GRE GRE Test Exam Prep
Graduate Record Examination Test: Verbal, Quantitative, Analytical Writing (Page 29 )

• Data loss prevention (DLP): Helps detect or prevent sensitive data from being copied or transmitted, but it does not primarily protect a stolen laptop’s stored data.
• Operating system hardening: Reduces vulnerabilities and attack surface but does not encrypt files if the device is stolen.
• Boot security: Helps ensure that only trusted software starts, but it does not fully protect the drive if an attacker accesses it offline.

• Each team’s Bedrock workflow uses a separate IAM service role.
• The role’s Amazon S3 permissions can be limited to only that team’s customer folder or objects.
• This enforces least privilege and prevents one team’s Bedrock application from accessing another team’s data.
• Access is enforced by AWS permissions, not by asking users to provide a customer name in each request.

• A single role with broad S3 access does not provide team-level isolation.
• Asking teams to specify a customer name is not an access-control mechanism.
• Redacting data does not prevent unauthorized access.
• A bucket policy alone is insufficient unless it explicitly enforces the required team-role restrictions.

• Laws and regulations
• Litigation holds
• Industry or contractual obligations
• Tax, financial, health, or privacy requirements

• Business strategy and direction: May influence retention, but cannot override legal requirements.
• Storage capacity and longevity: Practical considerations, not the primary driver.
• Business ease and value analysis: May support decisions after compliance obligations are identified.

• Initial Intrusion: The compromised VPN account and stolen phishing credentials describe how the attacker first gained access, but that happened months earlier.
• Persistence: The scheduled tasks and recurring C2 connections show how the attacker maintained and automated continued access.
• Search and Exfiltration: This would involve locating and transferring data. The scenario does not primarily describe data discovery or theft.
• Cleanup: Cleanup involves removing evidence or covering tracks. Obfuscated scripts may make detection harder, but the main behavior here is maintaining access.

• The requirement is an assessment of the Azure environment’s design, which requires a support plan offering proactive architectural guidance.
• Premier support would provide this capability, but it is a high-cost option.
• Since the requirement says to minimize expenses, Premier is not the best recommendation.
• A lower-cost plan with the required advisory/design-review capability—historically Professional Direct in Azure’s support-plan model—would be more appropriate.

• A: It allows for branching and merging...

• C: It allows multiple engineers to work against the same code and configuration files and manage differences and conflicts.

• B: Build automation and infrastructure provisioning are handled by CI/CD and automation tools, not by version control alone.
• D: User Stories and backlogs are managed by project-management tools.
• E: Version control stores and tracks code, but it does not itself ensure that developers write effective unit tests.

• Customers may boycott V’s products.
• Supermarket customers may stop buying from V.
• Investors may view V as having higher legal, ethical and reputational risk.
• V could face fines, lawsuits, contract losses and higher costs.
• Expected future profits may fall.

• Identifying the communication strategy: Usually part of a business continuity or incident response plan.
• Evaluating the risk management plan: Part of risk assessment and risk management activities.
• Establishing backup and recovery procedures: Usually part of disaster recovery planning.
• Developing the incident response plan: Part of incident response planning.

• Data Category Groups e categorias;
• Visibilidade dessas categorias para perfis ou permission sets.

• B e C: regras de compartilhamento não são o mecanismo apropriado para restringir resultados de busca do Knowledge por divisão.
• D: a role hierarchy não é o mecanismo principal para controlar a visibilidade de categorias do Knowledge. Além disso, a configuração correta é atribuir visibilidade a perfis ou permission sets.

• Suspended an operator who correctly refused to use unsafe equipment.
• Rewarded another operator for using the equipment despite the broken safety guard.

• A — Management is not particularly concerned with managing risks.

• B — Employees will perceive that management does not care about health and safety risks.

• C — This factory’s safety record is likely to be poor.

• Group1 — security-enabled: Eligible.
• Group2 — mail-enabled and security-enabled: Eligible because it is still a security group.
• Group3 — Microsoft 365 group: Not eligible for group-based licensing.
• Group4 — Microsoft 365 group, not security-enabled: Not eligible.

• A static IP gives the surveillance system a predictable local address, so users can reliably reach it on the LAN.
• However, a static IP does not block internet-based login attempts. If the router exposes the device through port forwarding, attackers could still reach it.
• Port mapping normally exposes an internal service externally, so A is a poor choice as written.
• Subnetting alone also does not block traffic; it would require routing/firewall rules.

