GARP ICBRR Exam Prep
International Certificate in Banking Risk and Regulation (ICBRR) (Page 28 )

• Dynamics 365 Remote Assist — used for remote collaboration and mixed-reality scenarios.
• Dynamics 365 Finance — supports financial and operational management.
• Dynamics 365 Business Central — designed primarily for small and medium-sized businesses’ finance and operations.
• Dynamics 365 for Phones — provides mobile access to Dynamics 365 apps, including Sales, through the mobile Unified Interface.

• Le rôle n’a pas de clés propres. Des identifiants temporaires (via STS) sont émis lorsque quelqu’un ou quelque chose « assume » le rôle.
• La trust policy déclare qui peut assumer le rôle (par ex. une instance EC2, un utilisateur IAM, ou un service comme Lambda).
• Une fois attaché à une ressource (par exemple comme un instance profile sur une EC2), l’application peut appeler les services AWS avec les permissions du rôle.

• Respect du principe du moindre privilège: on accorde uniquement ce qui est nécessaire.
• Pas de stockages de clés sur les instances; les credentials se renouvellent automatiquement.

• Rôles pour EC2, rôles pour Lambda, accès cross-compte, etc.

• In Microsoft Teams Phone System, a single Auto Attendant can handle multiple time-based greetings by using separate schedules for office hours, after hours, weekends, and holidays.
• You can configure one Auto Attendant with four distinct greetings mapped to:

• Open the Teams admin center > Voice > Auto attendants, edit or create an Auto Attendant.
• Under Time-based routing, define four rules:

• Create a Holiday schedule with the relevant dates (e.g., Easter, Christmas) and assign the Holiday greeting.
• Save the configuration.

• If your environment cannot separate weekend from after-hours within a single Auto Attendant, you might technically need more than one Auto Attendant.

• Correct answer: C: Amazon Comprehend.

• Why: The library wants to classify books based on their text content. This is an NLP (natural language processing) task. Amazon Comprehend is AWS’s managed NLP service that can perform content classification (including creating custom classifiers) and extract meaningful information from text. The other services are not focused on text classification:

• Quick note: In practice, you’d store the books in S3, extract text if needed (e.g., from PDFs with Textract), and then use Comprehend to classify the documents into topics or genres.

• The app on EC2 connects to Aurora using DB credentials stored on the instance. Secrets Manager centralizes these credentials and can rotate them automatically, eliminating manual updates on each EC2 host.
• Automatic rotation reduces operational overhead and enhances security because credentials are rotated on a schedule without code changes.
• The app can retrieve the current secret at runtime (e.g., via the AWS SDK) and use it to authenticate to Aurora, avoiding reliance on locally stored files.

• B (Parameter Store) can store secrets but lacks seamless built-in rotation for database credentials like Secrets Manager; rotation often requires more custom work.
• C (S3) would require complex tooling to rotate and securely fetch credentials and still risks exposure if access policies aren’t perfect.
• D (Encrypted EBS volumes) would store credentials locally on each instance and does not automate rotation or centralized management.

• A. Extranet
• B. VLAN
• C. Intranet
• D. VPN

• IaaS: You manage the virtual machine’s operating system, configuration, applications, and data. Azure manages the physical infrastructure and virtualization platform.
• PaaS: You deploy applications without managing the underlying operating system or servers.
• SaaS: You consume a complete application managed by the provider, such as Microsoft 365.

• A private IP address on the virtual network
• A public IP address associated with its IP configuration

• What it’s asking: In an ARM template, for an Availability Set, what value should you set for the property platformFaultDomainCount to maximize availability during fabric failures or maintenance?

• Key concept: Fault domains are groups of hardware that can fail independently. By spreading VMs across more fault domains, you reduce the risk that a single hardware fault takes out many VMs.

• Important detail: For managed Availability Sets, the number of fault domains you can use varies by region — typically 2 or 3.

• What to choose: Set platformFaultDomainCount to the maximum supported in your region. In most regions this is 3, which gives you the best resilience. If your region only supports 2, you’d use 2.

• Answer: 3 (Max Value). In ARM template syntax, this would appear as "platformFaultDomainCount": 3 (within the Availability Set resource).

• Business
• People
• Governance
• Platform
• Security
• Operations

• Cloud financial management
• Portfolio and program management
• Risk management
• Data governance
• Compliance and oversight

• Answer: D. Select an IdP

• Why: To reduce the number of credentials across multiple SaaS apps, implement a single sign-on approach via an Identity Provider. The first step is choosing the IdP; once selected, you can enable SAML (A) or OAuth as supported by apps. Password vaulting (C) is not a true SSO solution, and B is not the foundational step.

