Huawei H12-723_V3.0 Exam Prep
HCIP-Security-CTSS V3.0 Exam (Page 8 )

• A. IDS attack signatures: An IDS mainly detects suspicious network traffic. It is not the best control for scanning uploaded documents.
• C. Load balancer: Distributes traffic among servers and can improve availability, but does not specifically detect malware.
• D. WAF: Protects web applications from attacks such as SQL injection and command injection. It may inspect web requests, but malware scanning of PDF files is not its primary function.

• C — Before update
• D — Before insert

apex 
trigger AccountTrigger on Account (before insert, before update) { 
    for (Account acct : Trigger.new) { 
        acct.Description = 'Updated automatically'; 
    } 
}

• In after insert and after update, Trigger.new records are read-only.
• Use after triggers when you need the record’s final database Id or want to create/update related records.
• Attempting to change a field directly in an after trigger causes a read-only error.

1. Discovery tries the SSH probe first.
2. SSH fails.
3. Discovery tries SNMP, which succeeds.
4. Discovery records SNMP as the preferred service for that IP.
5. Future discoveries try SNMP first.

• Classification identifies the type of device, such as a server, router, or printer.
• Credential affinity remembers which credentials work for a device.
• MID Server affinity associates a device or network with a particular MID Server.
• IP service affinity specifically controls the preferred discovery protocol or service.

• Which host first communicated with the suspected malicious source
• Whether that host initiated suspicious traffic or merely received it
• Which other hosts show evidence of infection, such as connections from the originating host
• Which hosts have no related suspicious activity and are therefore clean

• An outbound connection to a suspicious external address
• A downloaded or executed malicious file
• Later lateral connections from that host to other internal systems
• Firewall logs showing the direction and timing of the traffic

• You can configure different pre-shared keys for different device groups.
• All cameras could use one key.
• All scanners could use another key.
• Each key can be associated with an appropriate role or access policy.

• Penetration test: Tests for exploitable vulnerabilities; it does not provide a broad opinion on whether security controls operate effectively.
• Annual self-assessment: Not independent, so it provides less assurance.
• Allow each client the right to audit: Inefficient because every customer may conduct a separate audit, creating duplicated effort and disruption.

• File is shared externally ? Access level

• File is labeled “Internal only” ? Sensitivity label

• T?o m?t Systems Manager Automation runbook d? ch?y l?nh kh?i d?ng l?i ?ng d?ng trên các EC2 instance.
• T?o m?t Amazon EventBridge rule ph?n ?ng khi CloudWatch alarm chuy?n sang tr?ng thái ALARM.
• Ð?t Automation runbook làm target c?a EventBridge rule.

1. Log c?a ?ng d?ng du?c ghi vào CloudWatch Logs.
2. CloudWatch alarm phát hi?n nhi?u l?i liên quan d?n vi?c restart.
3. Alarm chuy?n sang tr?ng thái ALARM.
4. EventBridge nh?n s? ki?n thay d?i tr?ng thái này.
5. EventBridge g?i Systems Manager Automation runbook.
6. Runbook restart ?ng d?ng trên các EC2 instance, không restart c? instance.

• A: SNS không tr?c ti?p g?i Systems Manager Automation runbook nhu m?t target native.
• B: Lambda có th? th?c hi?n vi?c restart, nhung ph?i t? x? lý vi?c xác d?nh instance và ch?y l?nh t? xa.
• C: Lambda ch? làm trung gian d? g?i runbook, không c?n thi?t vì EventBridge có th? g?i runbook tr?c ti?p.

• A: Concerns task scheduling and avoiding missed runs, not directly sizing the warehouse.
• B: The amount of data in a stream alone does not reliably determine compute needs; the SQL processing is what matters.
• D: A multi-cluster warehouse addresses concurrency, not the compute size needed for one task execution.

• D — Value analysis: Correct. It examines an existing product to identify ways of reducing its cost while still providing the required functions, quality and reliability.
• E — Kaizen costing: Correct. It involves making continuous, small improvements and cost reductions while the product is already in production.

• Functional analysis: It is not limited to minimizing the cost of the originally defined functions. It examines what functions are required and how they can be provided at the lowest overall cost.
• Value engineering: Usually applies to the design and development of a new product, rather than being a fundamental redesign of existing organisational processes. That description is closer to business process re-engineering.
• Target costing: The target cost is generally established during the product development stage, before production begins. It is not continuously reset while the product is in production.

