Microsoft MB-335 Exam Prep
Microsoft Dynamics 365 Supply Chain Management Functional Consultant Expert (Page 19 )

• Threat perspective: Focuses on possible attacks, but may seem technical or hypothetical.
• Compliance perspective: Can motivate action, but compliance alone does not demonstrate the broader business value of governance.
• Policy perspective: Policies are important, but they are a means of implementing governance, not its primary business justification.

• AWS AppSync is designed for serverless applications that need to retrieve and combine data from multiple sources.
• A pipeline resolver can invoke multiple functions or data-source resolvers, including resolvers connected to different DynamoDB tables.
• The application can receive the combined result through one GraphQL request, without requiring custom aggregation logic in the application.
• This is operationally efficient because AppSync manages the API layer and resolver execution.

• Athena Federated Query is intended primarily for analytics and ad hoc querying, not low-latency application data retrieval.
• Querying DynamoDB through Athena can consume DynamoDB read capacity and may affect table performance.
• It also introduces analytical-query overhead and is not the normal choice for a microservice web application.

• Inherent risk: Risk that exists before controls are implemented.
• Avoided risk: Risk eliminated by choosing not to perform the risky activity.
• Operational risk: Risk arising from failures in processes, people, systems, or daily operations.

• The servers are powered on.
• The network is functioning.
• Devices can still reach the server network.

• ARP poisoning: Redirects or intercepts local network traffic; it usually affects communication paths rather than overwhelming a service.
• Jamming: Disrupts wireless or radio signals. It would not fit a system that remains accessible from devices on the server network.
• Kerberoasting: Attempts to crack service-account credentials from Kerberos tickets; it does not normally cause an immediate outage.

• A static IP gives the surveillance system a predictable local address, so users can reliably reach it on the LAN.
• However, a static IP does not block internet-based login attempts. If the router exposes the device through port forwarding, attackers could still reach it.
• Port mapping normally exposes an internal service externally, so A is a poor choice as written.
• Subnetting alone also does not block traffic; it would require routing/firewall rules.

• A. IDS attack signatures: An IDS primarily detects suspicious network activity and usually does not provide dedicated file-upload malware scanning. It is generally detective rather than preventive.
• C. Load balancer: Distributes traffic among servers and improves availability; it does not inspect documents for malware.
• D. WAF: Helps block web-application attacks such as SQL injection, command injection, and XSS. Although a WAF may inspect upload requests, malware detection in PDF files is more directly addressed by antivirus or content-scanning functionality.

text 
heartrateheartrateheartrate

• Spark column objects can be multiplied, for example:

python 
  df["heartrate"] * 3

• A DataFrame itself cannot be multiplied, but the expression is referring to a column.
• It is also not primarily a Python syntax error; the code was parsed, then Spark failed while resolving the column name.

• Store privileged credentials securely
• Grant the consultant only the access needed
• Provide temporary or time-limited access
• Rotate passwords automatically
• Record or monitor administrator sessions

• TACACS+: Centralizes authentication and authorization, commonly for network devices, but does not primarily provide password vaulting and privileged-session control.
• SAML: Enables web-based federation and single sign-on, not privileged credential management.
• SSO platform: Reduces the number of passwords users need, but does not necessarily protect administrative credentials or control privileged sessions.
• Role-based access control (RBAC): Assigns permissions based on job roles, but does not by itself prevent password sharing or securely broker administrator access.

• C — Custom buttons display at the top and bottom of a page: Correct. In Salesforce Classic, buttons can appear in the page’s button areas, including the top and bottom of record pages.
• D — Custom buttons are available for Person Accounts: Correct. Person Accounts use the Account object, so Account custom buttons can be available on Person Account layouts.
• E — Custom buttons can reference an external app: Correct. A URL custom button can launch or navigate to an external application or website.

• A: JavaScript custom buttons are a Salesforce Classic feature and are not supported in Lightning Experience. They do not enhance Lightning Experience.
• B: The User object does not generally support custom buttons in the same way standard business objects do.

• Sensitive document shared during a Teams chat: Teams chat
• Sensitive document stored/shared in a Teams channel: Teams channel messages

• Files shared in a chat are generally stored in the sender’s OneDrive, but the relevant DLP context is the Teams chat message and its attachment.
• Files shared in a channel are stored in the team’s SharePoint site, but the relevant context is the Teams channel message.
• The DLP rule can then use an action such as restrict access to the content to prevent guest users from opening the sensitive document.

