GARP SCR Exam Prep
Sustainability and Climate Risk (Page 8 )

Correct reasoning

• Create storage5 as a General-purpose v2 (StorageV2) account.
• Configure Blob object replication from storage5 to an existing compatible storage account.
• The destination must support object replication—typically another StorageV2 or premium block blob account.
• Blob versioning must be enabled on both accounts.
• Blob change feed must be enabled on the source account.
• The accounts must meet Azure’s object-replication requirements, including being in supported regions and having compatible configuration.

1. Wireless AP

1. Router

1. Firewall

1. Device placement

• Vulnerability scanner: Identifies technical weaknesses in systems, applications, or devices.
• Penetration test: Simulates attacks to determine whether vulnerabilities can be exploited.
• SCAP (Security Content Automation Protocol): Uses standardized formats and protocols for automated vulnerability, configuration, and compliance checks.
• Illumination tool: Maps and analyzes broader supply-chain exposure and third-party risk.

• Lead investigator: Coordinates the investigation and directs the response.
• Information security representative: Provides security expertise and helps assess the incident.
• Technical representative: Preserves system evidence, takes forensic backups, and supports technical analysis.
• Legal representative: Advises on legal, regulatory, privacy, and evidence-handling requirements.

• Each Azure VM must have at least one network interface (NIC).
• A single NIC can have:

• Therefore, each of the five VMs needs only one NIC:

• sn_si_admin is an SIR administrator role.
• The prefix helps prevent naming conflicts between applications.
• It does not refer to a “Secure Identity token” or an instance security check.

• Tokens: Individual units of text processed by a model, such as words, subwords, or characters.
• Models: Systems that learn patterns and generate predictions or outputs.
• Binaries: Data represented using the binary number system, not semantic representations.

• Due diligence: Researching and evaluating a third party before entering or continuing a business relationship.
• Internal audit: Evaluates controls within the organization itself.
• Penetration testing: Actively tests systems for exploitable vulnerabilities.
• Attestation: A formal statement or report—such as a SOC 2 report—provided by an independent party about an organization’s controls.

• A — Tables
• B — Named file formats
• C — Schemas
• E — Databases

Why these are correct

• Tables: Can be cloned using CREATE TABLE ... CLONE. The clone initially uses zero-copy cloning, so storage is shared until changes are made.
• Named file formats: Can be cloned as database objects, preserving the file-format definition.
• Schemas: A schema and its eligible objects can be cloned.
• Databases: A database and its eligible schemas and objects can be cloned.

Why the others are incorrect

• Shares: A share is an account-level data-sharing object, not a normal cloneable database object.
• Users: Users are security principals and cannot be cloned with CLONE.

• Amazon EC2 instances — ???????? ?? ?? ??????? CPU, memory ??? instance size ???????? ???????
• AWS Lambda functions — memory configuration ?????????? ???????
• Amazon EBS volumes — volume type ?? size optimize ???? ???????
• ??????? ECS workloads — resource configuration ? cost optimization-?? ???????

• Memory ? compute usage ?????????? ???? custom code ????? ???? development ? maintenance ??????
• Cost allocation tags ???? ????? ??? ?????? ???? ??????? ???; inefficient resource ??????? ?? recommendation ???? ???
• CloudTrail resource ???? ?? API activity ??????, resource utilization ????

• A script of cloud CLI commands: IaC because the commands can be saved, reviewed, versioned, and rerun consistently.
• Manually run curl commands: Not necessarily IaC; they are manual actions unless organized into an automated script.
• A sequence of REST requests passed to an API: Could represent automation, but the wording does not explicitly say they are stored and executed as reusable code.
• Commands entered into a cloud console: Manual operation, not IaC.

• Employees can work from any location, including remote sites and offices worldwide.
• Login can be relatively seamless after the device is registered.
• It does not require distributing additional physical authentication equipment.

• Geotagging: Identifies location, but location alone is not a strong authentication method and may prevent legitimate remote access.
• Smart cards: Provide strong authentication but require card readers and physical cards, increasing equipment and management requirements.
• Time-based logins: Typically involve one-time codes that users must enter, making the experience less seamless and potentially requiring a token or authenticator app.

1. Initiate — establish the project, scope, team, and governance.
2. Plan — develop the detailed plan, schedule, resources, and implementation approach.
3. Execute — configure, integrate, migrate, test, and prepare the solution.
4. Deploy — move the solution into production and support go-live.
5. Close — complete handover, confirm outcomes, and formally close the project.

