Financial CMA Exam Prep
Certified Management Accountant (Page 122 )

• Ease of exploitation
• Required privileges
• User interaction
• Impact on confidentiality, integrity, and availability

• CVE: Identifies and names a specific publicly known vulnerability; it does not measure severity.
• OSINT: Refers to intelligence gathered from publicly available sources.
• SOAR: Automates and coordinates security operations, such as alert response and playbooks.

• Share of overall contribution: part of the organization’s total contribution is allocated to the supplying division.
• Dual pricing: the supplying division may record a higher transfer price while the receiving division records a lower price, with central accounts absorbing the difference.
• A centrally imposed price range: this may allow the transfer price to be set above variable cost, helping the supplying division recover fixed costs.

• Packet capture: Collects and analyzes network traffic; it does not describe the scan type.
• Privilege escalation: Attempts to gain higher permissions after obtaining access.
• System enumeration: Identifies systems, services, or resources, but is not specifically defined by the lack of credentials.
• Passive scan: Observes traffic without actively probing systems. A vulnerability scan is generally an active assessment.

• Active-active routers: Provide redundant Internet connections/devices. Both can operate, so traffic can fail over or be load-balanced.
• Active-active firewalls: Avoid a single firewall becoming a failure point while maintaining security inspection.
• Load balancers: Distribute requests across multiple web servers. If one server fails, traffic can go to the other.
• Redundant power supplies: A server with separate power supplies should connect to independent power sources or circuits.
• UPS A and UPS B: Provide backup power and redundancy. Ideally, each power supply is connected to a different UPS.
• SONET ring: A ring topology provides alternate paths if a fiber link or segment fails.

• Sales process: Controls which Opportunity Stage values are available.
• Record type: Associates the appropriate sales process with a business scenario and controls available picklist values.
• Page layout: Controls which fields are displayed and whether they are required or read-only.

• Energy Market Team 1 ? Record Type 1, Sales Process 1, Page Layout 1
• Energy Market Team 2 ? Record Type 2, Sales Process 2, Page Layout 2
• Services/Installation Team ? Record Type 3, Sales Process 3, Page Layout 3

• Each Case must follow defined support steps.
• Each step must be completed within a specified time limit.

• Case Escalation Rules: Escalate Cases based mainly on age or criteria; they do not model a complete sequence of service steps.
• Process Builder with Scheduled Actions: Can automate time-based actions but is not the standard framework for Case service-level commitments.
• Omni-Channel Routing: Routes work to agents based on capacity and priority; it does not track Case lifecycle deadlines.

• Amazon SageMaker — charges apply for compute, storage, and other resources used.
• AWS Config — generally charges for configuration recording and rule evaluations.
• Amazon CloudWatch — has a limited free tier, but many metrics, logs, alarms, and API usage can incur charges.

• Reduce the training data: Usually makes overfitting worse.
• Add hyperparameters: Hyperparameters already control training; simply adding them does not solve the problem. Proper tuning could help, but that is not what the option states.
• Increase training time: More training can worsen overfitting if the model is already memorizing the training data.

• IRR assumes that interim cash flows can be reinvested at the project’s own IRR. This may be unrealistic, especially when the IRR is very high.
• MIRR assumes reinvestment at a specified rate, usually the company’s cost of capital or another realistic reinvestment rate.

• B: MIRR does not specifically favour projects with long payback periods.
• C: MIRR and IRR can rank competing projects differently.
• D: MIRR is not always higher than IRR; it may be higher or lower depending on the cash flows and reinvestment rate.

• Outer packet: 10.5.1.1 > 52.165.16.154
• IPv4 protocol field: 41, which indicates IPv6 encapsulation
• Inner packet: IPv6 traffic between 2001:... addresses

• MAC address spoofing: Changes Layer 2 addressing; it does not explain the IPv6-in-IPv4 structure.
• Steganography: Hides data inside files or media, not visibly in a tunneled protocol.
• Broken encryption: No evidence of encryption being cracked.
• On-path sniffing: Involves intercepting traffic, not sending data to an external host.

