PMI PMI-CPMAI Exam Prep
PMI Certified Professional in Managing AI (Page 6 )

• Code signing: Verifies the software’s authenticity and integrity; it does not hide the source code or prevent reverse engineering.
• Tokenization: Replaces sensitive data with tokens, mainly for protecting data such as payment information—not software logic.
• Blockchain: Provides a tamper-resistant record of transactions or data; it does not protect compiled code from analysis.

• Each team’s Bedrock workflow uses a separate IAM service role.
• The role’s Amazon S3 permissions can be limited to only that team’s customer folder or objects.
• This enforces least privilege and prevents one team’s Bedrock application from accessing another team’s data.
• Access is enforced by AWS permissions, not by asking users to provide a customer name in each request.

• A single role with broad S3 access does not provide team-level isolation.
• Asking teams to specify a customer name is not an access-control mechanism.
• Redacting data does not prevent unauthorized access.
• A bucket policy alone is insufficient unless it explicitly enforces the required team-role restrictions.

1. Select Exchange email as a location.
2. Use the built-in Azure Storage Account key sensitive information type as the condition.
3. Configure the DLP action to encrypt the email—for example, using Microsoft Purview Message Encryption.

• ARP poisoning: Redirects or intercepts local network traffic; it would more likely affect communication paths or cause man-in-the-middle behavior.
• Jamming: Interferes with wireless signals. The scenario does not indicate a wireless outage.
• Kerberoasting: Attempts to obtain service-account password hashes from Kerberos; it is a credential attack, not typically a direct service outage.

• Existing expected ROI: 15%
• New project ROI: 14%
• Cost of capital: 12%

• Project return = 14%
• Cost of capital = 12%
• It earns 2% more than the cost of capital, so it should increase shareholder value.

• Limiting the number of MAC addresses allowed on a switch port
• Restricting ports to specific known MAC addresses
• Taking an action—such as dropping frames or shutting down the port—when the limit is exceeded

• Load balancer: Distributes application traffic; it does not protect switch MAC tables.
• IPS: May detect some attack traffic, but is not the primary control for switch-port MAC limits.
• NGFW: Filters network traffic at the firewall, but does not directly control MAC addresses learned by a switch.

• Active-active routers: Provide redundant Internet connections/devices. Both can operate, so traffic can fail over or be load-balanced.
• Active-active firewalls: Avoid a single firewall becoming a failure point while maintaining security inspection.
• Load balancers: Distribute requests across multiple web servers. If one server fails, traffic can go to the other.
• Redundant power supplies: A server with separate power supplies should connect to independent power sources or circuits.
• UPS A and UPS B: Provide backup power and redundancy. Ideally, each power supply is connected to a different UPS.
• SONET ring: A ring topology provides alternate paths if a fiber link or segment fails.

• Valor maior: mais aderência às instruções e aos detalhes descritos.
• Valor menor: mais liberdade criativa e resultados potencialmente mais variados.
• Valor excessivamente alto: pode causar artefatos ou imagens menos naturais.

• Aumentar o número de passos de geração: pode melhorar qualidade e refinamento, mas não é o principal controle de especificidade do prompt.
• MASK_IMAGE_BLACK: relaciona-se ao uso de máscara em geração ou edição de imagens, não à especificidade textual.
• Prompt strength: é mais associado à força do prompt em processos como image-to-image; nesta questão, o parâmetro diretamente ligado à aderência textual é o CFG scale.

Question 3: AWS Storage Gateway File Gateway

• A: S3 bucket per user — S3 is object storage, not a traditional shared file system; mounting it requires extra tools and is less efficient.
• B: File Gateway — Provides a local file share using standard file protocols while storing files in Amazon S3. This preserves convenient local access and extends storage capacity.
• C: WorkSpaces and WorkDocs — Designed for virtual desktops and document collaboration, not large shared file storage.
• D: EC2 with EBS — EBS is attached to one EC2 instance and is not designed for direct multi-user file sharing.

• Maximum response and resolution times
• Expected uptime or availability
• Performance requirements
• Escalation procedures
• Consequences for failing to meet requirements

• SOW: Defines a project’s scope, tasks, deliverables, and schedule.
• MOA: Documents specific responsibilities agreed upon by two parties.
• MOU: Records a general understanding or intent to cooperate.

