PECB DPO Exam Prep
PECB GDPR - Certified Data Protection Officer (Page 4 )

• SQL injection
• Cross-site scripting (XSS)
• Malicious or malformed web requests
• Some application-layer attacks

• Layer 4 firewall: Filters based mainly on IP addresses, ports, and transport protocols; it cannot deeply inspect web application content.
• NGFW: Provides advanced network filtering and may include application awareness, but a WAF is more specifically designed to protect web applications.
• UTM: Combines several security functions in one appliance, but it is not the most targeted solution for a web portal.

• Self-signed certificate — Causes a certificate trust warning, not incorrect name resolution.
• Nameserver record — A DNS record problem would usually affect multiple users, unless only this computer uses a different DNS server.
• IP helper — Relays certain network services, commonly DHCP, between subnets; it does not normally determine website name resolution.

• Measurement bias: Errors in how features or labels are measured, such as unreliable camera data or inconsistent labeling.
• Observer bias: A human evaluator’s subjective judgment influencing observations or labels.
• Confirmation bias: Favoring information that supports an existing belief.

• Ramen is a Linux worm associated with Red Hat Linux 6.2 and 7.0 systems.
• It spreads by scanning randomly generated IP addresses using tools such as synscan.
• It exploits vulnerable network services, including web-related services, and may leave malicious files or altered web content.
• The tar.gz file is also a clue because it is a common Linux archive/package format.

• Code Red: Primarily targeted Microsoft IIS servers running Windows.
• LoveLetter: Spread mainly through email attachments.
• Nimda: A Windows-based worm that spread through email, web servers, and network shares.

• Tokens: Individual units of text processed by a model, such as words, subwords, or characters.
• Models: Systems that learn patterns and generate predictions or outputs.
• Binaries: Data represented using the binary number system, not semantic representations.

• Un AG puede tener réplicas en Windows y Linux desde SQL Server 2017; por tanto, una réplica Windows y otra Linux es posible.
• Sin embargo, las réplicas de un AG deben utilizar normalmente la misma versión principal de SQL Server. Una instancia SQL Server 2017 no puede tener directamente una réplica secundaria SQL Server 2019 como configuración normal y permanente.
• En tu escenario, SQL Server 2017 en Windows y SQL Server 2019 en Linux no se pueden añadir directamente como réplicas equivalentes de AG1. Primero habría que realizar un proceso de actualización/migración compatible, por ejemplo mediante una actualización gradual o una tecnología de migración como log shipping o distributed availability groups, según el diseño.

• Tipo de clúster y mecanismo de quorum.
• Failover normalmente manual en configuraciones multiplataforma.
• Edición y características compatibles.
• Configuración de endpoints y permisos.
• Limitaciones específicas de SQL Server en Linux.

• Asynchronous inference is designed for applications that submit individual inference requests, place them in a queue, and retrieve results later. It is useful when requests may take a long time or when traffic is intermittent.
• Batch transform is designed specifically to run inference over an entire large dataset stored in Amazon S3 and produce an output dataset.

• Large dataset/offline processing ? Batch transform
• Large or slow individual requests processed later ? Asynchronous inference

• A PostToolUse hook for file writes under src/api/ that runs the linter.
• A separate PostToolUse hook for API/data processing that normalizes payloads to snake_case.

• VLAN 10 for data
• VLAN 20 for voice

• A: Describes physical trunking or logical switch ports, not an SVI.
• B: An SVI can provide management access, but that is only one use—not the best description here.
• D: SVI use is not related to running out of physical ports.

• MFA adds an additional authentication factor, such as a phone notification or verification code.
• It helps prevent unauthorized sign-ins, even if a password is compromised.
• It does not encrypt, store, or protect credentials used by deployment processes.

• Dataset file: Use Import mode. Excel files are imported into Power BI, and the two Sales tables can be combined with Power Query.
• Report file: Use a live connection to the published dataset. This keeps the report separate from the dataset and avoids importing the data again.

