CSI CSC2 Exam Prep
Canadian Securities Course 2 (Page 17 )

• The load balancer provides the listener’s frontend IP address.
• The active SQL Server node must also respond to that same listener IP.
• Enabling Floating IP allows the listener IP to be preserved and handled correctly by the active replica.
• Without it, SQL connections may be sent to a node that cannot correctly claim the listener address.

• A health probe for the SQL Server port
• A load-balancing rule using the listener port
• Floating IP enabled on that rule

• Understating expenses and liabilities
• Overstating profit
• Misleading users of the financial information
• Potentially breaching integrity, objectivity, and professional competence and due care

• Run the backup with WITH CHECKSUM
• Store the backup on an SMB network share

sql 
BACKUP DATABASE DB1 
TO DISK = '\\FileServer\SqlBackups\DB1_full.bak' 
WITH CHECKSUM;

• DMS does not create the SQL Server backups for you.
• You must provide a valid full database backup.
• You must continue taking transaction log backups while the source database remains online.
• The full backup and subsequent log backups must be available in the SMB share that DMS can access.
• WITH CHECKSUM enables backup checksum validation, helping detect backup corruption.

• A — Use getRecordTypeInfosByDeveloperName()

apex 
  Id rtId = Schema.SObjectType.Account 
      .getRecordTypeInfosByDeveloperName() 
      .get('Business_Account') 
      .getRecordTypeId();

• C — Query the RecordType object

apex 
  RecordType rt = [ 
      SELECT Id 
      FROM RecordType 
      WHERE SObjectType = 'Account' 
      AND Name = 'Business Account' 
      LIMIT 1 
  ];

• B: An outbound SOAP call is unnecessary and inefficient.
• D: Hardcoding an ID is not dynamic, and IDs can differ between orgs.

Statement 1 — Correct

Statement 2 — Correct

• Microsoft manages the physical datacenter, hardware, and virtualization.
• You manage the virtual machine’s operating system, installed software, configuration, and data.
• You choose the VM size, storage, networking, and scaling options.

• SaaS: You consume a complete application managed by the provider, such as Microsoft 365.
• PaaS: You deploy applications without managing the underlying operating system or VM infrastructure, such as Azure App Service.

• Complete MFA, or
• Securely change their password

• Identity Protection: evaluates user and sign-in risk and can trigger remediation.
• Privileged Identity Management (PIM): manages temporary, just-in-time access to privileged roles; it does not automatically require password changes for risky sign-ins.

• A password cracker would normally be identified by behavior such as loading password hashes or attempting dictionary/brute-force attacks.
• The question describes a routine audit, not password recovery.
• Simply encountering a protected file during an audit is characteristic of a misconfigured or insufficiently privileged FIM.

• Limiting the number of MAC addresses allowed on a switch port
• Restricting ports to specific known MAC addresses
• Taking an action—such as dropping frames or shutting down the port—when the limit is exceeded

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect some attack traffic, but is not the primary control for switch-port MAC limits.
• NGFW: Filters network traffic at the firewall, but does not directly control MAC addresses learned by a switch.

• VLAN 10 for data
• VLAN 20 for voice

• A: Describes physical trunking or logical switch ports, not an SVI.
• B: An SVI can provide management access, but that is only one use—not the best description here.
• D: SVI use is not related to running out of physical ports.

• If the hashes match, the software has likely not changed.
• If they differ, the software was modified or corrupted.

• Encryption: Protects confidentiality by making data unreadable; it does not primarily verify that software was unchanged.
• Baselines: Establish expected configurations or states, but hashing is the specific method for checking file integrity.
• Tokenization: Replaces sensitive data with non-sensitive tokens and is unrelated to software integrity.

• Customers may boycott V’s products.
• Supermarket customers may stop buying from V.
• Investors may view V as having higher legal, ethical and reputational risk.
• V could face fines, lawsuits, contract losses and higher costs.
• Expected future profits may fall.

• Scale out during the hours when customer traffic is high.
• Scale in during low-demand periods, reducing instance-hours and cost.
• Use scaling policies based on metrics such as CPU utilization or request count.

• Multiple Availability Zones: Improves availability and fault tolerance, but does not automatically reduce cost.
• Placement group: Helps with specialized performance or low-latency requirements, not cost optimization.
• Private subnets: Improve network security, but do not automatically adjust capacity or reduce EC2 usage costs.

• Instant messaging/chat: Can be abused to send malicious links or attachments, but is not the answer most directly associated with high-risk file sharing.
• E-mail: A common malware delivery method, but the question emphasizes an application type known for direct file exchange.
• End-to-end applications: This describes communication protection or architecture, not a specific malware distribution risk.

• The job keeps 31 days of regular restore points. A backup from the week of January 1 is older than 31 days by March 20, so it is no longer expected to remain on the performance tier.
• It is also a weekly GFS full backup, retained for 14 weeks. Therefore, it is still protected and has not been deleted.
• In a Scale-out Backup Repository, older backups can be moved from the performance tier to the capacity tier—typically object storage—according to the configured offload policy.
• The archive tier is not selected because the question’s configuration does not indicate that the backup has been archived there.

• Deterrent control: The signs warning people they may be filmed discourage unauthorized or malicious behavior. They may prevent incidents by influencing behavior, but their primary purpose is to deter.
• Detective control: The CCTV system monitors and records activity so security personnel can identify suspicious or unauthorized actions.

