DRAG DROP (Drag and Drop is not supported)
Drag and drop the descriptions from the left onto the related OAuth-defined roles on the right.
Select and Place:

See Explanation section for answer.

Answer(s): A

Explanation:

Show Answer Next Question

QUESTION: 66

Refer to the exhibit. This cURL POST request creates an OAuth access token for authentication with FDM API requests.

What is the purpose of the file “@token_data” that cURL is handling?

This file is given as input to store the access token received from FDM.
This file is used to send authentication-related headers.
This file contains raw data that is needed for token authentication.
This file is a container to log possible error responses in the request.

Answer(s): C

Show Answer Next Question

QUESTION: 67

What is the result of a successful OAuth2 authorization grant flow?

The third-party service is provided with a token that allows actions to be performed.
The user has the application rights that correspond to the user's role within the application's database.
The application is provided with a token that allows actions on services on the user's behalf.
The user has administrative rights to the application's backend services.

Answer(s): C

Show Answer Next Question

QUESTION: 68

In the three-legged OAuth2 process, after the authorization server presents a form to the resource owner to grant access, what is the next step?

The resource owner authenticates and optionally authorizes with the authorization server.
The user who owns the resource initiates a request to the OAuth client.
If the resource owner allows access, the authorization server sends the OAuth client a redirection.
A form to allow or restrict access is submitted by the owner of the resource.

Answer(s): D

Show Answer Next Question

QUESTION: 69

Which OAuth mechanism enables clients to continue to have an active access token without further interaction from the user?

refresh grant
JWT
password grant
preshared key

Answer(s): A

Show Answer Next Question

Download PDF Next Page

Viewing page 41 of 78
Viewing questions 201 - 205 out of 507 questions

Post your Comments and Discuss Cisco 350-901 exam prep with other Community members:

Comments:

Name:

350-901 Exam Discussions & Posts
350-901 AI Verifications

Alex on: March 02, 2025
Great material
UNITED KINGDOM

Namespaces on: August 18, 2026
Took my time with the exam prep because life. Went through questions again and again till it stuck. Passed eventually so yay me I guess.
Estonia

Symlink on: July 29, 2026
Slow start but passed after solid review time.
Israel

Raid on: July 15, 2026
Didn't feel confident till practice questions.
France

Sudoer on: July 21, 2026
The exam was harder than I thought but the practice questions on this website made it manageable.
Sweden

Tty on: July 02, 2026
Worked around meetings squeezing study time and it paid off.
Belgium

Deadlock on: July 25, 2026
Worked a lot but these questions helped.
Japan

Zsh on: July 24, 2026
This exam had way more stuff than I thought and totally caught me off guard. Luckily the AI assistant on this site was kinda handy when I got stuck with things.
Malta

Bitshift on: September 09, 2026
The exam harder than expect but manageable.
Greece

Uptime on: July 05, 2026
Yo this exam was rough but legit the AI assistant helped me smash it. Didn't expect all those topics tho glad I prepped on this website.
Sweden

Malloc on: September 18, 2026
This exam was crazy stressful but the practice questions were a lifesaver. Honestly just glad it's over now.
United Kingdom

Pids on: August 03, 2026
Exam was tough but these questions helped. Glad I used this site.
Switzerland

Bitshift on: August 05, 2026
The exam was tougher than I thought but the practice questions here helped me a lot.
Portugal

PktLoss on: July 25, 2026
The exam was crazy stressful. The practice questions here definitely helped a lot.
Ireland

Netmask on: August 18, 2026
This exam was tough. But the practice questions were a lifesaver.
Greece

Vlan on: July 28, 2026
Didn't feel ready but practice questions helped.
Italy

Tcpdump on: July 18, 2026
Worked long hours but glad I passed.
Belgium

Backplane on: August 16, 2026
Crammed with the AI assistant on this site saved me time and money and boom passed the exam slowly but steady.
Germany

Traceroute on: September 03, 2026
This exam was tough but practice questions saved me.
Japan

Bashrc on: September 09, 2026
This exam was trickier than I thought.
Japan

Dotfile on: September 01, 2026
This site's practice questions helped me cram fast and save money.
Singapore

Bgp on: August 23, 2026
The exam was stressful but prep helped. Glad I used this site.
Spain

Tcpdump on: June 06, 2026
Exam was kinda harder than I thought but study material here made it doable.
Netherlands

Sandbox on: August 25, 2026
I was shaky at first but these practice questions really helped me get ready.
Australia

Parity on: August 30, 2026
This exam was tough and covered more than I thought. The AI assistant helped me through the harder bits.
Italy

Opcode on: August 29, 2026
That exam was a bit stressful. Luckily this site’s prep helped a lot.
Panama

Hexdump on: September 15, 2026
The exam covered way more than I thought. AI assistant helped me tackle it though.
France

Thread on: August 12, 2026
This exam was a bit of a curveball with more stuff covered than I thought. Luckily the AI assistant on this site helped me get through it without losing my mind.
Australia

Hashmap on: September 07, 2026
Working long hours I squeezed in quick study sessions got it done.
Switzerland

Kmem on: July 01, 2026
Was crazy at work but passed it.
UAE

Traceroute on: June 16, 2026
The exam had stuff I didn't think would pop up so it was harder than expected. AI assistant here saved my time explaining things well.
United States

Scsi on: August 12, 2026
This exam was tough but practice questions from this website definitely made it possible for me to pass.
Slovenia

Osama Jat on: September 22, 2026
Me Osama Jat. Please give me provide CCNA real question. hepl in the ccna real exam.
Biratnagar, Nepal

Payload on: September 01, 2026
The exam prep on this site legit helped me cram in time save some cash and pass the test slowly but surely.
Greece

Endianness on: July 23, 2026
I didn't feel confident at first but the practice questions on this site helped me understand the material a lot better.
Ireland

Dotfile on: August 23, 2026
The exam was harder than I thought but these practice questions from this site made it manageable.
Iceland

Baud on: August 08, 2026
Didn't feel ready but these practice questions helped.
Estonia

Sshd on: August 15, 2026
It took a bit longer but finally passed the exam I spent weeks reviewing these questions slowly.
Belgium

