Financial SOFA-CFE Exam Prep
Certified Financial iner (Page 32 )

• Suspended an operator who correctly refused to use unsafe equipment.
• Rewarded another operator for using the equipment despite the broken safety guard.

• A — Management is not particularly concerned with managing risks.

• B — Employees will perceive that management does not care about health and safety risks.

• C — This factory’s safety record is likely to be poor.

• AWS Network Firewall can inspect and block traffic across a VPC when traffic is routed through the firewall. A Drop action rule can deny traffic from the suspicious source IP.
• GuardDuty findings are sent to Security Hub.
• A Lambda function can be invoked when Security Hub receives a new GuardDuty finding, extract the source IP, and update the Network Firewall policy with a blocking rule.

• GuardDuty threat lists: Used to identify or increase the severity of findings; they do not directly block VPC traffic.
• AWS WAF: Protects supported web applications, such as CloudFront or Application Load Balancers. It does not provide general VPC-wide traffic blocking.
• GuardDuty suppression rules: Suppress or hide findings. They do not block the suspicious traffic.

• Maximum response and resolution times
• Expected uptime or availability
• Performance requirements
• Escalation procedures
• Consequences for failing to meet requirements

• SOW: Defines a project’s scope, tasks, deliverables, and schedule.
• MOA: Documents specific responsibilities agreed upon by two parties.
• MOU: Records a general understanding or intent to cooperate.

1. Yes — Microsoft Foundry provides a secure, governed environment for building and managing generative AI applications and agents. It brings together models, data, tools, evaluation, deployment, and monitoring.

1. Yes — Foundry is designed for enterprise workloads and supports scaling AI applications as usage grows. Scalability comes from the underlying Azure services and managed infrastructure.

1. Yes — Foundry can be used in solutions involving image recognition and computer vision. Applications can use vision-capable models and Azure AI vision capabilities for tasks such as image analysis, object detection, and OCR.

• Response and resolution time frames
• Availability or uptime requirements
• Performance targets
• Support obligations
• Penalties for failing to meet requirements

• SOW (Statement of Work): Defines the project’s scope, tasks, and deliverables.
• MOA (Memorandum of Agreement): Describes cooperation and responsibilities between parties.
• MOU (Memorandum of Understanding): Records a general mutual understanding, usually without detailed enforceable service targets.

• A static IP gives the surveillance system a predictable local address, so users can reliably reach it on the LAN.
• However, a static IP does not block internet-based login attempts. If the router exposes the device through port forwarding, attackers could still reach it.
• Port mapping normally exposes an internal service externally, so A is a poor choice as written.
• Subnetting alone also does not block traffic; it would require routing/firewall rules.

• Restrict a port to a defined number of MAC addresses
• Use statically assigned or “sticky” MAC addresses
• Shut down or restrict the port when violations occur

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect suspicious network activity, but is not the primary control for limiting switch MAC entries.
• NGFW: Filters traffic at the network boundary; it does not directly prevent MAC table flooding on access switches.

• The S3 bucket as an origin for static content
• The Application Load Balancer (ALB) as an origin for dynamic content
• An Amazon Route 53 alias record pointing the application domain to CloudFront

Why this works

• Static data: CloudFront caches objects from S3 at edge locations, reducing latency for users worldwide.
• Dynamic data: CloudFront forwards requests that require application processing to the ALB. It can also maintain persistent connections and use the AWS global edge network to improve delivery performance.
• One domain: CloudFront behaviors can route different path patterns to different origins—for example, /static/* to S3 and other paths to the ALB.

Why the other options are incorrect

• Global Accelerator is designed primarily for accelerating traffic to applications with endpoints such as ALBs, not for caching S3 content.
• Using separate domains or splitting static and dynamic traffic adds unnecessary complexity.
• CloudFront already provides the required global edge distribution and caching, so combining it with Global Accelerator is unnecessary here.

