EMC DES-2T13 Exam Prep
Specialist - Cloud Architect-Cloud Infrastructure Version 2.0 (Page 3 )

• A is incorrect: Flow Debugger is for debugging Salesforce Flows, not Trust Layer masking.
• B is incomplete/misleading: Requesting audit data may be part of reviewing the results, but collection and storage must first be enabled.
• C is correct: It describes the initial validation step.

• AWS Network Firewall can inspect and block traffic across a VPC when traffic is routed through the firewall. A Drop action rule can deny traffic from the suspicious source IP.
• GuardDuty findings are sent to Security Hub.
• A Lambda function can be invoked when Security Hub receives a new GuardDuty finding, extract the source IP, and update the Network Firewall policy with a blocking rule.

• GuardDuty threat lists: Used to identify or increase the severity of findings; they do not directly block VPC traffic.
• AWS WAF: Protects supported web applications, such as CloudFront or Application Load Balancers. It does not provide general VPC-wide traffic blocking.
• GuardDuty suppression rules: Suppress or hide findings. They do not block the suspicious traffic.

• The servers run different operating systems: Windows, Linux, and Unix.
• Containers generally share the host operating system’s kernel, so they cannot normally run workloads requiring unrelated kernels, such as Windows and Linux, on the same Linux host.
• A hypervisor can create separate virtual machines, allowing each VM to run its own guest OS.
• A Type 2 hypervisor runs on top of a host operating system and can support multiple guest operating systems.

• Sales process: Controls which Opportunity Stage values are available.
• Record type: Associates the appropriate sales process with a business scenario and controls available picklist values.
• Page layout: Controls which fields are displayed and whether they are required or read-only.

• Energy Market Team 1 ? Record Type 1, Sales Process 1, Page Layout 1
• Energy Market Team 2 ? Record Type 2, Sales Process 2, Page Layout 2
• Services/Installation Team ? Record Type 3, Sales Process 3, Page Layout 3

• IaaS: você gerencia a VM e o sistema operacional.
• PaaS: o Azure gerencia a infraestrutura; você se concentra no aplicativo.

• Crowd-sourced evaluation: Requires recruiting and managing many evaluators.
• Human-worker evaluation: Provides human judgment but requires coordination, labeling instructions, and quality control.
• RLHF: Is a training and alignment process, not simply a low-overhead model comparison method.
• Automatic model evaluation: Quickly evaluates outputs using predefined toxicity or quality metrics with minimal manual effort.

• Database data: Aggregates are used to retrieve structured data, commonly from entities and database sources.
• Screen scope: A Screen Aggregate belongs to the screen where it is defined and is not directly reusable as a screen-level aggregate elsewhere.
• Asynchronous and parallel execution: Multiple Screen Aggregates can run asynchronously and in parallel, helping the screen load data efficiently.

• A user connects with their Google account.
• Google associates the user’s SSH key with that identity.
• IAM roles determine whether they can log in.
• Access can be tied to a specific employee for auditing.
• Removing the IAM role removes their login access.

• compute.osLogin: regular OS login access
• compute.osAdminLogin: OS login with administrative privileges, typically including sudo

text 
enable-oslogin=TRUE

• Code suggestions: Inline completions as you write code, such as lines, functions, or blocks.
• Chat: An interactive interface for asking questions, explaining code, generating code, and helping with debugging.

• Knowledge Base: Not listed as a standard Copilot Individual IDE feature in this context.
• Pull Request Diff Analysis: More closely associated with GitHub-based code review or pull-request features, not the core Individual IDE extension capabilities.

• Cloud architecture
• Data architecture
• Platform engineering
• Data engineering
• Provisioning and modernization

• Data protection is associated mainly with security and risk management.
• Data governance belongs to the governance perspective.
• Data science is not an AWS CAF capability.

• Replaces the verbal message — this describes non-verbal communication being used instead of words.
• Substitutes for verbal communication — similar; it means communicating without speech.
• Confuses the verbal message — this occurs when non-verbal signals contradict or obscure the spoken message.

• Share of overall contribution: part of the organization’s total contribution is allocated to the supplying division.
• Dual pricing: the supplying division may record a higher transfer price while the receiving division records a lower price, with central accounts absorbing the difference.
• A centrally imposed price range: this may allow the transfer price to be set above variable cost, helping the supplying division recover fixed costs.

• Import: Copies data into the Power BI model. It requires scheduled or manual refresh, so it may not meet the two-minute requirement.
• Live connection: Connects to an existing Power BI semantic model or Analysis Services model; it is not the appropriate choice for connecting directly to the Azure SQL database in this scenario.