• Accept: Acknowledges the risk without taking additional action.
• Transfer: Shifts the risk or financial impact to another party, such as an insurer.
• Mitigate: Reduces the likelihood or impact through controls like patching, MFA, or segmentation.
• Avoid: Eliminates the activity that creates the risk.

• Portfolio definition cycle — establishes and maintains the portfolio strategy, objectives, and management framework.
• Portfolio delivery cycle — coordinates and monitors the delivery of change initiatives, ensuring the portfolio remains aligned with strategic objectives and delivers value.

• Practice — a structured area of portfolio management activity, such as risk management or resource management.
• Technique — a method used to perform an activity; it is not the term for portfolio delivery itself.
• Principle — a guiding rule for effective portfolio management.

• CHAP: Uses a challenge-response exchange, so the password is not directly transmitted.
• IPsec: Provides authentication, integrity, and encryption for IP communications.
• EAP: An authentication framework that supports stronger methods, such as certificates or token-based authentication.

• Prevention costs – costs incurred to stop defects occurring, such as staff training, quality planning and supplier evaluation.
• Appraisal costs – costs of checking whether products meet standards, such as inspection, testing and quality audits.
• Internal failure costs – costs of defects found before delivery to customers, such as scrap, rework and retesting.
• External failure costs – costs of defects found after delivery, such as warranty claims, returns, complaints and product recalls.

• How quickly the vendor must respond to an incident or request
• Target resolution times
• Availability or uptime requirements
• Performance metrics and penalties for not meeting them

• SOW (Statement of Work): Describes the project’s scope, tasks, deliverables, and timeline.
• MOA (Memorandum of Agreement): Documents a formal agreement to cooperate or perform specific activities.
• MOU (Memorandum of Understanding): Records a mutual understanding or intent, often less binding than a contract.

• Security controls
• Processes and procedures
• Compliance evidence
• Performance against contractual requirements

• Service-level agreement (SLA): Defines expected service performance, such as uptime and response times.
• Memorandum of agreement (MOA): Documents a general agreement between parties, but does not necessarily provide audit rights.
• Supply chain analysis: Identifies risks across suppliers and dependencies, but is not a contractual mechanism for reviewing vendor controls.

• Have a definite, clear objective (C): Know exactly what you want to communicate. A clear purpose reduces ambiguity and irrelevant information.
• Plan the communication (E): Decide what to say, who needs the information, the appropriate channel and the best timing.
• Seek feedback (F): Check that the receiver understood the message. This could involve asking for confirmation or inviting questions.

• Ask questions (A): Usually associated with the receiver checking or clarifying information, although a sender may use questions in practice.
• Give feedback (B): Feedback is generally the receiver’s response to the sender’s message. The sender’s responsibility here is to seek feedback.
• Consider their contribution (D): This is not a standard sender-focused step in the communication process. The sender should consider the receiver’s needs and perspective, but the wording is less precise than the three recognised actions above.

• Ease of exploitation
• Required privileges
• User interaction
• Impact on confidentiality, integrity, and availability

• CVE: Identifies and names a specific publicly known vulnerability; it does not measure severity.
• OSINT: Refers to intelligence gathered from publicly available sources.
• SOAR: Automates and coordinates security operations, such as alert response and playbooks.

• The requirement explicitly says the organization wants to use SAML to secure Salesforce API access.
• The SAML Bearer Assertion Flow exchanges a SAML assertion for a Salesforce OAuth access token.
• It is intended for server-to-server or other noninteractive integrations where the application has already been authenticated by an identity provider.
• The connected app can be configured so administrators authorize or preauthorize applications that consume the APIs.