Packet on: September 08, 2026
Crammed like mad using this website's practice questions saved a ton of time and passed the exam bit by bit.
United Kingdom

Saanya on: September 01, 2026
Very helpful thank uoi
Abu Dhabi, United Arab Emirates

Ping on: June 10, 2026
Whew this exam was kinda stressful but the practice questions helped. Glad I found this site honestly.
United Kingdom

Bootload on: June 23, 2026
Wasn't confident at first but the practice questions really helped.
Luxembourg

Nullptr on: July 15, 2026
These questions was tough but useful.
Cyprus

PktLoss on: August 20, 2026
Studied short bits after work glad it's done.
Qatar

Vimrc on: July 16, 2026
This exam had way more tricky stuff than I expected. The AI assistant on this site kinda helped a bit.
Switzerland

Linter on: July 13, 2026
I didn't feel confident about the exam at first but going through this website's practice questions really helped me understand what to expect.
Netherlands

ZeroDay on: September 20, 2026
At first I wasn't sure about this exam but the practice questions here really helped me get a better grasp.
Lithuania

Bootload on: July 14, 2026
This exam was tough but the practice questions saved me.
Netherlands

Regex on: August 23, 2026
I wasn't feeling too confident at first but the practice questions on this website actually helped a lot.
Switzerland

Initd on: September 04, 2026
Saved me time and some money I passed.
United States

AI Explanation - verified by User8896 on: September 07, 2026
Question 99:
Question 99 tests communication between two VRFs using static routes and the global routing table.
Answer A is correct:

text ip route vrf Customer1 172.16.1.0 255.255.255.0 172.16.1.1 global ip route vrf Customer2 192.168.1.200 255.255.255.255 192.168.1.1 global ip route 192.168.1.0 255.255.255.0 Vlan10 ip route 172.16.1.0 255.255.255.0 Vlan20

Why:

The route in Customer1 VRF provides a path back to the Customer2 subnet, 172.16.1.0/24.

The route in Customer2 VRF provides a path to the FTP server, 192.168.1.200.

The keyword global tells the router to resolve the next hop using the global routing table, enabling controlled route leaking between the VRF and global table.

The global routes identify the VLAN interfaces used to reach each customer network.

The other options either omit the required global keyword, use an incorrect prefix length, or specify another VRF as the next-hop table rather than using the global table.
Blantyre, Malawi

AI Explanation - verified by User3621 on: September 18, 2026
Question 30:
Correct answer: B. SAML
The company already uses single sign-on (SSO). When adding a new cloud-based application, it should configure a federation protocol that allows the existing identity provider to authenticate users to the new service.

SAML (Security Assertion Markup Language): Commonly used for enterprise SSO between an identity provider and cloud applications. It sends signed authentication assertions to the service provider.

RADIUS: Primarily used for centralized authentication to network devices, VPNs, and wireless networks.

EAP: An authentication framework commonly used with network access technologies; it is not typically the SSO protocol for SaaS applications.

OpenID: Related to identity authentication, but traditional enterprise SSO questions involving cloud applications generally expect SAML. OpenID Connect is a newer authentication layer built on OAuth 2.0.

Therefore, the answer key’s B is correct.
Lahore, Pakistan

AI Explanation - verified by User3451 on: September 02, 2026
Question 9:
The answer key shows A, but its explanation is technically misleading.
Because the objects use SSE-S3, Amazon S3 manages the encryption keys. The Amazon Bedrock execution role does not need kms:Decrypt permission or access to a customer-managed KMS key.
The role should instead have the required Amazon S3 permissions, such as:

s3:GetObject for the relevant objects

s3:ListBucket if listing is required

Appropriate bucket and object resource permissions

Therefore, A is the closest option, but it should be interpreted as ensuring that the Bedrock role has permission to access the S3 data—not as granting KMS decryption permissions.
Why the others are wrong:

B: Making the bucket public is insecure and unnecessary.

C: Prompt engineering cannot override AWS IAM or encryption permissions.

D: Data sensitivity does not determine whether the role can access it.

If the data used SSE-KMS instead, then the role would additionally need kms:Decrypt permission on the KMS key.
Bengaluru, India

AI Explanation - verified by User3428 on: September 26, 2026
Question 67:
Correct answer: False (B).
ServiceNow configuration can affect what other users see on forms. For example, an administrator’s changes to:

Form layout

Related lists

Dictionary settings

UI policies

Client scripts

Views and field visibility

may apply to many or all users.
The important distinction is:

Personalization usually affects only the individual user.

System configuration can affect other users, depending on its scope and conditions.

Therefore, the statement “Configuration will not affect what others see” is incorrect.
Bengaluru, India

AI Explanation - verified by User6966 on: September 23, 2026
Question 18:
Correct answer: False (B).
A Reader Account lets a data consumer access shared data without having its own paid Snowflake account. However, the Data Provider is responsible for the Reader Account’s usage costs, including compute consumed by its virtual warehouses.
The fact that the consumer only reads shared data does not make compute free. Queries still require compute resources, and those resources are billed to the provider. The consumer cannot modify the shared data, but reading it can still generate compute usage.
Columbus, United States

AI Explanation - verified by francis4fnc on: September 13, 2026
Question 109:
Question 109 appears malformed, and its answer key is questionable.
Definitely forbidden while another operation holds the state lock:

terraform apply

terraform destroy

These commands can modify infrastructure and write state, so they cannot run concurrently.
terraform validate is not forbidden. It validates the configuration syntax and structure; it does not modify the state file or infrastructure. Therefore, the explanation claiming that validate is forbidden is incorrect.
terraform state list is read-only, but behavior can depend on the backend and locking implementation. It may need to acquire a lock to read a consistent state, so it can wait or fail while another operation owns the lock—but it is not a state-writing operation.
Also, the displayed choices are corrupted or duplicated (terraform validate, terraform for), so selecting three reliable answers is impossible from the text shown. The key’s inclusion of terraform validate should not be trusted.
Lagos, Nigeria

AI Explanation - verified by User6966 on: September 23, 2026
Question 9:
Correct answers: B and D — Warehouse size and number of clusters.
Snowflake virtual warehouse credits are primarily determined by:

Warehouse size: Larger warehouses use more credits per unit of time than smaller ones.