• Amazon S3 as the origin for static content
• Application Load Balancer (ALB) as the origin for dynamic content
• Amazon Route 53 configured to point the company’s domain name to CloudFront

• /static/* ? S3 origin; cache content at edge locations
• Dynamic paths such as /api/* ? ALB origin; forward requests to the EC2 application

• Ramen is a Linux worm associated with Red Hat Linux 6.2 and 7.0 systems.
• It spreads by scanning randomly generated IP addresses using tools such as synscan.
• It exploits vulnerable network services, including web-related services, and may leave malicious files or altered web content.
• The tar.gz file is also a clue because it is a common Linux archive/package format.

• Code Red: Primarily targeted Microsoft IIS servers running Windows.
• LoveLetter: Spread mainly through email attachments.
• Nimda: A Windows-based worm that spread through email, web servers, and network shares.

• C — Before update
• D — Before insert

apex 
trigger AccountTrigger on Account (before insert, before update) { 
    for (Account acct : Trigger.new) { 
        acct.Description = 'Updated automatically'; 
    } 
}

• In after insert and after update, Trigger.new records are read-only.
• Use after triggers when you need the record’s final database Id or want to create/update related records.
• Attempting to change a field directly in an after trigger causes a read-only error.

• Two-part tariff pricing: $10 per unit
• Dual pricing: $20 per unit

Two-part tariff pricing

Dual pricing

• Division X, the seller, is credited with the market price: \(\$20\)
• Division Y, the buyer, is charged the marginal cost: \(\$10\)

• Managerial: policies, standards, risk management, governance
• Operational: procedures carried out by people, such as training, incident response, and backups
• Technical: firewalls, encryption, access-control systems
• Physical: locks, guards, cameras

• The JSON files contain one billion items, so this is a big-data workload.
• PySpark uses Apache Spark’s distributed, parallel processing, allowing the data to be processed across multiple compute nodes.
• It can read and transform data directly from OneLake, helping minimize unnecessary data movement or duplication.
• A Fabric notebook can also support exploration and visualization, as well as Spark-based analytics and anomaly-detection workflows.

• Pandas is primarily in-memory and generally suited to smaller datasets. One billion records would be impractical on a typical single machine.
• A Power BI report with core visuals is appropriate for visualization and sharing, but it is not the best tool for large-scale transformation, parallel processing, or anomaly detection. It would normally consume prepared data rather than perform the entire workload.

• MFA adds an additional authentication factor, such as a phone notification or verification code.
• It helps prevent unauthorized sign-ins, even if a password is compromised.
• It does not encrypt, store, or protect credentials used by deployment processes.

• Limiting the number of MAC addresses allowed on a switch port
• Restricting ports to specific known MAC addresses
• Taking an action—such as dropping frames or shutting down the port—when the limit is exceeded

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect some attack traffic, but is not the primary control for switch-port MAC limits.
• NGFW: Filters network traffic at the firewall, but does not directly control MAC addresses learned by a switch.

• Packet loss
• Latency
• Jitter
• Call quality by user, device, network, location, or building

• Teams Usage Report: Shows adoption and usage statistics, not detailed call-quality metrics.
• Teams Device Usage Report: Reports which devices are being used and how, but does not provide detailed packet-loss analysis.
• Microsoft Network Testing Companion: Helps assess network readiness before deployment, but it is not the primary tool for analyzing packet loss from actual Teams calls.

• S3 Glacier Deep Archive is designed for long-term archival data with very infrequent access and has a lower storage cost than S3 One Zone-IA.
• The documents are copies stored elsewhere, so reduced availability and delayed retrieval are acceptable.
• An S3 interface VPC endpoint allows private access from the VPC without exposing the bucket through the public internet.
• A bucket policy can restrict access to requests coming through that endpoint.

• SQL injection
• Cross-site scripting (XSS)
• Malicious or malformed web requests
• Some application-layer abuse

• Layer 4 firewall: Filters based mainly on IP addresses, ports, and connections; it lacks detailed web-request inspection.
• NGFW: Provides broader network security, but a WAF is more specialized for protecting web applications.
• UTM: Combines multiple security functions, but it is not necessarily optimized for web-application protection.

• A. Periodically rotate responsibilities: May reduce some risks, but it does not directly detect unauthorized changes.
• B. Review segregation-of-duties conflicts: Identifies incompatible access combinations, not whether a specific data change was unauthorized.
• C. Log changes in an outside application: Logs provide evidence, but someone must review and analyze them. Logging alone does not detect misuse.
• D. Independent review: Directly detects unauthorized changes and reduces the risk that the person making the change can conceal it.

• HTTPS: Secure web traffic, not general command-line server administration.
• SNMPv3: Secure network monitoring and management, not interactive server login.
• RDP: Provides graphical remote desktop access. It can be secure, but it is not the direct replacement for Telnet in this scenario.
• SMTP: Used to send email.

