HITRUST CCSFP Exam Prep
Certified CSF Practitioner 2025 (Page 8 )

• Malware or malicious software
• Command-and-control tools
• Internet surveillance and intrusion software

• ITAR: A U.S. regulation controlling defense-related articles and services; it is not the international arrangement described.
• Palermo Convention: Focuses on transnational organized crime and related protocols, not export controls for cyber weapons.
• GDPR: European data-protection and privacy legislation.

• DB1 (500 TB): Azure Data Box Heavy

• Virtual machines: Azure Migrate

• Create a CodeCommit repository in the secondary Region.
• Use CodeBuild to run a Git mirror operation from the primary repository to the secondary repository.
• Use EventBridge to detect relevant repository events, such as a pull request being merged.
• Invoke a Lambda function, which starts the CodeBuild project.

• B: Amazon S3 is object storage, not a Git repository that developers can use as a CodeCommit remote.
• C: CodeArtifact is intended for packages and artifacts, not source-code repository mirroring.
• D: An AWS Cloud9 environment is not an appropriate automated replication mechanism and would require manual or persistent infrastructure management.

• Fine-tuning requires a properly formatted training dataset.
• For classification or instruction-style fine-tuning, examples are supplied in JSONL format.
• Each line represents one training example, typically containing the input prompt and the desired completion or label.
• The file must then be uploaded or made available to the Microsoft Foundry fine-tuning workflow.

• A: Prompt Flow is useful for prompt experimentation, but it is not required to start fine-tuning.
• B: You do not need to deploy the base model to an online endpoint before fine-tuning.
• C: Tracing supports observability and evaluation, but it does not prepare the fine-tuning job or dataset.

• The message came from the claimed sender (authentication)
• The message was not altered (integrity)
• The sender cannot easily deny sending it (non-repudiation)

• Attackers can send unsigned phishing emails.
• Attackers may compromise a legitimate account and send signed malicious emails.
• Users may still be tricked by a validly signed message.

• Deploy five individual VMs: This does not create a VM scale set.
• Modify Availability Zones or Size settings: These actions do not create the required scale set and add unnecessary steps.
• VM orchestration mode: This is Flexible orchestration, intended for more individually managed VMs and mixed configurations. It is not the best choice for a straightforward group of identical instances.

• Explain questions from the exam page
• Check whether the stated answer is technically correct
• Compare answer choices and eliminate distractors
• Clarify Azure AI concepts and terminology
• Point out when an answer key appears unreliable or when an image is missing

• Deficiency found before patient use: usually does not require an adverse-event report because no patient exposure occurred.
• Event caused solely by the patient’s condition: may not be reportable if the device did not contribute.
• Malfunction protection operated correctly: generally exempt when the device’s safety mechanism worked as intended and prevented harm.

• Rights issue: Raises new equity from existing shareholders. It does not increase debt or gearing, so it is least likely to breach the covenant.
• Retained earnings: Also equity finance, but the amount available may be insufficient for the required $800 million.
• Private placement of a bond: Creates additional debt and would worsen gearing, increasing the risk of breaching the covenant.
• Bank overdraft: Also debt finance, usually short-term and potentially expensive; it would still increase financial risk and gearing.

• Self-signed certificate: Causes a browser security warning, not incorrect name resolution.
• Nameserver record: A DNS problem would typically affect multiple users, not just one workstation.
• IP helper: Relays services such as DHCP across network segments; it does not resolve website names.

• Response and resolution time frames
• Availability or uptime requirements
• Performance targets
• Support obligations
• Penalties for failing to meet requirements

• SOW (Statement of Work): Defines the project’s scope, tasks, and deliverables.
• MOA (Memorandum of Agreement): Describes cooperation and responsibilities between parties.
• MOU (Memorandum of Understanding): Records a general mutual understanding, usually without detailed enforceable service targets.

• MTTC: Time required to contain or limit the incident’s impact — best match.
• MTTR: Time required to remediate or recover from the incident; this may include eradication, restoration, and cleanup, which goes beyond merely stopping spread.
• MTTD: How long it takes to discover the incident.
• MTBF: Average time between failures, generally a reliability metric.

• Sales processes: Define the available Opportunity stages for each team.
• Record types: Connect each team to its appropriate sales process and page layout.
• Page layouts: Control which fields and related sections each team sees.

• Solar market team 1
• Solar market team 2
• Installation Services team

• One sales process: Cannot provide different Opportunity stages for each team.
• One page layout: Cannot provide different field arrangements or fields by team.
• Three page layouts alone: Page layouts control fields, but not the available stages.

• Standardize which services users can deploy
• Apply governance and access controls
• Manage approved product versions
• Give users self-service access to authorized resources

• AWS Control Tower: Sets up and governs a multi-account AWS environment.
• AWS Cloud Map: Provides service discovery for applications.
• AWS Clean Rooms: Enables privacy-preserving collaboration on data analysis.

• Group1 — security-enabled: Eligible.
• Group2 — mail-enabled and security-enabled: Eligible because it is still a security group.
• Group3 — Microsoft 365 group: Not eligible for group-based licensing.
• Group4 — Microsoft 365 group, not security-enabled: Not eligible.