• ARP poisoning: Redirects or intercepts local network traffic; monitoring would typically show suspicious ARP changes or man-in-the-middle behavior.
• Jamming: Interferes with wireless or radio signals. It would affect connectivity, not usually show a server-specific overload.
• Kerberoasting: Attempts to obtain and crack Kerberos service-account hashes; it does not normally cause a system outage.

• IRR assumes that interim cash flows can be reinvested at the project’s own IRR. This may be unrealistic, especially when the IRR is very high.
• MIRR assumes reinvestment at a specified rate, usually the company’s cost of capital or another realistic reinvestment rate.

• B: MIRR does not specifically favour projects with long payback periods.
• C: MIRR and IRR can rank competing projects differently.
• D: MIRR is not always higher than IRR; it may be higher or lower depending on the cash flows and reinvestment rate.

• Create and manage approved IT services as products
• Control which users can deploy those products
• Apply governance, permissions, and constraints
• Use and manage infrastructure-as-code templates, such as AWS CloudFormation templates

• AWS Resource Explorer: Helps find and browse AWS resources; it does not govern IaC deployments.
• AWS Organizations: Manages accounts, consolidated billing, and organization-wide policies.
• AWS Systems Manager: Provides operational management, such as patching, automation, and parameter storage, but it is not primarily used to catalog and govern IaC-based service deployments.

• What information each stakeholder needs
• When and how often it should be communicated
• Which format or channel should be used
• Who is responsible for communicating it

• A: The team should not decide stakeholder communications without first checking the established plan and CEO’s needs.
• B: An executive summary may be appropriate, but choosing a solution before reviewing the plan is premature.
• D: The stakeholder engagement plan addresses how to engage stakeholders, but this is primarily a communication planning issue.

• IaaS: você gerencia a VM e o sistema operacional.
• PaaS: o Azure gerencia a infraestrutura; você se concentra no aplicativo.

• Firewall
• Intrusion prevention and detection
• Antivirus or antimalware
• Web and email filtering
• Virtual private networking (VPN)
• Sometimes content filtering and centralized reporting

Why this is correct

• Each user authenticates with their own Google account.
• Google manages the user’s SSH key association.
• IAM controls who can access instances.
• Access can be audited by user identity, so security can determine who accessed a VM.
• Granting the role to a Google group avoids managing permissions individually.

Why the others don’t apply

• A: A shared private key is difficult to distribute securely and cannot reliably identify which employee used it.
• B: Manually collecting and deploying keys on every instance is operationally inefficient and complicates auditing.
• D: A project-wide shared key has the same identity and key-management problems as option A. It also does not provide per-user accountability.

• Inherent risk: Risk that exists before controls are implemented.
• Avoided risk: Risk eliminated by choosing not to perform the risky activity.
• Operational risk: Risk arising from failures in processes, people, systems, or daily operations.

• Red team: Simulates attackers; exploits weaknesses to test security.
• Blue team: Defends systems; monitors, detects, and responds to attacks.
• Purple team: Combines red- and blue-team efforts to improve detection and defense.
• White team: Oversees or manages the test, defining rules, scope, and authorization.

• Internal hostnames and subdomains
• Network structure and naming conventions
• Servers and services
• Relationships between systems

• Determining ISP-assigned address space: Usually involves external registration and DNS information, not internal host discovery.
• Bypassing DNS sinkholing: Would require evidence that malicious DNS requests avoided redirection.
• Initial access: DNS queries alone do not show that the attacker gained access.
• Exfiltrating data: DNS tunneling can do this, but the snippet would typically show encoded or unusually long DNS queries.

• AWS AppSync is designed for serverless applications that need to retrieve and combine data from multiple sources.
• A pipeline resolver can invoke multiple functions or data-source resolvers, including resolvers connected to different DynamoDB tables.
• The application can receive the combined result through one GraphQL request, without requiring custom aggregation logic in the application.
• This is operationally efficient because AppSync manages the API layer and resolver execution.

• Athena Federated Query is intended primarily for analytics and ad hoc querying, not low-latency application data retrieval.
• Querying DynamoDB through Athena can consume DynamoDB read capacity and may affect table performance.
• It also introduces analytical-query overhead and is not the normal choice for a microservice web application.

• terraform apply
• terraform destroy

• SAML: Enables federated authentication and single sign-on between the IdP and SaaS providers.
• OAuth tokens: Allow delegated application access; OAuth is not primarily the first step for employee SSO.
• Password vaulting: Stores or autofills multiple passwords but does not eliminate the separate credentials or provide true federation.

