PECB NIS 2 Directive Lead Implementer Exam Prep
PECB Certified NIS 2 Directive Lead Implementer (Page 8 )

1. Select Exchange email as a location.
2. Use the built-in Azure Storage Account key sensitive information type as the condition.
3. Configure the DLP action to encrypt the email—for example, using Microsoft Purview Message Encryption.

• Espionage: Stealing information for intelligence or competitive purposes.
• Data exfiltration: Unauthorized removal or transfer of data.
• Nation-state attack: An attack sponsored or conducted by a government.
• Shadow IT: Technology or access methods used outside approved IT processes.

• Supervised learning requires labeled examples to learn how to classify customers.
• Reinforcement learning learns through actions, rewards, and penalties, which is not the main task here.
• RLHF uses human feedback to improve model behavior, typically for generative AI, not customer segmentation.

• Prevention costs: Avoiding defects, such as staff training and improved product design. The company has invested in these.
• Appraisal costs: Detecting defects before products reach customers, such as inspection and testing. The planned batch sampling has not been implemented.
• Internal failure costs: Correcting defects found before delivery.
• External failure costs: Dealing with defects after delivery, such as refunds, replacements, complaints and lost sales.

• The CSV contains the external users’ email addresses.
• The bulk invitation feature supports inviting many guest users in one operation.
• Each invited user becomes a guest account in contoso.com.

• Maintain head office control: Transfer pricing generally supports decentralisation rather than direct head-office control.
• Establish centralised decision making: This conflicts with divisional autonomy.
• Develop a top-down culture: Transfer pricing is intended to support empowered divisions and goal congruence, not impose purely top-down management.

• Identifying the communication strategy: Usually part of a business continuity or incident response plan.
• Evaluating the risk management plan: Part of risk assessment and risk management activities.
• Establishing backup and recovery procedures: Usually part of disaster recovery planning.
• Developing the incident response plan: Part of incident response planning.

• Label applied does not automatically exclude a file from Copilot.
• Encryption/usage rights determine whether Copilot can access the file’s content.
• If the user has no permission under Label2, File3 should be unavailable to Copilot for that user.
• File3’s label might be inherited by derived content only if File3 was actually processed and contributed by an authorized user; it should not be treated as contributing merely because it exists in the source set.

• D — Managers focus on keeping costs low in the short term to maximise profits.

• E — Managers are given incentives to meet or undercut budgets.

• F — Managers delegate responsibility simply to reduce their workload.

• Password spraying: Tries a few common passwords against many accounts; no indication of repeated login attempts.
• Remote-access Trojan (RAT): Could install malware, but it does not explain how the attacker obtained the administrator’s credentials.
• Dictionary attack: Tries words or common passwords against an account; again, the scenario specifically highlights Telnet’s lack of encryption.

• Create a CodeCommit repository in the secondary Region.
• Use CodeBuild to run a Git mirror operation from the primary repository to the secondary repository.
• Use EventBridge to detect relevant repository events, such as a pull request being merged.
• Invoke a Lambda function, which starts the CodeBuild project.

• B: Amazon S3 is object storage, not a Git repository that developers can use as a CodeCommit remote.
• C: CodeArtifact is intended for packages and artifacts, not source-code repository mirroring.
• D: An AWS Cloud9 environment is not an appropriate automated replication mechanism and would require manual or persistent infrastructure management.

• STP elects the switch with the lowest Bridge ID as the root bridge.
• The Bridge ID consists mainly of bridge priority + MAC address.
• If multiple switches have the same priority, the switch with the lower MAC address is preferred.
• STP bridge priority values are configured in increments of 4096, such as 0, 4096, 8192, and so on. 32768 is the standard default value.

• Portfolio definition cycle — establishes and maintains the portfolio strategy, objectives, and management framework.
• Portfolio delivery cycle — coordinates and monitors the delivery of change initiatives, ensuring the portfolio remains aligned with strategic objectives and delivers value.

• Practice — a structured area of portfolio management activity, such as risk management or resource management.
• Technique — a method used to perform an activity; it is not the term for portfolio delivery itself.
• Principle — a guiding rule for effective portfolio management.

• Domain controllers, because the requirement specifically excludes them. However, note that both member servers and domain controllers run Windows Server, so OS targeting alone cannot distinguish them unless the targeting option allows selecting the relevant server role/version. In the usual exam interpretation, target the applicable server OS category.
• Client computers, because they run a client Windows operating system.

• Domain: Targets membership in a domain, not the computer’s operating-system type.
• Security Group: Would require creating and maintaining a group containing all member servers, increasing administrative effort.
• Environment Variable: Not designed to reliably identify member servers.

