CompTIA DA0-001 Exam Actual Questions
Data+ (Page 19 )

• Network Security Groups (NSGs) control network traffic to and from Azure resources.
• By applying NSGs to the web tier and the database tier (subnets or NICs), you can:

• NSGs provide the necessary granularity (source/destination, port, protocol) to enforce the desired traffic patterns between tiers.
• For easier management you can use separate subnets for each tier or, optionally, use Application Security Groups to simplify rule management.

• A Storage Gateway File Gateway provides an on-premises NFS/SMB file share that's backed by objects in S3. This is exactly what you need to migrate an NFS workload: applications continue using NFS, while the actual data moves to and is stored in S3.
• It can cache frequently accessed data locally for performance, while uploads go to an S3 bucket.
• Why the other options aren’t suitable:

• The correct answer is D: All of the above.

• Snowflake Web Interface (UI): You can create and manage Virtual Warehouses from the UI (resize, suspend/resume settings, etc.).
• SQL commands: You can create and alter warehouses with DDL like CREATE WAREHOUSE and ALTER WAREHOUSE.
• Data integration tools: ETL/ELT tools can create/manage warehouses by connecting to Snowflake and issuing the appropriate commands or using their config to specify a warehouse.

• IaaS provides virtualized infrastructure, including VMs, disks, and networking. You manage the guest operating system and software installed on the VM.
• PaaS provides a managed platform for deploying applications without managing the underlying VMs or operating systems. Examples include Azure App Service and Azure Functions.

• The proposed solution: use Microsoft Managed Desktop.
• Why this does not meet the goal:

• A better fit would be Azure DevTest Labs (or similar lab services), which is designed to:

• The correct answer: B) Synthetic identity theft.

• Synthetic identity theft involves creating a new, forged identity by combining information from multiple real people (e.g., names, dates of birth, SSNs) to commit fraud.
• In the scenario, Adam “created a new identity by obtaining information from different victims,” which matches the idea of synthesizing data to form a fake person.

• Medical identity theft: using someone’s medical information to obtain care or services.
• Tax identity theft: using someone’s personal info to file fraudulent tax returns.
• Social identity theft: impersonating someone to deceive others socially or publicly.

• Look for phrases like “create a new identity” or “combine information from multiple people” to identify synthetic identity theft.

• En Cisco SD-Access, el fabric overlay se extiende hasta lo inalámbrico; los APs son nodos de borde del fabric y su tráfico queda dentro del overlay.
• El cliente inalámbrico genera tráfico que viaja por el overlay, pero no es un componente del fabric en sí.
• El WLC es principalmente una herramienta de gestión y control, no forma parte del overlay; el underlay es el transporte físico.

• User1 can sign in because the account is cloud-only. It does not depend on the on-premises domain.
• User3 can sign in because the account uses Password Hash Synchronization (PHS). Azure AD has a synchronized password hash and can validate the sign-in even when connectivity to on-premises Active Directory is unavailable.
• User2 cannot sign in because the account relies on Pass-through Authentication (PTA). PTA sends the authentication request to an on-premises PTA agent, which must contact a domain controller. With the internet connection from on-premises lost, that validation cannot occur.

• Correct answer: D (Special category data)

• Why:

• Quick notes:

• The Act requires:

• It does not, as a public obligation, mandate publishing a detailed report on the training data used.
• Also, the Act does not specify a fixed “six months” retention for system logs in a way that would clearly make A required; logs for traceability are implied, but the six-month period is not a defined, universal requirement.

• Server — provides services or resources
• Endpoint — a user device connected to the network
• Ethernet — a networking technology, not a filtering device
• Firewall — filters and controls traffic

• Answer: A

• Reason: The Standard web tier is the lowest tier that provides dedicated compute, built-in load balancing across instances, and sufficient storage to host multiple apps with custom domains. Basic may lack the required scalability/storage, while Free/Shared do not offer dedicated compute or proper load balancing.

• A — SCIM synchronizes changes to user attributes from the identity provider to GitHub.
• B — SCIM deactivates GitHub accounts when users are removed or deactivated in the identity provider.
• D — SCIM automates user provisioning when new users are added to the identity provider.

