IIA IIA-CIA-Part3 Exam Prep
Certified Internal Auditor - Part 3, Business Analysis and Information Technology (Page 16 )

• The problem describes the class updating field-level security on some profiles. To prevent updating fields that are not updateable for the current user, you should check each field’s updateability before making changes. Use DescribeFieldResult.isUpdateable() (e.g., via Field.describe() on each field) to guard updates.

• A and D (With Sharing): Running a class with Sharing affects record visibility, not whether a field can be updated by a user. It doesn’t prevent updates to fields the user shouldn’t modify.
• C (WITH SECURITY_ENFORCED in SOQL): This enforces FLS/FRC during queries, but it doesn’t control whether the Apex code updates fields or modifies permissions. It’s not addressing the update behavior directly.

• The correct AAA mapping (per Cisco objectives) is:

• Why the given options aren’t fully correct:

• Quick takeaway: when you configure AAA, you should conceptually map them as:

• Example commands (to reinforce concepts):

• Business
• People
• Governance
• Platform
• Security
• Operations

• Program and project management
• Risk management
• Cloud financial management
• Data governance
• Portfolio management

• Sustainability
• Performance efficiency
• Reliability

• IaaS: You manage the virtual machine’s operating system, configuration, applications, and data. Azure manages the physical infrastructure and virtualization platform.
• PaaS: You deploy applications without managing the underlying operating system or servers.
• SaaS: You consume a complete application managed by the provider, such as Microsoft 365.

• Amazon Kendra is a managed enterprise search service that can index content stored in S3 and support natural-language queries to find text inside documents (PDFs, Word files, etc.).

• Rekognition analyzes images/videos, not document text search.
• Polly is a text-to-speech service.
• Lex is a chatbot service.

• Create a Kendra index.
• Add a data source of type S3 and point it to your bucket (with an IAM role that allows access).
• Configure/document conversion if needed, then index the data.
• Use the Kendra API or console to run natural-language queries against your indexed documents.

• SageMaker endpoint: Not required because the model is being used through Amazon Bedrock.
• SageMaker Model Registry: Used for managing SageMaker models, not for making a Bedrock custom model available.
• Grant access in Amazon Bedrock: IAM permissions may still be needed, but granting access alone does not provide the required inference capacity.

• The Balanced Scorecard translates an organization’s vision and strategy into a set of concrete objectives and metrics across four perspectives (financial, customer, internal processes, learning & growth). This framework explicitly links IT goals to business goals and provides a way to measure and monitor alignment over time.

• Enterprise architecture (EA): Great for governance, standards, and roadmaps to ensure IT assets support business needs, but it’s more about structure and alignment at design time rather than directly measuring ongoing alignment of goals.
• KPIs: Useful metrics, but they don’t by themselves provide a full framework to ensure IT goals are aligned with organizational strategy.
• Enterprise dashboard: A visualization tool for metrics; it helps report status but doesn’t inherently establish or assess alignment.

• Primary and core nodes: Use On-Demand Instances because the workload is business-critical. These nodes manage the cluster and store/process HDFS data.
• Task nodes: Use Spot Instances in an instance fleet. Task nodes are suitable for interruption because they do not hold essential cluster data and can be replaced or diversified across instance types.
• Terminate the entire cluster after processing: The job runs only about six hours each morning, and EMRFS stores data in Amazon S3. Keeping the cluster running for the rest of the day would waste money.

• A: Using Spot for primary and core nodes risks interruption of the critical cluster.
• C: All On-Demand is reliable but unnecessarily expensive; terminating the cluster helps, but Spot task nodes provide greater savings.
• D: Leaving primary and core nodes running after the task finishes continues to incur costs. Savings Plans also are less appropriate for this intermittent workload.

• A. IDS attack signatures: An IDS primarily detects suspicious network activity and usually alerts rather than directly scanning and blocking uploaded files.
• C. Load balancer: Distributes traffic among servers but does not inspect files for malware.
• D. WAF: Protects web applications from attacks such as SQL injection, cross-site scripting, and some malicious requests. It is not primarily a PDF-malware scanning solution.

• A) You can only apply a single template BOM to a service object.

• C) You can modify or delete lines in a BOM template regardless of whether the template has been associated to a service object, or not.

• B) You can apply many template BOMs to a service object — false; typically only one template per service object.
• D) You can modify/delete lines only if not associated — false; you can modify templates even after association (per C).

