IBM C1000-142 Exam Prep
IBM Cloud Advocate v2 (Page 18 )

• Security
• Availability
• Processing integrity
• Confidentiality
• Privacy

• Whether controls are suitably designed, and
• Whether they operated effectively over a period of time

• Matching hashes: The software likely has not changed.
• Different hashes: The software was modified or corrupted.

• Encryption: Protects confidentiality by making data unreadable; it does not primarily detect changes.
• Baselines: Define an approved system or configuration state, but they are not the specific integrity mechanism here.
• Tokenization: Replaces sensitive data with substitute values.

• Custom domains: supported by Standard.
• Dedicated compute instances: Standard runs on dedicated Azure VMs.
• Load balancing: Standard supports scaling the app across multiple instances with traffic distributed between them.
• Storage: Standard provides more storage than the lower tiers.
• Cost control: Standard is cheaper than higher tiers while meeting the stated requirements.

• Free and Shared use shared infrastructure and are intended for basic/testing workloads.
• Basic provides dedicated instances, but the question’s expected answer treats Standard as the minimum tier providing the required load-balancing capability.

• Due diligence: Investigating and evaluating a third party before entering a business relationship.
• Attestation: An independent auditor’s examination and formal report—such as the SOC 2 report itself. The analyst is reviewing the attestation, not performing it.
• Internal audit: Examines the organization’s own processes and controls.
• Penetration testing: Actively tests systems for exploitable vulnerabilities.

• The team should inspect its way of working during retrospectives.
• The team can identify root causes of delays and agree on process improvements.
• The leader facilitates the removal of impediments and provides support, but does not impose solutions.

• A: An impediment log can help track issues, but documentation alone does not resolve them.
• B: Directing the team toward solutions conflicts with agile empowerment and self-management.
• C: Adding impediments to the product backlog may incorrectly treat team problems as product features and delay resolution.

• B: Extending credit to customers increases receivables, so more cash is tied up in working capital.
• C: Replacing obsolete inventory does not reduce the overall inventory investment; it simply changes its composition.
• D: Paying suppliers earlier reduces payables. This uses cash and therefore increases the funds tied up in working capital.

• Deterrent control: The signs warning that people may be filmed can discourage unauthorized or malicious activity. They do not directly stop the action; they influence behavior.
• Detective control: CCTV records or monitors activity so security personnel can identify events or investigate them afterward.

• Preventive: Stops an incident from occurring, such as access control.
• Corrective: Restores systems after an incident.
• Directive: Instructs people to behave in a certain way, such as a security policy.
• Compensating: An alternative control used when the preferred control is not feasible.

• Regression predicts continuous numeric outcomes, such as house price, temperature, or sales amount.
• Linear regression assumes the target can be estimated from a linear relationship between the input features and the target.
• In Azure Machine Learning, you use a labeled dataset containing:

• Classification predicts a category or class, such as “spam” or “not spam.”
• Clustering groups similar records without a known label; it is an unsupervised learning technique.

• Preparing and managing datasets
• Building and training machine-learning models
• Testing and evaluating models
• Deploying models as endpoints for predictions

• Run the backup with WITH CHECKSUM
• Store the backup on an SMB network share

sql 
BACKUP DATABASE DB1 
TO DISK = '\\FileServer\SqlBackups\DB1_full.bak' 
WITH CHECKSUM;

• DMS does not create the SQL Server backups for you.
• You must provide a valid full database backup.
• You must continue taking transaction log backups while the source database remains online.
• The full backup and subsequent log backups must be available in the SMB share that DMS can access.
• WITH CHECKSUM enables backup checksum validation, helping detect backup corruption.

• RTO is how quickly service must be restored.
• RPO is how much data loss is acceptable.

• Snapshots: Restore points may be older and require restoration time.
• On-site backups: Usually require rebuilding or restoring systems, producing higher RTO/RPO.
• Journaling: Records database changes and can reduce data loss, but it still generally requires recovery or replay operations; it does not by itself provide the fastest service restoration.
• Hot site: Designed for rapid failover and minimal data loss.

• Internal audit: Reviews the organization’s own controls and processes.
• Penetration testing: Actively tests systems for exploitable vulnerabilities.
• Attestation: A SOC 2 report is an attestation product issued by an independent auditor, but the analyst is not performing the attestation. They are reviewing it as part of vendor evaluation.