• Cross-account access is typically implemented with an IAM role. You create a role in the target account (where the resources live) and configure a trust policy that allows principals from the source account to assume that role.
• Users in the source account then assume the role (via Switch Role in the console or STS:AssumeRole) and receive temporary credentials with the role’s permissions to access the resources.

• IAM group: Groups exist inside a single account; they don’t grant cross-account access.
• IAM tag: Tags are metadata and do not grant access.
• IAM Access Analyzer: It analyzes and identifies public or cross-account access but does not grant access itself.

• Admin access to the deployment pipeline (B) – lets the developers use the pipeline and deploy content.
• Contributor access to the Development and Test workspaces (E) – required to deploy items into those workspaces.
• Viewer access to the Production workspace (D) – lets them view Production content without allowing deployment or modification.

• Contributor access to Production (F), because that could allow changes or deployment there.
• Viewer access to Development/Test (C), because Viewer is insufficient for deployment.
• Build permission to Production semantic models (A), because building reports on a semantic model is not required merely to view Production items.

• Correct answer: A. System characterization

• Why the other options are not correct:

• Automation handles repetitive tasks, and orchestration coordinates responses across tools (SIEM, SOAR, EDR, etc.).
• This allows the security team to process more events with the same number of people, improving throughput and response times.
• Analysts can focus on more complex tasks like investigation and threat hunting instead of manual triage.

• It increases complexity: automation can reduce complexity when well-implemented; complexity is not the main intended benefit.
• It removes technical debt: automation/OR focuses on current incident response efficiency, not primarily on architectural debt.
• It adds additional guard rails: governance is important but not the core value of automation/orchestration within a SIEM.

• The Balanced Scorecard translates an organization’s vision and strategy into a set of concrete objectives and metrics across four perspectives (financial, customer, internal processes, learning & growth). This framework explicitly links IT goals to business goals and provides a way to measure and monitor alignment over time.

• Enterprise architecture (EA): Great for governance, standards, and roadmaps to ensure IT assets support business needs, but it’s more about structure and alignment at design time rather than directly measuring ongoing alignment of goals.
• KPIs: Useful metrics, but they don’t by themselves provide a full framework to ensure IT goals are aligned with organizational strategy.
• Enterprise dashboard: A visualization tool for metrics; it helps report status but doesn’t inherently establish or assess alignment.

• VMs without NGT: Not clearly a migration blocker on its own; NGT (Nutanix Guest Tools) status isn’t the typical gating factor for live migration during maintenance.
• VMs marked as an Agent: Not a standard, widely-known migration blocker; agents aren’t the typical reason a VM can’t be migrated.
• Memory Overcommitted VMs: While memory pressure can affect placement, memory overcommitment isn’t a fundamental reason a VM would be labeled non-migratable during maintenance.
• VMs with attached Volume Groups: This is the strongest candidate. A Volume Group is a set of volumes bound to a VM; moving the VM would entail relocating and reattaching those volumes, which can complicate or block live migration during maintenance.

• Vertical scaling (scale up) means increasing the size of an existing VM—for example, adding CPU or RAM.
• Vertical scaling down means reducing the VM’s size when less capacity is needed.
• Horizontal scaling (scale out) means adding more VM instances rather than making one VM larger.
• Elasticity is the broader ability to automatically adjust resources based on demand; it does not specifically mean adding CPU or memory to one VM.
• Agility refers to the ability to provision or change resources quickly.

• Used for communication on the local link or LAN segment
• Automatically generated on IPv6-enabled interfaces
• Not routed by routers to other networks
• Commonly used by devices to communicate with their local IPv6 router
• Begins with FE80 through FEBF

• FC00::/7 — unique local unicast
• FE80::/10 — link-local unicast
• FF00::/8 — multicast
• 2000::/3 — global unicast

• I can’t view the images, so I can’t tell which table is labeled as A in your screenshot. But here’s how to decide:

• How to identify the fact table:

• How to identify the surrogate key in the Patient table:

• Relationship:

• Correct answer: A
• What this is saying: You need to write a Transact-SQL query that uses REGEXP_SUBSTR to extract the ID from MessageText, and you should apply STRING_ESCAPE(MessageText, 'json') before calling REGEXP_SUBSTR.

