Financial CMA Exam Prep
Certified Management Accountant (Page 91 )

• Authentication: Verifies who the user is.
• Authorization: Determines what the authenticated user is allowed to access.
• Accounting: Records activity such as login times and resource usage.

• CIA: Confidentiality, integrity, and availability—the three core security goals.
• ACL: Access Control List, which defines permitted or denied traffic or access.
• PEM: A certificate and key encoding format, not the primary function of RADIUS.

• \Pipeline1
• \Folder1\Lakehouse1

• Pipeline1 remains at the workspace root in Workspace1, so it is deployed to the root of Workspace2.
• Lakehouse1 was moved into Folder1, so its full path is preserved as \Folder1\Lakehouse1.
• Fabric deployment pipelines preserve folder paths because an item’s full path is treated as part of its name.

• Customer needs: Primary focus in agile; guides prioritization and decision-making.
• Organization’s needs: Important constraints, but processes should be tailored when they create waste.
• Agile lead/project manager: Their role is to facilitate value delivery, not prioritize their own preferences.

• B — The most significant risks are held by SQ.

• C — SQ should recognise the cars as inventory.

• F — SQ recognises revenue when LM sells a car to a third party.

• A: LM does not hold the most significant risks.
• D: LM does not recognise the cars as inventory.
• E: SQ should not recognise revenue when cars are merely delivered to LM.

• User-generated content: precisa ser coletado, filtrado, anonimizado e rotulado.
• Moderation logs: podem conter dados inconsistentes, informações pessoais e decisões que precisam ser revisadas.
• Content moderation guidelines: são regras ou orientações, não dados diretamente utilizáveis para medir o comportamento do modelo.

• Escape to host: A virtualization attack where code escapes a guest VM and accesses the host system. Nothing in the scenario mentions virtualization.
• Browser extension: Can redirect or manipulate web-browser traffic, but not normally database-server traffic.
• Valid accounts: Describes using stolen or compromised credentials, not redirecting network traffic.
• Process injection: Injecting malicious code into a legitimate database or networking process could allow an attacker to alter how that process handles outgoing traffic.

• Verifies the sender’s identity using their private key.
• Confirms the transaction was not altered after signing.
• Provides evidence that the signer approved or originated the transaction.

• Digital certificates: Bind an identity to a public key, but do not themselves prove that a specific transaction was signed.
• Encrypted passwords: Protect confidentiality or authentication, but generally do not provide transaction-level nonrepudiation.
• One-time passwords: Authenticate a user for a session or transaction, but usually do not provide durable proof of who authorized the electronic record.

• Training data for potential bias before model training
• Trained models for bias in predictions
• Model features to help explain how they influence predictions

• A: RAG workflows are typically built using services such as Amazon Bedrock, knowledge bases, and data sources.
• B: Monitoring model quality in production is primarily associated with SageMaker Model Monitor.
• C: Documenting model details is handled by capabilities such as SageMaker Model Cards.

• IKE (Internet Key Exchange) negotiates the IPsec security association, including:

• ESP (Encapsulating Security Payload) protects the data after negotiation by providing encryption and optionally authentication.
• AH provides authentication and integrity but does not encrypt traffic.
• TLS is used for protocols such as HTTPS, not for negotiating IPsec parameters.

• Highly polished, organization-wide presentations
• Advanced dashboard design and customization
• Broader business-user distribution and interaction
• Specialized BI governance and modeling features

Step 1: Calculate the rights issue price

Step 2: Calculate the number of new shares

Step 3: Calculate the value after the issue and project

• Rights issue proceeds: $21.6m
• Project NPV: $5m

Step 4: Calculate the theoretical ex-rights price

• Business
• People
• Governance
• Platform
• Security
• Operations

• Sustainability
• Performance efficiency
• Reliability

• ??????? ?? ??????? ????? ?? ???? Discount ????? ????? ??? 0.05.
• ?? Power Query Editor? ???? ???? Discount ?? ????:

• ???? ?????? 0.05.

• Remove Errors: ???? ?????? ???? ????? ??? ?????? ???? ????? ??? ???????? ??? ??????.
• Keep Errors: ????? ??? ??????? ???? ??? ?????? ???? ??? ???????.
• Edit the query in the Query Errors group: ???? ?? ???? ????????? ???????? ???? ?? ?????? ??? ????? ???? ???????? ???????.

• Crash cart: Provides local physical access, not remote access.
• Jump box: A secured intermediary used to reach devices over the normal network; it may be inaccessible if the appliance has not booted.
• Secure Shell (SSH): Requires the device’s operating system and network services to be running properly.