• Prevention costs – costs incurred to stop defects occurring, such as staff training, quality planning and supplier evaluation.
• Appraisal costs – costs of checking whether products meet standards, such as inspection, testing and quality audits.
• Internal failure costs – costs of defects found before delivery to customers, such as scrap, rework and retesting.
• External failure costs – costs of defects found after delivery, such as warranty claims, returns, complaints and product recalls.

• Feedback form: Captures opinions, not necessarily actual behavior; users may not respond.
• Questionnaire: Relies on memory and subjective judgments about usefulness.
• Interviews: Can provide valuable qualitative insights, but a sample of users may not represent overall usage accurately.

• Espionage: Stealing information for intelligence or competitive purposes.
• Data exfiltration: Unauthorized removal or transfer of data.
• Nation-state attack: An attack sponsored or conducted by a government.
• Shadow IT: Unapproved technology or methods used to access organizational resources.

• Firewall
• Intrusion prevention and detection
• Antivirus or antimalware
• Web and email filtering
• Virtual private networking (VPN)
• Sometimes content filtering and centralized reporting

• desktopwidth:i:1280
• desktopheight:i:1024

• Connection information: Controls connection-related settings, not the desktop resolution.
• Scaling plan: Controls when session hosts start, stop, or scale based on demand.
• Session behaviour: Controls behavior such as disconnect or logoff handling.
• Display settings: Specifically controls RDP display properties, making it the appropriate choice.

• Reporting relationships
• Organizational structures
• Leadership styles
• Team maturity
• Individual and group behavior
• Communication and motivation

• Acquire Project Team: Focuses on obtaining the people needed for the project.
• Develop Project Team: Focuses on improving team skills, relationships, and performance.
• Manage Project Team: Focuses on tracking performance, resolving issues, and managing changes within the team.

• C. Case after-insert trigger that publishes a Platform Event

• D. Custom Apex controller that publishes a Platform Event

• A. Trigger with a callout: Salesforce triggers should not make direct synchronous callouts, and this tightly couples transaction processing to the external system.
• B. Workflow Rule with Outbound Message: This can react to record changes, but it cannot reliably capture a user clicking a menu item. It also does not provide the same flexible event-driven model as Platform Events.

• Escape to host: A virtualization attack where code escapes a guest VM and accesses the host system. Nothing in the scenario mentions virtualization.
• Browser extension: Can redirect or manipulate web-browser traffic, but not normally database-server traffic.
• Valid accounts: Describes using stolen or compromised credentials, not redirecting network traffic.
• Process injection: Injecting malicious code into a legitimate database or networking process could allow an attacker to alter how that process handles outgoing traffic.

• The requirement is an assessment of the Azure environment’s design, which requires a support plan offering proactive architectural guidance.
• Premier support would provide this capability, but it is a high-cost option.
• Since the requirement says to minimize expenses, Premier is not the best recommendation.
• A lower-cost plan with the required advisory/design-review capability—historically Professional Direct in Azure’s support-plan model—would be more appropriate.

• A — Technical review by business owner: A business owner may approve the business impact, but a technical review is normally performed by technical personnel.
• C — Cost-benefit analysis after implementation: Cost-benefit analysis should occur before implementation to support the approval decision.
• D — Business continuity testing: This can be appropriate for major changes, but it is primarily part of business continuity and disaster recovery planning—not a universal change-management activity.

text 
ip route vrf Customer1 172.16.1.0 255.255.255.0 172.16.1.1 global 
ip route vrf Customer2 192.168.1.200 255.255.255.255 192.168.1.1 global 
ip route 192.168.1.0 255.255.255.0 Vlan10 
ip route 172.16.1.0 255.255.255.0 Vlan20

• The route in Customer1 VRF provides a path back to the Customer2 subnet, 172.16.1.0/24.
• The route in Customer2 VRF provides a path to the FTP server, 192.168.1.200.
• The keyword global tells the router to resolve the next hop using the global routing table, enabling controlled route leaking between the VRF and global table.
• The global routes identify the VLAN interfaces used to reach each customer network.

• D — Value analysis: Correct. It examines an existing product to identify ways of reducing its cost while still providing the required functions, quality and reliability.
• E — Kaizen costing: Correct. It involves making continuous, small improvements and cost reductions while the product is already in production.

• Functional analysis: It is not limited to minimizing the cost of the originally defined functions. It examines what functions are required and how they can be provided at the lowest overall cost.
• Value engineering: Usually applies to the design and development of a new product, rather than being a fundamental redesign of existing organisational processes. That description is closer to business process re-engineering.
• Target costing: The target cost is generally established during the product development stage, before production begins. It is not continuously reset while the product is in production.

• The connected switch
• The switch’s port/interface
• Device and port descriptions
• Sometimes VLAN or management information

• IKE: Establishes security associations for IPsec VPNs.
• VLAN: Defines logical network segmentation; it does not identify a physical switch port.
• netstat: Displays local network connections and statistics, not the upstream switch and port.