• Product Owner: May attend, but is not required unless also working as a Developer.
• Scrum Master: May attend to help facilitate or coach, but is not required.
• Developers: Must participate because the event is specifically for them.

• A. Implement retries with exponential backoff

• C. Reduce the frequency and/or size of requests

• B. Use PutRecord instead of PutRecords — PutRecord sends one record per call and does not remove the underlying throughput limitation. It may increase request overhead.
• D. Use Amazon SNS instead — SNS is not a direct fix for Kinesis shard throttling and changes the required streaming architecture.
• E. Reduce KCL consumers — KCL consumers read from Kinesis; they do not solve producer-side PutRecords throttling.

• Drop violating frames
• Log or alert on the violation
• Shut down or restrict the port

• Load balancer: Distributes application traffic; it does not control switch MAC learning.
• IPS: May detect some network attacks but is not the primary control for switch MAC-table exhaustion.
• NGFW: Protects traffic crossing network boundaries, while MAC flooding occurs at the switching/LAN layer.

• What the scenario asks: You have a Power BI semantic model that pulls from multiple sources (Azure SQL Database and SharePoint Online), must support a single dataset for three reports, keep data current (daily refresh by 7 AM PT), and apply RLS to limit sales data by region. You need to choose a storage mode for the tables.

• Correct choice: Dual storage mode.

• Why Dual fits:

• Key concepts:

• A? ??? Aurora Replicas? ?? ??? ???? ?? ???, ?? ???? Network Load Balancer(NLB)? ??????. NLB? ?? 4 ?? ???? HTTP ??? ?? ???(Sticky sessions)? ????? ???? ????.
• ??? ?? ??????? ?? ?? ???? ??? ???? ?? ????? ????? ?? ?? ???(?? ?/??? ??)? ?????. ? ??? ALB?? ?? ????, NLB?? ???? ?????.
• ??? ??? ??? ??? ???? ?? ???? ???? HTTP ???? ??? ALB? ???? ???. A? ? ??? ??????.

• What wipe does: A factory reset that erases all data, apps, and settings and returns the device to the OOBE. It removes the device from management and resets identity.
• Why not for this scenario: The goal is to repurpose the same device to a new user with Autopilot. Autopilot Reset keeps the device’s Azure AD/Intune identity and re-provisions the device for the next user without a full wipe.
• What Autopilot Reset does: Removes user data and apps but preserves device identity and management connection, then reapplies the Autopilot provisioning for the next user.
• When you’d use wipe instead: If you’re selling or permanently discarding the device, or you truly want to scrub all traces and start fresh without re-enrolling.

• Create a record-triggered Flow on Opportunity.
• Run it when the record is created or updated.
• Add entry criteria such as Probability > 50%.
• Use Create Records to create the related Sales Demo Request, populating its Opportunity lookup.

• Apex Trigger: Possible, but unnecessary custom code for a straightforward automation requirement.
• Workflow Rule: Cannot create a related custom record.
• Process Builder: Could create a record, but Flow is Salesforce’s preferred and more capable declarative automation tool.

• CAPWAP (Control And Provisioning of Wireless Access Points) creates a tunnel between the AP and the Wireless LAN Controller over the IP network. The AP and WLC communicate via this CAPWAP tunnel, which can traverse Layer 2 or Layer 3 networks.
• The AP does not have to be on the same switch as the WLC. It can connect to any switch in the network, as long as there is IP reachability between the AP and the WLC. This is why option D is correct.
• The other options are incorrect:

• Cross-account access is typically implemented with an IAM role. You create a role in the target account (where the resources live) and configure a trust policy that allows principals from the source account to assume that role.
• Users in the source account then assume the role (via Switch Role in the console or STS:AssumeRole) and receive temporary credentials with the role’s permissions to access the resources.

• IAM group: Groups exist inside a single account; they don’t grant cross-account access.
• IAM tag: Tags are metadata and do not grant access.
• IAM Access Analyzer: It analyzes and identifies public or cross-account access but does not grant access itself.

