Cyber AB CMMC-CCA Exam Prep
Certified CMMC Assessor (CCA) (Page 6 )

• SAMLRequest: the SAML authentication request
• RelayState: the original destination or application state

• RedirectURL: not the standard SAML parameter for preserving the original request.
• DisplayState: not a standard SAML SSO parameter.
• StartURL: Salesforce-related terminology, but not the standard parameter used in this SAML exchange.

• Code suggestions: Inline completions as you write code, such as lines, functions, or blocks.
• Chat: An interactive interface for asking questions, explaining code, generating code, and helping with debugging.

• Knowledge Base: Not listed as a standard Copilot Individual IDE feature in this context.
• Pull Request Diff Analysis: More closely associated with GitHub-based code review or pull-request features, not the core Individual IDE extension capabilities.

• Issuer: Identifies the party issuing a SAML message—usually the identity provider in the assertion. It is not the Salesforce-specific identifier the architect should provide for differentiating Salesforce.
• Identity Provider Login URL: The endpoint where users are sent to authenticate.
• SAML identity location: Determines where the user identity is found in the SAML assertion, such as the subject or an attribute.

• AWS AppSync is designed for serverless applications that need to retrieve and combine data from multiple sources.
• A pipeline resolver can invoke multiple functions or data-source resolvers, including resolvers connected to different DynamoDB tables.
• The application can receive the combined result through one GraphQL request, without requiring custom aggregation logic in the application.
• This is operationally efficient because AppSync manages the API layer and resolver execution.

• Athena Federated Query is intended primarily for analytics and ad hoc querying, not low-latency application data retrieval.
• Querying DynamoDB through Athena can consume DynamoDB read capacity and may affect table performance.
• It also introduces analytical-query overhead and is not the normal choice for a microservice web application.

• Hardware and infrastructure
• System software
• Networks and communications
• Technology platforms and services

• Business Architecture: Defines business strategy, organization, functions, and processes.
• Data Architecture: Defines the structure and management of enterprise data.
• Application Architecture: Describes application systems and how they interact to support business and data processing.

• The VM keeps its configuration, disks, IP settings, and associated resources.
• The operation may cause downtime.
• You cannot guarantee that it will move specifically to Host2; Azure selects the new host.
• Update management is for update configuration, not host relocation.
• Moving to another subscription does not move the VM to a different physical host.
• Usage location is unrelated to VM placement.

• Owner, Contributor, and Network Contributor provide sufficient management permissions.
• Reader can view Traffic Analytics data but cannot enable or configure it.

• Restarting the device: may fix software problems, but not a directional connection issue.
• Swollen battery: is a safety concern, but would not typically cause recognition only in one orientation.
• Failing cable: possible in general, but less likely because it works on other similar devices.
• Dirty or damaged port: best matches the symptoms. Inspect and carefully clean the port, or have it serviced if damaged.

• A — Add a Path for Stage: A Path lets users update the Opportunity’s Stage directly from the record page, without opening the full edit form. It can also display guidance and key fields.
• B — Use a Kanban list view: Users can move Opportunities between stages by dragging records between columns, which is ideal when Stage is the only field they normally change.

• A — Custom Button: A button can launch a flow, typically by passing the flow’s URL and record context.
• D — From a Process: A Process can invoke a flow using an Apex action configured for flow invocation. However, this is automation-triggered, not directly accessed by a user.
• B — Quick Action: In current Salesforce functionality, a Flow Quick Action can launch a screen flow directly from a record page. This makes B a valid modern method.
• C — Visual Workflow Launcher: This is not generally listed as a standard access method in current Salesforce terminology; Salesforce commonly uses the Flow component on Lightning pages instead.

• Accept: Acknowledging the risk without taking additional action.
• Mitigate: Reducing the likelihood or impact through controls, such as patching or employee training.
• Avoid: Eliminating the activity or condition that creates the risk.
• Transfer: Shifting the consequences—usually financial—to another party, such as an insurer.

• C — “when the query finishes”

• D — “when the query began”

• Laws and regulations
• Litigation holds
• Industry or contractual obligations
• Tax, financial, health, or privacy requirements

• Business strategy and direction: May influence retention, but cannot override legal requirements.
• Storage capacity and longevity: Practical considerations, not the primary driver.
• Business ease and value analysis: May support decisions after compliance obligations are identified.