• C: SCIM does not delete organization repositories.
• E: SCIM does not generate REST API authentication tokens.
• F: SCIM handles identity lifecycle management, not repository permission configuration based on roles.

1. Create a new AMI or copy the existing AMI while specifying EBS encryption and an appropriate AWS KMS key.
2. This creates an encrypted AMI backed by encrypted EBS snapshots.
3. Copy the encrypted AMI to the destination Region, using a KMS key available there.
4. Launch the application stack from the encrypted AMI.

• B: AWS KMS does not encrypt an existing unencrypted AMI in place. You must create an encrypted copy.
• C: AWS Certificate Manager manages TLS certificates, not EBS or AMI encryption.
• D: Enabling encryption by default affects newly created EBS volumes and snapshots; it does not encrypt an existing unencrypted AMI during copying.

• On-Demand: You pay by the hour with no long-term commitment. This is ideal for workloads that are infrequent or have highly variable usage. Since this job runs only 24 hours once per year, you pay only for those 24 hours, with no wasted upfront or long-term payments.
• Reserved Instances: Require a 1- or 3-year commitment and pay for capacity whether you use it or not. For a workload that runs just 24 hours a year, you’d be paying for most of the term unused, making it far less cost-efficient.
• Spot Instances: Can be interrupted whenever AWS needs capacity, which is unacceptable for an uninterruptible workload.
• Dedicated Instances: Generally more expensive and aimed at licensing or compliance requirements; not needed for this use case.

• Copilot??????????
• ???????????????
• ??????????
• ?????????????
• ???????????????????

• Prompts and Suggestions: Retained for 28 days
• User Engagement Data: Kept for Two Years

• Assignment
• Decision
• Get Records
• Loop

• Screen flow: Would include a Screen element.
• Inactive version: Inactive status does not restrict the available elements.
• Activated version: Activation status also does not determine the toolbox contents.

• Le rôle n’a pas de clés propres. Des identifiants temporaires (via STS) sont émis lorsque quelqu’un ou quelque chose « assume » le rôle.
• La trust policy déclare qui peut assumer le rôle (par ex. une instance EC2, un utilisateur IAM, ou un service comme Lambda).
• Une fois attaché à une ressource (par exemple comme un instance profile sur une EC2), l’application peut appeler les services AWS avec les permissions du rôle.

• Respect du principe du moindre privilège: on accorde uniquement ce qui est nécessaire.
• Pas de stockages de clés sur les instances; les credentials se renouvellent automatiquement.

• Rôles pour EC2, rôles pour Lambda, accès cross-compte, etc.

• Answer: The correct first step is to define a new SOC role for Company A in Google SecOps.

• Why this is right:

• Why the other options are less suitable as the first step:

• Practical note:

• Answer: No.

• Why it doesn’t meet the goal:

• How to implement correctly (brief guidance):

• Alice is co-resident on the same physical host and exploits shared hardware (the processor cache) to infer secrets. This is the classic definition of a side-channel attack—information leakage through implementation details (like timing or cache behavior) rather than by breaking a protocol or injecting code.

• Observing cache timing or access patterns to deduce cryptographic keys or plaintext data from the victim VM.

• Man-in-the-cloud attack: targets cloud trust/auth, not local hardware sharing.
• SQL injection: exploits input to run SQL commands, not a VM/caching vector.
• Service hijacking: takes control of a service, not about covert data leakage via shared hardware.

• Notice phrases like “shared hardware resources,” “co-resident,” or “cache”—these indicate a side-channel vector.

Why B works

• AWS KMS keys are Regional resources. A normal customer managed key in Region A cannot be used directly in Region B.
• A customer managed multi-Region KMS key (MRK) has related key replicas in both Regions. The replicas share key material and key ID, although each has a Regional ARN.
• With client-side encryption, the application encrypts the data before storing it in S3. Cross-Region replication then copies already-encrypted objects, so S3 does not need to decrypt and re-encrypt them with a different Regional key.

Why the other choices are weaker

• A and C: SSE-S3 uses Amazon-managed S3 keys, not the required customer managed KMS key.
• D: SSE-KMS can work only if the solution creates and configures the appropriate KMS key or multi-Region key replica in each Region. As written, it says to create a customer managed KMS key in each Region, which implies separate keys—not the same KMS key. Replication also requires additional KMS permissions and destination encryption configuration.

