HITRUST CCSFP Exam Prep
Certified CSF Practitioner 2025 (Page 6 )

• The CSV contains the external users’ email addresses.
• The bulk invitation feature supports inviting many guest users in one operation.
• Each invited user becomes a guest account in contoso.com.

• A — .gitignore: Controls Git tracking; it does not configure Copilot exclusions.
• B — copilot.ignore: This is not the standard GitHub Copilot Business exclusion mechanism.
• D — Renaming files: Adding _no_copilot has no recognized effect.

• Firewall
• Intrusion prevention and detection
• Antivirus or antimalware
• Web and email filtering
• Virtual private networking (VPN)
• Sometimes content filtering and centralized reporting

• Understating expenses and liabilities
• Overstating profit
• Misleading users of the financial information
• Potentially breaching integrity, objectivity, and professional competence and due care

• A — Windows 11 with Azure CLI installed: Yes

• D — Chrome OS using Azure Cloud Shell: Yes

• E — Windows 10 with the Azure PowerShell module installed: Yes

• B — Linux with only Azure CLI: No, because the option does not state that PowerShell is installed.
• C — macOS with PowerShell Core only: No, because it does not state that Azure PowerShell modules or Azure CLI are installed.

• Install unauthorized or unsupported software
• Access features blocked by the manufacturer or operating system
• Customize system behavior beyond normal settings

• Honeypots: Decoy systems designed to attract attackers. Legitimate users should not access them, so activity there is a strong indication of unauthorized access.
• DNS sinkholes: Redirect requests for known malicious domains to a controlled internal destination instead of the real attacker infrastructure. Security teams can then identify infected systems making those requests.

• Tokenization: Replaces sensitive data with non-sensitive tokens; it protects data but does not detect intruders.
• CI/CD: Software development and deployment processes.
• Threat modeling: Identifies potential threats before or during system design, rather than detecting successful infiltration.
• Data obfuscation: Makes information harder to understand, but is not an attacker-detection mechanism.

• Suspended an operator who correctly refused to use unsafe equipment.
• Rewarded another operator for using the equipment despite the broken safety guard.

• A — Management is not particularly concerned with managing risks.

• B — Employees will perceive that management does not care about health and safety risks.

• C — This factory’s safety record is likely to be poor.

• Plenum: Describes a fire-resistant cable jacket rating, not a transmission medium or speed.
• Ethernet: Describes a networking technology; Ethernet can use copper or fiber, so the term alone does not identify the fastest cable type.
• DAC (Direct Attach Copper): Uses copper and is typically intended for short-distance, high-speed connections in data centers.

• Where to find the TiMOS runtime image
• Which configuration file to load
• The IP address and related settings for the CPM management Ethernet port

• A: User authorization is configured in the router’s security configuration, not primarily in the BOF.
• C: Hardware initialization is performed by the boot process and system software.
• D: The system date and time are configured separately, often through NTP or CLI settings.

• B. Deploy to a SageMaker endpoint: This is needed for SageMaker-hosted models, not for a model intended to be used directly in Amazon Bedrock.
• C. Register with SageMaker Model Registry: SageMaker Model Registry is unrelated to invoking custom models in Bedrock.
• D. Grant access in Bedrock: Access permissions may be necessary, but they do not replace the required provisioned capacity.

• Microsoft manages the physical datacenter, hardware, and virtualization.
• You manage the virtual machine’s operating system, installed software, configuration, and data.
• You choose the VM size, storage, networking, and scaling options.

• SaaS: You consume a complete application managed by the provider, such as Microsoft 365.
• PaaS: You deploy applications without managing the underlying operating system or VM infrastructure, such as Azure App Service.

• Information sources: Collect security-related data, such as network packets, system logs, audit records, or application events.
• Analysis: Examines the collected data to identify suspicious activity, attacks, or policy violations.
• Response: Takes or recommends action, such as generating alerts, logging the event, or supporting a protective response.

• On VirtualNetworkA: enable Allow gateway transit.
• On VirtualNetworkB: enable Use remote gateways.