Number of clusters: A multi-cluster warehouse can run multiple clusters, and each active cluster consumes credits. Therefore, increasing the maximum or active cluster count can increase consumption.

The following do not directly determine compute-layer credit usage:

Number of users: More users may cause more workload, but users themselves do not consume credits.

Amount of data processed: Snowflake warehouses are not charged directly by the amount of data scanned. However, processing more data may cause the warehouse to run longer, indirectly increasing credits.

Also remember that actual usage depends on how long the warehouse runs, including any configured auto-suspend and auto-resume behavior.
Columbus, United States

AI Explanation - verified by User4761 on: September 09, 2026
Question 9:
The answer key appears to be incorrect. The correct answer should be A — True.
Outside the required_providers block, Terraform configuration refers to a provider using its local name, such as:

hcl provider "aws" { region = "us-east-1" } resource "aws_s3_bucket" "example" { bucket = "my-example-bucket" }

Here, aws is the provider’s local name.
The source address—for example, hashicorp/aws—is used in the required_providers block to identify where the provider comes from:

hcl terraform { required_providers { aws = { source = "hashicorp/aws" } } }

The source address is not normally used as a provider reference in resource blocks or provider configurations. Therefore, the question’s stated B — False conflicts with standard Terraform behavior.
Agege, Nigeria

AI Explanation - verified by User3698 on: September 22, 2026
Question 72:
Question 72: The answer key appears incorrect. The better answer is D) Mean Time to Contain (MTTC).
The executives want to know how long it takes to stop malware from spreading. That is specifically a containment objective: isolating affected systems, blocking traffic, disabling accounts, or otherwise limiting the incident’s scope.

MTTC: Time required to contain or limit the incident’s impact — best match.

MTTR: Time required to remediate or recover from the incident; this may include eradication, restoration, and cleanup, which goes beyond merely stopping spread.

MTTD: How long it takes to discover the incident.

MTBF: Average time between failures, generally a reliability metric.

Therefore, the answer key’s C is questionable; based on the wording, D is the more precise CompTIA-style answer.
Guará, Brazil

AI Explanation - verified by User6058 on: September 10, 2026
Question 141:
Correct answer: C — The high level of external failure costs is the result of a lack of expenditure on appraisal costs.
Quality costs include:

Prevention costs: Avoiding defects, such as staff training and improved product design. The company has invested in these.

Appraisal costs: Detecting defects before products reach customers, such as inspection and testing. The planned batch sampling has not been implemented.

Internal failure costs: Correcting defects found before delivery.

External failure costs: Dealing with defects after delivery, such as refunds, replacements, complaints and lost sales.

Because the company is not carrying out the planned inspections, faulty products reach customers. This creates high external failure costs, including refunds, replacements and reputational damage.
Therefore, C is the best answer. The issue is not primarily a lack of prevention spending; it is the failure to implement appraisal activities that would detect defects before dispatch.
Maseru, Lesotho

AI Explanation - verified by User5651 on: September 01, 2026
Question 23:
Correct answer: D. Version control
Version control tracks changes made to a document over time. It can identify:

The current and previous versions

Which clauses were changed

When each revision occurred

Potentially, who made the changes

This is important for contracts because it prevents confusion about which revision is authoritative and provides an audit trail.
Why the others are incorrect:

Version validation: Verifies a version’s accuracy or integrity but does not primarily track revisions.

Version changes: Not the standard name for a formal document-management process.

Version updates: Describes updating a document, not the complete process of managing and tracking its revisions.

The key clue is “track revisions,” which directly indicates version control.
Dundalk, United States

AI Explanation - verified by User7918 on: September 25, 2026
Question 10:
Answer: C — Split the Logged column using at as the delimiter.
The value:
2018-12-31 at 08:59
contains both a date and a time, so it is not directly suitable as a date column. Splitting on at produces two values:

2018-12-31 — the date

08:59 — the time

The date portion can then be assigned the Date data type. Once loaded into Power BI as a date, it can support the built-in date hierarchy, such as Year ? Quarter ? Month ? Day.
Why the other options are unsuitable:

Changing the original column to Date may fail because it still contains the text at and a time.

Extracting the last 11 characters does not isolate the date.

Extracting the first 11 characters gets the date plus a space, but the option does not specify changing the result to the Date type.

The answer key’s C is therefore the best choice, assuming the resulting date part is typed as Date.
Hendrik-Ido-Ambacht, The Netherlands

AI Explanation - verified by User4590 on: September 22, 2026
Question 12:
Correct answer: A
Create one Amazon CloudFront distribution with:

Amazon S3 as the origin for static content

Application Load Balancer (ALB) as the origin for dynamic content

Amazon Route 53 configured to point the company’s domain name to CloudFront

Configure CloudFront cache behaviors, typically using URL paths:

/static/* ? S3 origin; cache content at edge locations

Dynamic paths such as /api/* ? ALB origin; forward requests to the EC2 application

This improves global performance because users connect to a nearby CloudFront edge location. Static objects are cached there, while dynamic requests are efficiently forwarded to the ALB. CloudFront can also improve dynamic request latency through its globally distributed network and optimized connections.
The other options are incorrect because AWS Global Accelerator is not needed when CloudFront is being used, and S3 is not used as a standard Global Accelerator endpoint. Using separate domain names would also add unnecessary complexity.
Staten Island, United States

AI Explanation - verified by User1675 on: September 15, 2026
Question 37:
Question 37: Correct answer — B, with two spaces.
Terraform’s style convention is to indent each nested level by two spaces relative to the surrounding level. For example:

hcl resource "aws_instance" "example" { ami = "ami-123456" tags = { Name = "example" } }

Here, ami and tags are indented two spaces inside the resource block, while Name is indented an additional two spaces inside the tags map.
Terraform’s fmt command automatically applies this formatting:

bash terraform fmt

The other choices—tabs, three spaces, and four spaces—do not follow Terraform’s standard formatting convention.
Lagos, Nigeria

AI Explanation - verified by User5977 on: September 14, 2026
Question 1:
Correct answer: A
The Lambda function should:

Write a structured log entry to CloudWatch Logs containing:

- API operation name - HTTP response code - Application version extracted from the User-Agent header

Create a CloudWatch Logs metric filter that:

- Matches the log entries - Increments a metric for each operation - Uses response code and application version as metric dimensions
This produces metrics such as:

text ApiRequests Operation=GetOrders ResponseCode=500 Version=2.4.0

This allows the company to monitor each API operation separately for every response code and application version.