• vBond — orchestration plane: Authenticates devices, helps them discover each other, and assists with NAT traversal and initial control-connection setup.
• vSmart — control plane: Distributes routing and policy information to WAN Edge devices using the overlay control plane.
• vManage — management plane: Provides centralized configuration, monitoring, and orchestration through its GUI/API.
• WAN Edge — data plane: Forwards user traffic across the SD-WAN fabric.

sql 
CREATE TABLE my_table 
USING CSV 
OPTIONS (path '/path/to/csv');

sql 
CREATE TABLE my_table 
USING CSV 
LOCATION '/path/to/csv';

• USING CSV specifies the file format.
• path or LOCATION specifies where the files are stored.
• USING DELTA would be used only when the source data is in Delta format.
• FROM is used in a SELECT statement, not normally as the format declaration in CREATE TABLE.

• Create and manage approved IT services as products
• Control which users can deploy those products
• Apply governance, permissions, and constraints
• Use and manage infrastructure-as-code templates, such as AWS CloudFormation templates

• AWS Resource Explorer: Helps find and browse AWS resources; it does not govern IaC deployments.
• AWS Organizations: Manages accounts, consolidated billing, and organization-wide policies.
• AWS Systems Manager: Provides operational management, such as patching, automation, and parameter storage, but it is not primarily used to catalog and govern IaC-based service deployments.

• Matching hashes suggest the file has not changed.
• Different hashes indicate that the file was modified, whether authorized or unauthorized.

• Backup: Helps recover the previous version but does not identify or stop unauthorized changes.
• File labels: Classify or mark files; they do not verify integrity.
• Security audit: May discover weaknesses or improper changes, but is periodic and not a direct technical integrity control.

• B. Data loss prevention (DLP): Helps prevent sensitive data from being copied, emailed, or exfiltrated. It is not the primary control for protecting a stolen laptop’s stored data.
• C. Operating system hardening: Reduces vulnerabilities by disabling unnecessary services and applying secure settings, but it does not necessarily protect the files if the disk is accessed directly.
• D. Boot security: Helps ensure the device starts only through trusted software or approved processes. It supports platform integrity but does not itself encrypt stored files.

• Árvores de decisão: usam regras sequenciais, como “se característica X > valor, siga para este ramo”. São fáceis de visualizar e explicar. Atendem bem a problemas de classificação e regressão com alta interpretabilidade.

• Regressão linear: prevê um valor numérico contínuo, como preço, custo ou temperatura. Não é a escolha principal para classificar genes em categorias.

• Regressão logística: calcula a probabilidade de uma categoria. Pode atender à classificação, inclusive multiclasses, mas sua explicação costuma ser menos intuitiva que uma árvore para documentar decisões.

• Redes neurais: atendem a tarefas complexas, como imagens, texto e padrões não lineares. Porém, são menos interpretáveis, funcionando mais como uma “caixa-preta”.

• Planning and designing products and services
• Developing and delivering them
• Managing risks, suppliers, and resources
• Measuring performance
• Continually improving value delivery

• Value stream steps describe activities used to create and deliver value; they do not themselves provide the broader capabilities.
• Vision and operating model provide direction and structure, but they are not the practical management capabilities that enable the work.
• Value chain is the operating model showing how activities combine to create value; it is enabled by practices and resources.

• Subject: The entity that initiates an action—here, Derrick/user account.
• Object: The resource being accessed— the file.
• Action: Reading the file.

• The user starts in the corporate portal.
• The portal launches the Salesforce resource.
• The IdP sends the SAML response to Salesforce.

• Connected App + OAuth is for OAuth authorization and API/app access, not this SAML-based seamless login scenario.
• SP-initiated SSO would begin when the user first requests the Salesforce resource and Salesforce redirects them to the IdP. That is not the described starting point.

bash 
docker run -it microsoft/azure-cli:0.10.17

• docker run starts an Azure CLI container; it does not automatically connect to the AKS cluster.
• The command does not run kubectl apply.
• The container would need the appropriate Kubernetes tools and AKS credentials.
• The device or container must obtain cluster credentials, typically using an AKS credential command, before running Kubernetes commands.

bash 
az aks get-credentials --resource-group <resource-group> --name <aks-cluster> 
kubectl apply -f myapp.yaml

• The identified risk
• Its likelihood and potential impact
• The person or team responsible for handling it
• The response or treatment plan
• Risk thresholds, such as when escalation or action is required
• Current status and review dates

• Risk tolerance: The amount of risk an organization is willing to accept; it is a concept or limit, not usually the primary documentation.
• Risk transfer: Moving the responsibility or financial impact of a risk to another party, such as through insurance.
• Risk analysis: The process of evaluating risk likelihood and impact.

• Planning — identify the need, objectives, resources and feasibility.
• Analysis — determine user requirements and examine the existing system.
• Design — specify how the new system will work.
• Implementation — build, test, install and introduce the system.
• Maintenance/evaluation — monitor and improve the system after implementation.

• staff use the new system;
• transactions and reports are checked;
• problems are corrected;
• feedback is collected.