1. Clear principles and boundaries — Employees have freedom, but decisions must remain within clear organizational values, policies and limits.
2. High degree of freedom — Managers are trusted to make decisions rather than seeking continual approval from senior management.
3. Frontline customer responsibility — Customer-facing managers should be empowered to manage customer relationships and respond quickly to needs.
4. Transparent and ethical information — Information should be openly available and used honestly, supporting trust and informed decision-making.

• A PostToolUse hook for file writes under src/api/ that runs the linter.
• A separate PostToolUse hook for API/data processing that normalizes payloads to snake_case.

• Amazon S3 as the origin for static content
• Application Load Balancer (ALB) as the origin for dynamic content
• Amazon Route 53 configured to point the company’s domain name to CloudFront

• /static/* ? S3 origin; cache content at edge locations
• Dynamic paths such as /api/* ? ALB origin; forward requests to the EC2 application

• Deploy five individual VMs: This does not create a VM scale set.
• Modify Availability Zones or Size settings: These actions do not create the required scale set and add unnecessary steps.
• VM orchestration mode: This is Flexible orchestration, intended for more individually managed VMs and mixed configurations. It is not the best choice for a straightforward group of identical instances.

• The users currently have Office 365 Enterprise E3 licenses assigned directly.
• Assigning Microsoft 365 Enterprise E5 through a group does not automatically remove their directly assigned E3 licenses.
• From the Licenses blade, you can select the E3 product and remove it from all assigned users in one operation. This requires less effort than editing 2,500 users individually.

• Identity Governance manages access reviews, entitlement management, and related governance—not bulk license removal.
• Set-AzureAdUser does not remove product licenses.
• Set-WindowsProductKey applies Windows product keys and is unrelated to Microsoft 365 licensing.

• Existing expected ROI: 15%
• New project ROI: 14%
• Cost of capital: 12%

• Project return = 14%
• Cost of capital = 12%
• It earns 2% more than the cost of capital, so it should increase shareholder value.

• Sales process: Controls which Opportunity Stage values are available.
• Record type: Associates the appropriate sales process with a business scenario and controls available picklist values.
• Page layout: Controls which fields are displayed and whether they are required or read-only.

• Energy Market Team 1 ? Record Type 1, Sales Process 1, Page Layout 1
• Energy Market Team 2 ? Record Type 2, Sales Process 2, Page Layout 2
• Services/Installation Team ? Record Type 3, Sales Process 3, Page Layout 3

• Customize Opportunity Contact Role
• Add the Opportunity Contact Role related list to the Opportunity page layout

DAX 
Sales % of Total = 
DIVIDE( 
    [Total Sales], 
    CALCULATE( 
        [Total Sales], 
        ALLSELECTED(Products) 
    ) 
)

DAX 
Total Sales = 
SUM(Sales[SalesAmount])

Why ALLSELECTED is required

• The numerator, [Total Sales], is evaluated for the current product.
• ALLSELECTED(Products) removes the current product’s visual filter when calculating the denominator.
• It preserves filters applied at the report, page, or slicer level.

Why not ALL(Products)?

DAX 
CALCULATE([Total Sales], ALL(Products))

• Install unauthorized or unapproved applications
• Access system areas normally restricted
• Add features unavailable in the default software
• Modify the device’s operating system

• SQL injection (SQLi): Attacks databases by inserting malicious SQL commands.
• Cross-site scripting (XSS): Injects malicious scripts into web pages viewed by users.
• Sideloading: Installs an application from outside the official app store, but it does not necessarily remove the phone’s operating-system restrictions.

• Outer packet: 10.5.1.1 > 52.165.16.154
• IPv4 protocol field: 41, which indicates IPv6 encapsulation
• Inner packet: IPv6 traffic between 2001:... addresses

• MAC address spoofing: Changes Layer 2 addressing; it does not explain the IPv6-in-IPv4 structure.
• Steganography: Hides data inside files or media, not visibly in a tunneled protocol.
• Broken encryption: No evidence of encryption being cracked.
• On-path sniffing: Involves intercepting traffic, not sending data to an external host.

• Configure row-level security (RLS) using the sales region and the HR manager’s identity.
• Publish the reports and datasets through a Power BI app.
• Grant the HR managers permission to use the app, but do not add them as workspace members.
• App users can view and interact with reports while RLS limits them to their region.
• They cannot modify the report layout because they do not have workspace editing permissions.