• Authentication: Verifies who the user is.
• Authorization: Determines what the authenticated user is allowed to access.
• Accounting: Records login activity and resource usage.

• CIA: Confidentiality, integrity, and availability—the core security objectives.
• ACL: Access Control List; rules that permit or deny traffic or access.
• PEM: A format and standard commonly associated with encoded certificates and keys.

• Virtual introductions: Team members share their role, experience, location, and working preferences.
• Online icebreakers: Short, informal activities such as “two truths and a lie.”
• Virtual coffee chats: Pair team members for informal, non-project conversations.
• Collaborative problem-solving: The team works together on an online puzzle or scenario.
• Retrospectives: The team discusses what went well, what did not, and how to improve.
• Working-agreement sessions: The team agrees on response times, meeting etiquette, communication channels, and handoffs.
• Recognition sessions: Members acknowledge one another’s contributions.
• Remote workshops: Teams jointly create plans, diagrams, or schedules using collaboration tools.

• GPS coordinates
• Date and time the image was taken
• Camera or device model
• Exposure settings

• Log data: Records events or activities, such as system or application activity.
• Encrypted data: Information intentionally encoded to prevent unauthorized access.
• Sensitive data: A broad classification for information requiring protection; geolocation may be sensitive, but the technical type stored in the image is metadata.

• Honeypots: Decoy systems designed to attract attackers. Legitimate users should not access them, so activity there is a strong indication of unauthorized access.
• DNS sinkholes: Redirect requests for known malicious domains to a controlled internal destination instead of the real attacker infrastructure. Security teams can then identify infected systems making those requests.

• Tokenization: Replaces sensitive data with non-sensitive tokens; it protects data but does not detect intruders.
• CI/CD: Software development and deployment processes.
• Threat modeling: Identifies potential threats before or during system design, rather than detecting successful infiltration.
• Data obfuscation: Makes information harder to understand, but is not an attacker-detection mechanism.

• Azure Cosmos DB is a globally distributed NoSQL database service. It stores and retrieves application data, but it does not provide the complete environment for building, testing, and deploying predictive analytics models.
• Azure Machine Learning is the appropriate service for this requirement. It supports creating experiments, training and testing models, and deploying them for predictions.
• Azure Machine Learning Studio provides the browser-based interface for these tasks.

1. Wireless AP

1. Router

1. Firewall

1. Device placement

• Data owners: Decide who should have access and approve the access rules.
• Business process owners: May help define business requirements, but normally do not enforce technical permissions.
• Security steering committee: Provides governance and direction; it does not manage individual access rights.
• Security administrators: Apply and enforce the approved access controls.

• Architects design overall Splunk infrastructure and data strategy.
• Administrators manage configuration, access, and system operations.
• Knowledge Managers create and maintain knowledge objects such as data models, field extractions, and event types. They may support pivots, but they are not the primary users of them.

• Three DHCP scopes: Each VLAN has its own IPv4 subnet. DHCP scopes are subnet-specific, so create one scope for:

• Two DHCP relays: DHCP client discovery begins as a broadcast, and broadcasts do not cross routers or VLAN boundaries. Therefore, configure a DHCP relay on the router or Layer 3 switch interface for each client VLAN.

• Labels control access and protection, not blanket exclusion.
• If the user has permission to open a labeled file—especially if the label allows authenticated users to view it—Copilot can use that file in a summary.
• If the label applies encryption and the user lacks the required usage rights, Copilot should not use the file or reveal its contents.
• Copilot honors the user’s existing permissions, so it should not expose labeled content to an unauthorized user.

1. Version 1.0.0.0 — original published version
2. Version 2.0.0.0 — newly created and published version
3. Version 3.0.0.0 — new version created when version 1 is restored

1. Install a Cassandra-compatible ODBC driver.
2. Configure a data source name (DSN), if required.
3. In Power BI Desktop, select Get Data > ODBC.
4. Choose the configured DSN and connect.

• Microsoft SQL Server database: Connects to SQL Server, not Cassandra.
• OLE DB: Requires a compatible OLE DB provider; this is not the standard choice for Cassandra in Power BI.
• OData: Requires Cassandra data to be exposed through an OData service, which is not the normal direct connection method.

• Recovery Services vault — stores Site Recovery configuration and recovery metadata.
• Hyper-V site — represents the on-premises Hyper-V environment.
• Azure virtual network — the target network where the replicated VM will run after failover. Since Azure VMs already use the same virtual network, that VNet can be selected as the target.
• Storage account or managed-disk target, depending on the ASR configuration and portal version.
• Provider/agent on the Hyper-V server — enables replication from Hyper-V to Azure.