• Basic support does not include architectural/design assessments.
• Premier support includes advisory services such as architectural reviews/design assessments.

• The solution (subscribe to Premier support) does meet the goal. The correct choice should be Yes (A).
• The provided answer key showing B (No) is likely incorrect for current Azure support plans.

• Correct answer: A: The ITIL service value system (SVS).

• The SVS explains how all components (governance, the service value chain, practices, guiding principles, information and technology, partners and resources, and continual improvement) work together to enable value creation from demand to outcomes.

• B: The ITIL guiding principles describe aspirational guidance for decision-making, not how all components/activities interact.
• C: The four dimensions of service management explain areas to consider (organizations/people, information/technology, partners/suppliers, value streams/processes) but don’t describe the integrated system itself.
• D: A service relationship defines the relationship between provider and consumer, not the overall system of components and activities creating value.

• A? ??? Aurora Replicas? ?? ??? ???? ?? ???, ?? ???? Network Load Balancer(NLB)? ??????. NLB? ?? 4 ?? ???? HTTP ??? ?? ???(Sticky sessions)? ????? ???? ????.
• ??? ?? ??????? ?? ?? ???? ??? ???? ?? ????? ????? ?? ?? ???(?? ?/??? ??)? ?????. ? ??? ALB?? ?? ????, NLB?? ???? ?????.
• ??? ??? ??? ??? ???? ?? ???? ???? HTTP ???? ??? ALB? ???? ???. A? ? ??? ??????.

• ProductSearchModel.getProductSearchHits() — option C
• ProductSearchHit.getRepresentedProducts() — option B

• ProductMgr.queryAllSiteProducts() (A) queries every product in the site, which is heavy and not scalable for large catalogs.
• Category.getProducts() (D) retrieves all products in a category; this can be slow for large categories.
• Using the search model and hits (B and C) leverages the search index, supports paging, and avoids scanning the entire catalog, making it more scalable.

• TCP is connection-oriented. It establishes a connection before data transfer using a three-way handshake (SYN, SYN-ACK, ACK), enabling reliable delivery, ordering, and flow control.

• UDP is connectionless. It sends datagrams without a prior connection and provides no guarantee of delivery, order, or protection against duplicates; any reliability is up to the application.

• B incorrectly states UDP uses acknowledgment packets; UDP has no built-in ACKs.
• C wrongly claims UDP provides reliable transfer and that TCP is connectionless.
• D misstates framing bits; neither protocol uses the listed TCP/UDP handshake bits in frames.

• AWS IoT Greengrass supports local ML inference using models trained in Amazon SageMaker.
• The model and inference code run on the factory’s local server, so processing continues even when internet connectivity is unavailable.
• A Greengrass component can:

• This provides low latency and avoids sending images to AWS for every inference.

• A: Uses AWS-hosted services and therefore depends on internet connectivity. It would fail during an outage.
• C: Snowball Edge is unnecessary for this use case and adds deployment complexity. A local Greengrass server is the intended edge-inference solution.
• D: Amazon Monitron is designed for monitoring industrial equipment health, not analyzing camera images with a custom SageMaker model.

1. Remote access to a Windows PC
2. Full chat and optional game-console functions

• Windows Remote Desktop (RDP) uses TCP 3389. The router needs a port-forwarding rule that sends incoming traffic on that port to the Windows PC’s internal IP address.
• The game console should connect through the wireless AP. Using WPA2-PSK provides the required wireless security while allowing normal online, chat, and optional services.
• The firewall should separate the internal network from the screened subnet. Its screened-subnet-side address is shown as 10.100.0.1.
• Devices must be placed in the correct network locations: the PC behind the router, the console on the wireless AP, and the firewall between the appropriate network segments.

• Answer: No.

• Why:

• If you need such an assessment while controlling costs, you’d generally pursue a paid MCS engagement or another option outside of the basic Premier entitlement.

• Answer: No.

• Why: Microsoft Managed Desktop (MD) is a managed service for end-user desktops (Windows devices used by people), not a service for provisioning, managing, or lifecycle-managing large fleets of virtual machines. It won’t help automate weekly creation and deletion of many VMs, especially with mixed OS (Windows and Linux).