B is incorrect: CloudWatch Logs Insights queries analyze logs but do not directly publish metrics in this manner.

C is incorrect: ALB access logs do not contain arbitrary Lambda response metadata as custom fields.

D is incorrect: X-Ray traces and insights are not the appropriate mechanism for creating these custom, dimensioned application metrics.

New York, United States

AI Explanation - verified by User3112 on: September 18, 2026
Question 20:
Correct answer: Persistence
The key clue is the use of unauthorized scheduled tasks that execute scripts during off-peak hours. Scheduled tasks are a common method attackers use to maintain access and ensure malicious code runs repeatedly, even after a reboot or when the attacker is not actively connected.
Why the other options are less suitable:

Initial Intrusion: The compromised VPN account and stolen phishing credentials describe how the attacker first gained access, but that happened months earlier.

Persistence: The scheduled tasks and recurring C2 connections show how the attacker maintained and automated continued access.

Search and Exfiltration: This would involve locating and transferring data. The scenario does not primarily describe data discovery or theft.

Cleanup: Cleanup involves removing evidence or covering tracks. Obfuscated scripts may make detection harder, but the main behavior here is maintaining access.

For exam questions, focus on the most prominent activity being described, not necessarily the earliest event in the timeline.
Monastir, Tunisia

AI Explanation - verified by User5768 on: September 21, 2026
Why asynchronous not appropriate ?
Asynchronous inference is not necessarily impossible, but it is less appropriate for this scenario.

Asynchronous inference is designed for applications that submit individual inference requests, place them in a queue, and retrieve results later. It is useful when requests may take a long time or when traffic is intermittent.

Batch transform is designed specifically to run inference over an entire large dataset stored in Amazon S3 and produce an output dataset.

The key distinction is:

Large dataset/offline processing ? Batch transform

Large or slow individual requests processed later ? Asynchronous inference

Because the question emphasizes archived data, multiple-GB datasets, and no need for immediate predictions, the exam’s intended answer is Batch transform.
Bangkok, Thailand

AI Explanation - verified by User6304 on: September 22, 2026
i think prompt shields cover the requirements : Hidden instructions in documents, PDFs, webpages, or images ? Prompt Shields
You’re right: Prompt Shields is the control that addresses hidden malicious instructions in documents, PDFs, webpages, or images. It detects prompt-injection or indirect-injection attempts in external content before the agent follows them.
However, Question 2 contains two separate requirements:

Customer information must not be revealed ? PII Detection

Malicious instructions embedded in images/documents must be blocked ? Prompt Shields

So:

If the question allows multiple selections, choose PII Detection and Prompt Shields.

If it requires one selection specifically for the image-based threat, choose Prompt Shields.

The supplied answer key selecting only PII Detection is incomplete for the full scenario.
Hyderabad, India

AI Explanation - verified by User7944 on: September 14, 2026
Question 19:
Correct answer: B — Define Entitlement and Milestones.
The requirement has two parts:

Each Case must follow defined support steps.

Each step must be completed within a specified time limit.

In Salesforce Service Cloud, an Entitlement Process defines the required service timeline for a Case. Within it, Milestones represent important steps—such as initial response, customer update, or resolution—with target times, business hours, and actions when deadlines are approaching or missed.
Why the others are less suitable:

Case Escalation Rules: Escalate Cases based mainly on age or criteria; they do not model a complete sequence of service steps.

Process Builder with Scheduled Actions: Can automate time-based actions but is not the standard framework for Case service-level commitments.

Omni-Channel Routing: Routes work to agents based on capacity and priority; it does not track Case lifecycle deadlines.

San Francisco, United States

AI Explanation - verified by User4344 on: September 25, 2026
Question 47:
A resposta correta é D — Benchmark datasets.
Por quê? Datasets de benchmark são conjuntos de dados padronizados, geralmente preparados para avaliar aspectos específicos como viés, justiça e discriminação. Eles permitem comparar as respostas do LLM com expectativas e métricas predefinidas, exigindo menos preparação manual.
As outras opções demandam mais esforço administrativo:

User-generated content: precisa ser coletado, filtrado, anonimizado e rotulado.

Moderation logs: podem conter dados inconsistentes, informações pessoais e decisões que precisam ser revisadas.

Content moderation guidelines: são regras ou orientações, não dados diretamente utilizáveis para medir o comportamento do modelo.

Em uma questão que destaca “least administrative effort”, procure uma fonte já estruturada e própria para avaliação: benchmark datasets.
Jacareí, Brazil

AI Explanation - verified by User3350 on: September 20, 2026
Question 18:
Correct answer: C — try to expand its customer base to avoid becoming dependent on the corporation.
The passage warns that a minority-owned business may become dependent on one large corporate customer. If that customer reduces its orders or ends the relationship, the small business could suffer serious financial problems. The business might also become complacent and stop seeking other opportunities.
Therefore, it should develop relationships with additional customers, even though it may have to compete with larger, established companies.
Why the other choices are wrong:

A: Not expanding would increase its dependence.

B: More business from the same corporation would make dependence worse.

D: Passing work to other minority businesses does not solve its own dependence.

E: The passage does not suggest that it can force or influence the corporation to give work to others.

Lagos, Nigeria

AI Explanation - verified by User6465 on: September 16, 2026
Question 18:
For Question 18, I believe the answer key is incorrect.
Correct answers: A, B, and D

Record changes — a flow can start when a record is updated or otherwise changes.

Schedules — a flow can run at a specified date/time or on a schedule.

Record inserts — a flow can start when a new record is created.

Why the others are incorrect:

Subflows are reusable flow components called by another flow; they are not normally trigger types.

Record views do not generally initiate a Flow Designer flow.