• You can configure different pre-shared keys for different device groups.
• All cameras could use one key.
• All scanners could use another key.
• Each key can be associated with an appropriate role or access policy.

• The application failing to start or becoming unhealthy
• An incorrect probe path, port, or protocol
• The application needing more startup time
• Dependency or configuration failures
• A liveness probe being too aggressive

bash 
kubectl describe pod <pod-name> 
kubectl logs <pod-name> --previous

• Scale to more replicas: may hide the issue but does not diagnose it.
• Decrease initialDelaySeconds: makes probes run earlier and could worsen startup failures.
• Drain and reboot the node: node metrics are normal, so rebooting is not justified as the first step.

• Accept: Acknowledging the risk and choosing not to take additional action.
• Transfer: Shifting the risk or financial consequences to another party, such as an insurer.
• Mitigate: Reducing the likelihood or impact through controls, such as patching or access restrictions.
• Avoid: Eliminating the activity that creates the risk.

• Documented and evaluated
• Assessed for security, cost, and operational impact
• Reviewed and approved by the appropriate personnel
• Tested before implementation
• Tracked with version history and rollback procedures

• Risk management process: May help assess the issues, but it does not authorize and manage design changes.
• Product design process: Applies primarily while creating a new design.
• Design review process: Normally evaluates a design before release; this design is already released.

• Data loss prevention (DLP): Helps detect or prevent sensitive data from being copied or transmitted, but it does not primarily protect a stolen laptop’s stored data.
• Operating system hardening: Reduces vulnerabilities and attack surface but does not encrypt files if the device is stolen.
• Boot security: Helps ensure that only trusted software starts, but it does not fully protect the drive if an attacker accesses it offline.

• Authentication — verifies who the user is.
• Authorization — determines what the authenticated user is allowed to access.
• Accounting — records session activity, such as login time and resource usage.

• CIA — confidentiality, integrity, and availability; core security objectives.
• ACL — access control list; rules that permit or deny traffic or access.
• PEM — Privacy Enhanced Mail, an older email security standard.

• Accept: Acknowledging the risk without taking additional action.
• Transfer: Shifting responsibility or financial impact to another party, such as through insurance or outsourcing.
• Mitigate: Reducing the likelihood or impact of the risk through controls.
• Avoid: Eliminating the activity or condition that creates the risk.

• AWS Network Firewall can inspect and block traffic across a VPC when traffic is routed through the firewall. A Drop action rule can deny traffic from the suspicious source IP.
• GuardDuty findings are sent to Security Hub.
• A Lambda function can be invoked when Security Hub receives a new GuardDuty finding, extract the source IP, and update the Network Firewall policy with a blocking rule.

• GuardDuty threat lists: Used to identify or increase the severity of findings; they do not directly block VPC traffic.
• AWS WAF: Protects supported web applications, such as CloudFront or Application Load Balancers. It does not provide general VPC-wide traffic blocking.
• GuardDuty suppression rules: Suppress or hide findings. They do not block the suspicious traffic.

• 50% memory utilization baseline: The environment can be provisioned with excess capacity, leaving room for growth and workload spikes.
• Storage scalability: Cloud storage can generally be expanded as needed without redesigning the physical platform.
• Single circuit failure resilience: A properly designed IaaS provider uses redundant power circuits and infrastructure, so failure of one circuit should not take the platform offline.

• A — Dual PDUs: Helps with power redundancy but does not provide storage scalability.
• C — Network load balancing: Provides network-path resilience, not memory or storage scalability, and does not address a power-circuit failure.
• D — Multiple NAS devices: May improve storage capacity, but does not inherently provide power resilience or the required compute-capacity baseline.

• desktopwidth:i:1280
• desktopheight:i:1024

• Connection information: Controls connection-related settings, not the desktop resolution.
• Scaling plan: Controls when session hosts start, stop, or scale based on demand.
• Session behaviour: Controls behavior such as disconnect or logoff handling.
• Display settings: Specifically controls RDP display properties, making it the appropriate choice.

• Training or coaching
• Mentoring
• Additional support or resources
• Targeted performance improvement plans

• A: Recognition may be appropriate, but awards do not address identified gaps.
• C: Rotating schedules does not necessarily improve the specific competencies that are missing.
• D: Assessment results should be handled sensitively, but keeping them entirely private prevents useful feedback and development discussions.

