ISC2 ISSAP Exam Prep
ISC2 Information Systems Security Architecture Professional Exam (Page 20 )

xml 
<apex:page> 
    <apex:stylesheet value="{!URLFOR($Resource.MyStyles, 'styles/main.css')}" /> 
</apex:page>

• <apex:includeScript> is for JavaScript.
• <apex:includeStyle> is not a valid Visualforce component.
• <apex:require> is not the Visualforce tag used to load CSS.

• UPS battery-backed outlets: Connect only essential devices needed during an outage:

• Surge-protector-only outlets: Connect nonessential devices, especially the printer. Printing does not need to continue while you are saving work and shutting down.
• UPS power source: Plug the UPS directly into a wall outlet.
• Surge protector power source: Plug it directly into a wall outlet as well. Do not normally plug a surge protector into the UPS, because that creates a daisy chain and can overload the UPS.

• Crowd-sourced evaluation: Requires recruiting and managing many evaluators.
• Human-worker evaluation: Provides human judgment but requires coordination, labeling instructions, and quality control.
• RLHF: Is a training and alignment process, not simply a low-overhead model comparison method.
• Automatic model evaluation: Quickly evaluates outputs using predefined toxicity or quality metrics with minimal manual effort.

• Two-part tariff pricing: $10 per unit
• Dual pricing: $20 per unit

Two-part tariff pricing

Dual pricing

• Division X, the seller, is credited with the market price: \(\$20\)
• Division Y, the buyer, is charged the marginal cost: \(\$10\)

• A: CEO-sponsored formal policy — demonstrates executive support, but sponsorship at one point in time may not sustain commitment.
• B: Security awareness training — primarily improves employee behavior, not senior management commitment.
• C: Periodic alignment reviews — ongoing reviews show that security remains relevant, supports business priorities, and uses resources appropriately.
• D: Senior management signoff on the strategy — useful for governance and accountability, but signoff is generally a one-time event.

• Active-active routers: Provide redundant Internet connections/devices. Both can operate, so traffic can fail over or be load-balanced.
• Active-active firewalls: Avoid a single firewall becoming a failure point while maintaining security inspection.
• Load balancers: Distribute requests across multiple web servers. If one server fails, traffic can go to the other.
• Redundant power supplies: A server with separate power supplies should connect to independent power sources or circuits.
• UPS A and UPS B: Provide backup power and redundancy. Ideally, each power supply is connected to a different UPS.
• SONET ring: A ring topology provides alternate paths if a fiber link or segment fails.

• GPS coordinates
• Date and time the image was taken
• Camera or device information
• Image dimensions and software used

• Log data: Records generated by systems or applications, not normally embedded in image files.
• Encrypted data: Information intentionally encoded to prevent unauthorized access.
• Sensitive data: A broad classification, not the specific type of information being extracted.

• LastName: Required.
• FirstName: Optional.
• AccountId: Optional; a Contact may be associated with an Account later or remain private, depending on organization settings.
• Name: A compound display field made from first and last name; it isn’t entered as a separate field.

• A. IDS attack signatures: An IDS mainly detects suspicious network traffic. It is not the best control for scanning uploaded documents.
• C. Load balancer: Distributes traffic among servers and can improve availability, but does not specifically detect malware.
• D. WAF: Protects web applications from attacks such as SQL injection and command injection. It may inspect web requests, but malware scanning of PDF files is not its primary function.

• FTP — Transfers files using a client/server model and supports authentication. It uses separate control and data connections.
• TFTP — A very simple file-transfer protocol with no authentication and minimal features. Commonly used to transfer router or switch configuration files and IOS images.
• SCP — Securely copies files over SSH. It provides encryption and authentication.
• SFTP — Also transfers files securely through SSH, but provides more file-management capabilities than traditional SCP.
• HTTP/HTTPS — Primarily web protocols, but can also download files; HTTPS encrypts the session.

• TFTP = simple, unauthenticated file transfer
• FTP = file transfer with authentication, but not inherently encrypted
• SCP/SFTP = secure file transfer using SSH

• Atomicity: a write fully succeeds or does not appear.
• Consistency: table state remains valid.
• Isolation: concurrent operations do not corrupt one another.
• Durability: committed changes persist.

• Flexible schemas: common data lakes often support flexible or schema-on-read data.
• Open-source formats: common data lakes commonly use open formats such as Parquet.
• Scalable storage: cloud data lakes already provide scalable storage.

• Packet loss
• Latency
• Jitter
• Call quality by user, device, network, location, or building

• Teams Usage Report: Shows adoption and usage statistics, not detailed call-quality metrics.
• Teams Device Usage Report: Reports which devices are being used and how, but does not provide detailed packet-loss analysis.
• Microsoft Network Testing Companion: Helps assess network readiness before deployment, but it is not the primary tool for analyzing packet loss from actual Teams calls.