• Driver node: Coordinates Spark jobs and runs in the compute environment.
• Worker node: Executes tasks and processes data.
• Databricks Filesystem (DBFS): Provides storage access for data used by compute resources.

• Physical: Protects facilities or equipment, such as locks and security cameras.
• Technical: Uses technology, such as firewalls, encryption, or access controls.
• Operational: Covers day-to-day actions and processes, such as training, backups, or incident response.
• Managerial: Includes policies, standards, risk assessments, and procedures.

• File policy in Microsoft Defender for Cloud Apps: Can detect activity involving files, but it is not designed specifically to investigate risk from departing or deleted users.
• Access review policy in Microsoft Entra: Reviews whether users should retain access to resources; it does not detect historical document downloads.
• Alert policy in Microsoft Defender for Office 365: Primarily handles alerts for email and collaboration threats, not insider-risk investigations involving departed users.

• Plenum: Describes a fire-resistant cable jacket rating, not a transmission medium or speed.
• Ethernet: Describes a networking technology; Ethernet can use copper or fiber, so the term alone does not identify the fastest cable type.
• DAC (Direct Attach Copper): Uses copper and is typically intended for short-distance, high-speed connections in data centers.

• Job Links ? URL ID: Mainly summarizes link performance; it is not the easiest place to retrieve individual email addresses by alias.
• Tracking Overview ? Clicks: Provides aggregate click metrics, not a targeted list for one aliased link.
• Click Activity ? Link View: Focuses on link-level reporting, but the question’s intended workflow for locating clicks tied to a specific placement/alias is Email Overlay.

• The backup file is complete and uncorrupted.
• The required data can actually be recovered.
• The recovery process and documentation work as expected.
• Recovery objectives, such as acceptable downtime, can be met.

• Backup logs may show that a job completed, but not that the backup is usable.
• File size does not prove the contents are valid.
• Email notifications may confirm process completion, not recoverability.
• Appointing a DBA does not itself validate backups.

• Key-based authentication: Provides an endpoint secured with API keys.
• Real-time REST access: Supports online inference through an HTTP/REST endpoint.
• No VM vCPU quota consumption: Microsoft hosts and manages the underlying infrastructure, so your subscription’s VM quota isn’t used.

• Batch: Intended for asynchronous, large-volume processing rather than real-time requests.
• Self-hosted container: You manage the infrastructure and typically need compute resources and quota.
• Standard: This is not the clearest deployment type for the stated requirements; the specific Foundry option is serverless API.

• A. Adjust resolution: Incorrect because an incompatible resolution usually causes no display, distortion, or an unsupported-mode message—not intermittent flickering.
• B. Swap the HDMI cable: Correct. Replacing the common, easily tested component is the appropriate troubleshooting step.
• C. Replace the projector: Incorrect because the issue also occurs with a monitor.
• D. Configure refresh rate: A mismatched refresh rate can cause visual problems, but the repeated flicker across displays points more strongly to the cable.

• Create a CodeCommit repository in the secondary Region.
• Use CodeBuild to run a Git mirror operation from the primary repository to the secondary repository.
• Use EventBridge to detect relevant repository events, such as a pull request being merged.
• Invoke a Lambda function, which starts the CodeBuild project.

• B: Amazon S3 is object storage, not a Git repository that developers can use as a CodeCommit remote.
• C: CodeArtifact is intended for packages and artifacts, not source-code repository mirroring.
• D: An AWS Cloud9 environment is not an appropriate automated replication mechanism and would require manual or persistent infrastructure management.

• Menerjemahkan soal ke bahasa Indonesia.
• Menyebutkan jawaban yang benar.
• Menjelaskan alasan jawaban tersebut.
• Memberi tahu jika kunci jawaban yang tersedia tampaknya keliru.
• Menjelaskan istilah teknis penting dalam soal.

• D — Value analysis: Correct. It examines an existing product to identify ways of reducing its cost while still providing the required functions, quality and reliability.
• E — Kaizen costing: Correct. It involves making continuous, small improvements and cost reductions while the product is already in production.

• Functional analysis: It is not limited to minimizing the cost of the originally defined functions. It examines what functions are required and how they can be provided at the lowest overall cost.
• Value engineering: Usually applies to the design and development of a new product, rather than being a fundamental redesign of existing organisational processes. That description is closer to business process re-engineering.
• Target costing: The target cost is generally established during the product development stage, before production begins. It is not continuously reset while the product is in production.

• A — .gitignore: Controls Git tracking; it does not configure Copilot exclusions.
• B — copilot.ignore: This is not the standard GitHub Copilot Business exclusion mechanism.
• D — Renaming files: Adding _no_copilot has no recognized effect.