• Restrict a port to a defined number of MAC addresses
• Use statically assigned or “sticky” MAC addresses
• Shut down or restrict the port when violations occur

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect suspicious network activity, but is not the primary control for limiting switch MAC entries.
• NGFW: Filters traffic at the network boundary; it does not directly prevent MAC table flooding on access switches.

• B. Users accessing Salesforce from public Wi-Fi

• C. Users choosing the same password as their Facebook password

• A: 2FA does not protect an already-authenticated, unlocked session if someone accesses an unattended laptop.
• D: Weak password-reset questions are an account-recovery weakness. 2FA primarily strengthens login authentication, not necessarily the security-question reset process.

• CHAP: Uses a challenge-response exchange, so the password is not directly transmitted.
• IPsec: Provides authentication, integrity, and encryption for IP communications.
• EAP: An authentication framework that supports stronger methods, such as certificates or token-based authentication.

• Discovers sensitive data in Amazon S3 buckets
• Uses machine learning and pattern matching to identify data such as personally identifiable information (PII)
• Helps assess S3 security and privacy risks
• Generates findings for potentially sensitive or exposed data

• Amazon Detective: Investigates security findings and performs root-cause analysis.
• Amazon GuardDuty: Detects threats and suspicious activity across AWS accounts and workloads.
• AWS IAM Access Analyzer: Identifies resources that are accessible from outside their intended trust zone, such as publicly accessible S3 buckets.

• s3:GetObject for the relevant objects
• s3:ListBucket if listing is required
• Appropriate bucket and object resource permissions

• B: Making the bucket public is insecure and unnecessary.
• C: Prompt engineering cannot override AWS IAM or encryption permissions.
• D: Data sensitivity does not determine whether the role can access it.

• state preserves the client’s original context, such as the specific idea URL the user requested.
• The portal sends that value in the OAuth authorization request.
• Salesforce returns it after authorization, allowing the portal to redirect the user to the original idea rather than the Ideas home page.

• Monitoring: Detects activity but does not remove the underlying risk.
• Patching: Useful for systems that must remain operational, but these desktops are unused.
• Isolating: Can be a temporary containment measure, but permanently removing unnecessary systems is more appropriate.

• Un AG puede tener réplicas en Windows y Linux desde SQL Server 2017; por tanto, una réplica Windows y otra Linux es posible.
• Sin embargo, las réplicas de un AG deben utilizar normalmente la misma versión principal de SQL Server. Una instancia SQL Server 2017 no puede tener directamente una réplica secundaria SQL Server 2019 como configuración normal y permanente.
• En tu escenario, SQL Server 2017 en Windows y SQL Server 2019 en Linux no se pueden añadir directamente como réplicas equivalentes de AG1. Primero habría que realizar un proceso de actualización/migración compatible, por ejemplo mediante una actualización gradual o una tecnología de migración como log shipping o distributed availability groups, según el diseño.

• Tipo de clúster y mecanismo de quorum.
• Failover normalmente manual en configuraciones multiplataforma.
• Edición y características compatibles.
• Configuración de endpoints y permisos.
• Limitaciones específicas de SQL Server en Linux.

• CCTV system — Detective control: Cameras monitor and record activity, helping identify or investigate security incidents after—or while—they occur.
• Signs about being filmed — Deterrent control: The signs discourage people from attempting unauthorized or criminal activity because they know surveillance is present.

• Preventive: Stops an incident from occurring, such as a lock or access-control system.
• Corrective: Restores systems after an incident.
• Directive: Instructs people to behave in a certain way, such as a security policy.
• Compensating: Provides an alternative control when the preferred control cannot be implemented.

• D — Value analysis: Correct. It examines an existing product to identify ways of reducing its cost while still providing the required functions, quality and reliability.
• E — Kaizen costing: Correct. It involves making continuous, small improvements and cost reductions while the product is already in production.

