Huawei H13-321 Exam Actual Questions
HCIP-AI-EI Developer V2.0 (Page 17 )

• Assign users or their team an appropriate security role.
• Ensure the role has the required table privileges, such as read, create, write, and append.
• Share the app with that security role in the app designer.

• Dynamics administration center: Used for environment and service administration, not routine app access configuration.
• Manage Roles: Not the specific Dataverse area used to define app and data permissions.
• Security Roles: Define what users can access and which operations they can perform.

• Equipment and hardware
• Facilities
• Inventory
• Backup media
• Supplies stored at an alternate or remote location

• Personal belongings of staff: Usually not organizational assets.
• DR line-item revenues: Revenue is a financial impact, not a physical asset.
• Cloud-based applications: These are primarily logical or information-processing assets, even though they depend on physical infrastructure.

• En Cisco SD-Access, el fabric overlay se extiende hasta lo inalámbrico; los APs son nodos de borde del fabric y su tráfico queda dentro del overlay.
• El cliente inalámbrico genera tráfico que viaja por el overlay, pero no es un componente del fabric en sí.
• El WLC es principalmente una herramienta de gestión y control, no forma parte del overlay; el underlay es el transporte físico.

• Honeypots: Decoy systems or services designed to attract attackers. Legitimate users should not access them, so activity on a honeypot is a strong indicator of unauthorized activity. Security teams can also observe attacker behavior.

• DNS sinkhole: Redirects requests for known malicious domains to a controlled internal server or blocks them. If an infected workstation attempts to contact command-and-control infrastructure, the sinkhole records the request and helps identify the compromised device.

• Tokenization: Protects sensitive data by replacing it with tokens.
• CI/CD: Automates software development and deployment.
• Threat modeling: Identifies potential risks before or during system design.
• Data obfuscation: Makes data harder to understand, but does not detect intruders.

• To get min/max per column, you need column profiling. That’s provided by enabling the column profile.
• To actually see those min/max values, you should show the column profile in the details pane, and you also need the details pane itself enabled so you can view it.

• Enable column profile (B)
• Show column profile in details pane (C)
• Enable details pane (E)

• Show column value distribution (D) shows distribution shape but isn’t required to get min/max.
• Show column quality details (D) deals with data quality metrics, not min/max.

• The mapping and resolution of endpoint identities (EIDs) to their location (RLOCs) in an SD-Access fabric is handled by the control plane using the LISP protocol.
• Why not the others:

• Correct answer: A. Inbound data transfer from the internet

• Why: AWS does not charge for data transferred into AWS from the internet. Inbound data transfer is free, regardless of the amount (in this case, 2 TB). The other options involve data leaving AWS or moving between AWS regions/AZs, which incur costs:

• Correct answer: enable SLAAC on an interface (C)

• Why the other options are not correct:

• Pull: Downloads changes from the central repository and updates the local repository.
• Push: Sends local commits to the central repository.
• Commit: Records local changes in the repository’s history.
• Merge: Combines changes from different branches.
• Clone: Creates a new local copy of a repository.

• Phishing can map to two MITRE ATT&CK tactics depending on the attacker’s objective.

• Therefore, phishing isn’t confined to a single tactic; it can serve both Reconnaissance and Initial Access, which is why option D (Reconnaissance, Initial Access) is correct.

• Progress iteratively with feedback focuses on making improvements in manageable steps and learning from feedback.
• Optimize and automate focuses on maximizing value from resources and automating suitable activities.
• Start where you are focuses on assessing the current situation and reusing what already exists.

• Coordinate and manage the assessment team
• Assign assessment activities
• Direct interviews, examinations, and tests
• Ensure the assessment follows the CAP

• Answer key: Lead Assessor — likely wrong
• CAP-based answer: C3PAO

• Interactive development and exploration
• Small datasets
• Lightweight transformations or testing
• Avoiding the overhead and cost of multiple workers

• Automated reports: Jobs may benefit from job clusters or SQL warehouses.
• Working with SQL in Databricks SQL: Databricks SQL warehouses are the relevant compute option.
• Automatically scaling for larger data: A multi-node cluster with autoscaling is more suitable.
• Large amounts of data: Distributed worker nodes are generally needed.