• Vulnerability scanner: Identifies technical weaknesses in systems, applications, or devices.
• Penetration test: Simulates attacks to determine whether vulnerabilities can be exploited.
• SCAP (Security Content Automation Protocol): Uses standardized formats and protocols for automated vulnerability, configuration, and compliance checks.
• Illumination tool: Maps and analyzes broader supply-chain exposure and third-party risk.

• Use the grant-date fair value: $30
• Do not remeasure to the year-end value of $45
• Update the estimate of employees expected to vest

• Dr Share-based payment expense $450,000
• Cr Equity/share option reserve $450,000

• Case Assignment Rules normalmente são avaliadas quando o caso é criado. Elas podem ser executadas novamente em uma edição somente se o usuário marcar “Assign using active assignment rules”; isso não acontece automaticamente apenas porque o caso foi fechado.
• Portanto, criar uma regra de atribuição não corrige os centenas de casos já fechados e não garante, por si só, que um caso será transferido antes de ser fechado.

• B — Usar uma ferramenta de dados: corrige os registros históricos já existentes, atualizando o Owner.
• D — Criar uma regra de validação: impede que um caso seja fechado enquanto ainda pertence a uma fila. Exemplo conceitual: se Status = Closed e o proprietário for uma fila, bloquear o salvamento.

• Each directory is a separate identity boundary.
• Managing multiple directories increases administrative overhead.
• Users and administrators may need separate identities or additional configuration across tenants.
• Resources in a subscription are associated with one Microsoft Entra tenant.

• Management groups for governance across subscriptions
• Separate subscriptions for divisions when appropriate
• Resource groups to organize resources
• Azure role-based access control (RBAC) to give each division’s administrator access only to their own resources

• Treatment one – easier to prepare: Convenience for the accounting team is not the main objective of financial reporting.
• Treatment two – fair representation: This is the correct choice because financial statements must faithfully represent the underlying transaction and its economic substance.
• Treatment three – maximises profit: Accounting policies must not be selected simply to manipulate or inflate reported profit.
• Treatment four – easier to understand: Understandability is important, but it cannot justify presenting information that is less faithfully represented.

• Something you know: Password or PIN
• Something you have: Security token, smart card, or phone receiving an authentication code
• Something you are: Fingerprint or facial recognition
• Somewhere you are: Location-based verification

1. Write a structured log entry to CloudWatch Logs containing:

1. Create a CloudWatch Logs metric filter that:

text 
ApiRequests 
Operation=GetOrders 
ResponseCode=500 
Version=2.4.0

• B is incorrect: CloudWatch Logs Insights queries analyze logs but do not directly publish metrics in this manner.
• C is incorrect: ALB access logs do not contain arbitrary Lambda response metadata as custom fields.
• D is incorrect: X-Ray traces and insights are not the appropriate mechanism for creating these custom, dimensioned application metrics.

• Allow the team to identify the causes of delays.
• Encourage improvements to processes, tools, and collaboration.
• Help remove impediments without dictating solutions.
• Protect quality and maintain a sustainable pace.

• A: An impediment log may help track issues, but merely recording them does not resolve the root causes.
• B: Directing teams toward solutions conflicts with the agile principle of a self-managing team.
• C: Adding impediments to the product backlog may delay their resolution and incorrectly treats them as product features.

• Minimum
• Maximum
• Average
• Count
• Null/empty values
• Distinct values

• Enable column profile
• Enable details pane
• Show column profile in details pane

• A — Use getRecordTypeInfosByDeveloperName()

apex 
  Id rtId = Schema.SObjectType.Account 
      .getRecordTypeInfosByDeveloperName() 
      .get('Business_Account') 
      .getRecordTypeId();

• C — Query the RecordType object

apex 
  RecordType rt = [ 
      SELECT Id 
      FROM RecordType 
      WHERE SObjectType = 'Account' 
      AND Name = 'Business Account' 
      LIMIT 1 
  ];

• B: An outbound SOAP call is unnecessary and inefficient.
• D: Hardcoding an ID is not dynamic, and IDs can differ between orgs.

• Response and resolution times
• Availability or uptime
• Performance targets
• Support obligations
• Penalties for failing to meet commitments

• SOW (Statement of Work): Describes the work, deliverables, scope, and tasks.
• MOA (Memorandum of Agreement): Documents a formal agreement about roles or responsibilities.
• MOU (Memorandum of Understanding): Records a general mutual understanding, often without detailed service metrics.