• Share of overall contribution: part of the organization’s total contribution is allocated to the supplying division.
• Dual pricing: the supplying division may record a higher transfer price while the receiving division records a lower price, with central accounts absorbing the difference.
• A centrally imposed price range: this may allow the transfer price to be set above variable cost, helping the supplying division recover fixed costs.

• Input feature distributions differ from training data ? Analyze dataset drift metrics

• Model accuracy drops without code changes ? Analyze dataset drift metrics

• Endpoint latency increases under load ? Investigate scaling and infrastructure metrics

• Reviewing and validating generated code
• Checking security, licensing, and quality concerns
• Testing the implementation
• Making the final design and coding decisions

• A: Copilot is not a complete replacement for developers.
• C: Human input, review, and oversight are still required.
• D: Copilot Chat supports many tasks beyond debugging, including explanation, generation, refactoring, and testing assistance.

• You can configure different pre-shared keys for different device groups.
• All cameras could use one key.
• All scanners could use another key.
• Each key can be associated with an appropriate role or access policy.

• Continuous deployment: Automates software releases; it does not specifically test input handling.
• Static code analysis: Examines source or compiled code without executing it. It can find coding flaws but does not directly stress the application with malformed inputs.
• Manual peer review: Developers inspect code or design manually. Useful, but not the best practice specifically for testing how a live product handles invalid input.

• Espionage: Stealing information for intelligence or competitive purposes.
• Data exfiltration: Unauthorized removal or transfer of data.
• Nation-state attack: A sophisticated attack sponsored by a government.
• Shadow IT: Unapproved technology or access methods used by employees.

• Restrict a port to a defined number of MAC addresses
• Use statically assigned or “sticky” MAC addresses
• Shut down or restrict the port when violations occur

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect suspicious network activity, but is not the primary control for limiting switch MAC entries.
• NGFW: Filters traffic at the network boundary; it does not directly prevent MAC table flooding on access switches.

• R-squared: Typically used for regression, not classification.
• RMSE: Measures prediction error for continuous numerical values, so it is not the best fit here.
• Learning rate: A training hyperparameter that controls how quickly the model updates its weights; it is not an evaluation metric.

• Domínios personalizados.
• Armazenamento suficiente.
• Instâncias dedicadas.
• Balanceamento de carga.
• Menor custo entre os planos que atendem a tudo.

• C: Develop the rule in the Rules Editor, define the events, match, and condition sections, then use the test rule feature. This directly validates the YARA-L rule without enabling it in production.
• A: UDM Search can help investigate data and refine filters, but it does not fully test YARA-L logic—especially complex event joins, match windows, and conditions.

• Accept: Acknowledging the risk without taking additional action.
• Mitigate: Reducing the likelihood or impact through controls, such as patching or employee training.
• Avoid: Eliminating the activity or condition that creates the risk.
• Transfer: Shifting the consequences—usually financial—to another party, such as an insurer.

• Honeypots: Deliberately vulnerable or attractive systems designed to lure attackers. Legitimate users should not access them, so activity on a honeypot is a strong indicator of compromise.
• DNS sinkholes: Redirect requests for known malicious domains to a controlled internal system instead of allowing the connection. This can identify infected hosts attempting to contact command-and-control infrastructure.

• Tokenization: Replaces sensitive data with non-sensitive tokens; it protects data but does not primarily detect attackers.
• CI/CD: Automates software development and deployment processes.
• Threat modeling: Identifies potential threats and weaknesses before or during system design.
• Data obfuscation: Makes data harder to understand, but it is not an attacker-detection method.

• Server provisioning
• Operating systems and runtime infrastructure
• Scaling
• Much of the maintenance and patching

• Thin clients reduce endpoint hardware requirements but do not specifically streamline code deployment.
• Private cloud provides dedicated cloud infrastructure but usually requires more management and expense.
• Virtual machines improve resource utilization, but administrators still manage the VMs, operating systems, and deployments.

• Two-part tariff pricing: $10 per unit
• Dual pricing: $20 per unit

Two-part tariff pricing

Dual pricing

• Division X, the seller, is credited with the market price: \(\$20\)
• Division Y, the buyer, is charged the marginal cost: \(\$10\)

1. You try to access a cloud application, such as accounting software.
2. The application redirects you to the company’s IdP.
3. You authenticate with the IdP.
4. The IdP sends a digitally signed SAML assertion to the application.
5. The application validates the assertion and grants access.

• The user’s identity
• Whether authentication succeeded
• Roles or group membership
• Access-related attributes

• Documented and evaluated
• Assessed for security, cost, and operational impact
• Reviewed and approved by the appropriate personnel
• Tested before implementation
• Tracked with version history and rollback procedures

• Risk management process: May help assess the issues, but it does not authorize and manage design changes.
• Product design process: Applies primarily while creating a new design.
• Design review process: Normally evaluates a design before release; this design is already released.

