PEOPLECERT MOP Exam Prep
Management of Portfolio Foundation (MOP) (Page 6 )

• Alice is co-resident on the same physical host and exploits shared hardware (the processor cache) to infer secrets. This is the classic definition of a side-channel attack—information leakage through implementation details (like timing or cache behavior) rather than by breaking a protocol or injecting code.

• Observing cache timing or access patterns to deduce cryptographic keys or plaintext data from the victim VM.

• Man-in-the-cloud attack: targets cloud trust/auth, not local hardware sharing.
• SQL injection: exploits input to run SQL commands, not a VM/caching vector.
• Service hijacking: takes control of a service, not about covert data leakage via shared hardware.

• Notice phrases like “shared hardware resources,” “co-resident,” or “cache”—these indicate a side-channel vector.

• View/inspect configuration: Possible.
• Modify the installed application or its S-Controls: Typically restricted in a test-drive org.

• Correct answer: D (Special category data)

• Why:

• Quick notes:

1. Determine which host was infected first—the originating host.
2. Decide whether each other host is clean or infected based on communication and event logs.

• Compare timestamps and find the earliest suspicious event.
• Look for the host that initiated the malicious connection, file transfer, exploit, or command—not merely a host that later received traffic.
• Follow the timeline through the firewall:

• A host is likely infected if it both receives suspicious activity and then initiates related malicious traffic.
• A host may be clean if the firewall blocked the connection and there is no evidence of execution or follow-on communication.

• As the project progresses, you gain information, refine requirements, and lock down baselines (scope, schedule, cost). This reduces overall risk and uncertainty because more is known and addressed.
• At the same time, changes become more costly over time. Later changes can affect already approved baselines, cause rework, impact the critical path, require more coordination, and incur penalties or delays, all of which raise the cost of making changes.

• Assign a Teams license to a user — Licenses are assigned through the Microsoft 365 admin center, Microsoft Entra ID, or PowerShell.
• Deploy the Teams client — The Teams admin center manages Teams policies and apps, but it is not the primary tool for deploying the desktop client.
• Prevent users from creating teams — Team creation depends on controlling the creation of Microsoft 365 groups, generally configured through Microsoft Entra ID and PowerShell rather than directly in the Teams admin center.

Why B works

• AWS KMS keys are Regional resources. A normal customer managed key in Region A cannot be used directly in Region B.
• A customer managed multi-Region KMS key (MRK) has related key replicas in both Regions. The replicas share key material and key ID, although each has a Regional ARN.
• With client-side encryption, the application encrypts the data before storing it in S3. Cross-Region replication then copies already-encrypted objects, so S3 does not need to decrypt and re-encrypt them with a different Regional key.

Why the other choices are weaker

• A and C: SSE-S3 uses Amazon-managed S3 keys, not the required customer managed KMS key.
• D: SSE-KMS can work only if the solution creates and configures the appropriate KMS key or multi-Region key replica in each Region. As written, it says to create a customer managed KMS key in each Region, which implies separate keys—not the same KMS key. Replication also requires additional KMS permissions and destination encryption configuration.

• Answer: A — EC2 Image Builder

• Why: EC2 Image Builder is AWS’s fully managed service designed to automate the creation, testing, and ongoing management of custom EC2 AMIs. It lets you build image pipelines that start from a base image, apply software/components, run tests, and publish/distribute the resulting AMIs across regions or accounts.

• How it works (high level):

• Why not the other options:

• Quick tip: Use EC2 Image Builder to reduce manual image maintenance and drift, and to enforce consistent, tested base images across environments.

• In the AWS shared responsibility model, AWS manages the security of the “infrastructure,” including the physical hardware and underlying virtualization.
• The customer is responsible for everything else in the cloud stack: the guest OS on EC2, the NoSQL database software running on it, data, patching the OS, and configuring access controls like security groups.
• So, for a self-managed NoSQL database on EC2, AWS would handle the physical hardware, while you would patch the guest OS and manage DB availability, backups, and security.

• The correct AAA mapping (per Cisco objectives) is:

• Why the given options aren’t fully correct:

• Quick takeaway: when you configure AAA, you should conceptually map them as:

• Example commands (to reinforce concepts):

• Customize Opportunity Contact Role

• Add the Opportunity Contact Role related list to the Opportunity page layout

• Campaign Member Role relates contacts or leads to campaigns, not opportunities.
• Campaign Member related list would expose campaign participation, not the stakeholders for the opportunity.
• Customize Campaign Role also concerns campaigns.

• A — VARIANT "null" values are not the same as SQL NULL: Correct.

• B — Frequent, single-row DMLs: Incorrect.