• B — JWT Bearer Flow: Uses a signed JWT, not a SAML assertion. It would be appropriate if the requirement specified JWT-based authentication.
• C — SAML Assertion Flow: This is not the standard Salesforce OAuth flow name; the relevant name is OAuth 2.0 SAML Bearer Assertion Flow.
• D — User-Agent Flow: Designed for interactive browser-based authorization, not a SAML-based server-to-server integration.

text 
ip route vrf Customer1 172.16.1.0 255.255.255.0 172.16.1.1 global 
ip route vrf Customer2 192.168.1.200 255.255.255.255 192.168.1.1 global 
ip route 192.168.1.0 255.255.255.0 Vlan10 
ip route 172.16.1.0 255.255.255.0 Vlan20

• The route in Customer1 VRF provides a path back to the Customer2 subnet, 172.16.1.0/24.
• The route in Customer2 VRF provides a path to the FTP server, 192.168.1.200.
• The keyword global tells the router to resolve the next hop using the global routing table, enabling controlled route leaking between the VRF and global table.
• The global routes identify the VLAN interfaces used to reach each customer network.

• Azure Resource Manager (ARM) templates define the virtual machines and related Azure resources declaratively. You can deploy the same template repeatedly, ensuring consistent VM sizes, networking, storage, extensions, and other infrastructure settings.

• PowerShell DSC extension applies and maintains the required Windows configuration inside each VM. DSC is state-based: if a setting changes or becomes incorrect, DSC can bring it back to the desired configuration.

• Azure Pipelines deployment groups organize deployment targets, but they do not primarily enforce ongoing VM configuration.
• Custom Script Extension runs setup scripts, but it is generally less maintainable and does not continuously enforce configuration like DSC.
• Pipeline stage templates reuse pipeline workflow definitions; they do not configure the VMs themselves.

• An Adj-SID does not necessarily need manual configuration.
• It can often be dynamically allocated by the router, although manual configuration may also be possible.
• The adjacency information is advertised through the IGP, such as IS-IS or OSPF.

• It is identified by an Adj-SID.
• It represents a particular adjacency of a node.
• Its meaning is generally local to the advertising node; unlike a Node-SID, it is not a globally reusable instruction across the network.

• NIDS: Monitors network traffic for suspicious activity and network-based attacks targeting the application or its supporting services.
• HIPS: Protects an individual host by monitoring processes, files, and system activity. It can help secure the web server, but it is not focused specifically on the application’s network attack surface.
• SIEM: Aggregates and correlates logs; it does not directly prevent attacks.
• Honeypot: A decoy system, not the primary protection for a production web application.
• Certificate revocation list: Deals with certificate trust, not application exploitation.

1. Identify the fact table

• Records something that happened, such as a sale, test, appointment, or measurement
• Contains foreign keys to other tables
• Contains measures or numeric results
• Has many rows

2. Identify a dimension table

• Describe people, products, dates, locations, or departments
• Contain descriptive columns
• Are referenced by the fact table
• Have fewer rows than the fact table

3. Identify the surrogate key

• System-generated
• Unique within the dimension
• Often named PatientKey, CustomerKey, or similar
• Usually an integer
• Not meaningful outside the model

• Each Case must follow defined support steps.
• Each step must be completed within a specified time limit.

• Case Escalation Rules: Escalate Cases based mainly on age or criteria; they do not model a complete sequence of service steps.
• Process Builder with Scheduled Actions: Can automate time-based actions but is not the standard framework for Case service-level commitments.
• Omni-Channel Routing: Routes work to agents based on capacity and priority; it does not track Case lifecycle deadlines.

• CSIRT: A team that responds to and manages security incidents.
• CVSS: A scoring system for rating the severity of vulnerabilities.
• SOAR: A technology platform for automating and coordinating security operations and incident response.

• Compare each server’s drive specifications and performance data.
• Identify the drive that is faulty, slow, or mismatched.
• Replace it with a drive that matches the required interface, capacity, and performance characteristics.
• Avoid selecting a slower drive, because storage performance can bottleneck the entire server.
• In a redundant array, use a compatible replacement so rebuilding does not create unnecessary performance degradation.

• Import: Copies data into the Power BI model. It requires scheduled or manual refresh, so it may not meet the two-minute requirement.
• Live connection: Connects to an existing Power BI semantic model or Analysis Services model; it is not the appropriate choice for connecting directly to the Azure SQL database in this scenario.

