Financial CMA Exam Prep
Certified Management Accountant (Page 35 )

• Deficiency found before patient use: usually does not require an adverse-event report because no patient exposure occurred.
• Event caused solely by the patient’s condition: may not be reportable if the device did not contribute.
• Malfunction protection operated correctly: generally exempt when the device’s safety mechanism worked as intended and prevented harm.

• Active remediation actions role in Microsoft Defender for Endpoint

• Security Reader role in Azure AD/Entra ID

• Security Administrator is broader than necessary because it grants extensive security-management permissions, violating least privilege.
• Compliance Data Administrator is intended for compliance data management, not Defender for Endpoint remediation approvals.

• Existing Eventhouse data: remains available only in the KQL database.
• Data ingested after enabling the feature: is copied to OneLake and can be accessed through OneLake file explorer.
• New databases: are irrelevant; the setting applies to the selected KQL database.

• S3 Glacier Deep Archive is designed for long-term archival data with very infrequent access and has a lower storage cost than S3 One Zone-IA.
• The documents are copies stored elsewhere, so reduced availability and delayed retrieval are acceptable.
• An S3 interface VPC endpoint allows private access from the VPC without exposing the bucket through the public internet.
• A bucket policy can restrict access to requests coming through that endpoint.

• C: Develop the rule in the Rules Editor, define the events, match, and condition sections, then use the test rule feature. This directly validates the YARA-L rule without enabling it in production.
• A: UDM Search can help investigate data and refine filters, but it does not fully test YARA-L logic—especially complex event joins, match windows, and conditions.

• \Pipeline1
• \Folder1\Lakehouse1

• Pipeline1 remains at the workspace root in Workspace1, so it is deployed to the root of Workspace2.
• Lakehouse1 was moved into Folder1, so its full path is preserved as \Folder1\Lakehouse1.
• Fabric deployment pipelines preserve folder paths because an item’s full path is treated as part of its name.

• A is correct: It establishes the revised dates and identifies the effect on the critical path.
• B is premature: Stakeholders should be informed after the impact has been assessed and the updated schedule is understood.
• C is not automatically appropriate: Fast-tracking may introduce additional risk and should be considered only after analyzing schedule options.
• D is premature: Adding resources may not resolve a dependency and could increase costs without addressing the actual constraint.

• The Intune device limit restriction does not apply in the normal way; DEM enrollment supports up to 1,000 devices.
• However, the Microsoft Entra maximum number of devices per user setting can still impose a limit when the enrollment creates an Entra device object.
• Therefore, a DEM account is not automatically unlimited. The effective limit depends on the Entra device setting and the enrollment/join type.

• The Azure DevOps (Boards only) connector is designed specifically for Azure DevOps Analytics views.
• It authenticates directly to Azure DevOps and lets you select an existing Analytics view.
• Filters defined in the Analytics view are applied by Azure DevOps before Power BI retrieves the data, reducing the amount of data transferred.

• Azure DevOps Server (Boards only) is for on-premises Azure DevOps Server.
• OData Feed can consume OData endpoints, but it is not the dedicated Azure DevOps Analytics-view connector.
• OData queries are not the intended dedicated connector for this requirement.

• Label applied does not automatically exclude a file from Copilot.
• Encryption/usage rights determine whether Copilot can access the file’s content.
• If the user has no permission under Label2, File3 should be unavailable to Copilot for that user.
• File3’s label might be inherited by derived content only if File3 was actually processed and contributed by an authorized user; it should not be treated as contributing merely because it exists in the source set.

1. Append Table1 and Table2 as a new query

1. Select the product column in the appended query.

1. Choose Remove Rows > Remove Duplicates

• Accept terms of use
• Enter a temporary code or credentials
• Provide basic registration information

• Enterprise authentication — Authenticates organizational users, often with centralized identity services; it is not specifically designed for temporary guest access.
• Ad hoc network — A temporary device-to-device network, not an authentication process.
• WPA3 — A wireless security standard. It protects Wi-Fi access but does not provide the web-based temporary access workflow described here.