• Third-party attestation: Provides independent confirmation, often for formal compliance reporting, but is not usually performed frequently.
• Penetration testing: Attempts to exploit vulnerabilities; it focuses on technical security, not overall compliance procedures.
• Vulnerability scans: Identify known technical weaknesses in systems, but do not evaluate whether policies and processes meet compliance requirements.

• A. Remove rows where Sales[Status] is Canceled

• E. Remove Sales[Canceled Date]

• B: Removing Sales_Date would remove information users need—the date portion.
• C: Changing Delivery_Time to Integer could alter its meaning or precision and is not necessarily safe.
• D: Splitting the date/time column creates additional columns rather than simply removing unnecessary data.

• A — Use getRecordTypeInfosByDeveloperName()

apex 
  Id rtId = Schema.SObjectType.Account 
      .getRecordTypeInfosByDeveloperName() 
      .get('Business_Account') 
      .getRecordTypeId();

• C — Query the RecordType object

apex 
  RecordType rt = [ 
      SELECT Id 
      FROM RecordType 
      WHERE SObjectType = 'Account' 
      AND Name = 'Business Account' 
      LIMIT 1 
  ];

• B: An outbound SOAP call is unnecessary and inefficient.
• D: Hardcoding an ID is not dynamic, and IDs can differ between orgs.

• Installing software
• Applying configuration changes
• Calling PowerShell scripts
• Running setup or customization commands

cmd 
powershell.exe -ExecutionPolicy Bypass -File C:\Scripts\ConfigureVM.ps1

• GPO logon script: Runs only when a user logs on and depends on domain/GPO processing.
• GPO startup script: Runs during startup, but requires the VM to be domain joined and receives the applicable GPO.
• Place scripts in a VHD: Merely makes the scripts available; it does not automatically execute them.

• Microservices: An application design approach that divides software into small services; it does not specifically reduce the number of operating systems.
• Containerization: Uses isolated containers that share the host OS kernel—best match.
• Virtualization: Creates separate virtual machines, and each typically requires its own guest OS, so it does not minimize OS instances as effectively.
• Infrastructure as code: Automates deployment and management of infrastructure; it does not describe the architecture being used.

• Data only needs to be current at 7 AM each day, so scheduled refresh is sufficient.
• Import mode provides the fastest report interaction because data is stored in Power BI’s in-memory engine.
• It supports row-level security (RLS), including the USERNAME() filter.
• You can limit the imported data to the current year and previous three years to reduce model size.
• DirectQuery would generally provide slower visual response times and is unnecessary here.
• Dual is mainly useful in composite models where some tables use DirectQuery and others use Import. That is not required by this scenario.
• Live connection is not appropriate because you are creating the semantic model.

• terraform init is normally required first, especially for a new or changed working directory. It installs providers/modules and configures the backend.
• terraform plan previews the proposed changes.
• terraform apply applies those changes. It also creates a plan internally if you have not supplied a saved plan.

text 
terraform init 
terraform validate       # optional but recommended 
terraform plan 
terraform apply

• Accept: Acknowledging the risk without taking additional action.
• Transfer: Moving the risk’s financial impact to a third party, such as an insurer.
• Mitigate: Reducing the likelihood or impact through controls, such as patching or employee training.
• Avoid: Eliminating the activity that creates the risk.

• Virus signatures: Primarily associated with antivirus or antimalware tools.
• Security agent deployment: Usually handled by endpoint-management or endpoint-security platforms.
• Vulnerability scanning: Performed by vulnerability-assessment tools, although a SIEM may ingest their results.

• Access controls — ensuring only authorized users can access it.
• Encryption — protecting the data if it is intercepted or exposed.

• B — Incorporate contextual output encoding/escaping: Encode untrusted data based on its context—HTML, attribute, JavaScript, or URL—so the browser treats it as data rather than executable code.
• D — Run untrusted HTML input through an HTML sanitization engine: Sanitization removes or neutralizes dangerous elements and attributes, such as script-related content, while preserving safe HTML where needed.

• A: Enabling client-side scripts does not prevent XSS. Script restrictions may reduce risk in some environments, but “enable” is not a general XSS control.
• C: Cookie inspection is unrelated to preventing injected scripts.
• E: The SameSite cookie attribute primarily helps mitigate CSRF, not XSS. It should not generally be described as an XSS prevention measure.

• C. Case after-insert trigger that publishes a Platform Event

• D. Custom Apex controller that publishes a Platform Event

• A. Trigger with a callout: Salesforce triggers should not make direct synchronous callouts, and this tightly couples transaction processing to the external system.
• B. Workflow Rule with Outbound Message: This can react to record changes, but it cannot reliably capture a user clicking a menu item. It also does not provide the same flexible event-driven model as Platform Events.