• Functional analysis: It is not limited to minimizing the cost of the originally defined functions. It examines what functions are required and how they can be provided at the lowest overall cost.
• Value engineering: Usually applies to the design and development of a new product, rather than being a fundamental redesign of existing organisational processes. That description is closer to business process re-engineering.
• Target costing: The target cost is generally established during the product development stage, before production begins. It is not continuously reset while the product is in production.

• Planning and designing products and services
• Developing and delivering them
• Managing risks, suppliers, and resources
• Measuring performance
• Continually improving value delivery

• Value stream steps describe activities used to create and deliver value; they do not themselves provide the broader capabilities.
• Vision and operating model provide direction and structure, but they are not the practical management capabilities that enable the work.
• Value chain is the operating model showing how activities combine to create value; it is enabled by practices and resources.

• A is correct: It establishes the revised dates and identifies the effect on the critical path.
• B is premature: Stakeholders should be informed after the impact has been assessed and the updated schedule is understood.
• C is not automatically appropriate: Fast-tracking may introduce additional risk and should be considered only after analyzing schedule options.
• D is premature: Adding resources may not resolve a dependency and could increase costs without addressing the actual constraint.

yaml 
clusterIP: None

• CronJob: Runs Jobs on a schedule and normally does not need stable networking.
• Deployment: Manages interchangeable, stateless replicas and usually uses a regular Service.
• DaemonSet: Runs a Pod on selected nodes but does not inherently require stable Pod identities.

• Domínios personalizados.
• Armazenamento suficiente.
• Instâncias dedicadas.
• Balanceamento de carga.
• Menor custo entre os planos que atendem a tudo.

• The current and previous versions
• Which clauses were changed
• When each revision occurred
• Potentially, who made the changes

• Version validation: Verifies a version’s accuracy or integrity but does not primarily track revisions.
• Version changes: Not the standard name for a formal document-management process.
• Version updates: Describes updating a document, not the complete process of managing and tracking its revisions.

• Create and manage approved IT services as products
• Control which users can deploy those products
• Apply governance, permissions, and constraints
• Use and manage infrastructure-as-code templates, such as AWS CloudFormation templates

• AWS Resource Explorer: Helps find and browse AWS resources; it does not govern IaC deployments.
• AWS Organizations: Manages accounts, consolidated billing, and organization-wide policies.
• AWS Systems Manager: Provides operational management, such as patching, automation, and parameter storage, but it is not primarily used to catalog and govern IaC-based service deployments.

Correct reasoning

• Create storage5 as a General-purpose v2 (StorageV2) account.
• Configure Blob object replication from storage5 to an existing compatible storage account.
• The destination must support object replication—typically another StorageV2 or premium block blob account.
• Blob versioning must be enabled on both accounts.
• Blob change feed must be enabled on the source account.
• The accounts must meet Azure’s object-replication requirements, including being in supported regions and having compatible configuration.

• AWS Network Firewall can inspect and block traffic across a VPC when traffic is routed through the firewall. A Drop action rule can deny traffic from the suspicious source IP.
• GuardDuty findings are sent to Security Hub.
• A Lambda function can be invoked when Security Hub receives a new GuardDuty finding, extract the source IP, and update the Network Firewall policy with a blocking rule.

• GuardDuty threat lists: Used to identify or increase the severity of findings; they do not directly block VPC traffic.
• AWS WAF: Protects supported web applications, such as CloudFront or Application Load Balancers. It does not provide general VPC-wide traffic blocking.
• GuardDuty suppression rules: Suppress or hide findings. They do not block the suspicious traffic.

• Additional running costs: $800
• Less depreciation: $300

• The $100 reduction in fixed production overhead absorbed is only an accounting reallocation. It does not represent an actual saving in total fixed overhead.