• Security controls
• Processes and procedures
• Compliance evidence
• Performance against contractual requirements

• Service-level agreement (SLA): Defines expected service performance, such as uptime and response times.
• Memorandum of agreement (MOA): Documents a general agreement between parties, but does not necessarily provide audit rights.
• Supply chain analysis: Identifies risks across suppliers and dependencies, but is not a contractual mechanism for reviewing vendor controls.

• Internal hostnames and subdomains
• Network structure and naming conventions
• Servers and services
• Relationships between systems

• Determining ISP-assigned address space: Usually involves external registration and DNS information, not internal host discovery.
• Bypassing DNS sinkholing: Would require evidence that malicious DNS requests avoided redirection.
• Initial access: DNS queries alone do not show that the attacker gained access.
• Exfiltrating data: DNS tunneling can do this, but the snippet would typically show encoded or unusually long DNS queries.

• Review administrative-role membership ? PIM access reviews
• Require justification for continued membership ? PIM can require justification when activating or maintaining privileged access
• Alerts about administrator assignment changes ? PIM alerts and notifications
• History of administrator activation ? PIM audit history
• See changes made to Azure resources ? PIM activation/audit information can be correlated with Azure Activity Logs

• The underside clips or hinges are broken.
• The cap is stuck, loose, or misaligned.
• The cap no longer presses the switch correctly.
• The cap itself is missing or physically damaged.

1. The original app version exists.
2. You create and publish a new version, so there are now two versions.
3. When you restore the previous version, Power Apps does not delete or overwrite the newer version. Instead, it creates another version based on the restored one.

• Original version
• Newly created and published version
• New version created by the restore operation

• 50% memory utilization baseline: The environment can be provisioned with excess capacity, leaving room for growth and workload spikes.
• Storage scalability: Cloud storage can generally be expanded as needed without redesigning the physical platform.
• Single circuit failure resilience: A properly designed IaaS provider uses redundant power circuits and infrastructure, so failure of one circuit should not take the platform offline.

• A — Dual PDUs: Helps with power redundancy but does not provide storage scalability.
• C — Network load balancing: Provides network-path resilience, not memory or storage scalability, and does not address a power-circuit failure.
• D — Multiple NAS devices: May improve storage capacity, but does not inherently provide power resilience or the required compute-capacity baseline.

1. Write a structured log entry to CloudWatch Logs containing:

1. Create a CloudWatch Logs metric filter that:

text 
ApiRequests 
Operation=GetOrders 
ResponseCode=500 
Version=2.4.0

• B is incorrect: CloudWatch Logs Insights queries analyze logs but do not directly publish metrics in this manner.
• C is incorrect: ALB access logs do not contain arbitrary Lambda response metadata as custom fields.
• D is incorrect: X-Ray traces and insights are not the appropriate mechanism for creating these custom, dimensioned application metrics.

• Job Links ? URL ID: Mainly summarizes link performance; it is not the easiest place to retrieve individual email addresses by alias.
• Tracking Overview ? Clicks: Provides aggregate click metrics, not a targeted list for one aliased link.
• Click Activity ? Link View: Focuses on link-level reporting, but the question’s intended workflow for locating clicks tied to a specific placement/alias is Email Overlay.

Manager role

DAX 
Country[Manager] = USERPRINCIPALNAME()

• Sales
• Human Resources

CFO role

• See sales for all countries
• See no Human Resources data

• Do not restrict the Country table or Sales table.
• Apply a filter to Human Resources that always returns false, such as:

DAX 
FALSE()

• Deterrent control: The signs warning that people may be filmed can discourage unauthorized activity. They do not physically prevent the activity, but they may influence behavior.
• Detective control: CCTV detects or records activity so security personnel can identify incidents and investigate them later.

• Preventive: Stops an incident from occurring, such as a locked door.
• Corrective: Restores systems after an incident, such as backups.
• Directive: Instructs people what to do, such as security policies or warning instructions.
• Compensating: Provides an alternative control when the preferred control cannot be used.

• Assign endpoints to a group based on the result of one policy.
• Use that group as the scope of another policy.
• This effectively passes the endpoints from one policy’s processing flow to another.