• Phased changeover: different parts or functions are introduced in stages, often according to a planned sequence.
• Pilot changeover: one representative department, branch or group acts as a test site before wider implementation.
• Parallel changeover: old and new systems operate at the same time.
• Direct changeover: the old system is stopped and the new one starts immediately.

• A. Number ? Decimal — Correct. Salesforce Number fields are represented in Apex as Decimal.
• D. Date/Time ? Datetime — This is correct conceptually, but “Dateline” is not an Apex type. If the option literally says “Dateline,” it is incorrect.
• E. Checkbox ? Boolean — Correct. A checkbox contains true or false.

• Number ? Integer — A Number field maps to Decimal, even when its scale is zero.
• Text Area ? List<String> — A text area maps to a single String, not a list.

• SQL injection
• Cross-site scripting (XSS)
• Malicious file uploads
• Common web-application exploits

• Layer 4 firewall: Filters primarily by IP addresses, ports, and transport protocols; it lacks detailed web-application inspection.
• NGFW: Provides advanced network filtering and may include application awareness, but a WAF is more specialized for protecting web applications.
• UTM: Combines several security functions in one device, but it is not specifically focused on web-application attacks.

• A. A virtual network gateway
• D. A virtual network

• Azure virtual machines must be connected to an Azure virtual network (VNet). The VNet provides private IP addressing and network connectivity for the VMs.
• A virtual network gateway enables communication between the Azure VNet and the on-premises network, typically through a site-to-site VPN or ExpressRoute connection.

• Load balancer: Distributes traffic among Azure VMs; it does not connect Azure to an on-premises network.
• Application gateway: Provides web-application load balancing and Layer 7 routing; it is not the normal resource for on-premises connectivity.
• Gateway subnet: A gateway subnet is required inside the VNet when deploying a virtual network gateway, but the question’s intended two primary resources are the VNet and virtual network gateway.

• Customer contains one row per customer and the customer’s Address ID.
• Address contains one row per address and the corresponding location details.

1. Select the Customer query.
2. Choose Merge Queries.
3. Match Customer[Address ID] with Address[Address ID].
4. Use a Left outer join so every customer is retained.
5. Expand the merged Address column and select City, State/Region, and Country.

• Append adds rows vertically and is used for tables with the same structure.
• Group By summarizes rows rather than adding related columns.
• Transpose switches rows and columns and does not establish a relationship.

• Reviewing security policies and standards checks whether controls are documented, not whether they work.
• Reviewing security logs may show that monitoring is occurring, but does not directly establish that preventive controls are effective.
• Analyzing technical security practices is broad and may assess implementation, but it is less objective than an actual controlled attack.

• Design/compliance effectiveness: policies, standards, and procedures
• Operational effectiveness: logs, records, and evidence that controls operate
• Technical security effectiveness: penetration testing or vulnerability testing

• CCTV system — Detective control: Cameras monitor and record activity, helping identify or investigate security incidents after—or while—they occur.
• Signs about being filmed — Deterrent control: The signs discourage people from attempting unauthorized or criminal activity because they know surveillance is present.

• Preventive: Stops an incident from occurring, such as a lock or access-control system.
• Corrective: Restores systems after an incident.
• Directive: Instructs people to behave in a certain way, such as a security policy.
• Compensating: Provides an alternative control when the preferred control cannot be implemented.

• Have a definite, clear objective (C): Know exactly what you want to communicate. A clear purpose reduces ambiguity and irrelevant information.
• Plan the communication (E): Decide what to say, who needs the information, the appropriate channel and the best timing.
• Seek feedback (F): Check that the receiver understood the message. This could involve asking for confirmation or inviting questions.

• Ask questions (A): Usually associated with the receiver checking or clarifying information, although a sender may use questions in practice.
• Give feedback (B): Feedback is generally the receiver’s response to the sender’s message. The sender’s responsibility here is to seek feedback.
• Consider their contribution (D): This is not a standard sender-focused step in the communication process. The sender should consider the receiver’s needs and perspective, but the wording is less precise than the three recognised actions above.

• Conserve public IPv4 addresses: IPv4 addresses are limited, so many internal devices share a smaller number of public addresses through NAT.
• Reduce direct exposure: Private addresses are not directly routable from the public Internet, which helps reduce unsolicited access to internal devices.

• Secret scope: A named container that groups related secrets and defines access permissions. Example: finance-prod.
• Secret key: The name of an individual secret stored inside that scope. Example: db-password.

text 
Scope: finance-prod 
  Key: db-username 
  Key: db-password

python 
dbutils.secrets.get( 
    scope="finance-prod", 
    key="db-password" 
)

• Disaster recovery backups
• Long-term backup retention
• Data archiving that still needs occasional access

• Multi-Regional Storage: Intended for frequently accessed data needing broad geographic availability; it costs more.
• Regional Storage: Suitable for frequently accessed data within one region.
• Nearline Storage: Intended for data accessed roughly once per month, such as monthly backups.
• Coldline Storage: Better fit for backups accessed only during a disaster or occasional recovery event.