• Report file: DirectQuery/live connection
• Dataset file: Import

• User2 is in Group1, so CA2 applies.
• CA2 targets Office 365.
• CA2 requires MFA OR an app protection policy.
• User2 has no app protection policy, but if User2 successfully completes MFA, the OR condition is satisfied.
• The device being noncompliant does not matter because CA2 does not require device compliance.
• CA1 applies only to Global Administrators. Unless User2 is also a Global Administrator, CA1 does not apply.

• 10 minutes have elapsed, or
• 20 MB of accounting data has accumulated

• O dispositivo estar registado no Windows Autopilot;
• A atribuição de Profile1 ao grupo;
• O estado de associação ao Microsoft Entra ID e de inscrição no Intune/MDM.

• JobTitle: User1 and User3 only
• UsageLocation: User1, User2, and User3

• For a user whose source of authority is Windows Server Active Directory, attributes such as JobTitle are synchronized to Microsoft Entra ID. You must change them in on-premises AD; editing them in Entra ID is not allowed or will be overwritten.
• UsageLocation is a cloud-managed attribute used mainly for licensing and service availability. It can be set or changed in Microsoft Entra ID, including for synchronized users.

Statement 1 — Correct

Statement 2 — Correct

• An Adj-SID does not necessarily need manual configuration.
• It can often be dynamically allocated by the router, although manual configuration may also be possible.
• The adjacency information is advertised through the IGP, such as IS-IS or OSPF.

• It is identified by an Adj-SID.
• It represents a particular adjacency of a node.
• Its meaning is generally local to the advertising node; unlike a Node-SID, it is not a globally reusable instruction across the network.

• B: Não é preciso implantar o modelo em um endpoint do Amazon SageMaker, pois o Bedrock já oferece a infraestrutura de inferência.
• C: O SageMaker Model Registry é usado para gerenciar modelos no SageMaker, não é requisito para modelos customizados no Bedrock.
• D: Não existe uma etapa geral de “conceder acesso” ao modelo customizado como requisito principal de uso. O ponto essencial é adquirir o Provisioned Throughput.

1. Wireless AP

1. Router

1. Firewall

1. Device placement

• The product is already in production.
• The organization is examining the product’s functions and cost drivers.
• The objective is to reduce cost without reducing perceived value or required quality.

• Kaizen costing focuses on continuous, usually incremental, cost reductions during the manufacturing stage. It is not specifically the systematic examination of a product’s functions.
• Standard costing compares actual costs with predetermined standards; it is a control technique, not a product redesign method.
• Process innovation concerns developing significantly improved production processes, rather than analysing the product’s functions and value.

• A business-hours greeting
• An after-hours greeting
• A holiday greeting

• Weekday evenings/nights
• Saturdays and Sundays

1. Auto attendant 1

1. Auto attendant 2

• Allow the team to identify the causes of delays.
• Encourage improvements to processes, tools, and collaboration.
• Help remove impediments without dictating solutions.
• Protect quality and maintain a sustainable pace.

• A: An impediment log may help track issues, but merely recording them does not resolve the root causes.
• B: Directing teams toward solutions conflicts with the agile principle of a self-managing team.
• C: Adding impediments to the product backlog may delay their resolution and incorrectly treats them as product features.

• C — Before update
• D — Before insert

apex 
trigger AccountTrigger on Account (before insert, before update) { 
    for (Account acct : Trigger.new) { 
        acct.Description = 'Updated automatically'; 
    } 
}

• In after insert and after update, Trigger.new records are read-only.
• Use after triggers when you need the record’s final database Id or want to create/update related records.
• Attempting to change a field directly in an after trigger causes a read-only error.

Step 1: Calculate the rights issue price

Step 2: Calculate the number of new shares

Step 3: Calculate the value after the issue and project

• Rights issue proceeds: $21.6m
• Project NPV: $5m

Step 4: Calculate the theoretical ex-rights price

• Explain questions from the exam page
• Check whether the stated answer is technically correct
• Compare answer choices and eliminate distractors
• Clarify Azure AI concepts and terminology
• Point out when an answer key appears unreliable or when an image is missing

• Deploy five individual VMs: This does not create a VM scale set.
• Modify Availability Zones or Size settings: These actions do not create the required scale set and add unnecessary steps.
• VM orchestration mode: This is Flexible orchestration, intended for more individually managed VMs and mixed configurations. It is not the best choice for a straightforward group of identical instances.