• The requirement is a fully managed file server that natively supports Microsoft workloads and file systems and uses the SMB protocol. FSx for Windows File Server is built specifically for Windows workloads, provides native SMB file shares, and supports Windows permissions/Active Directory integration.
• Why the others don’t fit:

• Correct answer: A. Email templates

• Snippets are reusable content blocks that you insert into email content, and they require an email template (or at least an email draft) to render.
• You can store region-specific footers as snippets and include them in a template, but there would be nothing to render the snippet into without a template.
• The other options aren’t prerequisites for using snippets:

• What it says: you can add a cost when you adjust inventory, and that cost is posted automatically to a specific GL account.
• Reality: yes, you can adjust both quantity and value via an inventory adjustment journal. The cost on the journal line affects the inventory value.

• The general ledger postings are not arbitrary. the actual accounts used are determined by your item posting group and the system’s posting definitions. In practice, the adjustment debits/credits the appropriate inventory-related accounts (e.g., Inventory asset and a related offset such as an adjustment or COGS account) based on configuration.
• So, the cost change does not go to a single “manual” GL account you pick per line unless your posting setup maps to that account.

• The concept is true (you can adjust cost and have GL impact), but the claim that it posts to a single, specific GL account is oversimplified—the accounts come from your posting configuration.

• IPv6 address types you’ll typically see:

• Unique Local Addresses (ULAs)

• If an address begins with fdXX:… or fc00:…, place it under “Unique Local Address” (ULA).
• If it begins with 2000::/3, place it under “Global Unicast.”
• If it begins with fe80::, place it under “Link-local.”
• If it begins with ff00::, place it under “Multicast.”

• Correct answer: A. System characterization

• Why the other options are not correct:

• Honeypots: Decoy systems or services designed to attract attackers. Legitimate users should not access them, so activity on a honeypot is a strong indicator of unauthorized activity. Security teams can also observe attacker behavior.

• DNS sinkhole: Redirects requests for known malicious domains to a controlled internal server or blocks them. If an infected workstation attempts to contact command-and-control infrastructure, the sinkhole records the request and helps identify the compromised device.

• Tokenization: Protects sensitive data by replacing it with tokens.
• CI/CD: Automates software development and deployment.
• Threat modeling: Identifies potential risks before or during system design.
• Data obfuscation: Makes data harder to understand, but does not detect intruders.

1. Define Power Platform DLP policies
2. Add custom prompt modifications
3. Conduct adversarial testing

1. DLP policies first

1. Prompt modifications second

1. Adversarial testing last

Flat organisation

• Few levels of management
• A wide span of control—managers supervise many employees
• Shorter communication channels
• More employee autonomy and quicker decisions
• Fewer formal promotion levels

Tall organisation

• Many levels of management
• A narrow span of control—managers supervise relatively few employees
• A clear hierarchy and reporting structure
• More formal supervision and communication channels
• More obvious promotion and career stages

• Enable the owner dimension
• Allocate a standard costing inventory model

• Owner dimension (B): This dimension Lets you track who owns the stock. By enabling the owner dimension, items can be configured as either company owned or consignment (vendor-owned) when you create or edit items. Without enabling this dimension, you can’t designate ownership per item.
• Standard costing inventory model (D): Selecting a costing model determines how item costs are calculated and posted. Standard costing provides a fixed cost per unit, which is commonly used for agreed pricing scenarios like consignment arrangements for easier accounting and valuation. It helps ensure consistent cost treatment across transactions for items that can be owned by the company or on consignment.

• Batch dimension (A): Batch tracking is unrelated to ownership and isn’t required to support company-owned vs. consignment configurations.
• Moving average costing (C): This is an alternative costing method. It’s not required to enable ownership config, and the exam’s expected choice focuses on standard costing for this scenario.

• Correct answer: S3 Versioning

• Why the other options aren’t suitable for this protection:

• Quick tip: For enhanced protection, enable Versioning (and consider related features like Object Lock for write-once scenarios in specific compliance cases).

• Why: Table.Profile returns a per-column profile that includes statistics such as count, null count, distinct count, and standard deviation. It also provides min/max and average where applicable, which matches the requested metrics (Count, Average, Null count, Distinct count, Standard deviation).
• Syntax: Table.Profile(table as table, optional additionalAggregates as nullable list) as table
• How it helps: After running Table.Profile on your table, you can extract the per-column stats you need and display them in your semantic model or report.

• The missing piece is to configure an event source mapping between the DynamoDB stream and the Lambda function. Enabling DynamoDB Streams alone doesn’t trigger the function—you must wire the stream to Lambda so events invoke the function.
• Note that changing StreamViewType (A) only affects what data is delivered (e.g., NEW_IMAGE) and does not trigger invocations. Options C and D are not required for invocation: you don’t need SNS, and increasing the timeout won’t enable the trigger.

