PECB ISO-IEC-42001-Lead-Auditor Exam Prep
ISO/IEC 42001:2023 Artificial Intelligence Management System Lead Auditor (Page 10 )

1. Get Data > Folder

1. Expand the Attributes column

1. Remove the Content column

• Folder connector: lists files and their metadata, but also includes a Content binary column.
• Combine Files: processes and combines the actual CSV contents, which is explicitly disallowed here.

• The identified risk
• Its likelihood and potential impact
• The person or team responsible for handling it
• The response or treatment plan
• Risk thresholds, such as when escalation or action is required
• Current status and review dates

• Risk tolerance: The amount of risk an organization is willing to accept; it is a concept or limit, not usually the primary documentation.
• Risk transfer: Moving the responsibility or financial impact of a risk to another party, such as through insurance.
• Risk analysis: The process of evaluating risk likelihood and impact.

• Regional leads — Customer Community Plus

• Capacity planners — External Identity

• Customer Community does not provide the enhanced reporting/dashboard access required by regional leads.
• An Identity license is generally for internal Salesforce identity use and does not fit the external capacity-planning users as well as External Identity.

• SQL injection
• Cross-site scripting (XSS)
• Malicious or malformed web requests
• Some application-layer abuse

• Layer 4 firewall: Filters based mainly on IP addresses, ports, and connections; it lacks detailed web-request inspection.
• NGFW: Provides broader network security, but a WAF is more specialized for protecting web applications.
• UTM: Combines multiple security functions, but it is not necessarily optimized for web-application protection.

• CSIRT: A Computer Security Incident Response Team that handles and coordinates incident response.
• CVSS: A scoring system used to rate the severity of vulnerabilities.
• SOAR: Security Orchestration, Automation, and Response technology used to automate security workflows.

sql 
GRANT ALTER ON SCHEMA::schemaA TO User1;

• TRUNCATE TABLE is a DDL operation, not a normal DELETE.
• Having DELETE permission on a table is not sufficient to truncate it.
• The minimum relevant permission is ALTER on the table.
• Granting ALTER on SCHEMA::schemaA allows the user to truncate tables within schemaA.
• It does not grant equivalent permissions on schemaB or schemaC, satisfying least privilege.

• Azure Resource Manager (ARM) templates define the virtual machines and related Azure resources declaratively. You can deploy the same template repeatedly, ensuring consistent VM sizes, networking, storage, extensions, and other infrastructure settings.

• PowerShell DSC extension applies and maintains the required Windows configuration inside each VM. DSC is state-based: if a setting changes or becomes incorrect, DSC can bring it back to the desired configuration.

• Azure Pipelines deployment groups organize deployment targets, but they do not primarily enforce ongoing VM configuration.
• Custom Script Extension runs setup scripts, but it is generally less maintainable and does not continuously enforce configuration like DSC.
• Pipeline stage templates reuse pipeline workflow definitions; they do not configure the VMs themselves.

• A — Reports: Reports are informational and don’t enforce access during an SSO transaction.
• B — Apex trigger and Permission Sets: A trigger could update permissions when a Case changes, but this creates synchronization and timing issues. It also changes Salesforce permissions rather than making a direct, real-time decision for the external system.
• C — Custom SAML JIT Provisioning: JIT provisioning is primarily for creating or updating users at login. It isn’t the appropriate mechanism for dynamically querying business records and deciding whether access should be granted.
• D — Connected App Handler: Designed for custom, programmatic control during connected-app authentication and authorization. Apex can check the user’s current open classified cases and permit or reject the SSO request.

• Inherent risk: Risk that exists before controls are implemented.
• Avoided risk: Risk eliminated by choosing not to perform the risky activity.
• Operational risk: Risk arising from failures in processes, people, systems, or daily operations.

• Access controls — ensuring only authorized users can access it.
• Encryption — protecting the data if it is intercepted or exposed.

• C — “when the query finishes”

• D — “when the query began”

• Leaf switches provide access ports for servers, users, and other devices.
• Spine switches provide the backbone between leaf switches.
• Every leaf switch connects to every spine switch, creating a predictable, full-mesh fabric between the two layers.
• Leaf switches do not connect directly to other leaf switches, and spine switches do not connect directly to other spine switches.

• A: Adding both a spine and leaf is unnecessary for simply adding access ports.
• B: It focuses on uplink speed, not the scalable topology.
• D: A single spine connection creates a bottleneck and a single point of failure.

• Snapshot: Captures a point-in-time state for rollback. It is not an independent running VM and does not protect against failure of the underlying host or storage.
• Convert to dynamic disks: Changes disk allocation behavior; it does not provide redundancy or high availability.
• P2V: Converts a physical machine into a virtual machine. That is a migration process, not an availability solution.