Manager role

DAX 
Country[Manager] = USERPRINCIPALNAME()

• Sales
• Human Resources

CFO role

• See sales for all countries
• See no Human Resources data

• Do not restrict the Country table or Sales table.
• Apply a filter to Human Resources that always returns false, such as:

DAX 
FALSE()

• Additional running costs: $800
• Less depreciation: $300

• The $100 reduction in fixed production overhead absorbed is only an accounting reallocation. It does not represent an actual saving in total fixed overhead.

• Customers may boycott V’s products.
• Supermarket customers may stop buying from V.
• Investors may view V as having higher legal, ethical and reputational risk.
• V could face fines, lawsuits, contract losses and higher costs.
• Expected future profits may fall.

• Injection
• Broken access control
• Authentication failures
• Security misconfiguration
• Cross-site scripting

• STIX: A standardized language and format for exchanging threat intelligence.
• OVAL: Used to describe and assess system vulnerabilities and configuration issues.
• Threat intelligence feed: Provides current indicators and intelligence about threats, but not necessarily a structured overview of common application exploitation methods.
• CVE: A catalog of individually identified, publicly disclosed vulnerabilities.

• Ramen is a Linux worm associated with Red Hat Linux 6.2 and 7.0 systems.
• It spreads by scanning randomly generated IP addresses using tools such as synscan.
• It exploits vulnerable network services, including web-related services, and may leave malicious files or altered web content.
• The tar.gz file is also a clue because it is a common Linux archive/package format.

• Code Red: Primarily targeted Microsoft IIS servers running Windows.
• LoveLetter: Spread mainly through email attachments.
• Nimda: A Windows-based worm that spread through email, web servers, and network shares.

• If the attachment is safe, it is released to the user.
• If malware is detected, the attachment is blocked or removed according to the policy.
• This reduces delivery delays without disabling malware scanning.

• Replace removes the original attachment and replaces it with a text file explaining that it was blocked. It does not primarily optimize delivery time.
• Block and Enable redirect blocks messages with suspicious attachments and can redirect them for review; it does not provide the required faster delivery experience.
• Monitor and Enable redirect is for observation and does not reliably block malicious attachments.

• The message came from the claimed sender (authentication)
• The message was not altered in transit (integrity)
• The sender cannot easily deny having signed and sent it (non-repudiation)

• Compliance standards: May be a reason in some organizations, but it is not the primary security benefit.
• Increase delivery rates: Digital signatures do not generally improve email delivery.
• Block phishing attacks: Signatures can help recipients verify legitimate messages, but they do not block phishing by themselves.

Correct sequence

1. Merge Sales_Region with Sales_Manager using an inner join

1. Merge Region_Manager with Manager using an inner join

1. Merge Sales_Region and Region_Manager using a right join as a new query

• Create procurement-manager-role only in the shared services accounts, where procurement managers operate.
• Attach AWSPrivateMarketplaceAdminFullAccess to that role.
• Procurement managers assume the role when they need to administer Private Marketplace.
• Apply a root-level SCP that explicitly denies Private Marketplace administration to everyone except that role. The SCP acts as a maximum-permission boundary across member accounts.
• Add another SCP denying creation of a role with the same name. Otherwise, another administrator might create a similarly named role and bypass the intended exception.

• Creating the role in every account increases administration and creates more opportunities for misuse.
• A permissions boundary on developer roles does not prevent other administrators from managing Private Marketplace.
• Applying the SCP only to shared services accounts would not protect the rest of the organization.

DAX 
Blue Sales = 
CALCULATE( 
    [Total Sales], 
    KEEPFILTERS('Product'[Color] = "Blue") 
)

• CALCULATE evaluates [Total Sales] after applying an additional filter.
• 'Product'[Color] = "Blue" restricts the calculation to blue products.
• KEEPFILTERS ensures the existing filter context is preserved. For example, filters for year, region, or customer remain active. If Color is already filtered, the blue condition is applied as an intersection rather than replacing the existing filter.
• Avoid ALL, because it removes filters and would not maintain the existing context.

• Amazon S3 as the origin for static content
• Application Load Balancer (ALB) as the origin for dynamic content
• Amazon Route 53 configured to point the company’s domain name to CloudFront

• /static/* ? S3 origin; cache content at edge locations
• Dynamic paths such as /api/* ? ALB origin; forward requests to the EC2 application

• VLAN 10 for data
• VLAN 20 for voice

• A: Describes physical trunking or logical switch ports, not an SVI.
• B: An SVI can provide management access, but that is only one use—not the best description here.
• D: SVI use is not related to running out of physical ports.