• ?? ?? ?? ??
• ?? NFS ?? SMB ?? ??
• ?? ???? ???
• ?? IP ??? ???? ?? ???
• ??? ?? ???? ?????

• B: ????? NFS ? Snowball Edge? ?? ?? ? AWS? ?? ? S3
• D: ????? NFS ? ????/Direct Connect ? File Gateway ? S3

• httprint fingerprints Web servers by analyzing their HTTP responses. It can help identify the Web server type and sometimes its version, even when the banner has been modified or hidden.
• Wget is mainly used to download files or Web content.
• WinSSLMiM is associated with SSL man-in-the-middle testing.
• Whisker is an older Web-server vulnerability assessment tool, especially associated with IIS, rather than the expected banner-grabbing tool here.

• Row counts
• Minimum and maximum values for columns
• Distinct-value information
• Other characteristics used for optimization

• 2018-12-31 — the date
• 08:59 — the time

• Changing the original column to Date may fail because it still contains the text at and a time.
• Extracting the last 11 characters does not isolate the date.
• Extracting the first 11 characters gets the date plus a space, but the option does not specify changing the result to the Date type.

• Third-party attestation: Provides independent confirmation, often for formal compliance reporting, but is not usually performed frequently.
• Penetration testing: Attempts to exploit vulnerabilities; it focuses on technical security, not overall compliance procedures.
• Vulnerability scans: Identify known technical weaknesses in systems, but do not evaluate whether policies and processes meet compliance requirements.

• Self-signed certificate: Causes a browser security warning, not incorrect name resolution.
• Nameserver record: A DNS problem would typically affect multiple users, not just one workstation.
• IP helper: Relays services such as DHCP across network segments; it does not resolve website names.

• TLS passthrough: A TCP listener does not decrypt traffic. The client establishes TLS directly with the backend, so the backend can perform mutual TLS (mTLS) authentication.
• gRPC over TCP: gRPC commonly uses HTTP/2 over TLS, and an NLB can forward the underlying TCP connections without modifying them.
• Scalability: Registering the Pods as IP targets allows Kubernetes to add or remove Pods as the Horizontal Pod Autoscaler changes the workload. The AWS Load Balancer Controller updates the target registrations.
• Port 443: The NLB can forward TCP traffic on port 443 without terminating TLS.

• An ALB HTTPS listener terminates TLS at the load balancer, violating the requirement that traffic must not be decrypted before reaching the backend.
• Targeting the EKS node group's Auto Scaling group does not directly track dynamically scaling Pods.
• An NLB TLS listener also terminates TLS at the NLB, preventing end-to-end mTLS between the client and backend.

• D — Value analysis: Correct. It examines an existing product to identify ways of reducing its cost while still providing the required functions, quality and reliability.
• E — Kaizen costing: Correct. It involves making continuous, small improvements and cost reductions while the product is already in production.

• Functional analysis: It is not limited to minimizing the cost of the originally defined functions. It examines what functions are required and how they can be provided at the lowest overall cost.
• Value engineering: Usually applies to the design and development of a new product, rather than being a fundamental redesign of existing organisational processes. That description is closer to business process re-engineering.
• Target costing: The target cost is generally established during the product development stage, before production begins. It is not continuously reset while the product is in production.

• Least privilege: Limits users to only the access necessary for their job.
• Background checks: Help identify potentially risky individuals before employment.
• Separation of duties: Ensures that one person cannot complete a sensitive process alone, reducing fraud and abuse.

• A — Capacity: The system must handle all current records and anticipated future records. A system that cannot cope with volume will quickly become ineffective.
• C — Accuracy: Academic records are critical, so the new system must be at least as accurate as the existing system and comparable systems. Poor accuracy could cause serious administrative and reputational problems.
• D — Integration: Linking with the university’s financial systems supports consistency and avoids duplicate data entry, especially for registration, deregistration and fee-related transactions.