• A — VARIANT "null" values are not the same as SQL NULL: Correct.

• B — Frequent, single-row DMLs: Incorrect.

• C — Validate data before loading into the target table: Correct.

• D — Use staging tables to manage MERGE statements: Correct.

• D — Value analysis: Correct. It examines an existing product to identify ways of reducing its cost while still providing the required functions, quality and reliability.
• E — Kaizen costing: Correct. It involves making continuous, small improvements and cost reductions while the product is already in production.

• Functional analysis: It is not limited to minimizing the cost of the originally defined functions. It examines what functions are required and how they can be provided at the lowest overall cost.
• Value engineering: Usually applies to the design and development of a new product, rather than being a fundamental redesign of existing organisational processes. That description is closer to business process re-engineering.
• Target costing: The target cost is generally established during the product development stage, before production begins. It is not continuously reset while the product is in production.

• Keep earlier prompt versions.
• Identify the last version that produced acceptable output.
• Restore it as a baseline.
• Make small, controlled changes—ideally one significant change at a time.
• Test the output after each change.

• A: Discards useful information about what worked.
• B: Large simultaneous changes make it difficult to identify the cause of problems.
• D: Accepts output that does not meet the requirements.

• Data lakes: scalable, low-cost storage for structured, semi-structured, and unstructured data.
• Data warehouses: reliable SQL analytics, governance, and performance features.

• Data lake: Primarily provides flexible, scalable storage but may lack warehouse-style reliability and governance.
• Data warehouse: Strong for structured analytics but less flexible for raw and unstructured data.
• All of these: The individual lake and warehouse do not, by themselves, unify the siloed architecture.

• vSmart controls the overlay control plane. It uses OMP to exchange routing information, distribute policies, and determine how WAN Edge devices reach one another.
• vManage is the centralized management and configuration platform.
• vBond is the orchestrator. It helps devices authenticate, discover controllers, and traverse NAT during onboarding.
• APIC-EM is not the SD-WAN control-plane component described here.

• Personally identifiable information (PII) detection

• Prompt Shields

• Self-harm content filtering addresses self-harm-related content.
• Violence content filtering addresses violent content.
• Neither protects customer PII or detects document-based prompt injection.

• Server provisioning
• Operating systems and runtime infrastructure
• Scaling
• Much of the maintenance and patching

• Thin clients reduce endpoint hardware requirements but do not specifically streamline code deployment.
• Private cloud provides dedicated cloud infrastructure but usually requires more management and expense.
• Virtual machines improve resource utilization, but administrators still manage the VMs, operating systems, and deployments.

• Blue team: Defends systems, monitors activity, and responds to attacks.
• Purple team: Coordinates red- and blue-team activities to improve defenses.
• White team: Oversees or manages the exercise, including rules and scope.

• 255.255.255.128 = /25: 128 total, 126 usable
• 255.255.255.192 = /26: 64 total, 62 usable
• 255.255.255.224 = /27: 32 total, 30 usable
• 255.255.255.240 = /28: 16 total, 14 usable

• One for the network address
• One for the broadcast address

• 8 total addresses
• 6 usable addresses
• Mask: 255.255.255.248

• staff use the new system;
• transactions and reports are checked;
• problems are corrected;
• feedback is collected.

• Phased changeover: different parts or functions are introduced in stages, often according to a planned sequence.
• Pilot changeover: one representative department, branch or group acts as a test site before wider implementation.
• Parallel changeover: old and new systems operate at the same time.
• Direct changeover: the old system is stopped and the new one starts immediately.

• Accept: Acknowledging the risk without taking additional action.
• Transfer: Shifting responsibility or financial impact to another party, such as through insurance or outsourcing.
• Mitigate: Reducing the likelihood or impact of the risk through controls.
• Avoid: Eliminating the activity or condition that creates the risk.

• Prevention costs: Avoiding defects, such as staff training and improved product design. The company has invested in these.
• Appraisal costs: Detecting defects before products reach customers, such as inspection and testing. The planned batch sampling has not been implemented.
• Internal failure costs: Correcting defects found before delivery.
• External failure costs: Dealing with defects after delivery, such as refunds, replacements, complaints and lost sales.

• A: Describes a broad purpose and direction, but is not the specific CIMA definition.
• C: “Scoping out” activities is too vague and incomplete.
• D: Combines long-term goals, strategies and policies, but describes a wider strategic-planning statement rather than the definition of strategy itself.

• Identified risks
• Risk owners or responsible parties
• Likelihood and impact
• Risk response plans
• Current status
• Risk thresholds or trigger conditions

• Risk tolerance: The amount and type of risk an organization is willing to accept; it is not primarily a tracking document.
• Risk transfer: Moving the financial or operational impact of a risk to another party, such as through insurance or outsourcing.
• Risk analysis: The process of evaluating a risk’s likelihood and impact.