• IaaS: You deploy and manage virtual machines, including the operating system and installed software. Azure manages the physical datacenter, hosts, and networking infrastructure.
• PaaS: Azure manages the infrastructure and operating system, while you deploy and manage your application code. Examples include Azure App Service and Azure Functions.

• File is shared externally ? Access level

• File is labeled “Internal only” ? Sensitivity label

• Documented and formally requested
• Analyzed for security, cost, and operational impact
• Reviewed and approved by the appropriate personnel
• Tested before implementation
• Tracked and reversible if problems occur

• Risk management process: Identifies and evaluates risk, but does not directly authorize design changes.
• Product design process: Applies primarily while creating or developing the product.
• Design review process: May have identified the issues, but the next step for changing an already released design is controlled change management.

• MFA: Protects sign-in and authentication.
• Azure Key Vault: Protects deployment secrets and credentials.
• Answer: No (B).

• Bronze: Raw ingested data
• Silver: Cleaned, validated, and transformed data
• Gold: Business-level data for analytics, dashboards, and reporting

• Create a CodeCommit repository in the secondary Region.
• Use CodeBuild to run a Git mirror operation from the primary repository to the secondary repository.
• Use EventBridge to detect relevant repository events, such as a pull request being merged.
• Invoke a Lambda function, which starts the CodeBuild project.

• B: Amazon S3 is object storage, not a Git repository that developers can use as a CodeCommit remote.
• C: CodeArtifact is intended for packages and artifacts, not source-code repository mirroring.
• D: An AWS Cloud9 environment is not an appropriate automated replication mechanism and would require manual or persistent infrastructure management.

1. Identify the fact table

• Records something that happened, such as a sale, test, appointment, or measurement
• Contains foreign keys to other tables
• Contains measures or numeric results
• Has many rows

2. Identify a dimension table

• Describe people, products, dates, locations, or departments
• Contain descriptive columns
• Are referenced by the fact table
• Have fewer rows than the fact table

3. Identify the surrogate key

• System-generated
• Unique within the dimension
• Often named PatientKey, CustomerKey, or similar
• Usually an integer
• Not meaningful outside the model

• File hashes
• Strings and metadata
• Binary or code structure
• Known malicious patterns
• Embedded indicators or signatures

• Sandbox: Executes the file in an isolated environment; useful for observing behavior, but usually slower.
• Network traffic analysis: Examines communications generated by a system or application, not the file itself.
• Package monitoring: Tracks software packages or installations and is not the primary method for examining malware signatures.

• Default network device credentials: More associated with external attackers or poor device configuration.
• Spear phishing emails: Commonly used to compromise users, but less characteristic of an insider who already has access.
• Typosquatting and impersonation: Primarily social-engineering techniques aimed at deceiving users.
• Unidentified removable devices: Provide a direct way to transfer data outside the organization and may bypass network monitoring.

• Build, measure, learn: Create something, assess real feedback or results, and adapt.
• Minimum viable product (MVP): Produce the smallest useful version to test assumptions and reduce uncertainty.
• Fail fast: Test ideas early so that unsuccessful approaches can be identified before significant time or cost is invested.

• Static IP address: Not needed if the workstation already has network connectivity.
• Subnet mask: Incorrect subnetting would usually prevent local communication, including pinging the server.
• Default gateway: Primarily affects communication outside the local network; it does not normally prevent finding an internal domain controller.

• Matching hashes: The software likely has not changed.
• Different hashes: The software was modified or corrupted.

• Encryption: Protects confidentiality by making data unreadable; it does not primarily detect changes.
• Baselines: Define an approved system or configuration state, but they are not the specific integrity mechanism here.
• Tokenization: Replaces sensitive data with substitute values.

• Un AG puede tener réplicas en Windows y Linux desde SQL Server 2017; por tanto, una réplica Windows y otra Linux es posible.
• Sin embargo, las réplicas de un AG deben utilizar normalmente la misma versión principal de SQL Server. Una instancia SQL Server 2017 no puede tener directamente una réplica secundaria SQL Server 2019 como configuración normal y permanente.
• En tu escenario, SQL Server 2017 en Windows y SQL Server 2019 en Linux no se pueden añadir directamente como réplicas equivalentes de AG1. Primero habría que realizar un proceso de actualización/migración compatible, por ejemplo mediante una actualización gradual o una tecnología de migración como log shipping o distributed availability groups, según el diseño.