• Preventive: Blocks or prevents an incident, such as a lock or access-control system.
• Corrective: Fixes or restores systems after an incident.
• Directive: Tells people what they must do, typically through policies or procedures.
• Compensating: Provides an alternative control when the preferred control cannot be used.

• Partners first log in to the corporate portal, which uses the shared SAML Identity Provider.
• When they select a Salesforce link, the IdP can send a SAML assertion directly to Salesforce.
• Salesforce validates the assertion and grants access to the Partner Community without requiring another login. This is IdP-initiated SSO because authentication begins outside Salesforce.

• SP-initiated SSO starts when Salesforce sends an authentication request to the IdP. That would be appropriate if users began by visiting Salesforce.
• The Web Server and User Agent OAuth flows are for OAuth authorization, not browser-based SAML federation between an IdP and Salesforce.

• Each Case must follow defined support steps.
• Each step must be completed within a specified time limit.

• Case Escalation Rules: Escalate Cases based mainly on age or criteria; they do not model a complete sequence of service steps.
• Process Builder with Scheduled Actions: Can automate time-based actions but is not the standard framework for Case service-level commitments.
• Omni-Channel Routing: Routes work to agents based on capacity and priority; it does not track Case lifecycle deadlines.

• Disabling a compromised account
• Blocking a malicious IP address
• Isolating an endpoint
• Creating or escalating an incident ticket

• Virus signatures: Primarily associated with antivirus or endpoint protection.
• Security agent deployment: Usually handled by endpoint-management or security-agent platforms.
• Vulnerability scanning: Typically performed by vulnerability-management tools.

• Key-based authentication: Provides an endpoint secured with API keys.
• Real-time REST access: Supports online inference through an HTTP/REST endpoint.
• No VM vCPU quota consumption: Microsoft hosts and manages the underlying infrastructure, so your subscription’s VM quota isn’t used.

• Batch: Intended for asynchronous, large-volume processing rather than real-time requests.
• Self-hosted container: You manage the infrastructure and typically need compute resources and quota.
• Standard: This is not the clearest deployment type for the stated requirements; the specific Foundry option is serverless API.

• The Intune device limit restriction does not apply in the normal way; DEM enrollment supports up to 1,000 devices.
• However, the Microsoft Entra maximum number of devices per user setting can still impose a limit when the enrollment creates an Entra device object.
• Therefore, a DEM account is not automatically unlimited. The effective limit depends on the Entra device setting and the enrollment/join type.

• The table is large.
• Queries frequently filter or join on particular columns.
• The table’s natural data order does not support good micro-partition pruning.
• Clustering improves performance enough to justify its maintenance cost.

• Tracking who accessed or changed customer information
• Detecting unauthorized activity
• Supporting accountability and investigations
• Providing evidence for compliance and incident response

• Single sign-on not enabled: SSO improves convenience and centralized authentication, but it is not essential for access control.
• Complex passwords not required: This weakens authentication, but other controls may reduce the risk.
• Security baseline not consistently applied: A concern, but it is less specific and less immediately damaging than having no activity records at all.

• A — Tables
• B — Named file formats
• C — Schemas
• E — Databases

Why these are correct

• Tables: Can be cloned using CREATE TABLE ... CLONE. The clone initially uses zero-copy cloning, so storage is shared until changes are made.
• Named file formats: Can be cloned as database objects, preserving the file-format definition.
• Schemas: A schema and its eligible objects can be cloned.
• Databases: A database and its eligible schemas and objects can be cloned.

Why the others are incorrect

• Shares: A share is an account-level data-sharing object, not a normal cloneable database object.
• Users: Users are security principals and cannot be cloned with CLONE.

• Root path cost
• Port priority
• Port ID

text 
interface GigabitEthernet0/1 
 spanning-tree vlan 10 port-priority 64

• Interface number: Helps form the port ID but is not normally configured as the preference value.
• VLAN priority: Not used to select a preferred forwarding interface.
• Hello time: Controls how often BPDUs are sent; it does not select a preferred port.

• Reconnaissance: Gathering information about the target.
• Weaponization: Creating or combining a malicious payload with a delivery method.
• Delivery: Sending the payload, such as through phishing.
• Exploitation: Triggering a vulnerability or weakness to gain execution or access.

• sn_si_admin is an SIR administrator role.
• The prefix helps prevent naming conflicts between applications.
• It does not refer to a “Secure Identity token” or an instance security check.

• Accept: Acknowledge the risk and take no additional action.
• Transfer: Shift the risk or its financial impact to another party, such as through insurance or outsourcing.
• Mitigate: Reduce the likelihood or impact of the risk, such as by implementing security controls.
• Avoid: Eliminate the activity or exposure that creates the risk.

• Portfolio definition cycle — establishes and maintains the portfolio strategy, objectives, and management framework.
• Portfolio delivery cycle — coordinates and monitors the delivery of change initiatives, ensuring the portfolio remains aligned with strategic objectives and delivers value.

• Practice — a structured area of portfolio management activity, such as risk management or resource management.
• Technique — a method used to perform an activity; it is not the term for portfolio delivery itself.
• Principle — a guiding rule for effective portfolio management.

• host — simple, human-friendly lookups

bash 
  host example.com 
  host 192.0.2.1

• dig — detailed DNS troubleshooting

bash 
  dig example.com 
  dig example.com MX 
  dig @8.8.8.8 example.com

• nslookup — older, familiar, and widely available

bash 
  nslookup example.com

• Quick answer: host
• Detailed diagnosis: dig
• Compatibility or legacy environments: nslookup