• Behavioral and anomaly detection
• Threat intelligence integration
• User and entity behavior analytics
• Automated response actions, often through SOAR integration

• Virus signatures: Associated primarily with antivirus or endpoint protection.
• Security agent deployment: Usually an endpoint-management or EDR function.
• Vulnerability scanning: Typically performed by vulnerability-management tools, though a SIEM may integrate their results.

• Honeypots: Deliberately vulnerable or attractive systems designed to lure attackers. Legitimate users should not access them, so activity on a honeypot is a strong indicator of compromise.
• DNS sinkholes: Redirect requests for known malicious domains to a controlled internal system instead of allowing the connection. This can identify infected hosts attempting to contact command-and-control infrastructure.

• Tokenization: Replaces sensitive data with non-sensitive tokens; it protects data but does not primarily detect attackers.
• CI/CD: Automates software development and deployment processes.
• Threat modeling: Identifies potential threats and weaknesses before or during system design.
• Data obfuscation: Makes data harder to understand, but it is not an attacker-detection method.

• When the MVP will be defined — the MVP should already be understood sufficiently when assessing the business case.
• What the MVP is — useful information, but not the key requirement tested here.
• That the MVP is the same as project viability — incorrect. The MVP helps test viability; it is not identical to viability itself.

• File1.png — Yes: User1 can apply Label1 with the Microsoft Purview Information Protection client. The client supports labeling image files such as .png in this scenario.

• Folder2 — No: Folder2 is the root folder. The client does not allow labeling the root folder itself. Although the client can label ordinary folders, selecting one applies the label to existing files and subfolders—not automatically to future files.

• File1.docx — Yes: .docx is a supported Microsoft Word file type, so User1 can apply Label1 to it.

• A — Improved management of storage space: Correct.

• B — Improved supplier relationships: Correct.

• C — Improved pricing decisions: Correct.

• D — Non-product-specific costs must be apportioned: Incorrect.

• E — Profitability of each customer group: Incorrect.

• Leaf switches provide access ports for servers, users, and other devices.
• Spine switches provide the backbone between leaf switches.
• Every leaf switch connects to every spine switch, creating a predictable, full-mesh fabric between the two layers.
• Leaf switches do not connect directly to other leaf switches, and spine switches do not connect directly to other spine switches.

• A: Adding both a spine and leaf is unnecessary for simply adding access ports.
• B: It focuses on uplink speed, not the scalable topology.
• D: A single spine connection creates a bottleneck and a single point of failure.

• Compute: Not used; no virtual warehouse is required.
• Data Storage: Not scanned again.
• Metadata: May help Snowflake manage and validate cached results, but it is not the Snowflake architectural layer identified as serving the request.
• Cloud Services: Handles query coordination, metadata services, authentication, and result-cache access.

• Disable default accounts: Default or unused accounts may have known usernames or predictable settings, making them targets. They should be disabled, removed, or securely configured.
• Remove unnecessary services: Every running service creates potential vulnerabilities. Removing services the server does not need reduces exploitable entry points.

• Add the server to the asset inventory: Important for asset management, but not a hardening step.
• Document default passwords: Default passwords should be changed or eliminated—not documented for continued use.
• Send server logs to the SIEM: Valuable for monitoring and detection, but generally performed as part of logging/monitoring configuration.
• Join the server to the corporate domain: May be necessary operationally, but does not itself harden the server.

• A is incorrect: Flow Debugger is for debugging Salesforce Flows, not Trust Layer masking.
• B is incomplete/misleading: Requesting audit data may be part of reviewing the results, but collection and storage must first be enabled.
• C is correct: It describes the initial validation step.

DAX 
Blue Sales = 
CALCULATE( 
    [Total Sales], 
    KEEPFILTERS('Product'[Color] = "Blue") 
)

• CALCULATE evaluates [Total Sales] after applying an additional filter.
• 'Product'[Color] = "Blue" restricts the calculation to blue products.
• KEEPFILTERS ensures the existing filter context is preserved. For example, filters for year, region, or customer remain active. If Color is already filtered, the blue condition is applied as an intersection rather than replacing the existing filter.
• Avoid ALL, because it removes filters and would not maintain the existing context.

• Required response and resolution times
• Availability or uptime targets
• Performance standards
• Support obligations
• Remedies or penalties for failing to meet the terms

• SOW (Statement of Work): Defines the project’s scope, tasks, deliverables, and schedule.
• MOA (Memorandum of Agreement): Describes agreed responsibilities between parties, often for a specific activity.
• MOU (Memorandum of Understanding): Records a mutual understanding or intention, usually less formal than a contract.