Microsoft DP-420 Exam Prep
Designing and Implementing Cloud-Native Applications Using Microsoft Azure Cosmos DB (Page 3 )

1. Selling price per unit: $750
2. Required annual return:

1. Required profit per unit:

1. Target cost per unit:

• Reviewing and validating generated code
• Checking security, licensing, and quality concerns
• Testing the implementation
• Making the final design and coding decisions

• A: Copilot is not a complete replacement for developers.
• C: Human input, review, and oversight are still required.
• D: Copilot Chat supports many tasks beyond debugging, including explanation, generation, refactoring, and testing assistance.

• Leadership and stakeholder commitment
• Business capability and skills
• Organizational culture
• Availability of resources
• Ability to manage and sustain change
• Impact of the proposed transformation

• How ready the organization is
• Which areas require urgent attention
• How difficult each issue may be to resolve
• Risks that could affect implementation

• A: Places the assessment in Phase B and refers vaguely to creating views; this is not the prescribed technique.
• B: An Implementation Factor Assessment and Deduction Matrix is not the primary TOGAF technique described for business transformation readiness.
• D: A Business Scenario helps identify requirements and stakeholder concerns, but it is not the main technique for assessing organizational readiness.

• Modelo de embeddings de texto: trabalha principalmente com texto, não sendo adequado para imagens.
• Modelo generativo multimodal: pode interpretar ou gerar conteúdo de vários tipos, mas não é a opção específica para busca por similaridade.
• Modelo de geração de imagens: cria imagens a partir de entradas, não realiza busca multimodal.

• Elicited and documented customer requirements
• Converted them into clear, measurable specifications
• Validated the requirements with the customer
• Used them as the basis for design, quality checks, and acceptance

• A: Requirements should reflect the customer’s needs—not the supplier’s standards.
• B: Iteration review planning does not replace proper requirements collection.
• D: A retrospective occurs after work is completed and is mainly for process improvement, not initial requirements definition.

• Users retain their existing usernames and passwords.
• Existing accounts can be used to access Azure-based resources.
• Administrators avoid manually recreating thousands of accounts.
• The transition is less disruptive before the on-premises data center is retired.

• Inherent risk: Risk that exists before controls are implemented.
• Avoided risk: Risk eliminated by choosing not to perform the risky activity.
• Operational risk: Risk arising from failures in processes, people, systems, or daily operations.

• A. A virtual network gateway
• D. A virtual network

• Azure virtual machines must be connected to an Azure virtual network (VNet). The VNet provides private IP addressing and network connectivity for the VMs.
• A virtual network gateway enables communication between the Azure VNet and the on-premises network, typically through a site-to-site VPN or ExpressRoute connection.

• Load balancer: Distributes traffic among Azure VMs; it does not connect Azure to an on-premises network.
• Application gateway: Provides web-application load balancing and Layer 7 routing; it is not the normal resource for on-premises connectivity.
• Gateway subnet: A gateway subnet is required inside the VNet when deploying a virtual network gateway, but the question’s intended two primary resources are the VNet and virtual network gateway.

• administrators — Full access to switch configuration and REST API functions; excessive for this requirement.
• sysadmin — Intended for highly privileged system administration, not basic monitoring.
• helpdesk — More limited and focused on troubleshooting/support functions; it does not match the stated default role and level-1 requirement as directly.

• A. IDS attack signatures: An IDS primarily detects suspicious network activity and usually alerts rather than directly scanning and blocking uploaded files.
• C. Load balancer: Distributes traffic among servers but does not inspect files for malware.
• D. WAF: Protects web applications from attacks such as SQL injection, cross-site scripting, and some malicious requests. It is not primarily a PDF-malware scanning solution.

• A single Construction Job can use multiple Machinery records.
• A single Machinery record may be used on multiple Construction Jobs.
• This is a many-to-many relationship, which Salesforce models using a junction object.
• The junction object can contain fields such as:

• Master-detail to Machinery
• Master-detail to Construction Job
• Date and cost fields

1. Ensure BOMs can include subcomponents ? Configure an entity relationship

1. Report changes made by engineers ? Enable auditing

• Configure entity relationship
• Configure auditing

• Detect risky sign-ins from unfamiliar or unidentified IP addresses
• Evaluate user or sign-in risk
• Automatically require a password change because of a risky sign-in

• User risk policy: Can require a user to securely change their password when the account may be compromised.
• Sign-in risk policy: Can require MFA or block access based on the risk of a particular sign-in.

