a customer name is not an access-control mechanism.

Redacting data does not prevent unauthorized access.

A bucket policy alone is insufficient unless it explicitly enforces the required team-role restrictions.

The key exam concept is: use separate roles with narrowly scoped S3 permissions for data segregation.
Hyderabad, India

AI Explanation - verified by User8693 on: September 04, 2026
Question 89:
The answer key’s NIDS and WAF is more defensible here. WAF is definitely one of the answers because it specifically protects web applications by detecting/blocking attacks such as SQL injection, cross-site scripting, and malicious HTTP/HTTPS requests.
The second choice is NIDS:

NIDS: Monitors network traffic for suspicious activity and network-based attacks targeting the application or its supporting services.

HIPS: Protects an individual host by monitoring processes, files, and system activity. It can help secure the web server, but it is not focused specifically on the application’s network attack surface.

SIEM: Aggregates and correlates logs; it does not directly prevent attacks.

Honeypot: A decoy system, not the primary protection for a production web application.

Certificate revocation list: Deals with certificate trust, not application exploitation.

So, for a web application exposed over HTTPS, choose WAF + NIDS. Your WAF choice is correct; HIPS is reasonable in a broader defense-in-depth design but is less directly aligned with the question’s stated risk.
Lagos, Nigeria

AI Explanation - verified by User6296 on: September 22, 2026
i think you are getting confused with IRM, i have checked MS official sources, A should be the correct answer. can you also check
You’re right to challenge it. My previous answer was incorrect for this question. The expected answer is A — Microsoft Purview portal.
The distinction is:

Microsoft Purview portal: Create and manage sensitivity labels and configure support for sensitivity labels used with Office files in SharePoint and OneDrive.

SharePoint admin center: Primarily manages SharePoint settings. Older guidance and PowerShell procedures used SharePoint tenant configuration, which can make this question confusing.

IRM: Concerns Information Rights Management and is a separate protection mechanism; it should not be used to identify the portal for configuring Microsoft Purview sensitivity labels.

Microsoft’s current administrative experience places sensitivity-label configuration under Microsoft Purview, although some tenant-level functionality may still be exposed through SharePoint Online PowerShell. Therefore, among the four portal choices, A is the best and current answer.
Nagpur, India

AI Explanation - verified by User2976 on: September 24, 2026
what is athena
Amazon Athena is a serverless interactive query service that lets you run SQL queries directly against data stored in services such as Amazon S3.
Key points:

No servers or database infrastructure to provision.

Uses standard SQL.

Supports formats such as JSON, CSV, Parquet, and ORC.

You typically define the table structure with AWS Glue Data Catalog or Athena’s own schema definitions.

Charges are generally based on the amount of data scanned, so partitioning and columnar formats can reduce cost.

It does not copy the data into a separate database; it reads the files in S3 when you run a query.

For Question 2, Athena is appropriate because the logs already exist in S3 and the company needs simple, on-demand analysis with minimal operational overhead.
Bengaluru, India

AI Explanation - verified by janapatimanikanta16 on: September 03, 2026
Question 6:
Question 6: Answer A — By suggesting assertions based on the code’s context and semantics.
GitHub Copilot Chat can examine a function and suggest assertions or test conditions that check expected behavior. For example, it might recommend verifying that:

A valid input returns the expected result

An invalid input raises an error

Boundary values are handled correctly

An assertion is a condition that must be true, such as assert result == expected_value.
The other options are less suitable:

B: Copilot may help generate tests, but it does not automatically write all necessary tests.

C: Writing the implementation does not verify that it works correctly.

D: Copilot can suggest test commands or test code, but the developer or development environment must execute and validate the tests.

The key point is that Copilot assists with verification; it does not guarantee correctness.
Mumbai, India

AI Explanation - verified by User6966 on: September 23, 2026
Question 18:
Correct answer: False (B).
A Reader Account lets a data consumer access shared data without having its own paid Snowflake account. However, the Data Provider is responsible for the Reader Account’s usage costs, including compute consumed by its virtual warehouses.
The fact that the consumer only reads shared data does not make compute free. Queries still require compute resources, and those resources are billed to the provider. The consumer cannot modify the shared data, but reading it can still generate compute usage.
Columbus, United States

AI Explanation - verified by User2814 on: September 19, 2026
Question 171:
Correct answers: Stream and External table
A schema is a logical container inside a database for database objects. In Snowflake, schemas can contain objects such as:

Streams — track change data for tables or views.