1. Initiate — establish the project, scope, team, and governance.
2. Plan — develop the detailed plan, schedule, resources, and implementation approach.
3. Execute — configure, integrate, migrate, test, and prepare the solution.
4. Deploy — move the solution into production and support go-live.
5. Close — complete handover, confirm outcomes, and formally close the project.

• Install unauthorized or unapproved applications
• Access system areas normally restricted
• Add features unavailable in the default software
• Modify the device’s operating system

• SQL injection (SQLi): Attacks databases by inserting malicious SQL commands.
• Cross-site scripting (XSS): Injects malicious scripts into web pages viewed by users.
• Sideloading: Installs an application from outside the official app store, but it does not necessarily remove the phone’s operating-system restrictions.

• Actions that call external APIs
• Subflows
• Connection and credential aliases
• Supporting integration logic

• Action — A reusable operation within a flow, such as “Create a record” or “Send email.”
• Connection — Defines how ServiceNow authenticates and communicates with an external system.
• Integration step — A general flow step, not the name for the packaged integration.

DAX 
Previous Year Sales = 
CALCULATE( 
    [Total Sales], 
    PARALLELPERIOD('DATE'[Month], -1, YEAR) 
)

• CALCULATE evaluates [Total Sales] after modifying the filter context.
• PARALLELPERIOD shifts the current date period. -1 moves it backward, and YEAR specifies a one-year shift.
• 'DATE'[Month] is the date column used for the time calculation. In a proper date table, this should be a real date column or an appropriate calendar column—not merely text such as "January".

• Firewalls and routers
• Servers and applications
• Endpoint devices
• Authentication systems
• Cloud services

• Centralized log collection
• Event correlation
• Dashboards and reporting
• Alerting
• Compliance support

• A — VARIANT "null" values are not the same as SQL NULL values: True

• B — Frequent, single-row DMLs: False

• C — Validate data before loading into the target table: True

• D — Use staging tables to manage MERGE statements: True

• Wireshark captures packets and allows you to examine their contents, potentially revealing usernames and passwords sent without encryption.
• Netcat creates network connections and can send or receive data, but it is not primarily a packet-analysis tool.
• Nessus scans for known vulnerabilities and configuration issues; it generally would not prove that credentials are visible in transit.
• Nmap performs network discovery and port/service scanning, not detailed packet-content inspection.

• The server accepts unauthenticated image uploads, which creates an opportunity for an attacker to upload a malicious script disguised as an image or using an unexpected file type.
• A web shell is a malicious script placed on a web server that gives an attacker remote command execution through web requests.
• The suspicious process and outbound connection to a low-reputation IP are consistent with the attacker using the web shell to execute commands or establish communication with command-and-control infrastructure.

• Worm: Usually self-propagates across multiple systems; the scenario focuses on the upload page.
• Cryptocurrency mining: Possible, but there is no indication of resource-intensive mining activity or insider involvement.
• Rootkit Trojan over RDP: The evidence points to the vulnerable upload functionality, not an exposed RDP service.

• 2018-12-31 — the date
• 08:59 — the time

• Changing the original column to Date may fail because it still contains the text at and a time.
• Extracting the last 11 characters does not isolate the date.
• Extracting the first 11 characters gets the date plus a space, but the option does not specify changing the result to the Date type.

• B — The glass core component is encased in a cladding.

• D — Light is transmitted through the core of the fiber.

• BNC connectors are associated mainly with coaxial copper cabling, not standard fiber connections.
• Data does not pass through the cladding; the cladding helps reflect and contain the light.
• RJ-45 connectors are used with copper Ethernet cabling, not fiber-optic interfaces.

• Create procurement-manager-role only in the shared services accounts, where procurement managers operate.
• Attach AWSPrivateMarketplaceAdminFullAccess to that role.
• Procurement managers assume the role when they need to administer Private Marketplace.
• Apply a root-level SCP that explicitly denies Private Marketplace administration to everyone except that role. The SCP acts as a maximum-permission boundary across member accounts.
• Add another SCP denying creation of a role with the same name. Otherwise, another administrator might create a similarly named role and bypass the intended exception.