• Remote and global work: Access is based on the approved device, not a specific office or geographic location.
• Seamless login: Users may not need to repeatedly enter credentials on a recognized device.
• Limited equipment: It uses devices employees already have rather than requiring separate hardware.

• Geotagging: Restricts access based on location and may prevent legitimate remote work.
• Smart cards: Require issuing and managing additional physical equipment.
• Time-based logins: Limit access by time and do not provide a seamless authentication experience.

• 16GB RAM: A 64-bit OS is needed to use more than roughly 4GB effectively, but RAM capacity does not prove the CPU supports 64-bit operation.
• 500GB HDD: Storage capacity has no bearing on OS architecture.
• 1Gbps Ethernet: Network speed is unrelated to CPU architecture.

• A — Securing information assets: This is the responsibility of management and operational/security teams.
• B — Validating protection: Correct. The auditor checks whether controls—such as access restrictions, encryption, retention, and handling procedures—match the asset’s classification.
• C — Ensuring alignment with regulations: Management and legal/compliance functions typically establish classification requirements; the auditor may assess compliance but does not primarily define alignment.
• D — Defining classification levels: This is a management responsibility based on business needs, risk, and regulatory obligations.

• 2000::/3 — Global unicast, used for publicly routable IPv6 addresses.
• FC00::/7 — Unique local, used for private internal addressing.
• FE80::/10 — Link-local, used only on the local network segment and not routed between subnets.

• Keep earlier prompt versions.
• Identify the last version that produced acceptable output.
• Restore it as a baseline.
• Make small, controlled changes—ideally one significant change at a time.
• Test the output after each change.

• A: Discards useful information about what worked.
• B: Large simultaneous changes make it difficult to identify the cause of problems.
• D: Accepts output that does not meet the requirements.

• Each team’s Bedrock workflow uses a separate IAM service role.
• The role’s Amazon S3 permissions can be limited to only that team’s customer folder or objects.
• This enforces least privilege and prevents one team’s Bedrock application from accessing another team’s data.
• Access is enforced by AWS permissions, not by asking users to provide a customer name in each request.

• A single role with broad S3 access does not provide team-level isolation.
• Asking teams to specify a customer name is not an access-control mechanism.
• Redacting data does not prevent unauthorized access.
• A bucket policy alone is insufficient unless it explicitly enforces the required team-role restrictions.

• Deterministic approve/reject results
• Strict adherence to predefined rules
• Consistent, reproducible outcomes
• Auditability and regulatory compliance

• Access controls — ensuring only authorized users can access it.
• Encryption — protecting the data if it is intercepted or exposed.

json 
{ 
  "Effect": "Deny", 
  "NotAction": [ 
    "iam:*", 
    "route53:*", 
    "cloudfront:*", 
    "support:*" 
  ], 
  "Resource": "*", 
  "Condition": { 
    "StringNotEquals": { 
      "aws:RequestedRegion": "eu-west-1" 
    } 
  } 
}

• SCPs set maximum permissions; they do not grant permissions. The default SCP allows actions, so the restriction must be an explicit Deny.
• aws:RequestedRegion checks the Region targeted by an API request.
• StringNotEquals: eu-west-1 denies requests directed to every other Region.
• NotAction allows designated global services to remain usable because they do not operate in a single AWS Region.
• Attaching the SCP to the OU makes it apply to existing accounts and accounts later added to that OU.

• 800 devices ? a scalable, centralized solution is needed.
• Four hardware/vendor classes ? the tool must handle different drivers and images.
• Two user groups ? it should allow different configurations for each group.
• “Distribute custom images” ? an imaging/deployment tool is required, not just a file-copy utility.

• BCP: Maintains essential business operations during and after disruption. It is broader than IT recovery, but the question focuses on restoring the destroyed data center.
• Communication plan: Defines how the organization communicates with staff, the public, and other stakeholders.
• IRP: Handles security incidents such as malware, unauthorized access, or data breaches—not physical disaster recovery.

1. Define Power Platform DLP policies

1. Add custom prompt modifications

1. Conduct adversarial testing

• Active-active routers: Provide redundant Internet connections/devices. Both can operate, so traffic can fail over or be load-balanced.
• Active-active firewalls: Avoid a single firewall becoming a failure point while maintaining security inspection.
• Load balancers: Distribute requests across multiple web servers. If one server fails, traffic can go to the other.
• Redundant power supplies: A server with separate power supplies should connect to independent power sources or circuits.
• UPS A and UPS B: Provide backup power and redundancy. Ideally, each power supply is connected to a different UPS.
• SONET ring: A ring topology provides alternate paths if a fiber link or segment fails.