• C — Validate data before loading into the target table: Correct.

• D — Use staging tables to manage MERGE statements: Correct.

• Strongest encryption algorithms: Choose the strongest available encryption and integrity options, typically AES with the largest key size and a secure integrity algorithm.
• Encrypt all traffic: Select tunnel mode rather than transport mode. Tunnel mode encrypts the entire original IP packet, which is appropriate for a site-to-site VPN between branch networks.
• Secret-password authentication: Configure a pre-shared key (PSK) on both VPN concentrators. The key must match at both ends.

• Amazon Kendra is a managed enterprise search service that can index content stored in S3 and support natural-language queries to find text inside documents (PDFs, Word files, etc.).

• Rekognition analyzes images/videos, not document text search.
• Polly is a text-to-speech service.
• Lex is a chatbot service.

• Create a Kendra index.
• Add a data source of type S3 and point it to your bucket (with an IAM role that allows access).
• Configure/document conversion if needed, then index the data.
• Use the Kendra API or console to run natural-language queries against your indexed documents.

• The correct answer is D: All of the above.

• Snowflake Web Interface (UI): You can create and manage Virtual Warehouses from the UI (resize, suspend/resume settings, etc.).
• SQL commands: You can create and alter warehouses with DDL like CREATE WAREHOUSE and ALTER WAREHOUSE.
• Data integration tools: ETL/ELT tools can create/manage warehouses by connecting to Snowflake and issuing the appropriate commands or using their config to specify a warehouse.

1. Define Power Platform DLP policies
2. Add custom prompt modifications
3. Conduct adversarial testing

1. DLP policies first

1. Prompt modifications second

1. Adversarial testing last

• Question 142: Security governance is MOST associated with which IT infrastructure component? Network / Application / Platform / Process
• Answer: D. Process

• Security governance is about how decisions are made, accountability, and oversight to ensure security objectives align with business goals. These are implemented through governance processes (policy development, risk management, assurance, monitoring, escalation, etc.).
• The other options (Network, Application, Platform) are concrete IT components; governance affects them, but it’s exercised primarily through the processes that govern how those components are managed and controlled.

• In governance-related questions, focus on the decision-making, accountability, and control processes rather than the underlying technology components.

• Server — provides services or resources
• Endpoint — a user device connected to the network
• Ethernet — a networking technology, not a filtering device
• Firewall — filters and controls traffic

• Answer: D) Out-of-band management

• Why this is correct:

• Why the other options aren’t suitable here:

• In the source query: apply UPPER() or LOWER() to the column.
• In Power Query Editor: use Text.Upper or Text.Lower on the column, then load.

• This fixes the root cause when comparisons/joins depend on case.
• In DirectQuery, transformations are pushed to the source or query layer; ensure the transformation is supported by your data source/connector.
• After normalization, verify relationships and any downstream visuals that rely on that column.

Simple explanation

• The Azure VPN gateway to connect to
• Authentication settings
• Routes for networks that the client can access

• Domeny tworza restrykcjony razem z typem. Wykorzystujesz je w kolumnach, aby miec spójna walidacje danych w wielu miejscach.
• To nie jest pelny niestandardowy typ z wlasnym input/output funkcjonowaniem. Aby stworzyc typ z wlasnym I/O i operacjami, uzylbys CREATE TYPE (lub rozszerzen w C). Domeny to uproszczona forma ograniczen na istniejacy typ.

• CREATE DOMAIN positive_int AS integer NOT NULL CHECK (VALUE > 0);
• CREATE TABLE orders (id serial, qty positive_int);

• latwo wymuszaja wspólne reguly dla wielu kolumn/naglówków,
• zmiana regul w jednym miejscu (domena) automatycznie wplywa na wszystkie kolumny ja uzywajace.

• Who performed the action
• What action occurred
• When it occurred
• Where it originated
• Whether it succeeded or failed

• Investigating suspicious activity: Important, but investigation depends on having adequate audit data first.
• Storage allocation: Necessary for retention, but storage does not help if the records lack meaningful details.
• Actions after audit failure: Part of operational planning, not the primary assessment of the application’s audit capability.

• State is stored remotely in Terraform Cloud/Enterprise, not as a local file.
• Terraform runs (plan/apply) can be executed on remote infrastructure, with results visible in the remote workspace UI.
• Supports workspace-based organization, state locking, and concurrency control.
• Useful for team collaboration, centralized governance, and auditable logs.

• In your configuration, you use a backend block like backend "remote" { ... }.
• You still run terraform init to configure/migrate to the remote backend.
• After setup, terraform plan/terraform apply may be executed remotely, and the outputs/logs appear in the Terraform Cloud/Enterprise UI rather than (only) in your local terminal.