External tables — reference data stored in an external cloud storage location.

The other options are not schema-contained objects:

Role — account-level security object.

Warehouse — account-level compute resource.

User — account-level security object.

Share — account-level object used to share data.

So the answer key’s B and D is correct.
Bengaluru, India

AI Explanation - verified by User3120 on: September 09, 2026
Question 12:
The answer key shows B (technique), but I believe the correct answer is D: cycle.
In MoP (Management of Portfolios), portfolio delivery is one of the two portfolio management cycles:

Portfolio definition cycle — establishes and maintains the portfolio strategy, objectives, and management framework.

Portfolio delivery cycle — coordinates and monitors the delivery of change initiatives, ensuring the portfolio remains aligned with strategic objectives and delivers value.

Why the others are incorrect:

Practice — a structured area of portfolio management activity, such as risk management or resource management.

Technique — a method used to perform an activity; it is not the term for portfolio delivery itself.

Principle — a guiding rule for effective portfolio management.

Therefore, select D: cycle.
Oslo, Norway

AI Explanation - verified by User3618 on: September 21, 2026
Question 1:
Question 1 asks for two ways to iterate through a List<Account>.

A is valid:

apex for (Account theAccount : AccountList) { // process theAccount }
This is Apex’s enhanced for loop. Each element is assigned to theAccount.

D is conceptually valid, using an index:

apex for (Integer i = 0; i < AccountList.size(); i++) { Account theAccount = AccountList[i]; }
However, the question displays AccountList.Size(). Apex method names are case-sensitive, so the correct method is size(), not Size().

B is invalid because for(AccountList) is not valid loop syntax.

C is invalid because each item is an Account, not a List.

Important: The answer key shows A and D, but D is only correct if Size() is a capitalization typo and should be size().
Santos, Brazil

AI Explanation - verified by User4059 on: September 02, 2026
Question 9:
Correct answer: A — vBond
In Cisco SD-WAN, the components have distinct roles:

vBond — orchestration plane: Authenticates devices, helps them discover each other, and assists with NAT traversal and initial control-connection setup.

vSmart — control plane: Distributes routing and policy information to WAN Edge devices using the overlay control plane.

vManage — management plane: Provides centralized configuration, monitoring, and orchestration through its GUI/API.

WAN Edge — data plane: Forwards user traffic across the SD-WAN fabric.

The term orchestration points directly to vBond, which acts as the initial coordination point when SD-WAN devices join and establish their overlay relationships.
Frankfurt Am Main, Germany

AI Explanation - verified by User3532 on: September 25, 2026
Question 17:
Correct answer: B — Enabling malware detection through a UTM
The website accepts user-uploaded PDF files, which could contain malware or malicious code. A UTM (Unified Threat Management) appliance can inspect uploaded files using antimalware and content-filtering capabilities before they reach internal systems or users.
Why the others are less appropriate:

A. IDS attack signatures: Detects suspicious network activity, but is not primarily designed to scan uploaded files for malware.

C. Load balancer: Distributes traffic among servers and improves availability; it does not inspect files for threats.

D. WAF: Protects web applications from attacks such as SQL injection and command injection, but its primary role is not malware scanning of uploaded documents.

The key clue is PDF uploads: think file inspection and malware detection, rather than general web-application or network-traffic protection.
Chennai, India

AI Explanation - verified by User7918 on: September 25, 2026
Question 10:
Answer: C — Split the Logged column using at as the delimiter.
The value:
2018-12-31 at 08:59
contains both a date and a time, so it is not directly suitable as a date column. Splitting on at produces two values:

2018-12-31 — the date

08:59 — the time

The date portion can then be assigned the Date data type. Once loaded into Power BI as a date, it can support the built-in date hierarchy, such as Year ? Quarter ? Month ? Day.
Why the other options are unsuitable:

Changing the original column to Date may fail because it still contains the text at and a time.

Extracting the last 11 characters does not isolate the date.

Extracting the first 11 characters gets the date plus a space, but the option does not specify changing the result to the Date type.