• MessageText may contain JSON characters (quotes, backslashes, etc.). Escaping the JSON content first ensures the string you pass to the regex is safe and won’t confuse the regex engine.
• The pattern you apply with REGEXP_SUBSTR would then extract the first substring that matches your ID pattern from the (escaped) text.

• Example (conceptual):

• The question implies REGEXP_SUBSTR is available in this environment; some SQL Server and Fabric contexts don’t expose it natively in all versions. If REGEXP_SUBSTR isn’t available, you’d need an alternative approach (e.g., using built-in regex-like capabilities or CLR/UDFs).
• If you need the ID specifically from the first paragraph, you might first isolate the first paragraph and then apply REGEXP_SUBSTR, or compose a single pattern that anchors to the first paragraph.

• Strongest encryption algorithms: Choose the strongest available encryption and integrity options, typically AES with the largest key size and a secure integrity algorithm.
• Encrypt all traffic: Select tunnel mode rather than transport mode. Tunnel mode encrypts the entire original IP packet, which is appropriate for a site-to-site VPN between branch networks.
• Secret-password authentication: Configure a pre-shared key (PSK) on both VPN concentrators. The key must match at both ends.

• What wipe does: A factory reset that erases all data, apps, and settings and returns the device to the OOBE. It removes the device from management and resets identity.
• Why not for this scenario: The goal is to repurpose the same device to a new user with Autopilot. Autopilot Reset keeps the device’s Azure AD/Intune identity and re-provisions the device for the next user without a full wipe.
• What Autopilot Reset does: Removes user data and apps but preserves device identity and management connection, then reapplies the Autopilot provisioning for the next user.
• When you’d use wipe instead: If you’re selling or permanently discarding the device, or you truly want to scrub all traces and start fresh without re-enrolling.

• Batch processing, such as scheduled data transformations
• Streaming processing, such as continuously ingesting events

• Manipulating data with multiple languages: Mainly a benefit of Databricks and Spark.
• Real-time notebook collaboration: A workspace/notebook feature.
• Alerts for query failures: A Databricks SQL or job-monitoring feature.
• Distributing complex operations: Primarily a Spark compute capability.

Why B works

• AWS KMS keys are Regional resources. A normal customer managed key in Region A cannot be used directly in Region B.
• A customer managed multi-Region KMS key (MRK) has related key replicas in both Regions. The replicas share key material and key ID, although each has a Regional ARN.
• With client-side encryption, the application encrypts the data before storing it in S3. Cross-Region replication then copies already-encrypted objects, so S3 does not need to decrypt and re-encrypt them with a different Regional key.

Why the other choices are weaker

• A and C: SSE-S3 uses Amazon-managed S3 keys, not the required customer managed KMS key.
• D: SSE-KMS can work only if the solution creates and configures the appropriate KMS key or multi-Region key replica in each Region. As written, it says to create a customer managed KMS key in each Region, which implies separate keys—not the same KMS key. Replication also requires additional KMS permissions and destination encryption configuration.

• Elicited and documented customer requirements
• Converted them into clear, measurable specifications
• Validated the requirements with the customer
• Used them as the basis for design, quality checks, and acceptance

• A: Requirements should reflect the customer’s needs—not the supplier’s standards.
• B: Iteration review planning does not replace proper requirements collection.
• D: A retrospective occurs after work is completed and is mainly for process improvement, not initial requirements definition.

• Who performed the action
• What action occurred
• When it occurred
• Where it originated
• Whether it succeeded or failed

• Investigating suspicious activity: Important, but investigation depends on having adequate audit data first.
• Storage allocation: Necessary for retention, but storage does not help if the records lack meaningful details.
• Actions after audit failure: Part of operational planning, not the primary assessment of the application’s audit capability.

• The correct permission is Manage Sandboxes (the official Salesforce name; the option in the list is written as “Manage Sandbox,” which is effectively the same idea but the canonical name uses the plural).
• Why: Sandboxes are a lifecycle feature. Only users with the explicit Manage Sandboxes permission can perform create, delete, refresh, or activate actions.
• Why the other options aren’t correct:

• The problem describes the class updating field-level security on some profiles. To prevent updating fields that are not updateable for the current user, you should check each field’s updateability before making changes. Use DescribeFieldResult.isUpdateable() (e.g., via Field.describe() on each field) to guard updates.

• A and D (With Sharing): Running a class with Sharing affects record visibility, not whether a field can be updated by a user. It doesn’t prevent updates to fields the user shouldn’t modify.
• C (WITH SECURITY_ENFORCED in SOQL): This enforces FLS/FRC during queries, but it doesn’t control whether the Apex code updates fields or modifies permissions. It’s not addressing the update behavior directly.