1. Clear principles and boundaries — Employees have freedom, but decisions must remain within clear organizational values, policies and limits.
2. High degree of freedom — Managers are trusted to make decisions rather than seeking continual approval from senior management.
3. Frontline customer responsibility — Customer-facing managers should be empowered to manage customer relationships and respond quickly to needs.
4. Transparent and ethical information — Information should be openly available and used honestly, supporting trust and informed decision-making.

• Red team: Simulates attackers; exploits weaknesses to test security.
• Blue team: Defends systems; monitors, detects, and responds to attacks.
• Purple team: Combines red- and blue-team efforts to improve detection and defense.
• White team: Oversees or manages the test, defining rules, scope, and authorization.

• ARP poisoning: Redirects or intercepts local network traffic; it would more likely affect communication paths or cause man-in-the-middle behavior.
• Jamming: Interferes with wireless signals. The scenario does not indicate a wireless outage.
• Kerberoasting: Attempts to obtain service-account password hashes from Kerberos; it is a credential attack, not typically a direct service outage.

• Scheduling overlapping working hours for critical collaboration
• Assigning independent tasks that can proceed asynchronously
• Adding clear handoffs between offices
• Documenting decisions, questions, and required inputs
• Building appropriate time into the schedule for responses

• A laptop
• Software access
• A password reset
• A mobile phone

• They run behind the scenes — applies more to automation or workflows.
• They are optional — catalog items are fundamental to a request-based catalog.
• They provide options — variables and variable options collect the requester’s choices for an item; they are not the catalog item itself.

• A — Capacity: The system must handle all current records and anticipated future records. A system that cannot cope with volume will quickly become ineffective.
• C — Accuracy: Academic records are critical, so the new system must be at least as accurate as the existing system and comparable systems. Poor accuracy could cause serious administrative and reputational problems.
• D — Integration: Linking with the university’s financial systems supports consistency and avoids duplicate data entry, especially for registration, deregistration and fee-related transactions.

• B — Parallel running: This is a useful implementation and risk-control technique, but it is not an essential feature of the system itself. It may also be expensive and time-consuming.
• E — Internet access for all information: This creates significant confidentiality and security risks. External access might be needed for selected services, but unrestricted access to all information is not essential and would be inappropriate for student records.

• DB1 (500 TB): Azure Data Box Heavy

• Virtual machines: Azure Migrate

• Espionage: Stealing information for intelligence or competitive purposes.
• Data exfiltration: Unauthorized removal or transfer of data.
• Nation-state attack: An attack sponsored or conducted by a government.
• Shadow IT: Technology or access methods used outside approved IT processes.

• A — Increasing the minimum password length to 14 characters: Longer passwords have more possible combinations, making them harder to guess or crack through brute force.
• F — Requiring at least one special character: This increases password complexity and expands the possible character combinations.

• MD5 to SHA-512: Improves password-hash resistance, but does not stop users from choosing easy-to-guess passwords. Also, modern systems should use a password-specific hashing algorithm such as bcrypt, scrypt, or Argon2.
• Increasing maximum age to 120 days: Leaves weak passwords in use longer.
• Reducing minimum length to 10: Makes guessing easier.
• Reducing minimum age to zero: Allows immediate password changes but does not make the password itself harder to guess.

• A — Technical review by business owner: A business owner may approve the business impact, but a technical review is normally performed by technical personnel.
• C — Cost-benefit analysis after implementation: Cost-benefit analysis should occur before implementation to support the approval decision.
• D — Business continuity testing: This can be appropriate for major changes, but it is primarily part of business continuity and disaster recovery planning—not a universal change-management activity.

• T?o m?t Systems Manager Automation runbook d? ch?y l?nh kh?i d?ng l?i ?ng d?ng trên các EC2 instance.
• T?o m?t Amazon EventBridge rule ph?n ?ng khi CloudWatch alarm chuy?n sang tr?ng thái ALARM.
• Ð?t Automation runbook làm target c?a EventBridge rule.