• Relevant concept: To reduce administrative effort for rapidly provisioning and tearing down VMs, an Azure service like Azure DevTest Labs is appropriate. DevTest Labs lets you:

• Takeaway: The proposed solution (MD) does not meet the goal; the correct approach is to use a lab-oriented service such as Azure DevTest Labs for frequent, ephemeral VM deployments.

• RPO (Recovery Point Objective) — maximum acceptable data loss, measured in time. It specifies how far back in time you can tolerate data loss. Example: RPO of 2 hours means backups must occur at least every 2 hours.

• ARO (Annualized Rate of Occurrence) — expected frequency of a threat occurring per year. It estimates how often a risk is likely to happen on average (used in risk calculations).

• MTTR (Mean Time To Recover) — average time to recover/restore service after an incident. It includes detection, repair, and restoration time, and helps gauge downtime and alignment with RTO.

• A) configure matching hold and delay timers

• B) configure matching key-strings

• C) configure matching priority values

• D) configure unique virtual IP addresses

• Approval publish: Request approval from a manager of the knowledge base before moving the article into the publish state.
• Instant Publish: Immediately publishes a draft article without requiring an approval.
• Instant Retire: Immediately retires a published article without requiring an approval.
• Retire Knowledge: Moves a knowledge article to the retired state.

• These are the base knowledge workflows that control how articles move between states (Draft, Published, Retired) and whether approvals are required.
• The other options describe different lifecycle actions, but these four cover the standard publish/retire workflows in ServiceNow.

• VMs without NGT: Not clearly a migration blocker on its own; NGT (Nutanix Guest Tools) status isn’t the typical gating factor for live migration during maintenance.
• VMs marked as an Agent: Not a standard, widely-known migration blocker; agents aren’t the typical reason a VM can’t be migrated.
• Memory Overcommitted VMs: While memory pressure can affect placement, memory overcommitment isn’t a fundamental reason a VM would be labeled non-migratable during maintenance.
• VMs with attached Volume Groups: This is the strongest candidate. A Volume Group is a set of volumes bound to a VM; moving the VM would entail relocating and reattaching those volumes, which can complicate or block live migration during maintenance.

• Azure Resource Manager templates: Use ARM templates to define the VM infrastructure and baseline configuration as code. This ensures all Windows Server 2016 VMs are created with a uniform setup, minimizing manual configuration.

• PowerShell Desired State Configuration (DSC) extension for Windows: DSC enforces a defined state across all servers and can automatically remediate drift. This keeps the VMs in the desired configuration with minimal ongoing admin effort.

• The problem: Guest users can’t create posts in the Monthly Reports channel.
• The recommended fix (answer B): Modify the Guest access settings in the Teams admin center.

• Guest access settings control what guests are allowed to do across Teams (for example, posting, chat, and channel participation). If guests are restricted from posting, enabling the appropriate guest permissions will let them post in channels like Monthly Reports.
• The other options don’t directly change guest permissions in the way that affects posting:

powershell 
Get-AzureVM -ServiceName <service-name> -Name <vm-name> | 
  Set-AzureStaticVNetIP -IPAddress <private-ip> | 
  Update-AzureVM

• New-AzureRMVMConfig configures VM settings but does not itself assign the static IP.
• Set-AzureSubnet is not the appropriate cmdlet for assigning a VM’s private IP.
• The Azure portal option mentioned in the question was not the intended method for this older deployment model.
• Changing settings in Windows Network and Sharing Center is incorrect because Azure assigns the IP through the VM’s virtual network interface; manually configuring it inside the guest can cause conflicts.

• The app on EC2 connects to Aurora using DB credentials stored on the instance. Secrets Manager centralizes these credentials and can rotate them automatically, eliminating manual updates on each EC2 host.
• Automatic rotation reduces operational overhead and enhances security because credentials are rotated on a schedule without code changes.
• The app can retrieve the current secret at runtime (e.g., via the AWS SDK) and use it to authenticate to Aurora, avoiding reliance on locally stored files.