• Digitally signing the software: Verifies authenticity and integrity. It does not hide how the software works.
• Limiting third-party libraries: May reduce dependencies and attack surface, but does not directly prevent reverse engineering.
• Using compile flags: Some compiler options can remove debugging information or optimize code, which may provide limited protection, but this is not the primary technique identified for preventing reverse engineering.

• A laptop
• Software access
• A password reset
• A mobile phone

• They run behind the scenes — applies more to automation or workflows.
• They are optional — catalog items are fundamental to a request-based catalog.
• They provide options — variables and variable options collect the requester’s choices for an item; they are not the catalog item itself.

1. Modify the database subnet NACL inbound rules to allow traffic from the new web subnet’s CIDR block on the MySQL port (3306).
2. Modify the database subnet NACL outbound rules to allow return traffic to the new web subnet’s CIDR block on the required ephemeral port range.

• Espionage: Stealing information for intelligence or competitive purposes.
• Data exfiltration: Unauthorized removal or transfer of data.
• Nation-state attack: An attack sponsored or conducted by a government.
• Shadow IT: Unapproved technology or methods used to access organizational resources.

• Red team: Simulates attackers; exploits weaknesses to test security.
• Blue team: Defends systems; monitors, detects, and responds to attacks.
• Purple team: Combines red- and blue-team efforts to improve detection and defense.
• White team: Oversees or manages the test, defining rules, scope, and authorization.

• Tokenization: Replaces the value with a nonsensitive token, often reversible through a secure token vault.
• Hashing: Converts data into a one-way fixed-length value, generally used for integrity checks or password storage.
• Obfuscation: A broad term for making data difficult to understand; it is less precise than masking in this context.

• Modelo de embeddings multimodal: transforma texto e imagens em vetores no mesmo espaço semântico. Isso permite comparar uma consulta textual com imagens, ou uma imagem com textos relacionados.
• Modelo generativo multimodal: interpreta diferentes modalidades e gera conteúdo, mas não é a escolha específica para indexação e busca vetorial.
• Modelo de geração de imagens: cria imagens, portanto é inadequado.
• Modelo de embeddings de texto: não atende consultas com imagens.

• Exploitability
• Attack complexity
• Required privileges
• User interaction
• Impact on confidentiality, integrity, and availability

• CVE: Identifies and tracks a specific vulnerability; it does not primarily measure severity.
• OSINT: Open-source intelligence gathered from publicly available sources.
• SOAR: Security orchestration, automation, and response technology used to automate security workflows.

• Compensating control: The server is end-of-life, so it may no longer receive security patches or support. Placing it on a restricted VLAN provides an alternative layer of protection by reducing who can access it and limiting its exposure.
• Technical control: VLAN segmentation and access control lists (ACLs) are technology-based mechanisms that enforce network access restrictions automatically.

• Managerial: Policies, procedures, and governance—not network configuration.
• Physical: Locks, guards, or barriers.
• Corrective: Restores systems after an incident.
• Detective: Identifies suspicious activity rather than restricting access.
• Deterrent: Discourages behavior but does not enforce access rules.

• Threat perspective: Focuses on possible attacks, but may seem technical or hypothetical.
• Compliance perspective: Can motivate action, but compliance alone does not demonstrate the broader business value of governance.
• Policy perspective: Policies are important, but they are a means of implementing governance, not its primary business justification.

• A Layer 2 switch checks the destination MAC address in its MAC address table (CAM table).
• If the destination MAC is unknown, the switch cannot select a specific outgoing port.
• It therefore performs unknown-unicast flooding, sending the frame out every other port in that VLAN.
• The frame is not sent back through the port where it arrived.

• ADF: Automatic Document Feeder; a printer/scanner hardware component.
• USB: A short-range wired connection, not a protocol for accessing a remote shared folder.
• PCL: Printer Control Language; it describes how print jobs are formatted, not how files or printers are shared over a network.

• Check whether the data is accurate, complete, and properly prepared.
• Confirm that the pattern is not caused by an outlier, data-quality problem, or modeling issue.
• If the data is valid, treat the result as a potentially valuable new business insight.

• A: A data scientist may help, but expert validation and data-quality checking come first.
• C: Filtering out inconvenient data risks hiding a valid insight.
• D: Einstein’s result should not be accepted without verification simply because it produced the finding.