1. Log c?a ?ng d?ng du?c ghi vào CloudWatch Logs.
2. CloudWatch alarm phát hi?n nhi?u l?i liên quan d?n vi?c restart.
3. Alarm chuy?n sang tr?ng thái ALARM.
4. EventBridge nh?n s? ki?n thay d?i tr?ng thái này.
5. EventBridge g?i Systems Manager Automation runbook.
6. Runbook restart ?ng d?ng trên các EC2 instance, không restart c? instance.

• A: SNS không tr?c ti?p g?i Systems Manager Automation runbook nhu m?t target native.
• B: Lambda có th? th?c hi?n vi?c restart, nhung ph?i t? x? lý vi?c xác d?nh instance và ch?y l?nh t? xa.
• C: Lambda ch? làm trung gian d? g?i runbook, không c?n thi?t vì EventBridge có th? g?i runbook tr?c ti?p.

• A script of cloud CLI commands: IaC because the commands can be saved, reviewed, versioned, and rerun consistently.
• Manually run curl commands: Not necessarily IaC; they are manual actions unless organized into an automated script.
• A sequence of REST requests passed to an API: Could represent automation, but the wording does not explicitly say they are stored and executed as reusable code.
• Commands entered into a cloud console: Manual operation, not IaC.

1. Create or verify cost groups

1. Set up the item model group

1. Create the costing version

1. Enter or calculate item costs

1. Activate the standard costs

1. Select Exchange email as a location.
2. Use the built-in Azure Storage Account key sensitive information type as the condition.
3. Configure the DLP action to encrypt the email—for example, using Microsoft Purview Message Encryption.

CIMA P3 topics

• IT governance and systems strategy
• Systems development and implementation
• Change and project governance
• Strategic and business risk

• A — Plan for new systems: The committee should help identify and prioritise systems requirements and ensure planned systems support organisational needs.
• D — Consider competitive issues: New information systems may affect Y’s competitive position, service quality and efficiency. These strategic implications should be considered.
• E — Ensure the system meets company goals: This is a key governance responsibility. The committee should ensure the project remains aligned with Y’s objectives and delivers business value.

• B — Develop new systems: Detailed system development should be performed by IT specialists and project teams, not the steering committee.
• C — Manage the project: The project manager should handle day-to-day project management. The steering committee should provide oversight, challenge and key decisions, rather than manage daily activities.

• SQL injection
• Cross-site scripting (XSS)
• Malicious or malformed web requests
• Some application-layer abuse

• Layer 4 firewall: Filters based mainly on IP addresses, ports, and connections; it lacks detailed web-request inspection.
• NGFW: Provides broader network security, but a WAF is more specialized for protecting web applications.
• UTM: Combines multiple security functions, but it is not necessarily optimized for web-application protection.

• A password cracker would normally be identified by behavior such as loading password hashes or attempting dictionary/brute-force attacks.
• The question describes a routine audit, not password recovery.
• Simply encountering a protected file during an audit is characteristic of a misconfigured or insufficiently privileged FIM.

• SOW
• SLA
• MOA
• MOU

• Transfer — przeniesienie skutków lub kosztów ryzyka na inna organizacje, np. przez ubezpieczenie lub umowe.
• Akceptacja — firma swiadomie przyjmuje ryzyko bez dodatkowych dzialan.
• Mitigacja — zmniejszenie prawdopodobienstwa wystapienia ryzyka lub jego wplywu, np. przez wdrozenie kontroli bezpieczenstwa.
• Unikanie — calkowite wyeliminowanie ryzykownej dzialalnosci.

• Open or insecure ports
• Enabled legacy or insecure protocols
• Known vulnerabilities and misconfigurations
• Weak services and outdated software

• curl tests web requests and HTTP-based services.
• Wireshark captures and analyzes network traffic; it does not normally scan servers for weaknesses.
• netcat can test connectivity to individual ports and sometimes grab service banners, but it is not a comprehensive vulnerability scanner.