• Adding them to the workspace gives them workspace permissions that may allow report or dataset changes, depending on the assigned role.
• Creating copies is unnecessary and creates maintenance and security problems.
• Hosting datasets and reports in different workspaces does not, by itself, provide the required controlled access.

1. Which host originated the infection
2. Whether each other host is clean or infected
3. Which firewall or host logs provide evidence of the infection’s movement

• Find the earliest infection-related event. The host associated with that event is the likely origin.
• Follow the timeline: outbound connections from that host may indicate propagation or command-and-control activity.
• A host receiving suspicious traffic is not automatically infected; look for evidence that it executed or initiated malicious activity.
• A firewall log can show traffic paths, but endpoint logs are usually needed to confirm infection.
• Mark a host clean only when the logs show no indicators of compromise or malicious activity.

• STIX: A standardized format for exchanging cyber-threat intelligence.
• OVAL: A language and framework for describing and assessing system vulnerabilities and configuration issues.
• Threat intelligence feed: Provides current indicators or threat information, but is not specifically a reference for common application exploitation techniques.
• CVE: A catalog of publicly disclosed vulnerabilities, identified by unique CVE numbers.

• state preserves the client’s original context, such as the specific idea URL the user requested.
• The portal sends that value in the OAuth authorization request.
• Salesforce returns it after authorization, allowing the portal to redirect the user to the original idea rather than the Ideas home page.

• 24 cores: Available in the Business Critical provisioned-compute configurations.
• Approximately 124 GB memory: Matches the memory capacity of the relevant Business Critical hardware configuration.
• More than 50,000 IOPS: Business Critical uses local SSD storage and provides the high I/O performance required here.
• 500 GB storage: Well within the tier’s supported capacity.

• Premium: The DTU-based Premium tier does not provide the required combination of compute, memory, and I/O characteristics.
• Hyperscale: Hyperscale is primarily intended for very large databases and independent storage scaling. It is not the best match for these specific high-memory and high-IOPS requirements.

• Streams — track change data for tables or views.
• External tables — reference data stored in an external cloud storage location.

• Role — account-level security object.
• Warehouse — account-level compute resource.
• User — account-level security object.
• Share — account-level object used to share data.

• HTTPS: Secure web traffic, not general command-line server administration.
• SNMPv3: Secure network monitoring and management, not interactive server login.
• RDP: Provides graphical remote desktop access. It can be secure, but it is not the direct replacement for Telnet in this scenario.
• SMTP: Used to send email.

• A. Adjust resolution: Incorrect because an incompatible resolution usually causes no display, distortion, or an unsupported-mode message—not intermittent flickering.
• B. Swap the HDMI cable: Correct. Replacing the common, easily tested component is the appropriate troubleshooting step.
• C. Replace the projector: Incorrect because the issue also occurs with a monitor.
• D. Configure refresh rate: A mismatched refresh rate can cause visual problems, but the repeated flicker across displays points more strongly to the cable.

sql 
ALTER TABLE dbo.DimCustomer 
ADD CONSTRAINT PK_DimCustomer 
PRIMARY KEY NONCLUSTERED (CustomerKey) 
NOT ENFORCED;

1. ALTER TABLE dbo.DimCustomer
2. ADD CONSTRAINT PK_DimCustomer PRIMARY KEY NONCLUSTERED (CustomerKey)
3. NOT ENFORCED

• up ? down ? up
• Often happens rapidly or intermittently

• Faulty or loose cable or connector
• Failing transceiver, NIC, or switch port
• Speed/duplex or auto-negotiation problems
• Power or hardware instability
• Layer 1 interference

• Nothing plugged in: the port is simply down
• Latency: does not directly trigger err-disable
• shutdown: administratively disables the port, but that is not the same as an automatically detected err-disabled condition

• Custom domains are supported.
• It provides dedicated compute instances.
• It offers enough storage for the applications.
• It supports multiple instances with load balancing between them.
• It is less expensive than higher tiers such as Premium.

• Free and Shared use shared compute and have limited storage, so they cannot meet the dedicated-instance requirement.
• Basic provides dedicated compute and custom domains, but the question’s requirement for the broader multi-instance/load-balancing capability is intended to point to Standard.