• Two-part tariff pricing: $10 per unit
• Dual pricing: $20 per unit

Two-part tariff pricing

Dual pricing

• Division X, the seller, is credited with the market price: \(\$20\)
• Division Y, the buyer, is charged the marginal cost: \(\$10\)

• Security
• Availability
• Processing integrity
• Confidentiality
• Privacy

• Whether controls are suitably designed, and
• Whether they operated effectively over a period of time

• The job keeps 31 days of regular restore points. A backup from the week of January 1 is older than 31 days by March 20, so it is no longer expected to remain on the performance tier.
• It is also a weekly GFS full backup, retained for 14 weeks. Therefore, it is still protected and has not been deleted.
• In a Scale-out Backup Repository, older backups can be moved from the performance tier to the capacity tier—typically object storage—according to the configured offload policy.
• The archive tier is not selected because the question’s configuration does not indicate that the backup has been archived there.

• Recovery Services vault — stores Site Recovery configuration and recovery metadata.
• Hyper-V site — represents the on-premises Hyper-V environment.
• Azure virtual network — the target network where the replicated VM will run after failover. Since Azure VMs already use the same virtual network, that VNet can be selected as the target.
• Storage account or managed-disk target, depending on the ASR configuration and portal version.
• Provider/agent on the Hyper-V server — enables replication from Hyper-V to Azure.

• A: Not expanding would increase its dependence.
• B: More business from the same corporation would make dependence worse.
• D: Passing work to other minority businesses does not solve its own dependence.
• E: The passage does not suggest that it can force or influence the corporation to give work to others.

• CSIRT: A team that responds to and manages security incidents.
• CVSS: A scoring system for rating the severity of vulnerabilities.
• SOAR: A technology platform for automating and coordinating security operations and incident response.

• IKE (Internet Key Exchange) negotiates the IPsec security association, including:

• ESP (Encapsulating Security Payload) protects the data after negotiation by providing encryption and optionally authentication.
• AH provides authentication and integrity but does not encrypt traffic.
• TLS is used for protocols such as HTTPS, not for negotiating IPsec parameters.

• nmap - 10.11.1.130 — a network scanning command; mitigated with controls such as firewalls, monitoring, or access restrictions.
• “Click this link to get your free gift card.” — a phishing or social-engineering message; addressed through user awareness, email filtering, and authentication controls.
• “Your connection is not private.” — indicates a certificate or TLS validation problem; addressed by correcting the certificate or secure-connection configuration.

1. Search & Intelligence in the Microsoft 365 admin center — No

1. Audit in the Microsoft Defender portal — Yes

1. Audit in the Microsoft Purview portal — Yes

• A: Build a custom API — possible, but unnecessary as the primary solution and potentially more costly to develop and maintain.
• B: Use pre-built chatbots — these generally answer questions but may not support the required custom workflow and real-time actions.
• C: Fine-tune with sample data — improves model behavior but does not provide live database access.
• D: Google Cloud databases + Vertex AI — stores current inventory data and lets an AI agent retrieve it and take actions based on up-to-date information.

• CBWFQ (Class-Based Weighted Fair Queuing): Creates traffic classes and assigns each class a guaranteed bandwidth or queueing treatment.
• PQ (Priority Queuing): Uses multiple queues with strict priority. Higher-priority queues are serviced before lower-priority queues, making it useful for delay-sensitive traffic—but it can starve lower-priority traffic.

• FRTS: Traffic shaping for Frame Relay; it controls the transmission rate rather than selecting packets during congestion.
• CAR: Polices traffic by rate, typically dropping or remarking packets that exceed a limit.
• PBR: Policy-Based Routing; it selects forwarding paths and is not a QoS queueing mechanism.

• A business-hours greeting
• An after-hours greeting
• A holiday greeting

• Weekday evenings/nights
• Saturdays and Sundays

1. Auto attendant 1

1. Auto attendant 2

• A. Adjust resolution: Incorrect because an incompatible resolution usually causes no display, distortion, or an unsupported-mode message—not intermittent flickering.
• B. Swap the HDMI cable: Correct. Replacing the common, easily tested component is the appropriate troubleshooting step.
• C. Replace the projector: Incorrect because the issue also occurs with a monitor.
• D. Configure refresh rate: A mismatched refresh rate can cause visual problems, but the repeated flicker across displays points more strongly to the cable.

• Feedback form: Captures opinions, not necessarily actual behavior; users may not respond.
• Questionnaire: Relies on memory and subjective judgments about usefulness.
• Interviews: Can provide valuable qualitative insights, but a sample of users may not represent overall usage accurately.

• A: Concerns task scheduling and avoiding missed runs, not directly sizing the warehouse.
• B: The amount of data in a stream alone does not reliably determine compute needs; the SQL processing is what matters.
• D: A multi-cluster warehouse addresses concurrency, not the compute size needed for one task execution.

1. CALCULATE
2. AND
3. FILTER

DAX 
Transaction Category = 
CALCULATE( 
    MAX('Transaction Size'[Size]), 
    FILTER( 
        'Transaction Size', 
        AND( 
            Sales[Sales Amount] >= 'Transaction Size'[Minimum], 
            Sales[Sales Amount] <= 'Transaction Size'[Maximum] 
        ) 
    ) 
)

• FILTER examines the rows in the Transaction Size table.
• AND ensures the sales amount falls between the category’s minimum and maximum values.
• CALCULATE evaluates the result in the modified filter context and returns the matching category.