• Encryption to preserve confidentiality
• Integrity protection to detect alteration
• Authentication of the server through certificates

• SHA-256: A hashing algorithm; it does not encrypt data for transmission.
• SSL 3.0: Obsolete and insecure. It should not be used.
• AES-256: A strong encryption algorithm, but by itself it does not provide the complete secure communication protocol needed for data in transit.

• Understating expenses and liabilities
• Overstating profit
• Misleading users of the financial information
• Potentially breaching integrity, objectivity, and professional competence and due care

• A: Concerns task scheduling and avoiding missed runs, not directly sizing the warehouse.
• B: The amount of data in a stream alone does not reliably determine compute needs; the SQL processing is what matters.
• D: A multi-cluster warehouse addresses concurrency, not the compute size needed for one task execution.

1. Find the subnet-mask increment in the octet where the prefix ends.
2. Identify the network address by finding the subnet boundary at or below the given IP.
3. The first usable address is network address + 1.
4. The broadcast address is one address before the next subnet.
5. The last usable address is broadcast - 1.

• 172.28.228.144/18

• 172.28.228.144/23

• Cloud architecture
• Data architecture
• Platform engineering
• Data engineering
• Provisioning and modernization

• Data protection is associated mainly with security and risk management.
• Data governance belongs to the governance perspective.
• Data science is not an AWS CAF capability.

• IaaS: You deploy and manage virtual machines, including the operating system and installed software. Azure manages the physical datacenter, hosts, and networking infrastructure.
• PaaS: Azure manages the infrastructure and operating system, while you deploy and manage your application code. Examples include Azure App Service and Azure Functions.

• C — Custom buttons display at the top and bottom of a page: Correct. In Salesforce Classic, buttons can appear in the page’s button areas, including the top and bottom of record pages.
• D — Custom buttons are available for Person Accounts: Correct. Person Accounts use the Account object, so Account custom buttons can be available on Person Account layouts.
• E — Custom buttons can reference an external app: Correct. A URL custom button can launch or navigate to an external application or website.

• A: JavaScript custom buttons are a Salesforce Classic feature and are not supported in Lightning Experience. They do not enhance Lightning Experience.
• B: The User object does not generally support custom buttons in the same way standard business objects do.

• desktopwidth:i:1280
• desktopheight:i:1024

• Connection information: Controls connection-related settings, not the desktop resolution.
• Scaling plan: Controls when session hosts start, stop, or scale based on demand.
• Session behaviour: Controls behavior such as disconnect or logoff handling.
• Display settings: Specifically controls RDP display properties, making it the appropriate choice.

• Vulnerability scanner: Finds technical weaknesses in systems, applications, or devices. It does not usually analyze the entire supply chain.
• Penetration test: Simulates attacks against a defined target to identify exploitable weaknesses. Its scope is narrower.
• SCAP (Security Content Automation Protocol): Provides standardized formats and methods for automating security configuration and vulnerability checks, rather than mapping the full supply chain.

• Each Case must follow defined support steps.
• Each step must be completed within a specified time limit.

• Case Escalation Rules: Escalate Cases based mainly on age or criteria; they do not model a complete sequence of service steps.
• Process Builder with Scheduled Actions: Can automate time-based actions but is not the standard framework for Case service-level commitments.
• Omni-Channel Routing: Routes work to agents based on capacity and priority; it does not track Case lifecycle deadlines.

• Continuous deployment: Automates software releases; it does not specifically test input handling.
• Static code analysis: Examines source or compiled code without executing it. It can find coding flaws but does not directly stress the application with malformed inputs.
• Manual peer review: Developers inspect code or design manually. Useful, but not the best practice specifically for testing how a live product handles invalid input.

• Monitoring: Detects activity but does not remove the underlying risk.
• Patching: Useful for systems that must remain operational, but these desktops are unused.
• Isolating: Can be a temporary containment measure, but permanently removing unnecessary systems is more appropriate.

• Install unauthorized or unapproved applications
• Access system areas normally restricted
• Add features unavailable in the default software
• Modify the device’s operating system

• SQL injection (SQLi): Attacks databases by inserting malicious SQL commands.
• Cross-site scripting (XSS): Injects malicious scripts into web pages viewed by users.
• Sideloading: Installs an application from outside the official app store, but it does not necessarily remove the phone’s operating-system restrictions.