1. Search & Intelligence in the Microsoft 365 admin center — No

1. Audit in the Microsoft Defender portal — Yes

1. Audit in the Microsoft Purview portal — Yes

• Managerial: policies, standards, risk management, governance
• Operational: procedures carried out by people, such as training, incident response, and backups
• Technical: firewalls, encryption, access-control systems
• Physical: locks, guards, cameras

• Three DHCP scopes: Each VLAN has its own IPv4 subnet. DHCP scopes are subnet-specific, so create one scope for:

• Two DHCP relays: DHCP client discovery begins as a broadcast, and broadcasts do not cross routers or VLAN boundaries. Therefore, configure a DHCP relay on the router or Layer 3 switch interface for each client VLAN.

• PC A: 192.168.1.10/24
• PC B: 192.168.2.10/24

• Both PCs have a correct default gateway
• A router or Layer 3 switch connects the subnets
• Routing and firewall rules allow the traffic

• Which batches and markets are affected
• Whether the deficiency affects product quality, efficacy, or patient safety
• Whether the issue is an ongoing manufacturing problem
• Whether immediate containment or distribution suspension is needed

• A — Withdraw the product: may be necessary, but is premature before assessing the risk.
• B — “Dear Dr.” letter: may be appropriate later, depending on the risk.
• C — Notify global authorities: may become mandatory, but the scope and urgency depend on the assessment.

• Default route: 0.0.0.0/0; used only when no more specific route exists.
• Network route: A route covering the destination, such as 10.10.13.0/24.
• Host route: An exact 10.10.13.10/32 entry in the routing table.
• Floating static route: A backup static route with a higher administrative distance.

• The S3 bucket as an origin for static content
• The Application Load Balancer (ALB) as an origin for dynamic content
• An Amazon Route 53 alias record pointing the application domain to CloudFront

Why this works

• Static data: CloudFront caches objects from S3 at edge locations, reducing latency for users worldwide.
• Dynamic data: CloudFront forwards requests that require application processing to the ALB. It can also maintain persistent connections and use the AWS global edge network to improve delivery performance.
• One domain: CloudFront behaviors can route different path patterns to different origins—for example, /static/* to S3 and other paths to the ALB.

Why the other options are incorrect

• Global Accelerator is designed primarily for accelerating traffic to applications with endpoints such as ALBs, not for caching S3 content.
• Using separate domains or splitting static and dynamic traffic adds unnecessary complexity.
• CloudFront already provides the required global edge distribution and caching, so combining it with Global Accelerator is unnecessary here.

• Warehouse size: Larger warehouses use more credits per unit of time than smaller ones.
• Number of clusters: A multi-cluster warehouse can run multiple clusters, and each active cluster consumes credits. Therefore, increasing the maximum or active cluster count can increase consumption.

• Number of users: More users may cause more workload, but users themselves do not consume credits.
• Amount of data processed: Snowflake warehouses are not charged directly by the amount of data scanned. However, processing more data may cause the warehouse to run longer, indirectly increasing credits.

• Active remediation actions role in Microsoft Defender for Endpoint

• Security Reader role in Azure AD/Entra ID

• Security Administrator is broader than necessary because it grants extensive security-management permissions, violating least privilege.
• Compliance Data Administrator is intended for compliance data management, not Defender for Endpoint remediation approvals.

• Virus signatures: Primarily associated with antivirus or antimalware tools.
• Security agent deployment: Usually handled by endpoint-management or endpoint-security platforms.
• Vulnerability scanning: Performed by vulnerability-assessment tools, although a SIEM may ingest their results.

• Preparing and managing datasets
• Building and training machine-learning models
• Testing and evaluating models
• Deploying models as endpoints for predictions

• Tracking who accessed or changed customer information
• Detecting unauthorized activity
• Supporting accountability and investigations
• Providing evidence for compliance and incident response

• Single sign-on not enabled: SSO improves convenience and centralized authentication, but it is not essential for access control.
• Complex passwords not required: This weakens authentication, but other controls may reduce the risk.
• Security baseline not consistently applied: A concern, but it is less specific and less immediately damaging than having no activity records at all.

• 50% memory utilization baseline: The environment can be provisioned with excess capacity, leaving room for growth and workload spikes.
• Storage scalability: Cloud storage can generally be expanded as needed without redesigning the physical platform.
• Single circuit failure resilience: A properly designed IaaS provider uses redundant power circuits and infrastructure, so failure of one circuit should not take the platform offline.