• B — Parallel running: This is a useful implementation and risk-control technique, but it is not an essential feature of the system itself. It may also be expensive and time-consuming.
• E — Internet access for all information: This creates significant confidentiality and security risks. External access might be needed for selected services, but unrestricted access to all information is not essential and would be inappropriate for student records.

apex 
Set<Id> accountIds = new Set<Id>{ accountId1, accountId2 }; 


List<Account> accounts = [ 
    SELECT Id, Name 
    FROM Account 
    WHERE Id IN :accountIds 
];

• A: LIMIT accepts a number, not a collection of IDs.
• B: Set.containsAll() checks set contents in Apex; it does not filter SOQL results.
• C: Database.query() accepts a dynamic SOQL string, not a Set<Id> directly.

• Set credit quotas for an account or individual virtual warehouses.
• Define monitoring intervals.
• Trigger actions when usage reaches thresholds, such as sending notifications or suspending a warehouse.
• Help control unexpected warehouse spending.

• Account Usage: Provides historical usage and billing data; it does not enforce credit limits.
• Warehouse Limit Parameter: Not the Snowflake object used for account-wide credit controls.
• Credit Consumption Tracker: Not a standard Snowflake object.

• Process Builder: Automates actions based on record changes but does not create interactive forms.
• Approval Process: Routes records for approval; it is not designed to collect information through a wizard.
• Outbound Message: Sends information to an external system; it does not provide a user interface.

• PC A: 192.168.1.10/24
• PC B: 192.168.2.10/24

• Both PCs have a correct default gateway
• A router or Layer 3 switch connects the subnets
• Routing and firewall rules allow the traffic

• The table is large.
• Queries frequently filter or join on particular columns.
• The table’s natural data order does not support good micro-partition pruning.
• Clustering improves performance enough to justify its maintenance cost.

• Menerjemahkan soal ke bahasa Indonesia.
• Menyebutkan jawaban yang benar.
• Menjelaskan alasan jawaban tersebut.
• Memberi tahu jika kunci jawaban yang tersedia tampaknya keliru.
• Menjelaskan istilah teknis penting dalam soal.

• Business
• People
• Governance
• Platform
• Security
• Operations

• Sustainability
• Performance efficiency
• Reliability

• Actions that call external APIs
• Subflows
• Connection and credential aliases
• Supporting integration logic

• Action — A reusable operation within a flow, such as “Create a record” or “Send email.”
• Connection — Defines how ServiceNow authenticates and communicates with an external system.
• Integration step — A general flow step, not the name for the packaged integration.

• Internal audit: Reviews the organization’s own controls and processes.
• Penetration testing: Actively tests systems for exploitable vulnerabilities.
• Attestation: A SOC 2 report is an attestation product issued by an independent auditor, but the analyst is not performing the attestation. They are reviewing it as part of vendor evaluation.

• The underside clips or hinges are broken.
• The cap is stuck, loose, or misaligned.
• The cap no longer presses the switch correctly.
• The cap itself is missing or physically damaged.

• Authentication: Verifies who the user is.
• Authorization: Determines what the authenticated user is allowed to access.
• Accounting: Records activity such as login times and resource usage.

• CIA: Confidentiality, integrity, and availability—the three core security goals.
• ACL: Access Control List, which defines permitted or denied traffic or access.
• PEM: A certificate and key encoding format, not the primary function of RADIUS.

• Complete MFA, or
• Securely change their password

• Identity Protection: evaluates user and sign-in risk and can trigger remediation.
• Privileged Identity Management (PIM): manages temporary, just-in-time access to privileged roles; it does not automatically require password changes for risky sign-ins.

• UPS battery-backed outlets: Connect only essential devices needed during an outage:

• Surge-protector-only outlets: Connect nonessential devices, especially the printer. Printing does not need to continue while you are saving work and shutting down.
• UPS power source: Plug the UPS directly into a wall outlet.
• Surge protector power source: Plug it directly into a wall outlet as well. Do not normally plug a surge protector into the UPS, because that creates a daisy chain and can overload the UPS.