• A — Capacity: The system must handle all current records and anticipated future records. A system that cannot cope with volume will quickly become ineffective.
• C — Accuracy: Academic records are critical, so the new system must be at least as accurate as the existing system and comparable systems. Poor accuracy could cause serious administrative and reputational problems.
• D — Integration: Linking with the university’s financial systems supports consistency and avoids duplicate data entry, especially for registration, deregistration and fee-related transactions.

• B — Parallel running: This is a useful implementation and risk-control technique, but it is not an essential feature of the system itself. It may also be expensive and time-consuming.
• E — Internet access for all information: This creates significant confidentiality and security risks. External access might be needed for selected services, but unrestricted access to all information is not essential and would be inappropriate for student records.

• Tokenization: Replaces the value with a nonsensitive token, often reversible through a secure token vault.
• Hashing: Converts data into a one-way fixed-length value, generally used for integrity checks or password storage.
• Obfuscation: A broad term for making data difficult to understand; it is less precise than masking in this context.

• Disable default accounts: Default or unused accounts may have known usernames or predictable settings, making them targets. They should be disabled, removed, or securely configured.
• Remove unnecessary services: Every running service creates potential vulnerabilities. Removing services the server does not need reduces exploitable entry points.

• Add the server to the asset inventory: Important for asset management, but not a hardening step.
• Document default passwords: Default passwords should be changed or eliminated—not documented for continued use.
• Send server logs to the SIEM: Valuable for monitoring and detection, but generally performed as part of logging/monitoring configuration.
• Join the server to the corporate domain: May be necessary operationally, but does not itself harden the server.

• The audience and stakeholders
• The complexity and type of requirements
• The communication method and level of detail needed
• Whether to use diagrams, models, documents, demonstrations, or slides

• B: Authority to host the presentation is not the key preparation activity.
• C: Stakeholder sign-off may occur later; presenting requirements does not always require formal approval beforehand.
• D: A scribe may be useful in a meeting, but hiring one is not a core preparation requirement for presenting.

• Record changes — a flow can start when a record is updated or otherwise changes.
• Schedules — a flow can run at a specified date/time or on a schedule.
• Record inserts — a flow can start when a new record is created.

• Subflows are reusable flow components called by another flow; they are not normally trigger types.
• Record views do not generally initiate a Flow Designer flow.

• Install unauthorized or unapproved applications
• Access system areas normally restricted
• Add features unavailable in the default software
• Modify the device’s operating system

• SQL injection (SQLi): Attacks databases by inserting malicious SQL commands.
• Cross-site scripting (XSS): Injects malicious scripts into web pages viewed by users.
• Sideloading: Installs an application from outside the official app store, but it does not necessarily remove the phone’s operating-system restrictions.

• Reviewing security objectives to ensure they support business goals.
• Ensuring security requirements are integrated consistently across business units.
• Coordinating security policies, risk management, controls, and awareness activities.

• Executive management: Provides direction, funding, and support, but usually does not manage day-to-day security integration.
• Board of directors: Provides governance and oversight, not operational security coordination.
• Steering committee: Helps coordinate and prioritize initiatives, but the CISO typically owns the overall security program and ensures its integration.

• User1 (user1@contoso.com) — This is an external guest in the Fabrikam tenant. Assuming the guest uses email one-time passcode authentication, Azure AD emails a passcode to user1@contoso.com.
• User2 (user2@outlook.com) — An Outlook.com address can authenticate with a Microsoft account, so Azure AD uses that account’s authentication rather than sending an email OTP. The fact that User2 has never accessed Fabrikam resources does not by itself trigger OTP.
• User3 (user3@fabrikam.com) — This is an internal Fabrikam user, so the user signs in with the organization’s normal credentials and does not receive a guest OTP.

1. Select Exchange email as a location.
2. Use the built-in Azure Storage Account key sensitive information type as the condition.
3. Configure the DLP action to encrypt the email—for example, using Microsoft Purview Message Encryption.

• Azure Resource Manager (ARM) templates
• Or, in newer Azure terminology, Bicep files

• Accept: Acknowledging the risk without taking additional action.
• Mitigate: Reducing the likelihood or impact through controls, such as patching or employee training.
• Avoid: Eliminating the activity or condition that creates the risk.
• Transfer: Shifting the consequences—usually financial—to another party, such as an insurer.

• Financial performance
• Customer perspective
• Internal business processes
• Learning and growth

• Increasing the number of indicators can make the scorecard cluttered and less useful. Measures should be limited to those that are strategically important.
• The scorecard is mainly a tool for implementing and monitoring strategy, not for formulating strategy.
• It should contain both leading indicators and lagging indicators. Leading indicators predict future performance, while lagging indicators measure results already achieved.