• Other backends store state remotely but typically do not provide remote execution; with the remote backend you get remote runs and a collaborative UI, not just remote state storage.

• Why: If an application on EC2 needs to call other AWS services, using an IAM role (attached to the EC2 instance as an instance profile) provides temporary, automatically rotated credentials. This avoids embedding access keys in the application.
• How it works: Create a role with the minimum required permissions, attach it to the EC2 instance, and let the AWS SDK used by the application retrieve credentials from the instance metadata service. The credentials rotate automatically and are scoped to the policy you define.
• Why not other options:

• Product Owner: May attend, but is not required unless also working as a Developer.
• Scrum Master: May attend to help facilitate or coach, but is not required.
• Developers: Must participate because the event is specifically for them.

• Startup scripts run at computer startup, before any user logs on, making them ideal for machine-wide configuration on each new VM.
• They execute under the Local System account, which is appropriate for initial setup tasks.
• Linking a GPO to the OU ensures every new VM in that domain automatically receives the configuration—great for scalability.

• A) SetupComplete.cmd runs only once, right after Windows Setup, not on every boot, so it isn’t ideal for provisioning multiple VMs consistently.
• B) Logon scripts run per user, not per machine, so they aren’t reliable for initial VM configuration before a user signs in.
• D) Placing scripts in a VHD doesn’t automatically execute them.

• A — Add a Path for Stage: A Path lets users update the Opportunity’s Stage directly from the record page, without opening the full edit form. It can also display guidance and key fields.
• B — Use a Kanban list view: Users can move Opportunities between stages by dragging records between columns, which is ideal when Stage is the only field they normally change.

• The Accrue liability on product receipt flag controls whether a liability is accrued and posted at the time of receiving the item.
• If this checkbox is unchecked, receipts won’t create postings to the Product receipt journal. Enabling it ensures the system posts inventory value and the vendor liability when the item is received.

• Go to the Item model group setup form.
• Enable (check) Accrue liability on product receipt.
• Save.

• The other option, Include physical value, affects how physical value is handled but is not the direct cause of postings to the product receipt journal. If issues persist after enabling accrual, you may need to verify related posting definitions or journal setup.

• The correct answer is A: CCTV recordings are not regularly reviewed.

• CCTV is a monitoring/control mechanism. If recordings aren’t reviewed, security events (break-ins, policy violations, equipment tampering) can go undetected and unaddressed.
• Regular review is essential for deterrence, incident response, and forensic evidence. Without it, the entire CCTV control provides little value.

• B (records deleted after one year) affects forensic availability, but it’s a data-retention issue rather than the ongoing effectiveness of the surveillance program.
• C (footage not recorded 24x7) creates gaps in coverage, which is a concern, but regular review of available footage still supports detection; 24x7 coverage is a separate policy/perimeter issue.
• D (cameras not in break rooms) is more about privacy and space planning than core data-center security monitoring.

• Amazon S3 — Object storage, not a database.
• Amazon DynamoDB — Fully managed NoSQL key-value and document database.
• Amazon Redshift — Managed data warehouse designed for analytics, not primarily transactional MySQL workloads.

• Le rôle n’a pas de clés propres. Des identifiants temporaires (via STS) sont émis lorsque quelqu’un ou quelque chose « assume » le rôle.
• La trust policy déclare qui peut assumer le rôle (par ex. une instance EC2, un utilisateur IAM, ou un service comme Lambda).
• Une fois attaché à une ressource (par exemple comme un instance profile sur une EC2), l’application peut appeler les services AWS avec les permissions du rôle.

• Respect du principe du moindre privilège: on accorde uniquement ce qui est nécessaire.
• Pas de stockages de clés sur les instances; les credentials se renouvellent automatiquement.

• Rôles pour EC2, rôles pour Lambda, accès cross-compte, etc.

• Two VMs
• Distributed across two separate availability zones

• A limited lifetime
• Permissions defined by an IAM role or policy
• The ability to access AWS APIs without using long-term IAM user credentials

• Amazon API Gateway — Builds and manages APIs; it does not generally issue AWS credentials for applications.
• IAM users — Usually use long-term credentials, which are less suitable for applications.
• IAM instance profiles — Provide temporary role credentials to applications running on EC2 instances, but are specifically tied to EC2. The broader requirement described is best met by AWS STS.

• nomes de pessoas;
• organizações;
• locais;
• datas;
• números de processos;
• leis ou contratos.

• NER = identifica informações específicas e classificáveis.
• Sumarização = reduz um documento e apresenta seus pontos principais.