Why B works

• AWS KMS keys are Regional resources. A normal customer managed key in Region A cannot be used directly in Region B.
• A customer managed multi-Region KMS key (MRK) has related key replicas in both Regions. The replicas share key material and key ID, although each has a Regional ARN.
• With client-side encryption, the application encrypts the data before storing it in S3. Cross-Region replication then copies already-encrypted objects, so S3 does not need to decrypt and re-encrypt them with a different Regional key.

Why the other choices are weaker

• A and C: SSE-S3 uses Amazon-managed S3 keys, not the required customer managed KMS key.
• D: SSE-KMS can work only if the solution creates and configures the appropriate KMS key or multi-Region key replica in each Region. As written, it says to create a customer managed KMS key in each Region, which implies separate keys—not the same KMS key. Replication also requires additional KMS permissions and destination encryption configuration.

• Correct answer: C. AWS CloudFormation

• Why: CloudFormation lets you define infrastructure as code via templates (JSON or YAML). You can create a single template that describes multiple AWS resources and reuse it to deploy consistent stacks across environments. Templates can be parameterized and stored for repeated deployments. Other options (Marketplace, AMI, OpsWorks) don’t provide reusable deployment templates in the same way.

• State is stored remotely in Terraform Cloud/Enterprise, not as a local file.
• Terraform runs (plan/apply) can be executed on remote infrastructure, with results visible in the remote workspace UI.
• Supports workspace-based organization, state locking, and concurrency control.
• Useful for team collaboration, centralized governance, and auditable logs.

• In your configuration, you use a backend block like backend "remote" { ... }.
• You still run terraform init to configure/migrate to the remote backend.
• After setup, terraform plan/terraform apply may be executed remotely, and the outputs/logs appear in the Terraform Cloud/Enterprise UI rather than (only) in your local terminal.

• Other backends store state remotely but typically do not provide remote execution; with the remote backend you get remote runs and a collaborative UI, not just remote state storage.

• Why this is correct: In Azure Virtual Desktop, user access to a host pool is controlled through App Groups. The default app group for a host pool publishes the full desktop, so adding members to that app group grants them sign-in and access to the desktop (and any RemoteApps in that group). This is the standard way to give users access to AVD resources.

• Why the other options are not correct:

• Practical steps (high level):

• The correct permission is Manage Sandboxes (the official Salesforce name; the option in the list is written as “Manage Sandbox,” which is effectively the same idea but the canonical name uses the plural).
• Why: Sandboxes are a lifecycle feature. Only users with the explicit Manage Sandboxes permission can perform create, delete, refresh, or activate actions.
• Why the other options aren’t correct:

• The missing piece is to configure an event source mapping between the DynamoDB stream and the Lambda function. Enabling DynamoDB Streams alone doesn’t trigger the function—you must wire the stream to Lambda so events invoke the function.
• Note that changing StreamViewType (A) only affects what data is delivered (e.g., NEW_IMAGE) and does not trigger invocations. Options C and D are not required for invocation: you don’t need SNS, and increasing the timeout won’t enable the trigger.

• Goal: Identify the host that originated the infection, then label each remaining host as infected or clean based on log evidence.

• Logs to review (across hosts and firewall):

• How to identify the origin:

• How to classify other hosts:

• Quick tip: use the Reset All option if you want to re-run the scenario and practice again.

cmd 
powershell.exe -ExecutionPolicy Bypass -File C:\Scripts\Configure-VM.ps1

• GPO logon script: Runs only when a user logs on, so configuration may be delayed and is user-dependent.
• GPO startup script: Can work, but requires the VMs to be domain-joined and introduces GPO dependency. It is not specifically tied to Windows deployment.
• Place scripts in a VHD: Merely makes the files available; it does not execute them.

• Answer: S3 Inventory report.

• Why: The S3 Inventory report provides a scheduled listing of objects within a bucket, including metadata about each object. When you configure it to include object tagging, you can see tags for each object, and the object keys (which reflect prefixes) and bucket scope are captured in the report. This makes it suitable for auditing and tracking “tags, buckets, and prefixes” across S3 objects.

• What the other options do (not suitable for this purpose):

• Tip: If you need tags in the report, enable the inventory option to include object tagging in the configuration.

• Answer: Internal load balancers (ILB) — option C.

• An ILB has a frontend IP address that must be a private IP within the subnet’s address space. You pick this IP when you create the ILB, and it can be Static or Dynamic.
• Other options don’t require a per-subnet IP:

• Self-signed certificate: Causes a certificate warning, not incorrect IP resolution.
• Nameserver record: A DNS record problem would typically affect multiple users, not just one.
• IP helper: Relays DHCP or other broadcast traffic between networks; it does not control website name resolution.