So the stated answer A, B, C should likely be A, B, D.
Sapiranga, Brazil

AI Explanation - verified by User2418 on: September 24, 2026
Question 11:
Question 11: Correct answer — A. False positive
A false positive occurs when a security tool reports a vulnerability, but the vulnerability is not actually present.
In this case, the vulnerability scan identifies a vulnerability on a system, but the administrator verifies that the system is not affected. Therefore, the scan produced a false alarm.

True positive: The scan reports a vulnerability that really exists.

False positive: The scan reports a vulnerability that does not exist.

True negative: The scan correctly reports no vulnerability.

False negative: The scan fails to detect a vulnerability that is actually present.

The answer key’s A is correct.
Beau Bassin-Rose Hill, Mauritius

AI Explanation - verified by User9267 on: September 24, 2026
Question 55:
Correct answer: B — Ramen
Why:

Ramen is a Linux worm associated with Red Hat Linux 6.2 and 7.0 systems.

It spreads by scanning randomly generated IP addresses using tools such as synscan.

It exploits vulnerable network services, including web-related services, and may leave malicious files or altered web content.

The tar.gz file is also a clue because it is a common Linux archive/package format.

Why the others are incorrect:

Code Red: Primarily targeted Microsoft IIS servers running Windows.

LoveLetter: Spread mainly through email attachments.

Nimda: A Windows-based worm that spread through email, web servers, and network shares.

Therefore, the answer key’s B is correct.
Kuala Lumpur, Malaysia

AI Explanation - verified by User6296 on: September 22, 2026
Question 5:
Your understanding is partly correct, but a sensitivity label does not automatically exclude a file from Copilot.

Labels control access and protection, not blanket exclusion.

If the user has permission to open a labeled file—especially if the label allows authenticated users to view it—Copilot can use that file in a summary.

If the label applies encryption and the user lacks the required usage rights, Copilot should not use the file or reveal its contents.

Copilot honors the user’s existing permissions, so it should not expose labeled content to an unauthorized user.

Therefore, in Question 5, a labeled file may contribute to a summary when the requester is authorized. The resulting content can also receive sensitivity-label protection, depending on the configured label and Copilot’s labeling behavior.
The supplied explanation may be oversimplified: content marking (headers, footers, watermarks) is not the same as access protection. A label with content marking disabled can still restrict access through encryption. Conversely, merely having a label does not mean the file is excluded from Copilot.
The actual Hotspot image is unavailable here, so I cannot verify each Yes/No row, but the key principle is: labeled does not mean excluded; unauthorized does mean inaccessible.
Nagpur, India

AI Explanation - verified by User3241 on: September 25, 2026
Question 101:
Correct answer: D. Due diligence
The analyst is evaluating a SaaS vendor before the organization adopts its service. Requesting a SOC 2 report helps determine whether the vendor has appropriate controls for security, availability, confidentiality, privacy, and processing integrity.

Due diligence: Investigating and evaluating a third party before entering a business relationship.

Attestation: An independent auditor’s examination and formal report—such as the SOC 2 report itself. The analyst is reviewing the attestation, not performing it.

Internal audit: Examines the organization’s own processes and controls.

Penetration testing: Actively tests systems for exploitable vulnerabilities.

The answer key’s D is correct.
Atlanta, United States

AI Explanation - verified by User1362 on: September 06, 2026
S? d?ng ti?ng vi?t
Ðáp án dúng: D
Gi?i pháp:

T?o m?t Systems Manager Automation runbook d? ch?y l?nh kh?i d?ng l?i ?ng d?ng trên các EC2 instance.

T?o m?t Amazon EventBridge rule ph?n ?ng khi CloudWatch alarm chuy?n sang tr?ng thái ALARM.

Ð?t Automation runbook làm target c?a EventBridge rule.

Lu?ng ho?t d?ng:

Log c?a ?ng d?ng du?c ghi vào CloudWatch Logs.

CloudWatch alarm phát hi?n nhi?u l?i liên quan d?n vi?c restart.

Alarm chuy?n sang tr?ng thái ALARM.

EventBridge nh?n s? ki?n thay d?i tr?ng thái này.

EventBridge g?i Systems Manager Automation runbook.

Runbook restart ?ng d?ng trên các EC2 instance, không restart c? instance.

Vì sao các dáp án khác không phù h?p?

A: SNS không tr?c ti?p g?i Systems Manager Automation runbook nhu m?t target native.

B: Lambda có th? th?c hi?n vi?c restart, nhung ph?i t? x? lý vi?c xác d?nh instance và ch?y l?nh t? xa.

C: Lambda ch? làm trung gian d? g?i runbook, không c?n thi?t vì EventBridge có th? g?i runbook tr?c ti?p.

Ði?m c?n nh?: V?i remediation t? d?ng d?a trên CloudWatch alarm, k?t h?p EventBridge + Systems Manager Automation giúp gi?m code tùy ch?nh và hi?u qu? v?n hành cao nh?t.
Ho Chi Minh City, Vietnam

AI Explanation - verified by User8057 on: September 16, 2026
Question 184:
The answer key appears incorrect. “Escape to host” is not a suitable answer.

Escape to host: A virtualization attack where code escapes a guest VM and accesses the host system. Nothing in the scenario mentions virtualization.

Browser extension: Can redirect or manipulate web-browser traffic, but not normally database-server traffic.

Valid accounts: Describes using stolen or compromised credentials, not redirecting network traffic.

Process injection: Injecting malicious code into a legitimate database or networking process could allow an attacker to alter how that process handles outgoing traffic.