• Tipo de clúster y mecanismo de quorum.
• Failover normalmente manual en configuraciones multiplataforma.
• Edición y características compatibles.
• Configuración de endpoints y permisos.
• Limitaciones específicas de SQL Server en Linux.

• Identified risks
• Risk owners or responsible parties
• Likelihood and impact
• Risk response plans
• Current status
• Risk thresholds or trigger conditions

• Risk tolerance: The amount and type of risk an organization is willing to accept; it is not primarily a tracking document.
• Risk transfer: Moving the financial or operational impact of a risk to another party, such as through insurance or outsourcing.
• Risk analysis: The process of evaluating a risk’s likelihood and impact.

• The JSON files contain one billion items, so this is a big-data workload.
• PySpark uses Apache Spark’s distributed, parallel processing, allowing the data to be processed across multiple compute nodes.
• It can read and transform data directly from OneLake, helping minimize unnecessary data movement or duplication.
• A Fabric notebook can also support exploration and visualization, as well as Spark-based analytics and anomaly-detection workflows.

• Pandas is primarily in-memory and generally suited to smaller datasets. One billion records would be impractical on a typical single machine.
• A Power BI report with core visuals is appropriate for visualization and sharing, but it is not the best tool for large-scale transformation, parallel processing, or anomaly detection. It would normally consume prepared data rather than perform the entire workload.

• The product is already in production.
• The organization is examining the product’s functions and cost drivers.
• The objective is to reduce cost without reducing perceived value or required quality.

• Kaizen costing focuses on continuous, usually incremental, cost reductions during the manufacturing stage. It is not specifically the systematic examination of a product’s functions.
• Standard costing compares actual costs with predetermined standards; it is a control technique, not a product redesign method.
• Process innovation concerns developing significantly improved production processes, rather than analysing the product’s functions and value.

• Configure row-level security (RLS) using the sales region and the HR manager’s identity.
• Publish the reports and datasets through a Power BI app.
• Grant the HR managers permission to use the app, but do not add them as workspace members.
• App users can view and interact with reports while RLS limits them to their region.
• They cannot modify the report layout because they do not have workspace editing permissions.

• Adding them to the workspace gives them workspace permissions that may allow report or dataset changes, depending on the assigned role.
• Creating copies is unnecessary and creates maintenance and security problems.
• Hosting datasets and reports in different workspaces does not, by itself, provide the required controlled access.

• Share files with the wrong people
• Use public links unnecessarily
• Fail to classify sensitive data
• Upload data to unauthorized services
• Misunderstand company sharing policies

• A — Step-up authentication: Helps protect administrator accounts, but does not directly address improper file sharing by users.
• C — Password complexity: Helps reduce password attacks, not accidental data disclosure.
• D — Mobile device management: Secures managed mobile devices, but does not directly control file-sharing behavior across the organization.

• A valid input returns the expected result
• An invalid input raises an error
• Boundary values are handled correctly

• B: Copilot may help generate tests, but it does not automatically write all necessary tests.
• C: Writing the implementation does not verify that it works correctly.
• D: Copilot can suggest test commands or test code, but the developer or development environment must execute and validate the tests.

• A. Periodically rotate responsibilities: May reduce some risks, but it does not directly detect unauthorized changes.
• B. Review segregation-of-duties conflicts: Identifies incompatible access combinations, not whether a specific data change was unauthorized.
• C. Log changes in an outside application: Logs provide evidence, but someone must review and analyze them. Logging alone does not detect misuse.
• D. Independent review: Directly detects unauthorized changes and reduces the risk that the person making the change can conceal it.

apex 
for (Account updatedAccount : Trigger.new) { 
    AccountTriggerHelper.notinyxternalSystem(updatedAccount.Id); 
}

• Too many callouts: The callout occurs asynchronously in the future method, and each future transaction can perform its permitted callouts.
• Too many SOQL queries: The SOQL query is inside the future execution, not repeatedly in the trigger transaction.
• Callout from triggers not supported: Direct callouts from triggers are prohibited, but the trigger delegates the callout to asynchronous Apex, which is the correct pattern.