• A: True. You can change the size of a Virtual Warehouse after creation (via UI or ALTER WAREHOUSE).

• B: True. A warehouse can be resized while it’s running; the resize will take effect without needing to stop queries.

• C: True. A warehouse can be configured to suspend after a period of inactivity (AUTO_SUSPEND).

• D: True. A warehouse can be configured to auto-resume when new queries are submitted (AUTO_RESUME).

• Correct answer: only new data added to the eventhouse (option E).
• Why: When you enable OneLake availability for the eventhouse, OneLake starts syncing data going forward. It does not automatically backfill or copy over data that already exists in the eventhouse before the enablement.
• What that means in practice: Any data added to the eventhouse after you enable OneLake will appear in OneLake (and be visible from OneLake file explorer). Pre-existing data in the eventhouse stays there unless you perform a separate backfill/copy operation outside the standard OneLake enablement.
• How to verify: add a small new dataset to the eventhouse after enabling OneLake availability, then check OneLake to confirm the new dataset appears.

• The correct answer: C. Tokenization

• Why:

• Why the others are weaker:

• IKE: Negotiates security parameters for IPsec VPNs; it does not identify switch ports.
• VLAN: A logical network segmentation method, not a discovery protocol.
• netstat: Displays local network connections and listening services, but cannot identify the physical switch or port.

• L2TP uses UDP port 1701 for the L2TP control channel.
• The destination port is 1701; the source port is a dynamically chosen ephemeral port on the client (not 1701).
• Therefore the statement that both source and destination ports are 1710 is incorrect (and 1710 is not the standard L2TP port).

• The destination port should be 1701, not 1710.
• The source port should be an ephemeral port chosen by the client, not 1701.

• Correct answer: A. Email templates

• Snippets are reusable content blocks that you insert into email content, and they require an email template (or at least an email draft) to render.
• You can store region-specific footers as snippets and include them in a template, but there would be nothing to render the snippet into without a template.
• The other options aren’t prerequisites for using snippets:

• Drop violating frames
• Log or alert on the violation
• Shut down or restrict the port

• Load balancer: Distributes application traffic; it does not control switch MAC learning.
• IPS: May detect some network attacks but is not the primary control for switch MAC-table exhaustion.
• NGFW: Protects traffic crossing network boundaries, while MAC flooding occurs at the switching/LAN layer.

• Answer: D) Out-of-band management

• Why this is correct:

• Why the other options aren’t suitable here:

• Actual filename: Document.xml.txt
• Explorer displays: Document.xml
• File type: Text Document (.txt)

text 
Document.txt ? Document.xml

• On-prem you generalize and capture the VM as a VHD.
• Upload the VHD to Azure with Add-AzVhd.
• Register the VHD as an image in Azure with Add-AzImage (or New-AzImage) so it appears as a selectable image.
• Create new VMs from that image (e.g., with New-AzVM -Image ...).

• I can’t view the images, so I can’t tell which table is labeled as A in your screenshot. But here’s how to decide:

• How to identify the fact table:

• How to identify the surrogate key in the Patient table:

• Relationship:

• administrators — Full access to switch configuration and REST API functions; excessive for this requirement.
• sysadmin — Intended for highly privileged system administration, not basic monitoring.
• helpdesk — More limited and focused on troubleshooting/support functions; it does not match the stated default role and level-1 requirement as directly.

• Active vs passive: Active assessment involves actively scanning targets by sending probes/packets to identify hosts, services, and vulnerabilities. Passive assessment observes traffic without probing.
• External vs internal: External assessment is about testing from outside the network perimeter; the scenario doesn’t specify external vantage, only that tools are identifying hosts/services across the enterprise network.

• It is a sequence of distinct phases that flow one after another (requirements ? design ? implementation ? verification ? maintenance).
• Requirements are defined up front and changes are costly; the project often requires formal sign-off before moving to the next phase.
• It emphasizes heavy documentation and minimal iteration after a phase is completed.

• The correct option is B: AWS Storage Gateway.

• Why: The scenario requires backing up on-prem data to AWS without changing existing backup workflows. AWS Storage Gateway provides a hybrid storage solution; specifically, the Tape Gateway emulates a physical tape library, allowing your existing backup software to write to virtual tapes that are stored in AWS (in S3 or S3 Glacier). This lets you back up 10 TB to the cloud while preserving current backup workflows and on-prem infrastructure.