1. Create or verify cost groups

1. Set up the item model group

1. Create the costing version

1. Enter or calculate item costs

1. Activate the standard costs

• Laws and regulations
• Litigation holds
• Industry or contractual obligations
• Tax, financial, health, or privacy requirements

• Business strategy and direction: May influence retention, but cannot override legal requirements.
• Storage capacity and longevity: Practical considerations, not the primary driver.
• Business ease and value analysis: May support decisions after compliance obligations are identified.

• SQL injection
• Cross-site scripting (XSS)
• Malicious or malformed web requests
• Some application-layer abuse

• Layer 4 firewall: Filters based mainly on IP addresses, ports, and connections; it lacks detailed web-request inspection.
• NGFW: Provides broader network security, but a WAF is more specialized for protecting web applications.
• UTM: Combines multiple security functions, but it is not necessarily optimized for web-application protection.

• Constrained VMs: VMs whose workloads are experiencing resource pressure, such as insufficient CPU or memory. They may need additional resources or optimization.
• Overprovisioned VMs: VMs allocated more CPU, memory, or storage than their workloads require. Their resources may be reclaimed or reduced.

• Underprovisioned VMs: This is not the predefined view identified for this report question.
• Zombie VMs: These are typically inactive or unused VMs and are useful for cleanup, but they are not the two views specifically intended here to identify inefficient resource allocation.

• Understating expenses and liabilities
• Overstating profit
• Misleading users of the financial information
• Potentially breaching integrity, objectivity, and professional competence and due care

• A static IP gives the surveillance system a predictable local address, so users can reliably reach it on the LAN.
• However, a static IP does not block internet-based login attempts. If the router exposes the device through port forwarding, attackers could still reach it.
• Port mapping normally exposes an internal service externally, so A is a poor choice as written.
• Subnetting alone also does not block traffic; it would require routing/firewall rules.

• Labels control access and protection, not blanket exclusion.
• If the user has permission to open a labeled file—especially if the label allows authenticated users to view it—Copilot can use that file in a summary.
• If the label applies encryption and the user lacks the required usage rights, Copilot should not use the file or reveal its contents.
• Copilot honors the user’s existing permissions, so it should not expose labeled content to an unauthorized user.

• Input validation: Prevents malicious or malformed input within an application; it does not authenticate a software package.
• Secure cookies: Protect web-session cookies; they do not protect downloadable software.
• Fuzzing: Tests software by supplying unexpected input to find vulnerabilities; it does not verify software integrity.

• Restrict a port to a defined number of MAC addresses
• Use statically assigned or “sticky” MAC addresses
• Shut down or restrict the port when violations occur

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect suspicious network activity, but is not the primary control for limiting switch MAC entries.
• NGFW: Filters traffic at the network boundary; it does not directly prevent MAC table flooding on access switches.

• D — Create sibling resource pools for the Production VMs and Test VMs.

• B — Configure a memory reservation on the Production resource pool.

• Shares only determine relative priority when resources are scarce; they do not guarantee memory.
• A parent resource pool alone does not provide a guarantee.
• A child pool for Test VMs does not reserve memory for Production.

• Espionage: Stealing confidential information, often for a competitor or government.
• Data exfiltration: Unauthorized transfer of data outside the organization. This could occur, but the question focuses on using unapproved access methods.
• Nation-state attack: An attack sponsored or conducted by a government.
• Shadow IT: Employees using technology or access methods outside the organization’s approved security controls.

1. Identify the fact table

• Records something that happened, such as a sale, test, appointment, or measurement
• Contains foreign keys to other tables
• Contains measures or numeric results
• Has many rows

2. Identify a dimension table

• Describe people, products, dates, locations, or departments
• Contain descriptive columns
• Are referenced by the fact table
• Have fewer rows than the fact table

3. Identify the surrogate key

• System-generated
• Unique within the dimension
• Often named PatientKey, CustomerKey, or similar
• Usually an integer
• Not meaningful outside the model

• C series: CPU-optimized instances; not designed primarily for LLM training.
• G series: GPU instances generally optimized for graphics and some machine learning workloads, but not specifically large-scale model training efficiency.
• P series: Powerful GPU instances for ML training, but typically consume more energy than Trainium-based instances for suitable training workloads.

• Accept: Acknowledging the risk without taking additional action.
• Transfer: Shifting the risk’s impact to a third party, such as through insurance or outsourcing.
• Mitigate: Reducing the likelihood or impact of the risk through security controls.
• Avoid: Eliminating the activity or process that creates the risk.

• Physical: Protects facilities or equipment, such as locks and security cameras.
• Technical: Uses technology, such as firewalls, encryption, or access controls.
• Operational: Covers day-to-day actions and processes, such as training, backups, or incident response.
• Managerial: Includes policies, standards, risk assessments, and procedures.