• RPO (Recovery Point Objective) — maximum acceptable data loss, measured in time. It specifies how far back in time you can tolerate data loss. Example: RPO of 2 hours means backups must occur at least every 2 hours.

• ARO (Annualized Rate of Occurrence) — expected frequency of a threat occurring per year. It estimates how often a risk is likely to happen on average (used in risk calculations).

• MTTR (Mean Time To Recover) — average time to recover/restore service after an incident. It includes detection, repair, and restoration time, and helps gauge downtime and alignment with RTO.

• A. Extranet
• B. VLAN
• C. Intranet
• D. VPN

• The correct answer: C. Tokenization

• Why:

• Why the others are weaker:

• What the goal is: You want to add guest (external) users to your Azure AD tenant contoso.com, one entry per external user in a CSV.

• The proposed solution uses New-AzureADUser for each external user. Why this isn’t correct: New-AzureADUser creates a regular (internal) user in your directory. It does not create a guest/B2B user invite. So you’d end up with 500 ordinary accounts, not guest accounts with external access.

• The correct approach: Use New-AzureADMSInvitation for each external user. This invites the external user to your directory and creates a guest user (a B2B collaboration user) in your tenant. The invited user then accepts the invitation and gains access as a guest.

• Azure AD vs directory/tenant: Azure AD is the cloud identity service. A directory (also called a tenant) is your specific instance of that service (contoso.com in your scenario). The terms are often used interchangeably in exams.
• Guest user vs internal user: A guest user is external to your organization; an internal user is created directly in your directory as a normal employee/user account.
• B2B invitation: The process of inviting external users so they can collaborate in your resources; New-AzureADMSInvitation is designed for this.

• Goal: Guests should not use cameras, but company users can.
• Correct configuration: Guest access settings in the Org-wide settings.

• External access: Controls external-domain communication, not guest capabilities inside Teams.
• Teams settings in Org-wide settings: Too generic; doesn’t specifically target guest capabilities.
• Audio & Video in the default Meeting Policy: Would affect everyone assigned to that policy. To meet the requirement without impacting internal users, you’d need separate policies or guest-specific settings; the exam focuses on the guest-access policy.

• D. Provide public endpoints to store and retrieve data

• E. Manage the infrastructure layer and the operating system

• Classifying data
• Configuring access permissions, such as IAM policies
• Selecting or configuring available encryption options, depending on the requirement

• Amazon GuardDuty: Detects suspicious activity and threats using security-related data sources; it is not primarily a software vulnerability scanner.
• Amazon Detective: Helps investigate and analyze the root cause of security findings after an event.
• Amazon Cognito: Provides user authentication and authorization for applications.

• Version control provides a single source of truth for metadata changes and tracks every modification.
• It supports branching and merging, so each feature can be developed in isolation and later merged without overwriting others.
• It allows diffs and conflict resolution, making it easier to manage dependencies across features and ensure a stable release.

• Setup Audit Trail: only logs who/change when something happened; it doesn’t prevent overwriting or manage cross-feature dependencies.
• Change Sets: used to deploy changes between orgs, not to coordinate parallel development or prevent conflicts across ongoing sprints.

• The first step in risk management is to understand objectives, constraints, and drivers from those who care about the project. This stakeholder engagement helps identify what could go wrong and what risks are most critical.
• Only after you’ve gathered input from stakeholders should you identify risks and document them in the risk register. Updating the risk register (option C) is important, but it comes after identifying and analyzing risks.
• Options B (ensure resources) and D (revise the risk management plan) are actions that may follow once risks are identified and understood; they’re not the initial step.

• Answer: C – netstat -an

• netstat -an lists all active connections and listening ports with numeric addresses, without resolving names. This lets you spot DoS patterns such as a flood of connections to a specific port or many connections from a single or few IPs.
• The other options don’t help as directly:

• Windows: netstat -an and look for numerous ESTABLISHED connections to a service or many SYNs to a port.
• Filter by port, e.g., netstat -an | findstr :80, or on Linux: ss -tunap | grep ':80'.

• Netstat provides a snapshot. DoS detection often benefits from continuous monitoring, flow data, and IDS/IPS logs.