• How it would work: Deploy a gateway appliance or VM on-site, connect your tape-based backup software to the virtual tape library, and start writing to virtual tapes. The data is then archived in AWS, freeing up local storage.

• Why the others aren’t suitable:

• Quick tip: If you weren’t using tape, File Gateway could be another option for file-based backups; Tape Gateway is the right pick for tape-based workflows.

• Amazon S3 — Object storage, not a database.
• Amazon DynamoDB — Fully managed NoSQL key-value and document database.
• Amazon Redshift — Managed data warehouse designed for analytics, not primarily transactional MySQL workloads.

• Failed login attempts
• The account being targeted
• The source user or system
• Time and frequency of attempts

• Two-factor authentication: Helps prevent unauthorized access, but does not primarily detect the employee’s attempts.
• Firewall: Controls network traffic; it generally does not monitor individual login attempts.
• Intrusion prevention system (IPS): Can detect certain network attacks, but this scenario is best addressed through authentication and audit logging.

• A. Configure prompt modifications to enforce tone, disclaimers, and refusal behavior at the system level.

• D. Configure Power Platform DLP policies to restrict unauthorized data connectors.

• B: Manual topic-by-topic disclaimer edits are specifically discouraged.
• C: Channel settings do not replace agent-level Responsible AI controls.
• E: Publishing before enabling safety filters violates the stated deployment sequence. Responsible AI filters should be enabled before publication, not afterward.

• Correct options: C and D.

• The AWS Cloud Adoption Framework (CAF) security perspective focuses on capabilities to protect information and manage security risk.
• Observability (A) is primarily an operations/monitoring capability, not a core security capability under CAF.
• Incident and problem management (B) is IT service management/operations, not specifically a CAF security capability.
• Incident response (C) is a security-focused capability: detecting, containing, and recovering from security incidents.
• Infrastructure protection (D) involves applying security controls to protect the underlying infrastructure, which fits the security perspective.

• A single Construction Job can use multiple Machinery records.
• A single Machinery record may be used on multiple Construction Jobs.
• This is a many-to-many relationship, which Salesforce models using a junction object.
• The junction object can contain fields such as:

• Master-detail to Machinery
• Master-detail to Construction Job
• Date and cost fields

• ?????? CPU
• ?????????????????
• ??????????????????????????
• ???????????? throughput
• ??????????????????????????????

• A ??????? system software ????????????????????????????????? ??????????????????????????????????
• B ?????????????????????????? ????????????????????????? ?????????????????????????????
• D ????????????????????????? ?????????????? ?????????????????????????????????????????

• Correct answer: B (No, it does not).

• A purchase agreement in Dynamics 365 SCM is a vendor-side price arrangement. It sets prices/discounts for what your company buys from suppliers, not for what you sell to customers.
• The objective in Question 2 is to give clients a quantity-based discount on items they purchase from you. To accomplish this, you should configure a sales price / trade agreement (on the customer/sales side), not a purchase agreement.
• In a sales price trade agreement, you can define quantity breaks such as:

• Create a Sales price trade agreement for the item and relevant customer (or customer group).
• Add quantity breaks: 51–100 with 10% discount, 101+ with 15% discount.
• Ensure the agreement is active for the desired date range.

• The Act requires:

• It does not, as a public obligation, mandate publishing a detailed report on the training data used.
• Also, the Act does not specify a fixed “six months” retention for system logs in a way that would clearly make A required; logs for traceability are implied, but the six-month period is not a defined, universal requirement.

• Manage multiple organizations from one hierarchy.
• Enterprise-wide policies, including repository visibility, forking, and GitHub Copilot policies.
• Centralized identity and access management, such as SAML SSO, SCIM provisioning, and—where applicable—Enterprise Managed Users.
• Centralized billing and licensing, including organization and Copilot seat management.
• Enterprise audit log, which aggregates activity across organizations.
• Security and compliance oversight, such as organization security visibility and enterprise-wide controls.
• Enterprise support and account management features, depending on the plan.

• Organization: manages its own repositories, teams, members, and local policies.
• Enterprise: governs multiple organizations and can enforce policies across them.

• Basic: Self-help only; no technical support or design assessment.
• Developer/Standard: Technical support, but generally not the full proactive architecture guidance required here.
• Professional Direct: Includes proactive guidance and architecture recommendations.
• Premier: Also supports this, but is not the minimum-cost option.