• Firewall
• Intrusion prevention and detection
• Antivirus or antimalware
• Web and email filtering
• Virtual private networking (VPN)
• Sometimes content filtering and centralized reporting

• A: Concerns task scheduling and avoiding missed runs, not directly sizing the warehouse.
• B: The amount of data in a stream alone does not reliably determine compute needs; the SQL processing is what matters.
• D: A multi-cluster warehouse addresses concurrency, not the compute size needed for one task execution.

• Data Cloud combines data from multiple systems.
• It resolves and organizes that data into a unified customer view.
• That unified view enables downstream actions such as personalized campaigns, segmentation, analytics, and activation.

• A = core platform value
• D = a resulting business use case or benefit

1. Create a temporary Onboarding OU.
2. Move the new account into it.
3. Move the restrictive SCPs from the organization root to the Production OU.
4. Allow the account to update AWS Config.
5. Move the account into Production after onboarding.

• An SCP attached at the organization root applies to every account and OU beneath it.
• An SCP attached to the Production OU applies only to accounts in that OU.
• Therefore, moving the restrictive SCP from the root to Production temporarily exempts the onboarding account without weakening the policies for existing production accounts.
• Once onboarding is complete, moving the account into Production subjects it to the normal restrictions.

• Maximum response and resolution times
• Expected uptime or availability
• Performance requirements
• Escalation procedures
• Consequences for failing to meet requirements

• SOW: Defines a project’s scope, tasks, deliverables, and schedule.
• MOA: Documents specific responsibilities agreed upon by two parties.
• MOU: Records a general understanding or intent to cooperate.

• CBWFQ (Class-Based Weighted Fair Queuing): Creates traffic classes and assigns each class a guaranteed bandwidth or queueing treatment.
• PQ (Priority Queuing): Uses multiple queues with strict priority. Higher-priority queues are serviced before lower-priority queues, making it useful for delay-sensitive traffic—but it can starve lower-priority traffic.

• FRTS: Traffic shaping for Frame Relay; it controls the transmission rate rather than selecting packets during congestion.
• CAR: Polices traffic by rate, typically dropping or remarking packets that exceed a limit.
• PBR: Policy-Based Routing; it selects forwarding paths and is not a QoS queueing mechanism.

• Controlar o fluxo de dados entre S3 e SageMaker;
• Aplicar regras de segurança por meio da VPC;
• Reduzir a exposição dos dados;
• Permitir acesso privado ao bucket do S3.

• Amazon Inspector: avalia vulnerabilidades, mas não gerencia o fluxo de dados.
• Amazon Macie: ajuda a descobrir e proteger dados sensíveis no S3, mas não cria a conexão com o SageMaker.
• S3 Glacier Deep Archive: é uma classe de armazenamento para arquivamento, não uma solução de conectividade.

• Transport and handling
• Storage and warehousing
• Refrigeration
• Shelf-stacking or replenishment
• Other costs directly attributable to product P

• 2018-12-31 — the date
• 08:59 — the time

• Changing the original column to Date may fail because it still contains the text at and a time.
• Extracting the last 11 characters does not isolate the date.
• Extracting the first 11 characters gets the date plus a space, but the option does not specify changing the result to the Date type.

• Password spraying: Tries a few common passwords against many accounts; no indication of repeated login attempts.
• Remote-access Trojan (RAT): Could install malware, but it does not explain how the attacker obtained the administrator’s credentials.
• Dictionary attack: Tries words or common passwords against an account; again, the scenario specifically highlights Telnet’s lack of encryption.

• Build, measure, learn: Create something, assess real feedback or results, and adapt.
• Minimum viable product (MVP): Produce the smallest useful version to test assumptions and reduce uncertainty.
• Fail fast: Test ideas early so that unsuccessful approaches can be identified before significant time or cost is invested.

• HTTPS: Secure web traffic, not general command-line server administration.
• SNMPv3: Secure network monitoring and management, not interactive server login.
• RDP: Provides graphical remote desktop access. It can be secure, but it is not the direct replacement for Telnet in this scenario.
• SMTP: Used to send email.

sql 
ALTER TABLE dbo.DimCustomer 
ADD CONSTRAINT PK_DimCustomer 
PRIMARY KEY NONCLUSTERED (CustomerKey) 
NOT ENFORCED;

1. ALTER TABLE dbo.DimCustomer
2. ADD CONSTRAINT PK_DimCustomer PRIMARY KEY NONCLUSTERED (CustomerKey)
3. NOT ENFORCED

• Existing expected ROI: 15%
• New project ROI: 14%
• Cost of capital: 12%

• Project return = 14%
• Cost of capital = 12%
• It earns 2% more than the cost of capital, so it should increase shareholder value.