• IKE: Negotiates security parameters for IPsec VPNs; it does not identify switch ports.
• VLAN: A logical network segmentation method, not a discovery protocol.
• netstat: Displays local network connections and listening services, but cannot identify the physical switch or port.

• Snapshot: Captures a point-in-time state for rollback. It is not an independent running VM and does not protect against failure of the underlying host or storage.
• Convert to dynamic disks: Changes disk allocation behavior; it does not provide redundancy or high availability.
• P2V: Converts a physical machine into a virtual machine. That is a migration process, not an availability solution.

Question 3: AWS Storage Gateway File Gateway

• A: S3 bucket per user — S3 is object storage, not a traditional shared file system; mounting it requires extra tools and is less efficient.
• B: File Gateway — Provides a local file share using standard file protocols while storing files in Amazon S3. This preserves convenient local access and extends storage capacity.
• C: WorkSpaces and WorkDocs — Designed for virtual desktops and document collaboration, not large shared file storage.
• D: EC2 with EBS — EBS is attached to one EC2 instance and is not designed for direct multi-user file sharing.

• NIDS: Monitors network traffic for suspicious activity and network-based attacks targeting the application or its supporting services.
• HIPS: Protects an individual host by monitoring processes, files, and system activity. It can help secure the web server, but it is not focused specifically on the application’s network attack surface.
• SIEM: Aggregates and correlates logs; it does not directly prevent attacks.
• Honeypot: A decoy system, not the primary protection for a production web application.
• Certificate revocation list: Deals with certificate trust, not application exploitation.

• GPU: A failure may cause no video output, but the PC usually still powers on.
• RAM: Can prevent booting or produce error beeps, but fans and power indicators generally work.
• CPU: Can prevent startup or booting, but it usually does not cause a completely lifeless system.

• Sensitive document shared during a Teams chat: Teams chat
• Sensitive document stored/shared in a Teams channel: Teams channel messages

• Files shared in a chat are generally stored in the sender’s OneDrive, but the relevant DLP context is the Teams chat message and its attachment.
• Files shared in a channel are stored in the team’s SharePoint site, but the relevant context is the Teams channel message.
• The DLP rule can then use an action such as restrict access to the content to prevent guest users from opening the sensitive document.

• BCP (Business Continuity Plan): Ensures the organization can continue its broader business operations during and after a disruption. It is broader than the IT-focused recovery required here.
• Communication plan: Defines how information is shared with employees, the public, and other stakeholders; it does not restore systems.
• IRP (Incident Response Plan): Handles and contains security incidents, such as malware or unauthorized access. A tornado is a disaster, not primarily a cybersecurity incident.

• Approve major information security policies
• Allocate funding and resources
• Set the organization’s risk appetite
• Ensure security supports business objectives

• Evaluating vendors is generally handled by security, procurement, or technical teams.
• Assessing risks is typically performed by security and risk-management professionals, with management accepting or prioritizing the risks.
• Monitoring regulatory adherence is usually handled by compliance, audit, or security functions.

• Data loss prevention (DLP): Helps detect or prevent unauthorized data transfers, but does not directly protect data on a stolen, powered-off laptop.
• Operating system hardening: Reduces vulnerabilities and attack surface, but does not adequately protect stored data if the device is stolen.
• Boot security: Helps prevent unauthorized operating systems or boot media from loading. It supports device security but is not the primary solution for protecting the data itself.

• 16GB RAM: A 64-bit OS is needed to use more than roughly 4GB effectively, but RAM capacity does not prove the CPU supports 64-bit operation.
• 500GB HDD: Storage capacity has no bearing on OS architecture.
• 1Gbps Ethernet: Network speed is unrelated to CPU architecture.

• Looking up accounts, contacts, and opportunities
• Logging calls and updating Salesforce records
• Accessing previously available customer information when temporarily offline

• Salesforce Touch App: Primarily an older tablet-focused experience, not the best general solution for the sales team.
• Custom hybrid app: Unnecessary development when Salesforce provides the required capabilities natively.
• SalesforceA: Intended mainly for Salesforce administrators, not sales representatives.

• Due Date
• Order Date
• Delivery Date

DAX 
Order Date = 'Due Date' 
Delivery Date = 'Due Date'

• Due Date[Date] ? Sales[Due Date]
• Order Date[Date] ? Sales[Order Date]
• Delivery Date[Date] ? Sales[Delivery Date]