IIA IIA-ACCA Exam Prep
ACCA CIA Challenge Exam (Page 39 )

• B: Prompt caching reduces cost and latency for repeated content, but cached content still occupies the context window. It does not solve context accumulation.
• C: Switching to a smaller model changes model capacity but does not address the growing context or remove irrelevant data.
• D: Keeping everything indefinitely increases token usage, risks context-window limits, and can distract the model with outdated information.

• D — Value analysis: Correct. It examines an existing product to identify ways of reducing its cost while still providing the required functions, quality and reliability.
• E — Kaizen costing: Correct. It involves making continuous, small improvements and cost reductions while the product is already in production.

• Functional analysis: It is not limited to minimizing the cost of the originally defined functions. It examines what functions are required and how they can be provided at the lowest overall cost.
• Value engineering: Usually applies to the design and development of a new product, rather than being a fundamental redesign of existing organisational processes. That description is closer to business process re-engineering.
• Target costing: The target cost is generally established during the product development stage, before production begins. It is not continuously reset while the product is in production.

• S3 Glacier Deep Archive is designed for long-term archival data with very infrequent access and has a lower storage cost than S3 One Zone-IA.
• The documents are copies stored elsewhere, so reduced availability and delayed retrieval are acceptable.
• An S3 interface VPC endpoint allows private access from the VPC without exposing the bucket through the public internet.
• A bucket policy can restrict access to requests coming through that endpoint.

apex 
for (Account updatedAccount : Trigger.new) { 
    AccountTriggerHelper.notinyxternalSystem(updatedAccount.Id); 
}

• Too many callouts: The callout occurs asynchronously in the future method, and each future transaction can perform its permitted callouts.
• Too many SOQL queries: The SOQL query is inside the future execution, not repeatedly in the trigger transaction.
• Callout from triggers not supported: Direct callouts from triggers are prohibited, but the trigger delegates the callout to asynchronous Apex, which is the correct pattern.

• Which host first communicated with the suspected malicious source
• Whether that host initiated suspicious traffic or merely received it
• Which other hosts show evidence of infection, such as connections from the originating host
• Which hosts have no related suspicious activity and are therefore clean

• An outbound connection to a suspicious external address
• A downloaded or executed malicious file
• Later lateral connections from that host to other internal systems
• Firewall logs showing the direction and timing of the traffic

• Frequency/likelihood = how often or how likely the risk is to occur.
• Severity/impact = how damaging or costly the consequences would be.

• A minor equipment fault occurring frequently may have high frequency but low severity.
• A major cyberattack occurring rarely may have low frequency but high severity.
• A risk that happens often and causes substantial losses has high frequency and high severity.

• A business-hours greeting
• An after-hours greeting
• A holiday greeting

• Weekday evenings/nights
• Saturdays and Sundays

1. Auto attendant 1

1. Auto attendant 2

• A password cracker would normally be identified by behavior such as loading password hashes or attempting dictionary/brute-force attacks.
• The question describes a routine audit, not password recovery.
• Simply encountering a protected file during an audit is characteristic of a misconfigured or insufficiently privileged FIM.

• Amazon EC2 instances — ???????? ?? ?? ??????? CPU, memory ??? instance size ???????? ???????
• AWS Lambda functions — memory configuration ?????????? ???????
• Amazon EBS volumes — volume type ?? size optimize ???? ???????
• ??????? ECS workloads — resource configuration ? cost optimization-?? ???????

• Memory ? compute usage ?????????? ???? custom code ????? ???? development ? maintenance ??????
• Cost allocation tags ???? ????? ??? ?????? ???? ??????? ???; inefficient resource ??????? ?? recommendation ???? ???
• CloudTrail resource ???? ?? API activity ??????, resource utilization ????

• Repetitive and time-consuming
• Based on measurable conditions, such as last check-in time
• Easy to automate with alerts, dashboards, or scheduled reports
• Important for ensuring scan coverage

• Assigning custom recommendations usually requires analyst judgment and context.
• Analyzing false positives can sometimes be assisted by automation, but validation often requires human review.
• Rendering an additional executive report increases reporting activity rather than reducing a core operational workload.