Why B works

• AWS KMS keys are Regional resources. A normal customer managed key in Region A cannot be used directly in Region B.
• A customer managed multi-Region KMS key (MRK) has related key replicas in both Regions. The replicas share key material and key ID, although each has a Regional ARN.
• With client-side encryption, the application encrypts the data before storing it in S3. Cross-Region replication then copies already-encrypted objects, so S3 does not need to decrypt and re-encrypt them with a different Regional key.

Why the other choices are weaker

• A and C: SSE-S3 uses Amazon-managed S3 keys, not the required customer managed KMS key.
• D: SSE-KMS can work only if the solution creates and configures the appropriate KMS key or multi-Region key replica in each Region. As written, it says to create a customer managed KMS key in each Region, which implies separate keys—not the same KMS key. Replication also requires additional KMS permissions and destination encryption configuration.

• B. The community must be built with the Customer Account Portal template.

• C. An experience ID (expid) or placeholder parameter must be used in the URL.

• A: The Visualforce + Salesforce Tabs template does not provide this dynamic branding capability.
• D: An external CMS is not required. The branding configuration is handled within Salesforce Experience Cloud.

• A limited lifetime
• Permissions defined by an IAM role or policy
• The ability to access AWS APIs without using long-term IAM user credentials

• Amazon API Gateway — Builds and manages APIs; it does not generally issue AWS credentials for applications.
• IAM users — Usually use long-term credentials, which are less suitable for applications.
• IAM instance profiles — Provide temporary role credentials to applications running on EC2 instances, but are specifically tied to EC2. The broader requirement described is best met by AWS STS.

• Idioma: “Responda em português.”
• Tamanho: “Responda em até três frases.”
• Formato: “Use uma lista com três recomendações.”
• Objetivo: “Recomende produtos com base nas necessidades do cliente.”

• Mudar o tamanho do LLM: pode alterar capacidade e custo, mas não garante idioma ou respostas curtas.
• Aumentar a temperatura: aumenta a criatividade e a aleatoriedade; não controla diretamente o tamanho ou idioma.
• Aumentar o Top K: permite considerar mais tokens prováveis, aumentando a variedade; também não é o mecanismo principal para controlar idioma ou comprimento.

• Basic: Self-help only; no technical support or design assessment.
• Standard: Technical support, but not the full proactive architectural guidance required here.
• Professional Direct: Provides proactive guidance and architecture-related assistance.
• Premier: Also supports this, but is a more expensive, enterprise-level option.

• Continuous deployment: Automates software releases; it does not specifically test input handling.
• Static code analysis: Examines source or compiled code without executing it. It can find coding flaws but does not directly stress the application with malformed inputs.
• Manual peer review: Developers inspect code or design manually. Useful, but not the best practice specifically for testing how a live product handles invalid input.

• You normally do not create a new sensitive information type for credit card numbers. Microsoft Purview already provides a built-in Credit Card Number sensitive information type.
• The required sequence should generally be:

• Normalize casing in the data source—for example, convert all values to uppercase or lowercase.
• Add an index key to provide a unique, stable identifier for each row or value.

• Application management: Controls which apps can be installed or used; it does not remove existing data after theft.
• Full-disk encryption: Protects data when the device is powered off or locked, but it may not help if the attacker has already unlocked the device.
• Containerization: Separates corporate data from personal data, but the attacker may still access the corporate container using the stolen credentials.

• Assignment
• Decision
• Get Records
• Loop

• Screen flow: Would include a Screen element.
• Inactive version: Inactive status does not restrict the available elements.
• Activated version: Activation status also does not determine the toolbox contents.

• Forecasting lets sales leaders predict revenue for upcoming fiscal periods, compare forecasts with targets, and review performance by salesperson or team.
• Opportunity Stages help determine the likelihood that opportunities will close. Each stage can have a probability, which contributes to forecast calculations.

• Sales Quotes: Used to present pricing or product proposals to customers; they do not provide revenue forecasting.
• Opportunity List View: Helps users filter and view opportunities, but it is not the forecasting tool.

• Reviewing security policies and standards checks whether controls are documented, not whether they work.
• Reviewing security logs may show that monitoring is occurring, but does not directly establish that preventive controls are effective.
• Analyzing technical security practices is broad and may assess implementation, but it is less objective than an actual controlled attack.

• Design/compliance effectiveness: policies, standards, and procedures
• Operational effectiveness: logs, records, and evidence that controls operate
• Technical security effectiveness: penetration testing or vulnerability testing

• Create Power Query parameters for the Azure SQL server/database—or at least the database name.
• Use the parameter in the PBIX connection.
• Publish the same PBIX separately to the relevant development, test, and production workspaces.
• Set each dataset’s parameter value in the Power BI service so it points to the corresponding Azure SQL database.