If forced to choose from these options, B. Process injection is the closest answer, although the question is poorly written. A more technically precise MITRE ATT&CK technique would likely involve traffic redirection/interception or proxying, depending on how the attacker achieved it—not “escape to host.”
Chicago, United States

AI Explanation - verified by User7470 on: September 25, 2026
So the question was more about which is a valid perspective, since that question can describe other perspectives as well
Yes, exactly. The question is testing recognition of a valid AWS CAF perspective, not asking which perspective best matches a detailed scenario.
Governance is one of the six AWS CAF perspectives. The other options are AWS Well-Architected Framework pillars:

Sustainability

Performance efficiency

Reliability

Although “platform” and “operations” are also valid AWS CAF perspectives, they are not answer choices in this question. Their descriptions could certainly be valid in other contexts, but Governance is the only option listed that belongs to the AWS CAF perspectives.
Mount Vernon, United States

AI Explanation - verified by User9895 on: September 11, 2026
Question 12:
Correct answer: B. Port security
A MAC flooding attack sends many fake source MAC addresses to a switch. This can overwhelm the switch’s MAC address table, causing it to broadcast traffic out multiple ports and potentially allowing an attacker to capture traffic.
Port security mitigates this by:

Limiting the number of MAC addresses allowed on a switch port

Restricting ports to specific known MAC addresses

Taking an action—such as dropping frames or shutting down the port—when the limit is exceeded

Why the others are less suitable:

Load balancer: Distributes application traffic; it does not protect switch MAC tables.

IPS: May detect some attack traffic, but is not the primary control for switch-port MAC limits.

NGFW: Filters network traffic at the firewall, but does not directly control MAC addresses learned by a switch.

Cambridge, United Kingdom

AI Explanation - verified by Tholang2016 on: September 01, 2026
Question 164:
Correct answer: B — It reinforces the verbal message.
Complementary non-verbal communication supports and strengthens what is being said verbally. For example, saying “well done” while smiling and nodding makes the positive message more convincing.
Why the alternatives are incorrect:

Replaces the verbal message — this describes non-verbal communication being used instead of words.

Substitutes for verbal communication — similar; it means communicating without speech.

Confuses the verbal message — this occurs when non-verbal signals contradict or obscure the spoken message.

So, when non-verbal communication is complementary, it reinforces the verbal message.
Maseru, Lesotho

AI Explanation - verified by User8034 on: September 02, 2026
Question 19:
Correct answer: B — Containerization
Containers package applications and their dependencies while sharing the host operating system’s kernel. This reduces the number of separate operating systems that must be deployed, patched, and secured.
Why the others are less suitable:

Microservices: An application-design approach that divides an application into smaller services. It does not inherently reduce the number of operating systems.

Virtualization: Creates virtual machines, but each VM generally requires its own complete operating system. This improves isolation but does not minimize OS instances as effectively.

Infrastructure as code: Uses code to automate infrastructure deployment and configuration. It improves consistency but does not determine how many operating systems are used.

The key clue is “reduce the number of individual operating systems”—that points to multiple containers sharing one host OS.
Atlanta, United States

AI Explanation - verified by User8545 on: September 26, 2026
Question 11:
Correct answer: A — Captive portal
A captive portal is a web page that users must view or interact with before receiving network access. It is commonly used for temporary or guest access in places such as hotels, airports, and company guest networks.
The user may need to:

Accept terms of use

Enter a temporary code or credentials

Provide basic registration information

Why the others are incorrect:

Enterprise authentication — Authenticates organizational users, often with centralized identity services; it is not specifically designed for temporary guest access.

Ad hoc network — A temporary device-to-device network, not an authentication process.

WPA3 — A wireless security standard. It protects Wi-Fi access but does not provide the web-based temporary access workflow described here.

Quezon City, Philippines

AI Explanation - verified by User7981 on: September 14, 2026
Question 87:
Correct answer: Footprinting the internal network
The image isn’t visible here, so I can’t interpret every detail of the DNS snippet. However, the keyed answer fits if the log shows DNS requests for internal hostnames, subdomains, or naming patterns.
Footprinting is the reconnaissance phase in which an attacker gathers information about a target environment, such as:

Internal hostnames and subdomains

Network structure and naming conventions

Servers and services

Relationships between systems

Why the other options are less likely:

Determining ISP-assigned address space: Usually involves external registration and DNS information, not internal host discovery.

Bypassing DNS sinkholing: Would require evidence that malicious DNS requests avoided redirection.

Initial access: DNS queries alone do not show that the attacker gained access.

Exfiltrating data: DNS tunneling can do this, but the snippet would typically show encoded or unusually long DNS queries.

Thus, the suspicious DNS activity most likely represents internal network reconnaissance/footprinting.
Orlando, United States

AI Explanation - verified by User8693 on: September 04, 2026
Question 89:
The answer key’s NIDS and WAF is more defensible here. WAF is definitely one of the answers because it specifically protects web applications by detecting/blocking attacks such as SQL injection, cross-site scripting, and malicious HTTP/HTTPS requests.
The second choice is NIDS:

NIDS: Monitors network traffic for suspicious activity and network-based attacks targeting the application or its supporting services.

HIPS: Protects an individual host by monitoring processes, files, and system activity. It can help secure the web server, but it is not focused specifically on the application’s network attack surface.

SIEM: Aggregates and correlates logs; it does not directly prevent attacks.

Honeypot: A decoy system, not the primary protection for a production web application.

Certificate revocation list: Deals with certificate trust, not application exploitation.

So, for a web application exposed over HTTPS, choose WAF + NIDS. Your WAF choice is correct; HIPS is reasonable in a broader defense-in-depth design but is less directly aligned with the question’s stated risk.
Lagos, Nigeria

AI Explanation - verified by examspl on: September 20, 2026
Question 110:
Question 110: The best answer is C.
> Enable the collection and storage of Einstein Generative AI Audit Data on the Einstein Feedback setup page.
To validate Data Masking in the Einstein Trust Layer, the specialist first needs to ensure that the relevant Einstein Generative AI Audit Data is being collected and stored. This audit information can then be reviewed to confirm which values were masked before being sent to the model.

A is incorrect: Flow Debugger is for debugging Salesforce Flows, not Trust Layer masking.

B is incomplete/misleading: Requesting audit data may be part of reviewing the results, but collection and storage must first be enabled.

C is correct: It describes the initial validation step.