• B (Parameter Store) can store secrets but lacks seamless built-in rotation for database credentials like Secrets Manager; rotation often requires more custom work.
• C (S3) would require complex tooling to rotate and securely fetch credentials and still risks exposure if access policies aren’t perfect.
• D (Encrypted EBS volumes) would store credentials locally on each instance and does not automate rotation or centralized management.

• MFA verifies a user’s identity using additional authentication factors, such as a phone prompt or security token.
• It helps prevent unauthorized access even if a password is compromised.
• It does not provide secure storage or encryption of credentials used during automated deployment.

• Answer: A. Use Amazon SageMaker Serverless Inference to deploy the model.

• Why: SageMaker Serverless Inference hosts the model and serves real-time predictions without you provisioning or managing servers. It scales automatically and handles deployment details.

• Why the others aren’t suitable:

• Quick example flow: web app ? SageMaker Serverless Inference endpoint ? model ? response.

• The correct option is A: Data architecture.

• Why: In the AWS CAF, the Platform perspective covers the technical foundation and architecture that enable cloud workloads to run reliably and efficiently. This includes how data is modeled, stored, and accessed across the enterprise—the core of data architecture.

• Quick mapping for the other options:

• Why: Table.Profile returns a per-column profile that includes statistics such as count, null count, distinct count, and standard deviation. It also provides min/max and average where applicable, which matches the requested metrics (Count, Average, Null count, Distinct count, Standard deviation).
• Syntax: Table.Profile(table as table, optional additionalAggregates as nullable list) as table
• How it helps: After running Table.Profile on your table, you can extract the per-column stats you need and display them in your semantic model or report.

• Correct answer: A
• What this is saying: You need to write a Transact-SQL query that uses REGEXP_SUBSTR to extract the ID from MessageText, and you should apply STRING_ESCAPE(MessageText, 'json') before calling REGEXP_SUBSTR.

• MessageText may contain JSON characters (quotes, backslashes, etc.). Escaping the JSON content first ensures the string you pass to the regex is safe and won’t confuse the regex engine.
• The pattern you apply with REGEXP_SUBSTR would then extract the first substring that matches your ID pattern from the (escaped) text.

• Example (conceptual):

• The question implies REGEXP_SUBSTR is available in this environment; some SQL Server and Fabric contexts don’t expose it natively in all versions. If REGEXP_SUBSTR isn’t available, you’d need an alternative approach (e.g., using built-in regex-like capabilities or CLR/UDFs).
• If you need the ID specifically from the first paragraph, you might first isolate the first paragraph and then apply REGEXP_SUBSTR, or compose a single pattern that anchors to the first paragraph.

• Correct answer: No (B).

• To deploy and manage Azure VMs, you use Infrastructure as a Service (IaaS). IaaS provides the actual virtual machines you configure, patch, and control.
• Platform as a Service (PaaS) abstracts infrastructure and OS management and is used for hosting applications (e.g., web apps) on managed runtimes, not for provisioning and managing individual VMs.

• Strongest encryption algorithms: Choose the strongest available encryption and integrity options, typically AES with the largest key size and a secure integrity algorithm.
• Encrypt all traffic: Select tunnel mode rather than transport mode. Tunnel mode encrypts the entire original IP packet, which is appropriate for a site-to-site VPN between branch networks.
• Secret-password authentication: Configure a pre-shared key (PSK) on both VPN concentrators. The key must match at both ends.

• In the AWS shared responsibility model, AWS manages the security of the “infrastructure,” including the physical hardware and underlying virtualization.
• The customer is responsible for everything else in the cloud stack: the guest OS on EC2, the NoSQL database software running on it, data, patching the OS, and configuring access controls like security groups.
• So, for a self-managed NoSQL database on EC2, AWS would handle the physical hardware, while you would patch the guest OS and manage DB availability, backups, and security.

• Correct options: C and D.

• The AWS Cloud Adoption Framework (CAF) security perspective focuses on capabilities to protect information and manage security risk.
• Observability (A) is primarily an operations/monitoring capability, not a core security capability under CAF.
• Incident and problem management (B) is IT service management/operations, not specifically a CAF security capability.
• Incident response (C) is a security-focused capability: detecting, containing, and recovering from security incidents.
• Infrastructure protection (D) involves applying security controls to protect the underlying infrastructure, which fits the security perspective.