Manager role

DAX 
Country[Manager] = USERPRINCIPALNAME()

• Sales
• Human Resources

CFO role

• See sales for all countries
• See no Human Resources data

• Do not restrict the Country table or Sales table.
• Apply a filter to Human Resources that always returns false, such as:

DAX 
FALSE()

1. Discovery tries the SSH probe first.
2. SSH fails.
3. Discovery tries SNMP, which succeeds.
4. Discovery records SNMP as the preferred service for that IP.
5. Future discoveries try SNMP first.

• Classification identifies the type of device, such as a server, router, or printer.
• Credential affinity remembers which credentials work for a device.
• MID Server affinity associates a device or network with a particular MID Server.
• IP service affinity specifically controls the preferred discovery protocol or service.

• Accept: Acknowledge the risk and take no additional action.
• Transfer: Shift the risk or its financial impact to another party, such as through insurance or outsourcing.
• Mitigate: Reduce the likelihood or impact of the risk, such as by implementing security controls.
• Avoid: Eliminate the activity or exposure that creates the risk.

• A. IDS attack signatures: An IDS primarily detects suspicious network activity; it is not the best tool for scanning uploaded files.
• C. Load balancer: Improves availability and distributes traffic but does not inspect files for malware.
• D. WAF: Protects web applications against attacks such as SQL injection and command injection. It may inspect HTTP requests, but malware scanning of uploaded PDFs is the key requirement here.

• Deterrent control: The signs warning people they may be filmed discourage unauthorized or malicious behavior. They may prevent incidents by influencing behavior, but their primary purpose is to deter.
• Detective control: The CCTV system monitors and records activity so security personnel can identify suspicious or unauthorized actions.

• Preventive: Blocks or prevents an incident, such as a lock or access-control system.
• Corrective: Fixes or restores systems after an incident.
• Directive: Tells people what they must do, typically through policies or procedures.
• Compensating: Provides an alternative control when the preferred control cannot be used.

• Identity: User-assigned managed identity

• Authorization: Azure RBAC

• Feedback form: Captures opinions, not necessarily actual behavior; users may not respond.
• Questionnaire: Relies on memory and subjective judgments about usefulness.
• Interviews: Can provide valuable qualitative insights, but a sample of users may not represent overall usage accurately.

1. Open the Microsoft Entra Connect wizard.
2. Select Configure.
3. Choose Customize synchronization options.
4. Authenticate when prompted.
5. On the Domain and OU filtering page, select:

1. Complete the wizard.

• Start-ADSyncSyncCycle only starts synchronization; it does not change which OUs are included.
• Manage federation configures federation settings, which are unrelated to OU filtering.
• Add-ADSyncConnectorAttributeInclusion concerns connector attributes, not selecting additional OUs for synchronization.

• Dark web: A place where leaked credentials may be sold or shared, not usually the original source.
• Threat feeds: Collections of intelligence about threats, not a typical leakage source.
• State actors: A type of attacker, not an accidental corporate disclosure source.
• Vulnerability databases: Track known vulnerabilities, rather than leaked credentials.

• Prevention costs: Avoiding defects, such as staff training and improved product design. The company has invested in these.
• Appraisal costs: Detecting defects before products reach customers, such as inspection and testing. The planned batch sampling has not been implemented.
• Internal failure costs: Correcting defects found before delivery.
• External failure costs: Dealing with defects after delivery, such as refunds, replacements, complaints and lost sales.

• Tokens: Individual units of text processed by a model, such as words, subwords, or characters.
• Models: Systems that learn patterns and generate predictions or outputs.
• Binaries: Data represented using the binary number system, not semantic representations.

Statement 1 — Correct

Statement 2 — Correct

• Accept: Acknowledging the risk without taking additional action.
• Transfer: Moving the risk’s financial impact to a third party, such as an insurer.
• Mitigate: Reducing the likelihood or impact through controls, such as patching or employee training.
• Avoid: Eliminating the activity that creates the risk.

• terraform init is normally required first, especially for a new or changed working directory. It installs providers/modules and configures the backend.
• terraform plan previews the proposed changes.
• terraform apply applies those changes. It also creates a plan internally if you have not supplied a saved plan.

text 
terraform init 
terraform validate       # optional but recommended 
terraform plan 
terraform apply