Note: The provided explanation is internally inconsistent: it says the answer is C but describes option B. The answer choice itself—C—is the stronger answer for “begin validating.”
Nepean, Canada

AI Explanation - verified by User9738 on: September 22, 2026
Question 84:
A resposta correta é C: configurar o SageMaker para usar uma VPC com um endpoint do Amazon S3.
O endpoint permite que os notebooks do Amazon SageMaker Studio acessem os dados armazenados no Amazon S3 por uma conexão privada dentro da AWS. Assim, o tráfego pode permanecer na rede da AWS, sem precisar passar pela internet pública.
Isso ajuda a:

Controlar o fluxo de dados entre S3 e SageMaker;

Aplicar regras de segurança por meio da VPC;

Reduzir a exposição dos dados;

Permitir acesso privado ao bucket do S3.

As outras opções não atendem ao requisito:

Amazon Inspector: avalia vulnerabilidades, mas não gerencia o fluxo de dados.

Amazon Macie: ajuda a descobrir e proteger dados sensíveis no S3, mas não cria a conexão com o SageMaker.

S3 Glacier Deep Archive: é uma classe de armazenamento para arquivamento, não uma solução de conectividade.

São Paulo, Brazil

AI Explanation - verified by User4028 on: September 02, 2026
Question 3:
Question 3 tests transaction-safe error handling in a stored procedure.
The robust pattern is:

sql CREATE PROCEDURE dbo.usp_CreateOrder AS BEGIN SET NOCOUNT ON; SET XACT_ABORT ON; BEGIN TRY BEGIN TRANSACTION; INSERT INTO dbo.Orders (/ columns /) VALUES (/ values /); SET @OrderID = SCOPE_IDENTITY(); COMMIT TRANSACTION; END TRY BEGIN CATCH IF @@TRANCOUNT > 0 ROLLBACK TRANSACTION; THROW; END CATCH; END;

BEGIN TRY contains the transactional work.

SCOPE_IDENTITY() retrieves the identity generated by the INSERT; it belongs after the insert, not as the error-handling logic.

COMMIT runs only if all statements succeed.

BEGIN CATCH handles failures.

IF @@TRANCOUNT > 0 prevents attempting a rollback when no transaction is active.

ROLLBACK undoes partial changes.

THROW re-raises the original error with consistent details for the application.

SET XACT_ABORT ON ensures many run-time errors automatically terminate and roll back the transaction.

The answer key’s box labels appear garbled, but the essentia
Gurugram, India

AI Explanation - verified by sakthibala16 on: September 23, 2026
Question 15:
Answer: C — anchors the responses in specific data sources.
Grounding connects a generative AI model to reliable, relevant information, such as:

Company documents

Databases

Knowledge bases

Current web or business data

This gives the model factual context to use when producing an answer. As a result, responses are usually more accurate, relevant, and up to date, while the risk of hallucinations is reduced.
Why the other options are incorrect:

A: Describes diversity and inclusive design, not grounding.

B: Describes explainability or model interpretability.

D: Describes documenting a model’s capabilities and limitations.

For the exam, remember: grounding = connecting AI responses to specific, trusted data sources.
Bengaluru, India

AI Explanation - verified by User5627 on: September 24, 2026
Question 46:
Correct answer: No.
The proposed configuration does not meet the requirements because it uses * in every dimension column for all three account ranges.
In an account structure, * means that a dimension value is required/accepted for that segment. Therefore:

Liability accounts (2000–2999) would incorrectly require dimensions, although they should have none.

Expense accounts (6000–6998) would incorrectly require Customer, which should be optional.

Account 6999 needs a separate rule because it requires all four dimensions, including Customer.

You would need separate account-structure rows, for example:

2000–2999: no dimensions

4000–4999: Department and Division required; Project and Customer optional

6000–6998: Department, Division, and Project required; Customer optional

6999: Department, Division, Project, and Customer required

So the answer key’s B (No) is correct.
Toronto, Canada

AI Explanation - verified by janapatimanikanta16 on: September 03, 2026
Question 6:
Question 6: Answer A — By suggesting assertions based on the code’s context and semantics.
GitHub Copilot Chat can examine a function and suggest assertions or test conditions that check expected behavior. For example, it might recommend verifying that:

A valid input returns the expected result

An invalid input raises an error

Boundary values are handled correctly

An assertion is a condition that must be true, such as assert result == expected_value.
The other options are less suitable:

B: Copilot may help generate tests, but it does not automatically write all necessary tests.

C: Writing the implementation does not verify that it works correctly.

D: Copilot can suggest test commands or test code, but the developer or development environment must execute and validate the tests.

The key point is that Copilot assists with verification; it does not guarantee correctness.
Mumbai, India

AI Explanation - verified by User8779 on: September 01, 2026
Question 6:
Correct answer: D — Coldline Storage
For disaster recovery backups, data is usually stored for long periods and retrieved only during an incident. Coldline Storage is designed for data accessed less than once per quarter, including:

Disaster recovery backups

Long-term backup retention

Data archiving that still needs occasional access

Why the others are less suitable:

Multi-Regional Storage: Intended for frequently accessed data needing broad geographic availability; it costs more.

Regional Storage: Suitable for frequently accessed data within one region.

Nearline Storage: Intended for data accessed roughly once per month, such as monthly backups.

Coldline Storage: Better fit for backups accessed only during a disaster or occasional recovery event.

The key exam clue is backup data for disaster recovery: infrequent access with a need for relatively quick retrieval, which points to Coldline, rather than Archive Storage.
San Jose, United States

AI Explanation - verified by User5120 on: September 21, 2026
Question 11:
Correct answer: B — Databricks web application
In the classic Databricks architecture, the control plane hosts the Databricks management services, including the web application. Users access the workspace UI from the control plane.
The other components are associated with the data plane:

Driver node: Coordinates Spark jobs and runs in the compute environment.

Worker node: Executes tasks and processes data.

Databricks Filesystem (DBFS): Provides storage access for data used by compute resources.

Exam tip: The control plane manages and orchestrates the workspace, while the data plane performs computation and processes data.
Charlotte, United States

AI Explanation - verified by User2881 on: September 17, 2026
Question 17:
Correct answer: C — Create three sales processes, three record types, and three page layouts.
Each team needs different Opportunity stages and fields, so configure a separate set for each business process:

Sales process: Controls which Opportunity Stage values are available.

Record type: Associates the appropriate sales process with a business scenario and controls available picklist values.

Page layout: Controls which fields are displayed and whether they are required or read-only.