1. The specific table — for example, incident
2. The parent table — for example, task
3. The wildcard table — *, which applies broadly

• Employees can work from any location, including remote sites and offices worldwide.
• Login can be relatively seamless after the device is registered.
• It does not require distributing additional physical authentication equipment.

• Geotagging: Identifies location, but location alone is not a strong authentication method and may prevent legitimate remote access.
• Smart cards: Provide strong authentication but require card readers and physical cards, increasing equipment and management requirements.
• Time-based logins: Typically involve one-time codes that users must enter, making the experience less seamless and potentially requiring a token or authenticator app.

• The vulnerability scan identifies a vulnerability.
• The administrator verifies that the vulnerability is not present.
• Therefore, the scan produced a false positive.

• True positive: A vulnerability is reported and genuinely exists.
• False negative: A vulnerability exists, but the scan fails to detect it.
• True negative: No vulnerability exists, and the scan correctly reports no issue.

• Actions that call external APIs
• Subflows
• Connection and credential aliases
• Supporting integration logic

• Action — A reusable operation within a flow, such as “Create a record” or “Send email.”
• Connection — Defines how ServiceNow authenticates and communicates with an external system.
• Integration step — A general flow step, not the name for the packaged integration.

• Link-local — FE80::/10; valid only on the local link/subnet and not routed by routers.
• Multicast — FF00::/8; identifies a group of interfaces rather than a private address range.
• Global unicast — 2000::/3; publicly routable IPv6 addressing.

Box 1: No

• configure_azure_monitor() configures Azure Monitor and the OpenTelemetry pipeline.
• LangChain requires its own instrumentation or callback tracer, such as AzureAIOpenTelemetryTracer.
• You must pass the tracer to the LangChain execution configuration so chains, tools, prompts, and model calls become spans in Application Insights.

Box 2: Yes

text 
OTEL_SERVICE_NAME=customer-agent 
OTEL_SERVICE_NAME=invoice-agent

• An Adj-SID does not necessarily need manual configuration.
• It can often be dynamically allocated by the router, although manual configuration may also be possible.
• The adjacency information is advertised through the IGP, such as IS-IS or OSPF.

• It is identified by an Adj-SID.
• It represents a particular adjacency of a node.
• Its meaning is generally local to the advertising node; unlike a Node-SID, it is not a globally reusable instruction across the network.

• A: Build a custom API — possible, but unnecessary as the primary solution and potentially more costly to develop and maintain.
• B: Use pre-built chatbots — these generally answer questions but may not support the required custom workflow and real-time actions.
• C: Fine-tune with sample data — improves model behavior but does not provide live database access.
• D: Google Cloud databases + Vertex AI — stores current inventory data and lets an AI agent retrieve it and take actions based on up-to-date information.

• Instant messaging/chat: Can be abused to send malicious links or attachments, but is not the answer most directly associated with high-risk file sharing.
• E-mail: A common malware delivery method, but the question emphasizes an application type known for direct file exchange.
• End-to-end applications: This describes communication protection or architecture, not a specific malware distribution risk.

• User2 is in Group1, so CA2 applies.
• CA2 targets Office 365.
• CA2 requires MFA OR an app protection policy.
• User2 has no app protection policy, but if User2 successfully completes MFA, the OR condition is satisfied.
• The device being noncompliant does not matter because CA2 does not require device compliance.
• CA1 applies only to Global Administrators. Unless User2 is also a Global Administrator, CA1 does not apply.

• FTP — Transfers files using a client/server model and supports authentication. It uses separate control and data connections.
• TFTP — A very simple file-transfer protocol with no authentication and minimal features. Commonly used to transfer router or switch configuration files and IOS images.
• SCP — Securely copies files over SSH. It provides encryption and authentication.
• SFTP — Also transfers files securely through SSH, but provides more file-management capabilities than traditional SCP.
• HTTP/HTTPS — Primarily web protocols, but can also download files; HTTPS encrypts the session.

• TFTP = simple, unauthenticated file transfer
• FTP = file transfer with authentication, but not inherently encrypted
• SCP/SFTP = secure file transfer using SSH

• 10.2.1.0 — network address
• 10.2.1.1 — usable host
• 10.2.1.2 — usable host
• 10.2.1.3 — broadcast address

• Error correction (ECC): Improves data reliability but does not maximize bandwidth.
• RAM voltage: Increasing voltage may affect stability or speed, but it is not the primary method for increasing module bandwidth.
• Physical module size: Refers to the capacity or form factor of the RAM, not its data-transfer bandwidth.