• A separate scope using a /32 subnet: A /32 identifies one host, but it is not a practical DHCP scope for this purpose.
• A static IP within the DHCP range: This can cause an IP address conflict if DHCP assigns that address to another device.
• SLAAC: Used for automatic IPv6 address configuration, not for assigning a predictable IPv4 address through DHCP.

• Version control provides a single source of truth for metadata changes and tracks every modification.
• It supports branching and merging, so each feature can be developed in isolation and later merged without overwriting others.
• It allows diffs and conflict resolution, making it easier to manage dependencies across features and ensure a stable release.

• Setup Audit Trail: only logs who/change when something happened; it doesn’t prevent overwriting or manage cross-feature dependencies.
• Change Sets: used to deploy changes between orgs, not to coordinate parallel development or prevent conflicts across ongoing sprints.

• Storage accounts: storage1, storage2, and storage3
• Log Analytics workspace: Analytics3

• Azure Backup reports can send the AzureBackupReports diagnostic log to eligible storage accounts. The storage account’s subscription and region do not have to match the Recovery Services vault, so all three listed storage accounts are valid.
• The Log Analytics workspace must be in the same region as the Recovery Services vault for this configuration. Vault1 and Analytics3 are both in West Europe, making Analytics3 the valid workspace.

• Sustainability is not a CAF perspective (it's not one of the CAF perspectives).
• Performance efficiency and Reliability are pillars of the AWS Well-Architected Framework, not CAF.

• Self-signed certificate: Causes a certificate warning, not incorrect IP resolution.
• Nameserver record: A DNS record problem would typically affect multiple users, not just one.
• IP helper: Relays DHCP or other broadcast traffic between networks; it does not control website name resolution.

• Numerical flexibility: Adjusting the number of employees, such as using temporary, part-time or contract staff.
• Temporal flexibility: Varying when employees work, such as through flexitime, overtime or different working hours.
• Shift system flexibility: Changing work patterns or shift arrangements; it is not specifically about moving between tasks.

• C — Schema.describeSObjects(new String[]{myObject})[0].fields.getMap()

• D — Schema.getGlobalDescribe().get(myObject).getDescribe().fields.getMap()

• A: sObjectType is not used this way, and fieldSet() is not the appropriate method for retrieving all fields.
• B: mySObject.myObject is not valid dynamic Apex syntax.

• Answer: S3 Inventory report.

• Why: The S3 Inventory report provides a scheduled listing of objects within a bucket, including metadata about each object. When you configure it to include object tagging, you can see tags for each object, and the object keys (which reflect prefixes) and bucket scope are captured in the report. This makes it suitable for auditing and tracking “tags, buckets, and prefixes” across S3 objects.

• What the other options do (not suitable for this purpose):

• Tip: If you need tags in the report, enable the inventory option to include object tagging in the configuration.

• Correct answer: A
• What this is saying: You need to write a Transact-SQL query that uses REGEXP_SUBSTR to extract the ID from MessageText, and you should apply STRING_ESCAPE(MessageText, 'json') before calling REGEXP_SUBSTR.

• MessageText may contain JSON characters (quotes, backslashes, etc.). Escaping the JSON content first ensures the string you pass to the regex is safe and won’t confuse the regex engine.
• The pattern you apply with REGEXP_SUBSTR would then extract the first substring that matches your ID pattern from the (escaped) text.

• Example (conceptual):

• The question implies REGEXP_SUBSTR is available in this environment; some SQL Server and Fabric contexts don’t expose it natively in all versions. If REGEXP_SUBSTR isn’t available, you’d need an alternative approach (e.g., using built-in regex-like capabilities or CLR/UDFs).
• If you need the ID specifically from the first paragraph, you might first isolate the first paragraph and then apply REGEXP_SUBSTR, or compose a single pattern that anchors to the first paragraph.

• The two correct options are:

• The two incorrect options:

• Correct answer: D) Amazon Aurora Serverless

• Aurora Serverless is serverless, so compute capacity scales automatically and can pause during idle periods. This minimizes ongoing administration and you pay only for actual usage, which is ideal for infrequent workloads.
• PostgreSQL on EC2 requires full OS and DB administration.
• RDS for PostgreSQL is managed but still involves provisioning capacity and some maintenance tasks.
• Aurora PostgreSQL (non-Serverless) is managed but requires you to manage capacity, though with some automation; it’s not as hands-off as Serverless for intermittent usage.

• Coordinate and manage the assessment team
• Assign assessment activities
• Direct interviews, examinations, and tests
• Ensure the assessment follows the CAP

• Answer key: Lead Assessor — likely wrong
• CAP-based answer: C3PAO