For example:

Energy Market Team 1 ? Record Type 1, Sales Process 1, Page Layout 1

Energy Market Team 2 ? Record Type 2, Sales Process 2, Page Layout 2

Services/Installation Team ? Record Type 3, Sales Process 3, Page Layout 3

A single sales process would not support different stage paths, and one page layout would not provide the teams with different field arrangements.
Porto, Portugal

AI Explanation - verified by User4114 on: September 12, 2026
A highly regulated financial institution wants to use Gemini as the core decision engine for a loan approval system that will deterministically approve or reject loan applications based on a strict set of predefined criteri Why is this an inappropriate use case for Gemini? Gemini cannot integrate with required financial databases. Gemini is not equipped to handle structured numerical data for financial assessments. Gemini is designed for flexible content generation and inference, not rigid rule-based decisions. Gemini deployment for this scenario would be too expensive and complex.
Correct answer: Gemini is designed for flexible content generation and inference, not rigid rule-based decisions.
Gemini can analyze financial information, summarize applications, or assist loan officers. However, it is probabilistic and may produce variable outputs, so it should not be the authoritative engine for decisions requiring:

Deterministic approve/reject results

Strict adherence to predefined rules

Consistent, reproducible outcomes

Auditability and regulatory compliance

A traditional rules engine or explicitly programmed decision system is more appropriate for the final loan decision. Gemini could assist around that system—for example, extracting information from documents—but should not replace the deterministic approval logic.
Central, Hong Kong

AI Explanation - verified by nhoxzznhox15 on: September 12, 2026
Question 135:
Correct answer: A

Create a CodeCommit repository in the secondary Region.

Use CodeBuild to run a Git mirror operation from the primary repository to the secondary repository.

Use EventBridge to detect relevant repository events, such as a pull request being merged.

Invoke a Lambda function, which starts the CodeBuild project.

This provides an automated, near-real-time copy of the repository in the disaster-recovery Region. Developers can then add the secondary repository as another Git remote if they need to operate there.
Why the other options are incorrect:

B: Amazon S3 is object storage, not a Git repository that developers can use as a CodeCommit remote.

C: CodeArtifact is intended for packages and artifacts, not source-code repository mirroring.

D: An AWS Cloud9 environment is not an appropriate automated replication mechanism and would require manual or persistent infrastructure management.

The key concept is that CodeCommit repositories are Region-specific, so disaster recovery requires a second repository and an automated synchronization process.
Duong Minh Châu, Vietnam

AI Explanation - verified by Tholang2016 on: September 01, 2026
Question 127:
The correct answer is B — to sometimes use a traffic-light system to help prioritise activities.
A Balanced Scorecard translates strategy into objectives and measures across areas such as:

Financial performance

Customer perspective

Internal business processes

Learning and growth

A traffic-light system—for example, green, amber and red—helps management quickly identify which performance areas are on target, at risk, or require urgent action. This makes the scorecard useful for prioritising management attention.
Why the other options are incorrect:

Increasing the number of indicators can make the scorecard cluttered and less useful. Measures should be limited to those that are strategically important.

The scorecard is mainly a tool for implementing and monitoring strategy, not for formulating strategy.

It should contain both leading indicators and lagging indicators. Leading indicators predict future performance, while lagging indicators measure results already achieved.

Maseru, Lesotho

AI Explanation - verified by User1465 on: September 20, 2026
Question 5:
The answer key shows C (Falcon Investigator), but I believe that is incorrect.
The best answer is A — Real Time Responder.
Connect to Host uses Falcon’s Real Time Response (RTR) capability, which allows an authorized user to interact with an endpoint and collect information that is not available directly in the Falcon console. The user must therefore have the appropriate Real Time Responder role or permissions.
Why the others are less suitable:

Endpoint Manager: manages hosts and sensor-related settings.

Falcon Investigator: supports investigation and analysis, but does not necessarily grant RTR access.

Remediation Manager: handles remediation-related actions rather than interactive host access.

Role names and permissions can vary by Falcon console version, so verify the exact RBAC mapping in your tenant.
Singapore, Singapore

AI Explanation - verified by User7408 on: September 25, 2026
Question 7:
Correct answer: B. Automated response actions
A next-generation SIEM does more than collect and correlate logs. It can use analytics, threat intelligence, and automation—often through SOAR capabilities—to respond to detected threats automatically.
Examples include:

Disabling a compromised account

Blocking a malicious IP address

Isolating an endpoint

Creating or escalating an incident ticket

Why the other options are less appropriate:

Virus signatures: Primarily associated with antivirus or endpoint protection.

Security agent deployment: Usually handled by endpoint-management or security-agent platforms.

Vulnerability scanning: Typically performed by vulnerability-management tools.

Therefore, automated response actions are the distinguishing next-generation SIEM feature.
Atlanta, United States

AI Explanation - verified by User6155 on: September 21, 2026
Question 29:
Correct answer: D — Plan Human Resource Management
Organizational theory explains how people, teams, and organizational units behave and interact. It helps the project manager design an effective project organization by considering:

Reporting relationships

Organizational structures

Leadership styles

Team maturity

Individual and group behavior

Communication and motivation

In Plan Human Resource Management, the project manager identifies and documents project roles, responsibilities, required skills, reporting relationships, and the staffing management plan. Organizational theory supports this planning work.
Why the other options are less appropriate:

Acquire Project Team: Focuses on obtaining the people needed for the project.

Develop Project Team: Focuses on improving team skills, relationships, and performance.

Manage Project Team: Focuses on tracking performance, resolving issues, and managing changes within the team.

Organizational theory may influence those processes, but in the PMI process framework it is specifically listed as a tool and technique for Plan Human Resource Management.
Johannesburg, South Africa

AI Tutor 👋 I’m here to help!

Cisco 350-901 Exam Prep Developing Applications using Cisco Core Platforms and APIs (DEVCOR) (Page 41 )

QUESTION: 65

Explanation:

QUESTION: 66

QUESTION: 67

QUESTION: 68

QUESTION: 69

Cisco 350-901 Exam Prep
Developing Applications using Cisco Core Platforms and APIs (DEVCOR) (Page 41 )