• How quickly the vendor must respond to an incident or request
• Target resolution times
• Availability or uptime requirements
• Performance metrics and penalties for not meeting them

• SOW (Statement of Work): Describes the project’s scope, tasks, deliverables, and timeline.
• MOA (Memorandum of Agreement): Documents a formal agreement to cooperate or perform specific activities.
• MOU (Memorandum of Understanding): Records a mutual understanding or intent, often less binding than a contract.

• BCP (Business Continuity Plan): è più ampio e mira a mantenere le funzioni essenziali dell’organizzazione durante un’interruzione. Il DRP è una componente più specifica del BCP.
• Communication plan: stabilisce come comunicare con dipendenti, cittadini e altre parti interessate, ma non ripristina i sistemi.
• IRP (Incident Response Plan): gestisce la risposta iniziale a un incidente di sicurezza, come un attacco informatico, non principalmente il recupero da un disastro fisico.

• LastName: Required.
• FirstName: Optional.
• AccountId: Optional; a Contact may be associated with an Account later or remain private, depending on organization settings.
• Name: A compound display field made from first and last name; it isn’t entered as a separate field.

• SAML (Security Assertion Markup Language): Commonly used for enterprise SSO between an identity provider and cloud applications. It sends signed authentication assertions to the service provider.
• RADIUS: Primarily used for centralized authentication to network devices, VPNs, and wireless networks.
• EAP: An authentication framework commonly used with network access technologies; it is not typically the SSO protocol for SaaS applications.
• OpenID: Related to identity authentication, but traditional enterprise SSO questions involving cloud applications generally expect SAML. OpenID Connect is a newer authentication layer built on OAuth 2.0.

• Power BI dataset — Reuses the existing tables, relationships, and measures. You mainly create new visualizations.
• SharePoint folder — Connects to the source files, but you would need to rebuild the model and measures.
• Power BI dataflows — Primarily provide reusable data preparation; they do not automatically provide the existing report’s measures and model.
• Excel workbook — Requires reconnecting to and modeling the source data again.

• state preserves the client’s original context, such as the specific idea URL the user requested.
• The portal sends that value in the OAuth authorization request.
• Salesforce returns it after authorization, allowing the portal to redirect the user to the original idea rather than the Ideas home page.

• A is valid:

apex 
  for (Account theAccount : AccountList) { 
      // process theAccount 
  }

• D is conceptually valid, using an index:

apex 
  for (Integer i = 0; i < AccountList.size(); i++) { 
      Account theAccount = AccountList[i]; 
  }

• B is invalid because for(AccountList) is not valid loop syntax.
• C is invalid because each item is an Account, not a List.

• Configure row-level security (RLS) using the sales region and the HR manager’s identity.
• Publish the reports and datasets through a Power BI app.
• Grant the HR managers permission to use the app, but do not add them as workspace members.
• App users can view and interact with reports while RLS limits them to their region.
• They cannot modify the report layout because they do not have workspace editing permissions.

• Adding them to the workspace gives them workspace permissions that may allow report or dataset changes, depending on the assigned role.
• Creating copies is unnecessary and creates maintenance and security problems.
• Hosting datasets and reports in different workspaces does not, by itself, provide the required controlled access.

1. Create a temporary Onboarding OU.
2. Move the new account into it.
3. Move the restrictive SCPs from the organization root to the Production OU.
4. Allow the account to update AWS Config.
5. Move the account into Production after onboarding.

• An SCP attached at the organization root applies to every account and OU beneath it.
• An SCP attached to the Production OU applies only to accounts in that OU.
• Therefore, moving the restrictive SCP from the root to Production temporarily exempts the onboarding account without weakening the policies for existing production accounts.
• Once onboarding is complete, moving the account into Production subjects it to the normal restrictions.

• Managerial: policies, standards, risk management, governance
• Operational: procedures carried out by people, such as training, incident response, and backups
• Technical: firewalls, encryption, access-control systems
• Physical: locks, guards, cameras

• AWS Network Firewall can inspect and block traffic across a VPC when traffic is routed through the firewall. A Drop action rule can deny traffic from the suspicious source IP.
• GuardDuty findings are sent to Security Hub.
• A Lambda function can be invoked when Security Hub receives a new GuardDuty finding, extract the source IP, and update the Network Firewall policy with a blocking rule.

• GuardDuty threat lists: Used to identify or increase the severity of findings; they do not directly block VPC traffic.
• AWS WAF: Protects supported web applications, such as CloudFront or Application Load Balancers. It does not provide general VPC-wide traffic blocking.
• GuardDuty suppression rules: Suppress or hide findings. They do not block the suspicious traffic.