• Vulnerability scanner: Finds technical weaknesses in systems, applications, or devices. It does not usually analyze the entire supply chain.
• Penetration test: Simulates attacks against a defined target to identify exploitable weaknesses. Its scope is narrower.
• SCAP (Security Content Automation Protocol): Provides standardized formats and methods for automating security configuration and vulnerability checks, rather than mapping the full supply chain.

• C — Some risks cannot be eliminated.

• D — Accepting residual risk does not imply recklessness.

• E — Most companies in this industry will say something similar.

• Determining ISP-assigned address space: Usually involves public reconnaissance, such as WHOIS or regional Internet registry information.
• Bypassing DNS sinkholing: Would require evidence that malicious domains are resolving outside the organization’s sinkhole controls.
• Achieving initial access: DNS log entries alone do not demonstrate compromise or entry.
• Exfiltrating data: DNS tunneling generally involves repeated queries containing encoded or unusually long data, not merely internal host discovery.

• The application failing to start or becoming unhealthy
• An incorrect probe path, port, or protocol
• The application needing more startup time
• Dependency or configuration failures
• A liveness probe being too aggressive

bash 
kubectl describe pod <pod-name> 
kubectl logs <pod-name> --previous

• Scale to more replicas: may hide the issue but does not diagnose it.
• Decrease initialDelaySeconds: makes probes run earlier and could worsen startup failures.
• Drain and reboot the node: node metrics are normal, so rebooting is not justified as the first step.

• The vulnerability scan identifies a vulnerability.
• The administrator verifies that the vulnerability is not present.
• Therefore, the scan produced a false positive.

• True positive: A vulnerability is reported and genuinely exists.
• False negative: A vulnerability exists, but the scan fails to detect it.
• True negative: No vulnerability exists, and the scan correctly reports no issue.

• GPS coordinates
• Date and time the image was taken
• Camera or device information
• Image dimensions and software used

• Log data: Records generated by systems or applications, not normally embedded in image files.
• Encrypted data: Information intentionally encoded to prevent unauthorized access.
• Sensitive data: A broad classification, not the specific type of information being extracted.

• Internal hostnames and subdomains
• Network structure and naming conventions
• Servers and services
• Relationships between systems

• Determining ISP-assigned address space: Usually involves external registration and DNS information, not internal host discovery.
• Bypassing DNS sinkholing: Would require evidence that malicious DNS requests avoided redirection.
• Initial access: DNS queries alone do not show that the attacker gained access.
• Exfiltrating data: DNS tunneling can do this, but the snippet would typically show encoded or unusually long DNS queries.

• Reviewing security policies and standards checks whether controls are documented, not whether they work.
• Reviewing security logs may show that monitoring is occurring, but does not directly establish that preventive controls are effective.
• Analyzing technical security practices is broad and may assess implementation, but it is less objective than an actual controlled attack.

• Design/compliance effectiveness: policies, standards, and procedures
• Operational effectiveness: logs, records, and evidence that controls operate
• Technical security effectiveness: penetration testing or vulnerability testing

• Wireshark captures packets and allows you to examine their contents, potentially revealing usernames and passwords sent without encryption.
• Netcat creates network connections and can send or receive data, but it is not primarily a packet-analysis tool.
• Nessus scans for known vulnerabilities and configuration issues; it generally would not prove that credentials are visible in transit.
• Nmap performs network discovery and port/service scanning, not detailed packet-content inspection.

• CCTV system — Detective control: Cameras monitor and record activity, helping identify or investigate security incidents after—or while—they occur.
• Signs about being filmed — Deterrent control: The signs discourage people from attempting unauthorized or criminal activity because they know surveillance is present.

• Preventive: Stops an incident from occurring, such as a lock or access-control system.
• Corrective: Restores systems after an incident.
• Directive: Instructs people to behave in a certain way, such as a security policy.
• Compensating: Provides an alternative control when the preferred control cannot be implemented.

• D — Value analysis: Correct. It examines an existing product to identify ways of reducing its cost while still providing the required functions, quality and reliability.
• E — Kaizen costing: Correct. It involves making continuous, small improvements and cost reductions while the product is already in production.

• Functional analysis: It is not limited to minimizing the cost of the originally defined functions. It examines what functions are required and how they can be provided at the lowest overall cost.
• Value engineering: Usually applies to the design and development of a new product, rather than being a fundamental redesign of existing organisational processes. That description is closer to business process re-engineering.
• Target costing: The target cost is generally established during the product development stage, before production begins. It is not continuously reset while the product is in production.

• The selling division receives a credit based on a favourable transfer price, often market price or full cost plus a profit margin.
• The receiving division is charged a lower amount, such as marginal cost or another agreed price.
• The difference is accounted for centrally by head office or a corporate adjustment.