• Creating the role in every account increases administration and creates more opportunities for misuse.
• A permissions boundary on developer roles does not prevent other administrators from managing Private Marketplace.
• Applying the SCP only to shared services accounts would not protect the rest of the organization.

• Power BI dataset — Reuses the existing tables, relationships, and measures. You mainly create new visualizations.
• SharePoint folder — Connects to the source files, but you would need to rebuild the model and measures.
• Power BI dataflows — Primarily provide reusable data preparation; they do not automatically provide the existing report’s measures and model.
• Excel workbook — Requires reconnecting to and modeling the source data again.

• Data source: Folder
• Transformation: Remove the Content column (or keep only the file-metadata columns)

Why

• File name
• Extension
• Date modified
• Folder path
• Content — the binary contents of the file

• Build, measure, learn: Create something, assess real feedback or results, and adapt.
• Minimum viable product (MVP): Produce the smallest useful version to test assumptions and reduce uncertainty.
• Fail fast: Test ideas early so that unsuccessful approaches can be identified before significant time or cost is invested.

• Access List: controls whether a client is allowed or denied.
• Connect List: controls which wireless networks/APs a station may connect to.

• FTP — Transfers files using a client/server model and supports authentication. It uses separate control and data connections.
• TFTP — A very simple file-transfer protocol with no authentication and minimal features. Commonly used to transfer router or switch configuration files and IOS images.
• SCP — Securely copies files over SSH. It provides encryption and authentication.
• SFTP — Also transfers files securely through SSH, but provides more file-management capabilities than traditional SCP.
• HTTP/HTTPS — Primarily web protocols, but can also download files; HTTPS encrypts the session.

• TFTP = simple, unauthenticated file transfer
• FTP = file transfer with authentication, but not inherently encrypted
• SCP/SFTP = secure file transfer using SSH

• The listener uses a virtual IP address shared by the availability-group replicas.
• Floating IP, also called Direct Server Return (DSR), allows the SQL Server nodes to respond using the listener’s IP address rather than their individual VM IP addresses.
• This is required for the availability-group listener to function correctly with an Azure internal load balancer.

• JDBC
• SnowSQL
• Snowflake Web Interface (UI)
• ODBC
• Python connector

1. Search & Intelligence in the Microsoft 365 admin center — No

1. Audit in the Microsoft Defender portal — Yes

1. Audit in the Microsoft Purview portal — Yes

• Denial-of-service: Prevents users from accessing a service; it does not normally redirect them.
• Social engineering: Manipulates people into taking an action, such as clicking a malicious link, but does not directly alter DNS resolution.
• ARP spoofing: Associates the attacker’s MAC address with another device’s IP address on a local network. It can intercept traffic, but the described website redirection is most specifically DNS poisoning.

• Who owns security risks and decisions
• Who is responsible for implementing controls
• Who reports security performance to management
• How security responsibilities align with business objectives

• B — Compliance with audit requirements: Governance may support compliance, but audit compliance is not its main objective.
• C — Monitoring security incidents: This is an operational security activity, not the central purpose of governance.
• D — Creation of tactical solutions: Governance establishes direction and oversight; tactical solutions belong to management and operational teams.

• B — Incorporate contextual output encoding/escaping: Encode untrusted data based on its context—HTML, attribute, JavaScript, or URL—so the browser treats it as data rather than executable code.
• D — Run untrusted HTML input through an HTML sanitization engine: Sanitization removes or neutralizes dangerous elements and attributes, such as script-related content, while preserving safe HTML where needed.

• A: Enabling client-side scripts does not prevent XSS. Script restrictions may reduce risk in some environments, but “enable” is not a general XSS control.
• C: Cookie inspection is unrelated to preventing injected scripts.
• E: The SameSite cookie attribute primarily helps mitigate CSRF, not XSS. It should not generally be described as an XSS prevention measure.