• The correct permission is Manage Sandboxes (the official Salesforce name; the option in the list is written as “Manage Sandbox,” which is effectively the same idea but the canonical name uses the plural).
• Why: Sandboxes are a lifecycle feature. Only users with the explicit Manage Sandboxes permission can perform create, delete, refresh, or activate actions.
• Why the other options aren’t correct:

• Answer: D

• The strongest security comes from enforcing access at the storage layer. An IAM policy scoped to the Cognito identity prefix restricts each user to their own S3 prefix (folder), so users can only access their own files regardless of client or server code.
• This per-user isolation reduces risk of cross-user data access and is more robust than UI validation or Lambda/API validation alone.
• Implementation note: attach a policy to the Cognito identity role that allows actions on arn:aws:s3:::your-bucket/${cognito-identity.amazonaws.com:sub}/* (per-user prefix). Ensure TLS in transit and enable at-rest encryption (SSE-S3 or SSE-KMS). Use multipart upload for large files up to 300 MB.

• Mapping:

• Why:

• Quick note: If you were to host a website on a VM, it would be IaaS; if you used a platform service instead of a VM, it would be PaaS. CaaS (containers) isn’t shown here.

• This is a lookup relationship. Salesforce does not cascade access from a child (Opportunity) to its parent (Account) via implicit sharing.
• To view the Account, the user must have explicit access to the Account (via its OWD/sharing, or object permissions).

• The user has Read/View (or higher) on Account via profile/permission set.
• Manual sharing or a sharing rule grants that Account to the user.
• The Account is exposed by a broader permission like View All/Modify All on Account.
• Role hierarchy with Grant Access Using Hierarchies could grant access to Accounts owned by others, if applicable.

• On-prem you generalize and capture the VM as a VHD.
• Upload the VHD to Azure with Add-AzVhd.
• Register the VHD as an image in Azure with Add-AzImage (or New-AzImage) so it appears as a selectable image.
• Create new VMs from that image (e.g., with New-AzVM -Image ...).

• Create and manage catalogs of approved IT services
• Govern and publish infrastructure-as-code (IaC) templates, commonly AWS CloudFormation templates
• Control which users can deploy specific products and configurations
• Apply versioning, permissions, and deployment constraints

• AWS Resource Explorer: Searches and discovers AWS resources; it does not govern IaC templates.
• AWS Organizations: Manages multiple AWS accounts, policies, and consolidated billing.
• AWS Systems Manager: Helps operate and manage deployed resources, such as patching and automation, but is not primarily a catalog for governed IaC products.

• Correct answer: D) Amazon Aurora Serverless

• Aurora Serverless is serverless, so compute capacity scales automatically and can pause during idle periods. This minimizes ongoing administration and you pay only for actual usage, which is ideal for infrequent workloads.
• PostgreSQL on EC2 requires full OS and DB administration.
• RDS for PostgreSQL is managed but still involves provisioning capacity and some maintenance tasks.
• Aurora PostgreSQL (non-Serverless) is managed but requires you to manage capacity, though with some automation; it’s not as hands-off as Serverless for intermittent usage.

• In the AWS shared responsibility model, AWS manages the security of the “infrastructure,” including the physical hardware and underlying virtualization.
• The customer is responsible for everything else in the cloud stack: the guest OS on EC2, the NoSQL database software running on it, data, patching the OS, and configuring access controls like security groups.
• So, for a self-managed NoSQL database on EC2, AWS would handle the physical hardware, while you would patch the guest OS and manage DB availability, backups, and security.

• Correct answer: All four statements are true (A, B, C, and D). The given key (A,B) is likely incorrect.

• A) Customers can change the size of the Warehouse after creation — Yes. You can resize a virtual warehouse after it’s created using ALTER WAREHOUSE ... SET WAREHOUSE_SIZE.
• B) A Warehouse can be resized while running — Yes. Snowflake supports online resizing; you can change the size without stopping queries.
• C) A Warehouse can be configured to suspend after a period of inactivity — Yes. You can enable auto-suspend with a delay (AUTO_SUSPEND).
• D) A Warehouse can be configured to auto-resume when new queries are submitted — Yes. You can enable auto-resume (AUTO_RESUME) so a suspended warehouse automatically resumes on new queries.

• Example commands:

• Even if a warehouse is resizing or auto-suspending, queries will be queued and then executed once the warehouse has the appropriate capacity.