• Premium file shares: contoso104 only
• Blob access tiers: contoso101, contoso102, and contoso103

• Premium Azure Files shares require a storage account with the FileStorage account kind. This is a specialized account type and is not used for blob storage.
• Blob access tiers such as Hot, Cool, and—where supported—Archive apply to blob-capable accounts, such as General-purpose v2 or BlobStorage accounts shown in the exhibit.
• contoso104 is therefore excluded from the blob-tier selection because it is the premium Files account.

• Correct answer: All four statements are true (A, B, C, and D). The given key (A,B) is likely incorrect.

• A) Customers can change the size of the Warehouse after creation — Yes. You can resize a virtual warehouse after it’s created using ALTER WAREHOUSE ... SET WAREHOUSE_SIZE.
• B) A Warehouse can be resized while running — Yes. Snowflake supports online resizing; you can change the size without stopping queries.
• C) A Warehouse can be configured to suspend after a period of inactivity — Yes. You can enable auto-suspend with a delay (AUTO_SUSPEND).
• D) A Warehouse can be configured to auto-resume when new queries are submitted — Yes. You can enable auto-resume (AUTO_RESUME) so a suspended warehouse automatically resumes on new queries.

• Example commands:

• Even if a warehouse is resizing or auto-suspending, queries will be queued and then executed once the warehouse has the appropriate capacity.

• What it says: you can add a cost when you adjust inventory, and that cost is posted automatically to a specific GL account.
• Reality: yes, you can adjust both quantity and value via an inventory adjustment journal. The cost on the journal line affects the inventory value.

• The general ledger postings are not arbitrary. the actual accounts used are determined by your item posting group and the system’s posting definitions. In practice, the adjustment debits/credits the appropriate inventory-related accounts (e.g., Inventory asset and a related offset such as an adjustment or COGS account) based on configuration.
• So, the cost change does not go to a single “manual” GL account you pick per line unless your posting setup maps to that account.

• The concept is true (you can adjust cost and have GL impact), but the claim that it posts to a single, specific GL account is oversimplified—the accounts come from your posting configuration.

• Amazon Kendra is a managed enterprise search service that can index content stored in S3 and support natural-language queries to find text inside documents (PDFs, Word files, etc.).

• Rekognition analyzes images/videos, not document text search.
• Polly is a text-to-speech service.
• Lex is a chatbot service.

• Create a Kendra index.
• Add a data source of type S3 and point it to your bucket (with an IAM role that allows access).
• Configure/document conversion if needed, then index the data.
• Use the Kendra API or console to run natural-language queries against your indexed documents.

• Disabling GPS: Affects location services, not email connectivity.
• Configuring 4G usage only: Does not enable international data access and could prevent connectivity if 4G is unavailable.
• Connecting using a hotspot: Could provide data, but it is not the most direct solution and depends on another network or device.

• The inference container image or built-in algorithm
• The location of model artifacts in Amazon S3
• IAM permissions through the execution role
• Optional environment variables and networking settings

1. Create AWS::SageMaker::Model
2. Create an AWS::SageMaker::EndpointConfig that references the model
3. Create AWS::SageMaker::Endpoint that references the endpoint configuration

• AWS::SageMaker::Endpoint hosts a model but does not define the model itself.
• AWS::SageMaker::NotebookInstance provides a development environment.
• AWS::SageMaker::Pipeline orchestrates ML workflow steps.

• Create a record-triggered Flow on Opportunity.
• Run it when the record is created or updated.
• Add entry criteria such as Probability > 50%.
• Use Create Records to create the related Sales Demo Request, populating its Opportunity lookup.

• Apex Trigger: Possible, but unnecessary custom code for a straightforward automation requirement.
• Workflow Rule: Cannot create a related custom record.
• Process Builder: Could create a record, but Flow is Salesforce’s preferred and more capable declarative automation tool.

• Correct answer: C — The model is deployed at UK border checkpoints.

• The EU AI Act applies to AI systems used within the EU or by entities established in the EU. So:

• Answer: C (192.168.0.1-192.168.0.99, 192.168.0.101-192.168.0.254)

• Why: The interface is 192.168.0.100/24, so DHCP pools must be within the 192.168.0.0/24 subnet and cannot include the router’s IP (192.168.0.100), the network address (192.168.0.0), or the broadcast (192.168.0.255). Option C provides two ranges that exclude those addresses.

• Why the other options are invalid:

• The correct answer is D: All of the above.