• Leaf switches provide access ports for servers, users, and other devices.
• Spine switches provide the backbone between leaf switches.
• Every leaf switch connects to every spine switch, creating a predictable, full-mesh fabric between the two layers.
• Leaf switches do not connect directly to other leaf switches, and spine switches do not connect directly to other spine switches.

• A: Adding both a spine and leaf is unnecessary for simply adding access ports.
• B: It focuses on uplink speed, not the scalable topology.
• D: A single spine connection creates a bottleneck and a single point of failure.

• Install unauthorized or unsupported software
• Access features blocked by the manufacturer or operating system
• Customize system behavior beyond normal settings

• C. Case after-insert trigger that publishes a Platform Event

• D. Custom Apex controller that publishes a Platform Event

• A. Trigger with a callout: Salesforce triggers should not make direct synchronous callouts, and this tightly couples transaction processing to the external system.
• B. Workflow Rule with Outbound Message: This can react to record changes, but it cannot reliably capture a user clicking a menu item. It also does not provide the same flexible event-driven model as Platform Events.

• New investment: $536,500
• Resulting NPV: $0

• An active relationship is used automatically when filters are evaluated. An inactive relationship does not propagate filters unless explicitly activated in DAX, so it would not reliably enforce the required security behavior.
• Apply security filter in both directions allows RLS filters to propagate across the relationship in both directions. This ensures that bidirectional filtering respects the RLS rules applied to both tables.
• Assume referential integrity is unrelated to RLS. It is mainly a DirectQuery optimization that allows Power BI to use an inner join when matching keys are guaranteed to exist.
• The relationship must therefore be active, with security filtering enabled in both directions.

• The type of change: standard, normal, or emergency
• The risk, impact, and complexity
• The change model being used

• A standard change may be pre-authorized through its change model.
• A normal change may require assessment and approval by an appropriate change authority.
• An emergency change may be authorized by an emergency change authority, often using an expedited process.

• Change authorities are not only needed for emergency changes.
• They are not assigned only when a change is deployed.
• They are not only required for normal changes.

• C — Custom buttons display at the top and bottom of a page: Correct. In Salesforce Classic, buttons can appear in the page’s button areas, including the top and bottom of record pages.
• D — Custom buttons are available for Person Accounts: Correct. Person Accounts use the Account object, so Account custom buttons can be available on Person Account layouts.
• E — Custom buttons can reference an external app: Correct. A URL custom button can launch or navigate to an external application or website.

• A: JavaScript custom buttons are a Salesforce Classic feature and are not supported in Lightning Experience. They do not enhance Lightning Experience.
• B: The User object does not generally support custom buttons in the same way standard business objects do.

• 50% memory utilization baseline: The environment can be provisioned with excess capacity, leaving room for growth and workload spikes.
• Storage scalability: Cloud storage can generally be expanded as needed without redesigning the physical platform.
• Single circuit failure resilience: A properly designed IaaS provider uses redundant power circuits and infrastructure, so failure of one circuit should not take the platform offline.

• A — Dual PDUs: Helps with power redundancy but does not provide storage scalability.
• C — Network load balancing: Provides network-path resilience, not memory or storage scalability, and does not address a power-circuit failure.
• D — Multiple NAS devices: May improve storage capacity, but does not inherently provide power resilience or the required compute-capacity baseline.

• Remote and global work: Access is based on the approved device, not a specific office or geographic location.
• Seamless login: Users may not need to repeatedly enter credentials on a recognized device.
• Limited equipment: It uses devices employees already have rather than requiring separate hardware.