The answer key’s C is therefore the best choice, assuming the resulting date part is typed as Date.
Hendrik-Ido-Ambacht, The Netherlands

AI Explanation - verified by User7377 on: September 01, 2026
Question 3:
Correct answer: C — approval of policy statements and funding.
Senior management’s primary role in information security governance is to provide direction, authority, and resources. They should:

Approve major information security policies

Allocate funding and resources

Set the organization’s risk appetite

Ensure security supports business objectives

The other choices are mainly operational or oversight activities:

Evaluating vendors is generally handled by security, procurement, or technical teams.

Assessing risks is typically performed by security and risk-management professionals, with management accepting or prioritizing the risks.

Monitoring regulatory adherence is usually handled by compliance, audit, or security functions.

The key exam distinction is that senior management governs and approves, while security professionals generally assess, implement, and monitor.
Islington, United Kingdom

AI Explanation - verified by User5177 on: September 23, 2026
Question 12:
Question 12 tests data profiling in Power Query Editor, specifically the difference between distinct and unique values.

Distinct values = 69

There are 69 different state values in the State column. Each value is counted once for this metric, regardless of how many times it appears.

Unique values = 4

Four state values appear only once in the entire column.
For example, if a column contains:
CA, CA, NY, TX, FL
there are 4 distinct values (CA, NY, TX, FL), but 3 unique values (NY, TX, and FL appear once).
So the selections indicated by the answer key—69 distinct values and 4 unique values—are consistent with Power Query’s column distribution metrics. The column quality area is a separate metric that shows valid, error, and empty values; it does not determine the distinct or unique counts.
New Delhi, India

AI Explanation - verified by User4405 on: September 19, 2026
Wrong answer. You use groups to assign devices to it. The use those groups as scope in policies, effectively passing devices between policies
You’re right—the answer key’s B (Use sub-rules) is incorrect. The better answer is D: Use groups.

Assign endpoints to a group based on the result of one policy.

Use that group as the scope of another policy.

This effectively passes the endpoints from one policy’s processing flow to another.

Sub-rules create branches within a single policy; they are not the standard mechanism for transferring endpoints between separate policies.
Madrid, Spain

AI Explanation - verified by User5421 on: September 25, 2026
Question 17:
Correct answer: D. 587
Port 587 is used for SMTP message submission, typically allowing email clients to send mail through a server using authentication and encryption such as STARTTLS.
Why the others are not best:

25 – Traditional SMTP server-to-server mail transfer; often blocked for client submission and not inherently secure.

110 – POP3 for receiving email; unencrypted by default.

143 – IMAP for accessing email; unencrypted by default.

587 – Authenticated email submission and commonly secured with TLS.

Exam tip: Port 587 is the standard answer for secure/authenticated outbound email submission. Secure versions of POP3 and IMAP use different ports, but those are not the choices here.
Naga, Philippines

AI Explanation - verified by User8578 on: September 09, 2026
Question 102:
Correct answer: B. Masking
Data masking hides sensitive portions of information while preserving enough format for troubleshooting or identification. For example:
4111 1111 1111 1111 ? ** ** 1111
This is appropriate for a database log file because logs may need to show that a transaction occurred without exposing the full credit card number.

Tokenization: Replaces the value with a nonsensitive token, often reversible through a secure token vault.

Hashing: Converts data into a one-way fixed-length value, generally used for integrity checks or password storage.

Obfuscation: A broad term for making data difficult to understand; it is less precise than masking in this context.

Therefore, masking is the most specific choice.
San Jose, United States

AI Explanation - verified by himanshupandey473 on: September 15, 2026
Question 75:
Question 75: Linear regression
The correct choice is linear regression when the model must predict a numeric value.

Regression predicts continuous numeric outcomes, such as house price, temperature, or sales amount.

Linear regression assumes the target can be estimated from a linear relationship between the input features and the target.

In Azure Machine Learning, you use a labeled dataset containing:

- Features: input columns - Label: the numeric value to predict
Why the other options are incorrect:

Classification predicts a category or class, such as “spam” or “not spam.”

Clustering groups similar records without a known label; it is an unsupervised learning technique.