• Standardize which services users can deploy
• Apply governance and access controls
• Manage approved product versions
• Give users self-service access to authorized resources

• AWS Control Tower: Sets up and governs a multi-account AWS environment.
• AWS Cloud Map: Provides service discovery for applications.
• AWS Clean Rooms: Enables privacy-preserving collaboration on data analysis.

• Labels control access and protection, not blanket exclusion.
• If the user has permission to open a labeled file—especially if the label allows authenticated users to view it—Copilot can use that file in a summary.
• If the label applies encryption and the user lacks the required usage rights, Copilot should not use the file or reveal its contents.
• Copilot honors the user’s existing permissions, so it should not expose labeled content to an unauthorized user.

• Information sources: Collect security-related data, such as network packets, system logs, audit records, or application events.
• Analysis: Examines the collected data to identify suspicious activity, attacks, or policy violations.
• Response: Takes or recommends action, such as generating alerts, logging the event, or supporting a protective response.

• Scale out during the hours when customer traffic is high.
• Scale in during low-demand periods, reducing instance-hours and cost.
• Use scaling policies based on metrics such as CPU utilization or request count.

• Multiple Availability Zones: Improves availability and fault tolerance, but does not automatically reduce cost.
• Placement group: Helps with specialized performance or low-latency requirements, not cost optimization.
• Private subnets: Improve network security, but do not automatically adjust capacity or reduce EC2 usage costs.

• Firewall
• Intrusion prevention and detection
• Antivirus or antimalware
• Web and email filtering
• Virtual private networking (VPN)
• Sometimes content filtering and centralized reporting

• MTTC: Time required to contain or limit the incident’s impact — best match.
• MTTR: Time required to remediate or recover from the incident; this may include eradication, restoration, and cleanup, which goes beyond merely stopping spread.
• MTTD: How long it takes to discover the incident.
• MTBF: Average time between failures, generally a reliability metric.

• Due diligence: Investigating and evaluating a third party before entering a business relationship.
• Attestation: An independent auditor’s examination and formal report—such as the SOC 2 report itself. The analyst is reviewing the attestation, not performing it.
• Internal audit: Examines the organization’s own processes and controls.
• Penetration testing: Actively tests systems for exploitable vulnerabilities.

• Correct exam answer: A — HKEY_LOCAL_MACHINE
• The relevant location is associated with HKEY_LOCAL_MACHINE\SAM.
• The SAM does not store passwords in plain text; it stores password hashes.

• HKEY_CURRENT_USER contains settings for the currently logged-in user, not the account-password database.
• HKEY_USERS contains user profiles and settings loaded for users.
• HKEY_CURRENT_CONFIGURATION contains hardware/profile configuration information.

• Minimum
• Maximum
• Average
• Count
• Null/empty values
• Distinct values

• Enable column profile
• Enable details pane
• Show column profile in details pane

• Access List: controls whether a client is allowed or denied.
• Connect List: controls which wireless networks/APs a station may connect to.

• Base table — the table containing common inherited fields
• Parent table — the table directly extended by the child
• Other tables in the hierarchy

• Security groups
• Dynamic security groups
• Cloud-only or synchronized security groups

• Microsoft 365 groups
• Distribution groups
• Mail-enabled distribution groups

• Honeypots: Decoy systems or services designed to attract attackers. Legitimate users should not access them, so activity there is a strong indicator of compromise.
• DNS sinkholes: Redirect malicious or suspicious DNS requests to a controlled destination. This can identify infected systems attempting to contact command-and-control infrastructure.

• Tokenization: Replaces sensitive data with non-sensitive tokens; it is not an attacker-detection method.
• CI/CD: Automates software development, testing, and deployment.
• Threat modeling: Identifies potential threats and weaknesses before or during system design; it does not directly detect an active infiltrator.
• Data obfuscation: Makes information harder to understand, but does not identify attackers.