• Geotagging: Restricts access based on location and may prevent legitimate remote work.
• Smart cards: Require issuing and managing additional physical equipment.
• Time-based logins: Limit access by time and do not provide a seamless authentication experience.

• Security controls
• Processes and procedures
• Compliance evidence
• Performance against contractual requirements

• Service-level agreement (SLA): Defines expected service performance, such as uptime and response times.
• Memorandum of agreement (MOA): Documents a general agreement between parties, but does not necessarily provide audit rights.
• Supply chain analysis: Identifies risks across suppliers and dependencies, but is not a contractual mechanism for reviewing vendor controls.

• Minimum
• Maximum
• Average
• Count
• Null/empty values
• Distinct values

• Enable column profile
• Enable details pane
• Show column profile in details pane

• Each team’s Bedrock workflow uses a separate IAM service role.
• The role’s Amazon S3 permissions can be limited to only that team’s customer folder or objects.
• This enforces least privilege and prevents one team’s Bedrock application from accessing another team’s data.
• Access is enforced by AWS permissions, not by asking users to provide a customer name in each request.

• A single role with broad S3 access does not provide team-level isolation.
• Asking teams to specify a customer name is not an access-control mechanism.
• Redacting data does not prevent unauthorized access.
• A bucket policy alone is insufficient unless it explicitly enforces the required team-role restrictions.

• SAML (Security Assertion Markup Language): Commonly used for enterprise SSO between an identity provider and cloud applications. It sends signed authentication assertions to the service provider.
• RADIUS: Primarily used for centralized authentication to network devices, VPNs, and wireless networks.
• EAP: An authentication framework commonly used with network access technologies; it is not typically the SSO protocol for SaaS applications.
• OpenID: Related to identity authentication, but traditional enterprise SSO questions involving cloud applications generally expect SAML. OpenID Connect is a newer authentication layer built on OAuth 2.0.

• JDBC
• SnowSQL
• Snowflake Web Interface (UI)
• ODBC
• Python connector

• Restrict a port to a defined number of MAC addresses
• Use statically configured or “sticky” MAC addresses
• Shut down or restrict the port when violations occur

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect suspicious traffic but is not the primary control for switch-port MAC limits.
• NGFW: Filters routed network traffic, not the switch’s CAM/MAC address table directly.

• An Adj-SID does not necessarily need manual configuration.
• It can often be dynamically allocated by the router, although manual configuration may also be possible.
• The adjacency information is advertised through the IGP, such as IS-IS or OSPF.

• It is identified by an Adj-SID.
• It represents a particular adjacency of a node.
• Its meaning is generally local to the advertising node; unlike a Node-SID, it is not a globally reusable instruction across the network.

• Namespace: The namespace associated with the code where the checkpoint was set.
• Time: When the checkpoint was captured or executed.

• Exception: Exceptions are viewed through debug logs or execution results, not as the primary Checkpoints tab information.
• Debug Statement: System.debug() output belongs in the Logs tab. A checkpoint captures program state, such as variables and their values, at a specific point in execution.

• Crowd-sourced evaluation: Requires recruiting and managing many evaluators.
• Human-worker evaluation: Provides human judgment but requires coordination, labeling instructions, and quality control.
• RLHF: Is a training and alignment process, not simply a low-overhead model comparison method.
• Automatic model evaluation: Quickly evaluates outputs using predefined toxicity or quality metrics with minimal manual effort.

1. The specific table — for example, incident
2. The parent table — for example, task
3. The wildcard table — *, which applies broadly

• Identifying the communication strategy: Usually part of a business continuity or incident response plan.
• Evaluating the risk management plan: Part of risk assessment and risk management activities.
• Establishing backup and recovery procedures: Usually part of disaster recovery planning.
• Developing the incident response plan: Part of incident response planning.

• Reduce the training data: Usually makes overfitting worse.
• Add hyperparameters: Hyperparameters already control training; simply adding them does not solve the problem. Proper tuning could help, but that is not what the option states.
• Increase training time: More training can worsen overfitting if the model is already memorizing the training data.