• A — Dual PDUs: Helps with power redundancy but does not provide storage scalability.
• C — Network load balancing: Provides network-path resilience, not memory or storage scalability, and does not address a power-circuit failure.
• D — Multiple NAS devices: May improve storage capacity, but does not inherently provide power resilience or the required compute-capacity baseline.

• Each Case must follow defined support steps.
• Each step must be completed within a specified time limit.

• Case Escalation Rules: Escalate Cases based mainly on age or criteria; they do not model a complete sequence of service steps.
• Process Builder with Scheduled Actions: Can automate time-based actions but is not the standard framework for Case service-level commitments.
• Omni-Channel Routing: Routes work to agents based on capacity and priority; it does not track Case lifecycle deadlines.

• IKE (Internet Key Exchange) negotiates the IPsec security association, including:

• ESP (Encapsulating Security Payload) protects the data after negotiation by providing encryption and optionally authentication.
• AH provides authentication and integrity but does not encrypt traffic.
• TLS is used for protocols such as HTTPS, not for negotiating IPsec parameters.

• Error correction (ECC): Improves data reliability but does not maximize bandwidth.
• RAM voltage: Increasing voltage may affect stability or speed, but it is not the primary method for increasing module bandwidth.
• Physical module size: Refers to the capacity or form factor of the RAM, not its data-transfer bandwidth.

• No servers or database infrastructure to provision.
• Uses standard SQL.
• Supports formats such as JSON, CSV, Parquet, and ORC.
• You typically define the table structure with AWS Glue Data Catalog or Athena’s own schema definitions.
• Charges are generally based on the amount of data scanned, so partitioning and columnar formats can reduce cost.
• It does not copy the data into a separate database; it reads the files in S3 when you run a query.

• JDBC
• SnowSQL
• Snowflake Web Interface (UI)
• ODBC
• Python connector

• Accept: Acknowledging the risk and choosing not to take additional action.
• Transfer: Shifting the risk or financial consequences to another party, such as an insurer.
• Mitigate: Reducing the likelihood or impact through controls, such as patching or access restrictions.
• Avoid: Eliminating the activity that creates the risk.

• C. Case after-insert trigger that publishes a Platform Event

• D. Custom Apex controller that publishes a Platform Event

• A. Trigger with a callout: Salesforce triggers should not make direct synchronous callouts, and this tightly couples transaction processing to the external system.
• B. Workflow Rule with Outbound Message: This can react to record changes, but it cannot reliably capture a user clicking a menu item. It also does not provide the same flexible event-driven model as Platform Events.

• A: Knowledge of IT platforms, networks, and methodologies — Useful technical knowledge, but the CISO does not need to be the deepest technical expert.
• C: Regulatory and project management knowledge — Important, but compliance and projects must still support the organization’s broader needs.
• D: Managing people and resources — Essential for execution, but effective management of the wrong security priorities will not produce good results.

• Menerjemahkan soal ke bahasa Indonesia.
• Menyebutkan jawaban yang benar.
• Menjelaskan alasan jawaban tersebut.
• Memberi tahu jika kunci jawaban yang tersedia tampaknya keliru.
• Menjelaskan istilah teknis penting dalam soal.

• Each team’s Bedrock workflow uses a separate IAM service role.
• The role’s Amazon S3 permissions can be limited to only that team’s customer folder or objects.
• This enforces least privilege and prevents one team’s Bedrock application from accessing another team’s data.
• Access is enforced by AWS permissions, not by asking users to provide a customer name in each request.

• A single role with broad S3 access does not provide team-level isolation.
• Asking teams to specify a customer name is not an access-control mechanism.
• Redacting data does not prevent unauthorized access.
• A bucket policy alone is insufficient unless it explicitly enforces the required team-role restrictions.

• Box 1: No — The rule requires user.department to equal Engineering. Engineer does not match, so User1 is not in AU1. Admin1 cannot reset User1’s password.
• Box 2: No — Admin1’s role is scoped to AU1 and cannot manage users outside that AU.
• Box 3: Yes — Admin2 is a Global Administrator and can reset User3’s password.

• Employees can work from any location, including remote sites and offices worldwide.
• Login can be relatively seamless after the device is registered.
• It does not require distributing additional physical authentication equipment.