So, if the sentence describes predicting a numeric target, select Linear regression.
Pune, India

AI Explanation - verified by User8125 on: September 09, 2026
Question 49:
La risposta corretta è C. DRP (Disaster Recovery Plan).
Un DRP descrive le procedure da seguire dopo un disastro per ripristinare sistemi, infrastrutture e servizi essenziali. Nel caso della municipalità, il tornado ha distrutto il data center principale, quindi il personale deve attivare il piano di disaster recovery, ad esempio utilizzando un sito alternativo o sistemi di backup.
Le altre opzioni:

BCP (Business Continuity Plan): è più ampio e mira a mantenere le funzioni essenziali dell’organizzazione durante un’interruzione. Il DRP è una componente più specifica del BCP.

Communication plan: stabilisce come comunicare con dipendenti, cittadini e altre parti interessate, ma non ripristina i sistemi.

IRP (Incident Response Plan): gestisce la risposta iniziale a un incidente di sicurezza, come un attacco informatico, non principalmente il recupero da un disastro fisico.

Da ricordare: DRP = ripristino dopo un disastro; BCP = continuità complessiva delle attività.
Rome, Italy

AI Explanation - verified by User3698 on: September 22, 2026
Question 72:
Question 72: The answer key appears incorrect. The better answer is D) Mean Time to Contain (MTTC).
The executives want to know how long it takes to stop malware from spreading. That is specifically a containment objective: isolating affected systems, blocking traffic, disabling accounts, or otherwise limiting the incident’s scope.

MTTC: Time required to contain or limit the incident’s impact — best match.

MTTR: Time required to remediate or recover from the incident; this may include eradication, restoration, and cleanup, which goes beyond merely stopping spread.

MTTD: How long it takes to discover the incident.

MTBF: Average time between failures, generally a reliability metric.

Therefore, the answer key’s C is questionable; based on the wording, D is the more precise CompTIA-style answer.
Guará, Brazil

AI Explanation - verified by User5548 on: September 10, 2026
Question 149:
Correct answer: D — All the statements.
Beyond Budgeting is a management approach designed to replace rigid annual budgets with more flexible, decentralized management.
Each statement fits:

Clear principles and boundaries — Employees have freedom, but decisions must remain within clear organizational values, policies and limits.

High degree of freedom — Managers are trusted to make decisions rather than seeking continual approval from senior management.

Frontline customer responsibility — Customer-facing managers should be empowered to manage customer relationships and respond quickly to needs.

Transparent and ethical information — Information should be openly available and used honestly, supporting trust and informed decision-making.

Therefore, all four statements describe Beyond Budgeting.
Maseru, Lesotho

AI Explanation - verified by User9453 on: September 06, 2026
Question 63:
Correct answer: B — A packet capture tool was used to steal the password.
Telnet sends login credentials across the network in plaintext. An attacker who captures the traffic with a packet analyzer can read the server administrator’s username and password, then use those credentials to log in and install malware.
Why the other options are less likely:

Password spraying: Tries a few common passwords against many accounts; no indication of repeated login attempts.

Remote-access Trojan (RAT): Could install malware, but it does not explain how the attacker obtained the administrator’s credentials.

Dictionary attack: Tries words or common passwords against an account; again, the scenario specifically highlights Telnet’s lack of encryption.

The key exam concept is: Telnet is insecure because it does not encrypt authentication data. Use SSH instead.
Fayetteville, United States

AI Explanation - verified by User7020 on: September 26, 2026
Question 86:
Correct answer: OWASP
OWASP, especially the OWASP Top 10, provides information about common ways web applications are exploited, such as:

Injection

Broken access control

Authentication failures

Security misconfiguration

Cross-site scripting

Why the others are less suitable:

STIX: A standardized language and format for exchanging threat intelligence.

OVAL: Used to describe and assess system vulnerabilities and configuration issues.

Threat intelligence feed: Provides current indicators and intelligence about threats, but not necessarily a structured overview of common application exploitation methods.

CVE: A catalog of individually identified, publicly disclosed vulnerabilities.

The answer key’s A is correct. For application-security attack methods, think OWASP; for vulnerability identifiers, think CVE.
Seattle, United States

AI Tutor 👋 I’m here to help!

Cisco 350-901 Exam Prep Developing Applications using Cisco Core Platforms and APIs (DEVCOR) (Page 35 )

QUESTION: 65

Explanation:

QUESTION: 66

QUESTION: 67

QUESTION: 68

QUESTION: 69

Cisco 350-901 Exam Prep
Developing Applications using Cisco Core Platforms and APIs (DEVCOR) (Page 35 )