• Development dataset ? DevelopmentDB
• Test dataset ? TestDB
• Production dataset ? ProductionDB

• The same PBIX is used for every lifecycle stage.
• Each stage consumes data from its matching database.
• Deployment pipelines are not required.
• Azure SQL is a cloud source, so gateway administration is generally avoided.
• Only the parameter value differs between published datasets, reducing maintenance.

• SageMaker endpoint: Not required because the model is being used through Amazon Bedrock.
• SageMaker Model Registry: Used for managing SageMaker models, not for making a Bedrock custom model available.
• Grant access in Amazon Bedrock: IAM permissions may still be needed, but granting access alone does not provide the required inference capacity.

• Compare each server’s drive specifications and performance data.
• Identify the drive that is faulty, slow, or mismatched.
• Replace it with a drive that matches the required interface, capacity, and performance characteristics.
• Avoid selecting a slower drive, because storage performance can bottleneck the entire server.
• In a redundant array, use a compatible replacement so rebuilding does not create unnecessary performance degradation.

• Input feature distributions differ from training data ? Analyze dataset drift metrics

• Model accuracy drops without code changes ? Analyze dataset drift metrics

• Endpoint latency increases under load ? Investigate scaling and infrastructure metrics

• Data loss prevention (DLP): Helps detect or prevent unauthorized data transfers, but does not directly protect data on a stolen, powered-off laptop.
• Operating system hardening: Reduces vulnerabilities and attack surface, but does not adequately protect stored data if the device is stolen.
• Boot security: Helps prevent unauthorized operating systems or boot media from loading. It supports device security but is not the primary solution for protecting the data itself.

• B: Trigger.Once + scheduled job

• C: 10-minute processing-time trigger

• Open or insecure ports
• Enabled legacy or insecure protocols
• Known vulnerabilities and misconfigurations
• Weak services and outdated software

• curl tests web requests and HTTP-based services.
• Wireshark captures and analyzes network traffic; it does not normally scan servers for weaknesses.
• netcat can test connectivity to individual ports and sometimes grab service banners, but it is not a comprehensive vulnerability scanner.

• A vulnerability scanner automates discovery of known vulnerabilities and misconfigurations across systems. It can contribute to a supply-chain assessment.
• A penetration test actively attempts exploitation and is usually limited to an agreed scope.
• SCAP standardizes vulnerability and configuration assessment data; it is not the analysis itself.
• Illumination tool is not a commonly defined CompTIA Security+ term.

• Separate accounts/domains create a strong administrative boundary between non-production and production.
• Separate projects provide distinct IAM boundaries, billing, quotas, service accounts, and resources.
• Developers can receive permissions in the development project without automatically gaining access to production.
• Production administrators can be restricted from development resources, supporting separation of duties and least privilege.

• A: Creates excessive project fragmentation without being required by the stated requirement.
• C: Keeps development and production under one account and does not clearly separate administrative duties.
• D: Uses one account and only two projects; it provides some project isolation but weaker organizational separation.

• Store privileged credentials securely
• Grant the consultant only the access needed
• Provide temporary or time-limited access
• Rotate passwords automatically
• Record or monitor administrator sessions

• TACACS+: Centralizes authentication and authorization, commonly for network devices, but does not primarily provide password vaulting and privileged-session control.
• SAML: Enables web-based federation and single sign-on, not privileged credential management.
• SSO platform: Reduces the number of passwords users need, but does not necessarily protect administrative credentials or control privileged sessions.
• Role-based access control (RBAC): Assigns permissions based on job roles, but does not by itself prevent password sharing or securely broker administrator access.

• Review the risk register.
• Use the previously defined risk response plan, such as assigning a backup resource, reprioritizing work, or using another qualified engineer.
• Implement the response promptly because the task is on the critical path.

• B: Revising the schedule without first applying the planned response may be premature.
• C: Excluding a required task could compromise the project’s objectives and requirements.
• D: Updating the risk and lessons learned records is appropriate, but it should happen after managing the immediate issue, not as the next primary action.

• Reusing features across different models and teams
• Consistent feature definitions
• Managing feature versions and metadata
• Using features for both training and inference

• SageMaker Data Wrangler: Prepares and transforms data; it is not primarily a shared feature repository.
• SageMaker Clarify: Helps detect bias and explain model predictions.
• SageMaker Model Cards: Documents models, including intended use, risks, and evaluation results.

• nomes de pessoas;
• organizações;
• locais;
• datas;
• números de processos;
• leis ou contratos.