• The S3 bucket as an origin for static content
• The Application Load Balancer (ALB) as an origin for dynamic content
• An Amazon Route 53 alias record pointing the application domain to CloudFront

Why this works

• Static data: CloudFront caches objects from S3 at edge locations, reducing latency for users worldwide.
• Dynamic data: CloudFront forwards requests that require application processing to the ALB. It can also maintain persistent connections and use the AWS global edge network to improve delivery performance.
• One domain: CloudFront behaviors can route different path patterns to different origins—for example, /static/* to S3 and other paths to the ALB.

Why the other options are incorrect

• Global Accelerator is designed primarily for accelerating traffic to applications with endpoints such as ALBs, not for caching S3 content.
• Using separate domains or splitting static and dynamic traffic adds unnecessary complexity.
• CloudFront already provides the required global edge distribution and caching, so combining it with Global Accelerator is unnecessary here.

• SQL injection (SQLi): Attacks databases by inserting malicious SQL commands.
• Cross-site scripting (XSS): Injects scripts into web pages viewed by other users.
• Sideloading: Installing an application from outside the official app store. It may install unauthorized apps, but it does not generally unlock the operating system or enable restricted system features.

• Install unauthorized or unapproved applications
• Access system areas normally restricted
• Add features unavailable in the default software
• Modify the device’s operating system

• SQL injection (SQLi): Attacks databases by inserting malicious SQL commands.
• Cross-site scripting (XSS): Injects malicious scripts into web pages viewed by users.
• Sideloading: Installs an application from outside the official app store, but it does not necessarily remove the phone’s operating-system restrictions.

kusto 
Event 
| summarize make_set(EventID) by Computer

• summarize groups records.
• by Computer creates one result row per virtual machine.
• make_set(EventID) returns an array containing unique event IDs for that computer.

kusto 
| summarize make_list(EventID) by Computer

yaml 
clusterIP: None

• CronJob: Runs Jobs on a schedule and normally does not need stable networking.
• Deployment: Manages interchangeable, stateless replicas and usually uses a regular Service.
• DaemonSet: Runs a Pod on selected nodes but does not inherently require stable Pod identities.

sql 
CREATE PROCEDURE dbo.usp_CreateOrder 
AS 
BEGIN 
    SET NOCOUNT ON; 
    SET XACT_ABORT ON; 


    BEGIN TRY 
        BEGIN TRANSACTION; 


        INSERT INTO dbo.Orders (/ columns /) 
        VALUES (/ values /); 


        SET @OrderID = SCOPE_IDENTITY(); 


        COMMIT TRANSACTION; 
    END TRY 
    BEGIN CATCH 
        IF @@TRANCOUNT > 0 
            ROLLBACK TRANSACTION; 


        THROW; 
    END CATCH; 
END;

• BEGIN TRY contains the transactional work.
• SCOPE_IDENTITY() retrieves the identity generated by the INSERT; it belongs after the insert, not as the error-handling logic.
• COMMIT runs only if all statements succeed.
• BEGIN CATCH handles failures.
• IF @@TRANCOUNT > 0 prevents attempting a rollback when no transaction is active.
• ROLLBACK undoes partial changes.
• THROW re-raises the original error with consistent details for the application.
• SET XACT_ABORT ON ensures many run-time errors automatically terminate and roll back the transaction.

• The Subscribe to Reports user permission.
• At least Viewer access to the report’s folder.
• Access to the report itself.

• Subscribe to Reports: Run Reports is not the relevant Salesforce permission.
• Chatter Subscribe to Reports is not a Salesforce permission.
• Set Running User relates to configuring the user whose permissions determine report results—not subscribing to a report.

• Data loss prevention (DLP): Helps detect or prevent unauthorized data transfers, but does not directly protect data on a stolen, powered-off laptop.
• Operating system hardening: Reduces vulnerabilities and attack surface, but does not adequately protect stored data if the device is stolen.
• Boot security: Helps prevent unauthorized operating systems or boot media from loading. It supports device security but is not the primary solution for protecting the data itself.

• The servers are powered on.
• The network is functioning.
• Devices can still reach the server network.

• ARP poisoning: Redirects or intercepts local network traffic; it usually affects communication paths rather than overwhelming a service.
• Jamming: Disrupts wireless or radio signals. It would not fit a system that remains accessible from devices on the server network.
• Kerberoasting: Attempts to crack service-account credentials from Kerberos tickets; it does not normally cause an immediate outage.

• An active relationship is used automatically when filters are evaluated. An inactive relationship does not propagate filters unless explicitly activated in DAX, so it would not reliably enforce the required security behavior.
• Apply security filter in both directions allows RLS filters to propagate across the relationship in both directions. This ensures that bidirectional filtering respects the RLS rules applied to both tables.
• Assume referential integrity is unrelated to RLS. It is mainly a DirectQuery optimization that allows Power BI to use an inner join when matching keys are guaranteed to exist.
• The relationship must therefore be active, with security filtering enabled in both directions.