• Suspended an operator who refused to use unsafe equipment.
• Paid another operator a bonus for using it.
• Prioritised short-term productivity over employee safety.

• A — Management is not particularly concerned with managing risks.

• B — Employees will perceive that management does not care about health and safety risks.

• C — The factory’s safety record is likely to be poor.

• Dark web: A place where leaked credentials may be sold or shared, not usually the original source.
• Threat feeds: Collections of intelligence about threats, not a typical leakage source.
• State actors: A type of attacker, not an accidental corporate disclosure source.
• Vulnerability databases: Track known vulnerabilities, rather than leaked credentials.

• Allow only approved MAC addresses
• Limit the number of learned addresses
• Shut down or restrict a port when a violation occurs

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect some attack traffic, but it is not the direct control for limiting MAC addresses on switch ports.
• NGFW: Filters routed network traffic, while this attack targets Layer 2 switch behavior.

• The requirement is an assessment of the Azure environment’s design, which requires a support plan offering proactive architectural guidance.
• Premier support would provide this capability, but it is a high-cost option.
• Since the requirement says to minimize expenses, Premier is not the best recommendation.
• A lower-cost plan with the required advisory/design-review capability—historically Professional Direct in Azure’s support-plan model—would be more appropriate.

• Complete MFA, or
• Securely change their password

• Identity Protection: evaluates user and sign-in risk and can trigger remediation.
• Privileged Identity Management (PIM): manages temporary, just-in-time access to privileged roles; it does not automatically require password changes for risky sign-ins.

• A: It allows for branching and merging...

• C: It allows multiple engineers to work against the same code and configuration files and manage differences and conflicts.

• B: Build automation and infrastructure provisioning are handled by CI/CD and automation tools, not by version control alone.
• D: User Stories and backlogs are managed by project-management tools.
• E: Version control stores and tracks code, but it does not itself ensure that developers write effective unit tests.

• A. IDS attack signatures: An IDS mainly detects suspicious network traffic. It is not the best control for scanning uploaded documents.
• C. Load balancer: Distributes traffic among servers and can improve availability, but does not specifically detect malware.
• D. WAF: Protects web applications from attacks such as SQL injection and command injection. It may inspect web requests, but malware scanning of PDF files is not its primary function.

• Internal hostnames and subdomains
• Network structure and naming conventions
• Servers and services
• Relationships between systems

• Determining ISP-assigned address space: Usually involves external registration and DNS information, not internal host discovery.
• Bypassing DNS sinkholing: Would require evidence that malicious DNS requests avoided redirection.
• Initial access: DNS queries alone do not show that the attacker gained access.
• Exfiltrating data: DNS tunneling can do this, but the snippet would typically show encoded or unusually long DNS queries.

• A: Not expanding would increase its dependence.
• B: More business from the same corporation would make dependence worse.
• D: Passing work to other minority businesses does not solve its own dependence.
• E: The passage does not suggest that it can force or influence the corporation to give work to others.

• Feedback form: Captures opinions, not necessarily actual behavior; users may not respond.
• Questionnaire: Relies on memory and subjective judgments about usefulness.
• Interviews: Can provide valuable qualitative insights, but a sample of users may not represent overall usage accurately.

• Matching hashes: The software is likely unchanged.
• Different hashes: The software or its contents have been modified.

• Encryption: Protects confidentiality, not primarily integrity.
• Baselines: Document expected configurations and support comparison, but hashing is more directly suited to verifying file integrity.
• Tokenization: Replaces sensitive data with tokens and is unrelated to software tampering.

1. Which host originated the infection
2. Whether each other host is clean or infected
3. Which firewall or host logs provide evidence of the infection’s movement

• Find the earliest infection-related event. The host associated with that event is the likely origin.
• Follow the timeline: outbound connections from that host may indicate propagation or command-and-control activity.
• A host receiving suspicious traffic is not automatically infected; look for evidence that it executed or initiated malicious activity.
• A firewall log can show traffic paths, but endpoint logs are usually needed to confirm infection.
• Mark a host clean only when the logs show no indicators of compromise or malicious activity.

• D — Managers focus on keeping costs low in the short term to maximise profits.

• E — Managers are given incentives to meet or undercut budgets.

• F — Managers delegate responsibility simply to reduce their workload.