• Wireshark captures packets and allows you to examine their contents, potentially revealing usernames and passwords sent without encryption.
• Netcat creates network connections and can send or receive data, but it is not primarily a packet-analysis tool.
• Nessus scans for known vulnerabilities and configuration issues; it generally would not prove that credentials are visible in transit.
• Nmap performs network discovery and port/service scanning, not detailed packet-content inspection.

• A — Consumption-based pricing: AWS generally uses a pay-as-you-go model. You pay for the resources you consume rather than purchasing hardware upfront or paying for unused capacity.
• C — Economies of scale: AWS purchases and operates infrastructure at a very large scale, allowing it to reduce costs and pass some savings to customers through lower service prices.

• Perpetual licenses: These involve paying once for permanent software ownership and are not a primary AWS Cloud economic benefit.
• AWS Enterprise Support at no additional cost: Enterprise Support has an additional charge.
• Bring-your-own-hardware model: AWS provides and manages the underlying cloud infrastructure; customers do not normally bring their own physical servers.

Correct reasoning

• Create storage5 as a General-purpose v2 (StorageV2) account.
• Configure Blob object replication from storage5 to an existing compatible storage account.
• The destination must support object replication—typically another StorageV2 or premium block blob account.
• Blob versioning must be enabled on both accounts.
• Blob change feed must be enabled on the source account.
• The accounts must meet Azure’s object-replication requirements, including being in supported regions and having compatible configuration.

• A password cracker would normally be identified by behavior such as loading password hashes or attempting dictionary/brute-force attacks.
• The question describes a routine audit, not password recovery.
• Simply encountering a protected file during an audit is characteristic of a misconfigured or insufficiently privileged FIM.

• Accept terms of use
• Enter a temporary code or credentials
• Provide basic registration information

• Enterprise authentication — Authenticates organizational users, often with centralized identity services; it is not specifically designed for temporary guest access.
• Ad hoc network — A temporary device-to-device network, not an authentication process.
• WPA3 — A wireless security standard. It protects Wi-Fi access but does not provide the web-based temporary access workflow described here.

• Code signing: Verifies the software’s authenticity and integrity; it does not hide the source code or prevent reverse engineering.
• Tokenization: Replaces sensitive data with tokens, mainly for protecting data such as payment information—not software logic.
• Blockchain: Provides a tamper-resistant record of transactions or data; it does not protect compiled code from analysis.

• Deficiency found before patient use: usually does not require an adverse-event report because no patient exposure occurred.
• Event caused solely by the patient’s condition: may not be reportable if the device did not contribute.
• Malfunction protection operated correctly: generally exempt when the device’s safety mechanism worked as intended and prevented harm.

• CSIRT: A team that responds to and manages security incidents.
• CVSS: A scoring system for rating the severity of vulnerabilities.
• SOAR: A technology platform for automating and coordinating security operations and incident response.

• Existing measures
• Relationships
• Calculated columns
• Tables and fields
• Existing transformations in the model

• SharePoint folder: Reconnects to the source files. You would likely need to recreate the model and measures.
• Power BI dataflows: Primarily provide reusable data preparation and storage, but they do not automatically provide the existing semantic model and measures.
• Excel workbook: Connects directly to the source file and would also require rebuilding the model and measures.

• Firewalls and routers
• Servers and applications
• Endpoint devices
• Authentication systems
• Cloud services

• Centralized log collection
• Event correlation
• Dashboards and reporting
• Alerting
• Compliance support

• Azure Machine Learning Studio is designed to build, test, train, and deploy machine-learning models, including predictive analytics.
• Azure Cosmos DB is a globally distributed NoSQL database. It can store data used by an AI solution, but it is not the primary service for developing and deploying predictive models.
• Therefore, the appropriate recommendation is Azure Machine Learning Studio, as shown in Question 15.

• A. IDS attack signatures: An IDS mainly detects suspicious network traffic. It is not the best control for scanning uploaded documents.
• C. Load balancer: Distributes traffic among servers and can improve availability, but does not specifically detect malware.
• D. WAF: Protects web applications from attacks such as SQL injection and command injection. It may inspect web requests, but malware scanning of PDF files is not its primary function.