• NER = identifica informações específicas e classificáveis.
• Sumarização = reduz um documento e apresenta seus pontos principais.

• Multiple nodes: Data is replicated several times in the primary region.
• Separate geography: A copy is asynchronously replicated to a secondary Azure region.
• Readable secondary: RA-GRS provides read-only access to the secondary replica, even when the primary region is available.

• GRS: Replicates to another region but the secondary copy isn’t normally readable.
• ZRS: Replicates across availability zones in the same region, not a separate geographic region.
• LRS: Keeps replicas within a single datacenter or region and provides no geographic redundancy.

• ARP poisoning: Redirects or intercepts local network traffic; monitoring would typically show suspicious ARP changes or man-in-the-middle behavior.
• Jamming: Interferes with wireless or radio signals. It would affect connectivity, not usually show a server-specific overload.
• Kerberoasting: Attempts to obtain and crack Kerberos service-account hashes; it does not normally cause a system outage.

• An Anypoint VPC provides private network connectivity for CloudHub applications.
• An IPsec VPN tunnel or AWS Direct Connect connects that VPC to the customer’s on-premises network without exposing the database to the public internet.
• The VPC and on-premises firewalls must allow the required traffic, routes, and ports.

• Static IP addresses only identify the application’s outbound traffic; they do not create a private network path to the database.
• A Dedicated Load Balancer does not replace the required network connection to the on-premises environment. It is also unnecessary merely to reach individual databases.
• Moving sensitive databases to a DMZ is not the intended architecture and could reduce their protection.

Simple explanation

• The Azure VPN gateway to connect to
• Authentication settings
• Routes for networks that the client can access

• A private IP address on the virtual network
• An associated public IP address

• The listener has a virtual IP address on the load balancer.
• The active SQL Server replica must respond using the listener’s IP address, not its own VM IP.
• Floating IP allows the listener IP to be preserved and returned by the active replica.
• This is required for the SQL Always On listener configuration.

• A health probe for the SQL listener/cluster role
• The SQL Server listener port, commonly 1433
• Appropriate backend pool membership

1. Ingestion Lambda receives requests from API Gateway and places messages in an SQS queue.
2. Processing Lambda is triggered by the queue and loads records into Aurora PostgreSQL.

• Decoupling: API request handling is separated from database loading.
• Buffering: SQS absorbs bursts when incoming traffic exceeds the database’s processing capacity.
• Controlled concurrency: Configure the SQS-triggered Lambda’s concurrency and batch size to avoid overwhelming Aurora or exhausting database connections.
• Automatic retries: Messages that fail processing can return to the queue and be retried. A dead-letter queue can capture persistent failures.
• Lower operational effort: The solution remains serverless and avoids managing EC2 servers or Kubernetes clusters.

• A: EC2 and Tomcat add server-management overhead.
• B: DynamoDB/DAX would require changing the database model and does not solve the Aurora ingestion design.
• C: SNS is useful for notifications and fanout, but SQS is better for durable buffering and backpressure in this producer-consumer workflow.

• The user authenticates with the external Identity Provider.
• Salesforce receives the SAML assertion.
• Salesforce uses attributes in that assertion—such as username, email, first name, last name, and profile/community information—to create the user during the first login.
• On later logins, Salesforce updates or uses the existing user record.

• On-the-fly provisioning is a general phrase; the Salesforce capability being tested is specifically JIT provisioning.
• Salesforce APIs would require a separate integration and provisioning process.
• Identity Connect is designed primarily to synchronize users from an identity directory, not to create users at the moment of their first SAML login.

• tag=Priv searches the tag field for values beginning with Priv. The wildcard can match the remaining characters, so it matches Privileged.
• tag=Priv would search for the exact tag Priv, not Privileged.
• tag=priv* uses lowercase priv; tag matching is treated as case-sensitive here, so it may not match the tag Privileged.
• tag=privileged uses the wrong capitalization for the exact tag.

• Updating the CRL: Revokes compromised certificates, but does not fix the CA flaw that allowed them to be created.
• Changing passwords: May be necessary if accounts were compromised, but it does not address the certificate-generation vulnerability.
• Implementing SOAR: Improves security automation and response; it does not remediate the underlying PKI weakness.

• Azure creates a corresponding service principal in Microsoft Entra ID.
• The identity’s lifecycle is tied to the Azure resource.
• If the resource is deleted, Azure automatically deletes the identity.
• Only the associated resource can use that identity to request tokens.
• You can grant the identity permissions to access services such as Key Vault or Storage without storing credentials in code.