• Personally identifiable information (PII) detection

• Prompt Shields

• Self-harm content filtering addresses self-harm-related content.
• Violence content filtering addresses violent content.
• Neither protects customer PII or detects document-based prompt injection.

• Each team’s Bedrock workflow uses a separate IAM service role.
• The role’s Amazon S3 permissions can be limited to only that team’s customer folder or objects.
• This enforces least privilege and prevents one team’s Bedrock application from accessing another team’s data.
• Access is enforced by AWS permissions, not by asking users to provide a customer name in each request.

• A single role with broad S3 access does not provide team-level isolation.
• Asking teams to specify a customer name is not an access-control mechanism.
• Redacting data does not prevent unauthorized access.
• A bucket policy alone is insufficient unless it explicitly enforces the required team-role restrictions.

• A: Configure security groups — Customers define inbound and outbound rules for resources such as Amazon EC2 instances.
• B: Classify company assets — Customers decide how their data and assets should be classified and protected.

• C: Amazon S3 is a regional service; customers select a Region, not individual Availability Zones for buckets.
• D: AWS manages the infrastructure and patching for Amazon DynamoDB.
• E: AWS manages the infrastructure used by AWS Lambda; customers do not select EC2 instances for Lambda functions.

• Existing measures
• Relationships
• Calculated columns
• Tables and fields
• Existing transformations in the model

• SharePoint folder: Reconnects to the source files. You would likely need to recreate the model and measures.
• Power BI dataflows: Primarily provide reusable data preparation and storage, but they do not automatically provide the existing semantic model and measures.
• Excel workbook: Connects directly to the source file and would also require rebuilding the model and measures.

• Business
• People
• Governance
• Platform
• Security
• Operations

• Cloud financial management
• Portfolio management
• Data governance
• Risk management
• Compliance

• HTTPS: Secure web traffic, not general command-line server administration.
• SNMPv3: Secure network monitoring and management, not interactive server login.
• RDP: Provides graphical remote desktop access. It can be secure, but it is not the direct replacement for Telnet in this scenario.
• SMTP: Used to send email.

• Vulnerability scanner: Identifies technical weaknesses in systems, applications, or devices.
• Penetration test: Simulates attacks to determine whether vulnerabilities can be exploited.
• SCAP (Security Content Automation Protocol): Uses standardized formats and protocols for automated vulnerability, configuration, and compliance checks.
• Illumination tool: Maps and analyzes broader supply-chain exposure and third-party risk.

• Group1 — security-enabled: Eligible.
• Group2 — mail-enabled and security-enabled: Eligible because it is still a security group.
• Group3 — Microsoft 365 group: Not eligible for group-based licensing.
• Group4 — Microsoft 365 group, not security-enabled: Not eligible.

• If the hashes match, the software has likely not changed.
• If they differ, the software was modified or corrupted.

• Encryption: Protects confidentiality by making data unreadable; it does not primarily verify that software was unchanged.
• Baselines: Establish expected configurations or states, but hashing is the specific method for checking file integrity.
• Tokenization: Replaces sensitive data with non-sensitive tokens and is unrelated to software integrity.

CIMA P3 topics

• IT governance and systems strategy
• Systems development and implementation
• Change and project governance
• Strategic and business risk

• A — Plan for new systems: The committee should help identify and prioritise systems requirements and ensure planned systems support organisational needs.
• D — Consider competitive issues: New information systems may affect Y’s competitive position, service quality and efficiency. These strategic implications should be considered.
• E — Ensure the system meets company goals: This is a key governance responsibility. The committee should ensure the project remains aligned with Y’s objectives and delivers business value.

• B — Develop new systems: Detailed system development should be performed by IT specialists and project teams, not the steering committee.
• C — Manage the project: The project manager should handle day-to-day project management. The steering committee should provide oversight, challenge and key decisions, rather than manage daily activities.

sql 
ALTER TABLE dbo.DimCustomer 
ADD CONSTRAINT PK_DimCustomer 
PRIMARY KEY NONCLUSTERED (CustomerKey) 
NOT ENFORCED;

1. ALTER TABLE dbo.DimCustomer
2. ADD CONSTRAINT PK_DimCustomer PRIMARY KEY NONCLUSTERED (CustomerKey)
3. NOT ENFORCED

• Physical: Protects facilities or equipment, such as locks and security cameras.
• Technical: Uses technology, such as firewalls, encryption, or access controls.
• Operational: Covers day-to-day actions and processes, such as training, backups, or incident response.
• Managerial: Includes policies, standards, risk assessments, and procedures.