• Geotagging: Identifies location, but location alone is not a strong authentication method and may prevent legitimate remote access.
• Smart cards: Provide strong authentication but require card readers and physical cards, increasing equipment and management requirements.
• Time-based logins: Typically involve one-time codes that users must enter, making the experience less seamless and potentially requiring a token or authenticator app.

• Customers may boycott V’s products.
• Supermarket customers may stop buying from V.
• Investors may view V as having higher legal, ethical and reputational risk.
• V could face fines, lawsuits, contract losses and higher costs.
• Expected future profits may fall.

Manager role

DAX 
Country[Manager] = USERPRINCIPALNAME()

• Sales
• Human Resources

CFO role

• See sales for all countries
• See no Human Resources data

• Do not restrict the Country table or Sales table.
• Apply a filter to Human Resources that always returns false, such as:

DAX 
FALSE()

1. x = -100
2. -100 < x < 100
3. 100 = x < 1000
4. x = 1000

• -500 ? class 1
• 0 ? class 2
• 100 ? class 3
• 1000 ? class 4

• Access controls — ensuring only authorized users can access it.
• Encryption — protecting the data if it is intercepted or exposed.

• BCP (Business Continuity Plan): è più ampio e mira a mantenere le funzioni essenziali dell’organizzazione durante un’interruzione. Il DRP è una componente più specifica del BCP.
• Communication plan: stabilisce come comunicare con dipendenti, cittadini e altre parti interessate, ma non ripristina i sistemi.
• IRP (Incident Response Plan): gestisce la risposta iniziale a un incidente di sicurezza, come un attacco informatico, non principalmente il recupero da un disastro fisico.

• Data Cloud combines data from multiple systems.
• It resolves and organizes that data into a unified customer view.
• That unified view enables downstream actions such as personalized campaigns, segmentation, analytics, and activation.

• A = core platform value
• D = a resulting business use case or benefit

• Streams — track change data for tables or views.
• External tables — reference data stored in an external cloud storage location.

• Role — account-level security object.
• Warehouse — account-level compute resource.
• User — account-level security object.
• Share — account-level object used to share data.

• B: Extending credit to customers increases receivables, so more cash is tied up in working capital.
• C: Replacing obsolete inventory does not reduce the overall inventory investment; it simply changes its composition.
• D: Paying suppliers earlier reduces payables. This uses cash and therefore increases the funds tied up in working capital.

• Deficiency found before patient use: usually does not require an adverse-event report because no patient exposure occurred.
• Event caused solely by the patient’s condition: may not be reportable if the device did not contribute.
• Malfunction protection operated correctly: generally exempt when the device’s safety mechanism worked as intended and prevented harm.

• Process Builder: Automates actions based on record changes; it does not create interactive user forms.
• Approval Process: Routes records for approval and captures approval decisions.
• Outbound Message: Sends information to an external system; it does not provide a user interface.

• A — Technical review by business owner: A business owner may approve the business impact, but a technical review is normally performed by technical personnel.
• C — Cost-benefit analysis after implementation: Cost-benefit analysis should occur before implementation to support the approval decision.
• D — Business continuity testing: This can be appropriate for major changes, but it is primarily part of business continuity and disaster recovery planning—not a universal change-management activity.

1. Open the Microsoft Entra Connect wizard.
2. Select Configure.
3. Choose Customize synchronization options.
4. Authenticate when prompted.
5. On the Domain and OU filtering page, select:

1. Complete the wizard.

• Start-ADSyncSyncCycle only starts synchronization; it does not change which OUs are included.
• Manage federation configures federation settings, which are unrelated to OU filtering.
• Add-ADSyncConnectorAttributeInclusion concerns connector attributes, not selecting additional OUs for synchronization.

• state preserves the client’s original context, such as the specific idea URL the user requested.
• The portal sends that value in the OAuth authorization request.
• Salesforce returns it after authorization, allowing the portal to redirect the user to the original idea rather than the Ideas home page.

• Filtering harmful or inappropriate content
• Blocking specified topics
• Detecting and masking sensitive information
• Enforcing content policies suitable for children

• Amazon Rekognition analyzes images and videos; it does not control text generated by a language model.
• Amazon Bedrock playgrounds are for testing models and prompts, not enforcing production safety policies.
• Agents for Amazon Bedrock help models complete tasks and use tools; they do not primarily provide content-safety controls.