• Snowflake Web Interface (UI): You can create and manage Virtual Warehouses from the UI (resize, suspend/resume settings, etc.).
• SQL commands: You can create and alter warehouses with DDL like CREATE WAREHOUSE and ALTER WAREHOUSE.
• Data integration tools: ETL/ELT tools can create/manage warehouses by connecting to Snowflake and issuing the appropriate commands or using their config to specify a warehouse.

• Correct answer: D – Do not enable default administrative accounts to ensure accountability.

• A – Do not use encryption methods … backups and sensitive information: Encryption helps protect data; not using it increases risk, not reduces insider threats.
• B – Do not allow administrators to use unique accounts during installation: We actually want unique admin accounts, not the opposite.
• C – Do not control the access to administrators and privileged users: Failing to control access directly enables misuse.

• Why Ishikawa:

• Why not the others:

• Answer: False. Agents and managers CAN create knowledge articles from Community questions.

• Why: In ServiceNow, a Community question can be converted into a Knowledge article using the Create Knowledge (or Convert to Knowledge) action. This allows what customers asked to become a reusable article for others.

• How it works (high level):

• Permissions: This ability depends on having the right roles/permissions (e.g., agents or knowledge managers). If you don’t see the option, check your role assignments or the knowledge-management configuration.

• Quick take: If a question in Community is valuable for others, a trained agent can turn it into a Knowledge article, making it available for self-service.

• Copilot??????????
• ???????????????
• ??????????
• ?????????????
• ???????????????????

• Prompts and Suggestions: Retained for 28 days
• User Engagement Data: Kept for Two Years

• Source: on-premises SQL Server Database1
• Destination: Fabric Warehouse Warehouse1
• Connectivity: on-premises data gateway

• Dataflow Gen1: Primarily for Power Query transformations and isn’t the best Fabric-native choice for this copy operation.
• KQL queryset: Queries data; it does not orchestrate copying from SQL Server.
• Notebook: Could perform custom code-based movement, but it is unnecessary and less direct than a pipeline.

• Failed login attempts
• The account being targeted
• The source user or system
• Time and frequency of attempts

• Two-factor authentication: Helps prevent unauthorized access, but does not primarily detect the employee’s attempts.
• Firewall: Controls network traffic; it generally does not monitor individual login attempts.
• Intrusion prevention system (IPS): Can detect certain network attacks, but this scenario is best addressed through authentication and audit logging.

• Drop violating frames
• Log or alert on the violation
• Shut down or restrict the port

• Load balancer: Distributes application traffic; it does not control switch MAC learning.
• IPS: May detect some network attacks but is not the primary control for switch MAC-table exhaustion.
• NGFW: Protects traffic crossing network boundaries, while MAC flooding occurs at the switching/LAN layer.

• Short answer: The correct term is Anti-forensics (option D), not “Felony.”

• Why: The actions described—hiding files in slack space, changing file headers, placing suspicious files in executables, and altering metadata—are classic anti-forensics techniques. They’re used to hinder or obscure forensic analysis, not to label the act as a legal category.

• About the options:

• Note: The provided answer key lists B (Felony), which is misleading for this exam objective. The exam typically tests knowledge of forensics concepts, where anti-forensics is the correct category.

• Amazon GuardDuty: Detects suspicious activity and threats using security-related data sources; it is not primarily a software vulnerability scanner.
• Amazon Detective: Helps investigate and analyze the root cause of security findings after an event.
• Amazon Cognito: Provides user authentication and authorization for applications.

• Correct answer: D — AWS Migration Hub

• AWS Migration Hub provides a single location to track the progress of application migrations. It offers a centralized dashboard to view migration status across multiple tools and projects.

• AWS Application Discovery Service helps inventory and map on-prem applications and their dependencies, not a single progress tracker.
• AWS Application Migration Service (formerly SMS) performs the actual lift-and-shift migrations, but isn’t the centralized tracker itself.
• AWS Service Catalog manages catalogs of IT services for self-service deployment, not migration progress.

• RPO (Recovery Point Objective) — maximum acceptable data loss, measured in time. It specifies how far back in time you can tolerate data loss. Example: RPO of 2 hours means backups must occur at least every 2 hours.

• ARO (Annualized Rate of Occurrence) — expected frequency of a threat occurring per year. It estimates how often a risk is likely to happen on average (used in risk calculations).

• MTTR (Mean Time To Recover) — average time to recover/restore service after an incident. It includes detection, repair, and restoration time, and helps gauge downtime and alignment with RTO.