• Menerjemahkan soal ke bahasa Indonesia.
• Menyebutkan jawaban yang benar.
• Menjelaskan alasan jawaban tersebut.
• Memberi tahu jika kunci jawaban yang tersedia tampaknya keliru.
• Menjelaskan istilah teknis penting dalam soal.

• The S3 bucket as an origin for static content
• The Application Load Balancer (ALB) as an origin for dynamic content
• An Amazon Route 53 alias record pointing the application domain to CloudFront

Why this works

• Static data: CloudFront caches objects from S3 at edge locations, reducing latency for users worldwide.
• Dynamic data: CloudFront forwards requests that require application processing to the ALB. It can also maintain persistent connections and use the AWS global edge network to improve delivery performance.
• One domain: CloudFront behaviors can route different path patterns to different origins—for example, /static/* to S3 and other paths to the ALB.

Why the other options are incorrect

• Global Accelerator is designed primarily for accelerating traffic to applications with endpoints such as ALBs, not for caching S3 content.
• Using separate domains or splitting static and dynamic traffic adds unnecessary complexity.
• CloudFront already provides the required global edge distribution and caching, so combining it with Global Accelerator is unnecessary here.

• COE: Identifies the Center of Excellence, such as Payroll or Benefits.
• Topic Detail: Classifies the HR service within its COE; it does not identify the catalog item.
• Template: Supplies default values or case configuration.
• Record Producer: Represents the catalog item that employees use to submit the request and create the case.

• Maintain head office control: Transfer pricing generally supports decentralisation rather than direct head-office control.
• Establish centralised decision making: This conflicts with divisional autonomy.
• Develop a top-down culture: Transfer pricing is intended to support empowered divisions and goal congruence, not impose purely top-down management.

• Case Assignment Rules normalmente são avaliadas quando o caso é criado. Elas podem ser executadas novamente em uma edição somente se o usuário marcar “Assign using active assignment rules”; isso não acontece automaticamente apenas porque o caso foi fechado.
• Portanto, criar uma regra de atribuição não corrige os centenas de casos já fechados e não garante, por si só, que um caso será transferido antes de ser fechado.

• B — Usar uma ferramenta de dados: corrige os registros históricos já existentes, atualizando o Owner.
• D — Criar uma regra de validação: impede que um caso seja fechado enquanto ainda pertence a uma fila. Exemplo conceitual: se Status = Closed e o proprietário for uma fila, bloquear o salvamento.

• WPA3: Secures wireless traffic but does not normally verify whether someone has paid.
• PSK: A shared Wi-Fi password gives access to anyone who knows it; it cannot easily validate individual receipts.
• IEEE 802.1X: Provides user/device authentication, commonly through an authentication server, but is excessive and not designed specifically for a simple receipt-based guest-access workflow.

• Each team’s Bedrock workflow uses a separate IAM service role.
• The role’s Amazon S3 permissions can be limited to only that team’s customer folder or objects.
• This enforces least privilege and prevents one team’s Bedrock application from accessing another team’s data.
• Access is enforced by AWS permissions, not by asking users to provide a customer name in each request.

• A single role with broad S3 access does not provide team-level isolation.
• Asking teams to specify a customer name is not an access-control mechanism.
• Redacting data does not prevent unauthorized access.
• A bucket policy alone is insufficient unless it explicitly enforces the required team-role restrictions.

• Managerial: policies, standards, risk management, governance
• Operational: procedures carried out by people, such as training, incident response, and backups
• Technical: firewalls, encryption, access-control systems
• Physical: locks, guards, cameras

• Confirming the data has the required columns and data types
• Handling missing or duplicate records
• Converting data into a suitable format
• Selecting or engineering useful features
• Splitting it into training, validation, and test sets

1. Prepare the training data
2. Select an algorithm or configure AutoML
3. Train the model
4. Evaluate its performance
5. Tune hyperparameters if needed
6. Deploy the model

• Keep earlier prompt versions.
• Identify the last version that produced acceptable output.
• Restore it as a baseline.
• Make small, controlled changes—ideally one significant change at a time.
• Test the output after each change.

• A: Discards useful information about what worked.
• B: Large simultaneous changes make it difficult to identify the cause of problems.
• D: Accepts output that does not meet the requirements.

• Deploy five individual VMs: This does not create a VM scale set.
• Modify Availability Zones or Size settings: These actions do not create the required scale set and add unnecessary steps.
• VM orchestration mode: This is Flexible orchestration, intended for more individually managed VMs and mixed configurations. It is not the best choice for a straightforward group of identical instances.

• PC A: 192.168.1.10/24
• PC B: 192.168.2.10/24

• Both PCs have a correct default gateway
• A router or Layer 3 switch connects the subnets
• Routing and firewall rules allow the traffic