• New investment: $536,500
• Resulting NPV: $0

• Accept: Acknowledge the risk and take no additional action.
• Transfer: Shift the risk or its financial impact to another party, such as through insurance or outsourcing.
• Mitigate: Reduce the likelihood or impact of the risk, such as by implementing security controls.
• Avoid: Eliminate the activity or exposure that creates the risk.

• Products ? OrderHistory: Products is 1, OrderHistory is many (1:*)

• Date ? OrderHistory: Date is 1, OrderHistory is many (1:*)

• Plenum: Describes a fire-resistant cable jacket rating, not a transmission medium or speed.
• Ethernet: Describes a networking technology; Ethernet can use copper or fiber, so the term alone does not identify the fastest cable type.
• DAC (Direct Attach Copper): Uses copper and is typically intended for short-distance, high-speed connections in data centers.

• Self-signed certificate — Causes a certificate trust warning, not incorrect name resolution.
• Nameserver record — A DNS record problem would usually affect multiple users, unless only this computer uses a different DNS server.
• IP helper — Relays certain network services, commonly DHCP, between subnets; it does not normally determine website name resolution.

• A Screen Flow can present a form that inspectors complete and submit on an Experience Cloud page.
• It can collect inspection findings, validate the input, and create or update records.
• An Autolaunched Flow has no user interface, so it cannot directly provide the form.
• A Related List only displays related records, and Record Detail is primarily for viewing or editing an existing record—not for a custom inspection submission form.

• Existing Eventhouse data: remains available only in the KQL database.
• Data ingested after enabling the feature: is copied to OneLake and can be accessed through OneLake file explorer.
• New databases: are irrelevant; the setting applies to the selected KQL database.

• A — Windows 11 with Azure CLI installed: Yes

• D — Chrome OS using Azure Cloud Shell: Yes

• E — Windows 10 with the Azure PowerShell module installed: Yes

• B — Linux with only Azure CLI: No, because the option does not state that PowerShell is installed.
• C — macOS with PowerShell Core only: No, because it does not state that Azure PowerShell modules or Azure CLI are installed.

• Authentication: Verifies who the user is.
• Authorization: Determines what the authenticated user is allowed to access.
• Accounting: Records activity such as login times and resource usage.

• CIA: Confidentiality, integrity, and availability—the three core security goals.
• ACL: Access Control List, which defines permitted or denied traffic or access.
• PEM: A certificate and key encoding format, not the primary function of RADIUS.

• Scanning is not essential during a power outage.
• A scanner can consume UPS battery power without helping the user save cloud documents or shut down safely.
• The UPS should be reserved for the computer, monitor, and necessary network equipment.
• The surge protector helps protect the scanner from voltage spikes, but it will not keep it running during an outage.

• Third-party enterprise application with embedded AI: The provider manages most security controls. The customer mainly manages users, data, and configuration.
• Application using an existing third-party FM: The customer controls the application and its inputs/outputs, but the provider controls the underlying model and infrastructure.
• Fine-tuning a third-party FM: The customer has additional responsibility for training data, data protection, and model behavior, but still depends on the provider’s base model and platform.
• Building and training a model from scratch: The customer controls the model, training data, application, deployment, and many security safeguards. This creates the greatest security ownership.

• Warehouse size: Larger warehouses use more credits per unit of time than smaller ones.
• Number of clusters: A multi-cluster warehouse can run multiple clusters, and each active cluster consumes credits. Therefore, increasing the maximum or active cluster count can increase consumption.

• Number of users: More users may cause more workload, but users themselves do not consume credits.
• Amount of data processed: Snowflake warehouses are not charged directly by the amount of data scanned. However, processing more data may cause the warehouse to run longer, indirectly increasing credits.

• Create procurement-manager-role only in the shared services accounts, where procurement managers operate.
• Attach AWSPrivateMarketplaceAdminFullAccess to that role.
• Procurement managers assume the role when they need to administer Private Marketplace.
• Apply a root-level SCP that explicitly denies Private Marketplace administration to everyone except that role. The SCP acts as a maximum-permission boundary across member accounts.
• Add another SCP denying creation of a role with the same name. Otherwise, another administrator might create a similarly named role and bypass the intended exception.

• Creating the role in every account increases administration and creates more opportunities for misuse.
• A permissions boundary on developer roles does not prevent other administrators from managing Private Marketplace.
• Applying the SCP only to shared services accounts would not protect the rest of the organization.