• Limiting the number of MAC addresses allowed on a switch port
• Restricting ports to specific known MAC addresses
• Taking an action—such as dropping frames or shutting down the port—when the limit is exceeded

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect some attack traffic, but is not the primary control for switch-port MAC limits.
• NGFW: Filters network traffic at the firewall, but does not directly control MAC addresses learned by a switch.

• Regression predicts continuous numeric outcomes, such as house price, temperature, or sales amount.
• Linear regression assumes the target can be estimated from a linear relationship between the input features and the target.
• In Azure Machine Learning, you use a labeled dataset containing:

• Classification predicts a category or class, such as “spam” or “not spam.”
• Clustering groups similar records without a known label; it is an unsupervised learning technique.

• A — Use getRecordTypeInfosByDeveloperName()

apex 
  Id rtId = Schema.SObjectType.Account 
      .getRecordTypeInfosByDeveloperName() 
      .get('Business_Account') 
      .getRecordTypeId();

• C — Query the RecordType object

apex 
  RecordType rt = [ 
      SELECT Id 
      FROM RecordType 
      WHERE SObjectType = 'Account' 
      AND Name = 'Business Account' 
      LIMIT 1 
  ];

• B: An outbound SOAP call is unnecessary and inefficient.
• D: Hardcoding an ID is not dynamic, and IDs can differ between orgs.

1. Convert text and images into numerical embeddings.
2. Store or compare those embeddings.
3. Retrieve the most semantically similar items.

• Embedding model: Best for similarity search and retrieval.
• Generation model: Best for producing new text or other content from multimodal input.

• Wireshark captures packets and allows you to examine their contents, potentially revealing usernames and passwords sent without encryption.
• Netcat creates network connections and can send or receive data, but it is not primarily a packet-analysis tool.
• Nessus scans for known vulnerabilities and configuration issues; it generally would not prove that credentials are visible in transit.
• Nmap performs network discovery and port/service scanning, not detailed packet-content inspection.

• Resources that do not need internet access should remain on private network segments.
• Internet-facing access should be restricted to systems that require it.
• Access should be explicitly allowed rather than broadly exposed.

• A: A single administrator with access to core functions may violate least privilege if that access is broader than necessary.
• B: Inspecting traffic supports monitoring and defense, but does not itself limit privileges.
• C: Updating routing configurations supports availability and connectivity, not least privilege.

• Customer: Dual
• Date: Dual
• Sales: DirectQuery
• SalesAggregate: Import

• Sales – DirectQuery: Near-real-time data should not rely on an imported cache. DirectQuery sends queries to the source when visuals are loaded, allowing recent sales data to appear.
• SalesAggregate – Import: A weekly refresh is sufficient, and imported data generally gives faster visual performance because it is stored in Power BI’s in-memory cache.
• Customer and Date – Dual: These are dimension tables used with both the DirectQuery Sales table and the imported SalesAggregate table. Dual allows Power BI to use cached data when possible, while still behaving appropriately in queries involving DirectQuery data. This can improve performance and reduce unnecessary limited relationships.

• C — Custom buttons display at the top and bottom of a page: Correct. In Salesforce Classic, buttons can appear in the page’s button areas, including the top and bottom of record pages.
• D — Custom buttons are available for Person Accounts: Correct. Person Accounts use the Account object, so Account custom buttons can be available on Person Account layouts.
• E — Custom buttons can reference an external app: Correct. A URL custom button can launch or navigate to an external application or website.

• A: JavaScript custom buttons are a Salesforce Classic feature and are not supported in Lightning Experience. They do not enhance Lightning Experience.
• B: The User object does not generally support custom buttons in the same way standard business objects do.

• A — Use a custom controller: An Apex class can contain the page’s logic.
• C — Use a standard controller with extensions: The standard controller provides basic CRUD behavior, while an extension adds custom logic.
• E — Use a standard controller: Useful when the page works mainly with one Salesforce object and needs standard functionality.

• A page with no controller for static or controller-free content.
• A custom controller with extensions; extensions are not limited only to standard controllers.

1. Clear principles and boundaries — Employees have freedom, but decisions must remain within clear organizational values, policies and limits.
2. High degree of freedom — Managers are trusted to make decisions rather than seeking continual approval from senior management.
3. Frontline customer responsibility — Customer-facing managers should be empowered to manage customer relationships and respond quickly to needs.
4. Transparent and ethical information — Information should be openly available and used honestly, supporting trust and informed decision-making.