• Managerial: policies, standards, risk management, governance
• Operational: procedures carried out by people, such as training, incident response, and backups
• Technical: firewalls, encryption, access-control systems
• Physical: locks, guards, cameras

• Accept: Acknowledging the risk without taking additional action.
• Transfer: Shifting the risk’s impact to a third party, such as through insurance or outsourcing.
• Mitigate: Reducing the likelihood or impact of the risk through security controls.
• Avoid: Eliminating the activity or process that creates the risk.

• Advanced Persistent Threat (APT): A sustained, targeted attack campaign or attacker group—not a vulnerability.
• Trojan: Malware disguised as legitimate software.
• Stealthware: A general term for malware designed to avoid detection; it does not specifically mean an unknown vulnerability.

1. Which host originated the infection

1. Which remaining hosts are infected

• Third-party enterprise application with embedded AI: The provider manages most security controls. The customer mainly manages users, data, and configuration.
• Application using an existing third-party FM: The customer controls the application and its inputs/outputs, but the provider controls the underlying model and infrastructure.
• Fine-tuning a third-party FM: The customer has additional responsibility for training data, data protection, and model behavior, but still depends on the provider’s base model and platform.
• Building and training a model from scratch: The customer controls the model, training data, application, deployment, and many security safeguards. This creates the greatest security ownership.

• B — Single customer login across properties: Customer 360 Identity provides centralized identity services, allowing an organization to recognize a customer across multiple digital properties and applications. This helps UC understand authenticated activity as part of a broader customer identity.

• C — Multi-brand support: Customer 360 Identity can support multiple brands and user experiences. Identity services can remain centralized while correlating a customer’s activity across different corporate brands or channels.

• A: Customer 360 Identity does not automatically populate all data into Customer 360 Data Manager and Customer 360 Audiences. Integration and data configuration are still required.
• D: Tracking anonymous activity and linking it after sign-up may be possible through broader customer-data and tracking implementations, but it is not the primary Customer 360 Identity benefit tested here. Identity focuses mainly on authentication, registration, and cross-property identity correlation.

• Subject: The entity that initiates an action—here, Derrick/user account.
• Object: The resource being accessed— the file.
• Action: Reading the file.

1. Create a temporary Onboarding OU.
2. Move the new account into it.
3. Move the restrictive SCPs from the organization root to the Production OU.
4. Allow the account to update AWS Config.
5. Move the account into Production after onboarding.

• An SCP attached at the organization root applies to every account and OU beneath it.
• An SCP attached to the Production OU applies only to accounts in that OU.
• Therefore, moving the restrictive SCP from the root to Production temporarily exempts the onboarding account without weakening the policies for existing production accounts.
• Once onboarding is complete, moving the account into Production subjects it to the normal restrictions.

• MAC flooding: Overwhelms a switch’s MAC address table, potentially causing traffic to be broadcast.
• DNS spoofing: Provides false DNS responses to redirect users.
• ARP poisoning: Sends false ARP information to associate an attacker’s MAC address with another device’s IP address.

• Un AG puede tener réplicas en Windows y Linux desde SQL Server 2017; por tanto, una réplica Windows y otra Linux es posible.
• Sin embargo, las réplicas de un AG deben utilizar normalmente la misma versión principal de SQL Server. Una instancia SQL Server 2017 no puede tener directamente una réplica secundaria SQL Server 2019 como configuración normal y permanente.
• En tu escenario, SQL Server 2017 en Windows y SQL Server 2019 en Linux no se pueden añadir directamente como réplicas equivalentes de AG1. Primero habría que realizar un proceso de actualización/migración compatible, por ejemplo mediante una actualización gradual o una tecnología de migración como log shipping o distributed availability groups, según el diseño.

• Tipo de clúster y mecanismo de quorum.
• Failover normalmente manual en configuraciones multiplataforma.
• Edición y características compatibles.
• Configuración de endpoints y permisos.
• Limitaciones específicas de SQL Server en Linux.

• Laws and regulations
• Litigation holds
• Industry or contractual obligations
• Tax, financial, health, or privacy requirements

• Business strategy and direction: May influence retention, but cannot override legal requirements.
• Storage capacity and longevity: Practical considerations, not the primary driver.
• Business ease and value analysis: May support decisions after compliance obligations are identified.