• Server provisioning
• Operating systems and runtime infrastructure
• Scaling
• Much of the maintenance and patching

• Thin clients reduce endpoint hardware requirements but do not specifically streamline code deployment.
• Private cloud provides dedicated cloud infrastructure but usually requires more management and expense.
• Virtual machines improve resource utilization, but administrators still manage the VMs, operating systems, and deployments.

• Espionage: Stealing information for intelligence or competitive purposes.
• Data exfiltration: Unauthorized removal or transfer of data.
• Nation-state attack: An attack sponsored or conducted by a government.
• Shadow IT: Unapproved technology or methods used to access organizational resources.

1. Which host originated the infection

1. Which remaining hosts are infected

• Economy: Obtaining inputs at the lowest appropriate cost.
• Efficiency: Making the best use of resources, such as staff, money, and equipment.
• Effectiveness: Achieving the intended objectives or outcomes.

• User preferences change, so the model must learn from recent data.
• Keeping the existing data helps preserve knowledge of older patterns and provides a broader training distribution.
• Training only on new data can cause catastrophic forgetting and may overfit if the new dataset is small.
• The new data should not automatically be used as the test set, because it is needed for training and the model must still be evaluated on separate, representative data.

• Third-party enterprise application with embedded AI: The provider manages most security controls. The customer mainly manages users, data, and configuration.
• Application using an existing third-party FM: The customer controls the application and its inputs/outputs, but the provider controls the underlying model and infrastructure.
• Fine-tuning a third-party FM: The customer has additional responsibility for training data, data protection, and model behavior, but still depends on the provider’s base model and platform.
• Building and training a model from scratch: The customer controls the model, training data, application, deployment, and many security safeguards. This creates the greatest security ownership.

• You can configure different pre-shared keys for different device groups.
• All cameras could use one key.
• All scanners could use another key.
• Each key can be associated with an appropriate role or access policy.

• SOW
• SLA
• MOA
• MOU

• Error correction (ECC): Improves data reliability but does not maximize bandwidth.
• RAM voltage: Increasing voltage may affect stability or speed, but it is not the primary method for increasing module bandwidth.
• Physical module size: Refers to the capacity or form factor of the RAM, not its data-transfer bandwidth.

• SQL injection
• Cross-site scripting (XSS)
• Malicious or malformed web requests
• Some application-layer attacks

• Layer 4 firewall: Filters based mainly on IP addresses, ports, and transport protocols; it cannot deeply inspect web application content.
• NGFW: Provides advanced network filtering and may include application awareness, but a WAF is more specifically designed to protect web applications.
• UTM: Combines several security functions in one appliance, but it is not the most targeted solution for a web portal.

sql 
SELECT COUNT(*) FROM table;

• A: It does not normally need to scan all data files for this operation.
• B: Results are not simply reused from a query cache every time. Caching is separate from Delta’s metadata optimization.
• D: The relevant metadata is maintained through the Delta transaction log, not directly treated as a Parquet-file metadata operation in this context.

• A password cracker would normally be identified by behavior such as loading password hashes or attempting dictionary/brute-force attacks.
• The question describes a routine audit, not password recovery.
• Simply encountering a protected file during an audit is characteristic of a misconfigured or insufficiently privileged FIM.

• The product is already in production.
• The organization is examining the product’s functions and cost drivers.
• The objective is to reduce cost without reducing perceived value or required quality.

• Kaizen costing focuses on continuous, usually incremental, cost reductions during the manufacturing stage. It is not specifically the systematic examination of a product’s functions.
• Standard costing compares actual costs with predetermined standards; it is a control technique, not a product redesign method.
• Process innovation concerns developing significantly improved production processes, rather than analysing the product’s functions and value.

• Accept: Acknowledge the risk and choose not to take additional action.
• Transfer: Shift the risk or its financial impact to another party, such as through insurance or outsourcing.
• Mitigate: Reduce the likelihood or impact of the risk, such as by implementing security controls.
• Avoid: Eliminate the activity or condition that creates the risk.

• A — If there is no demand, there should be no production.

• B — Not all sales equal profit.

• C — Stocking up on inventory is bad for business.

• D — All costs, except materials, are considered fixed.

• E — Departments should operate at full capacity regardless of bottlenecks.

• Accept: Acknowledging the risk without taking additional action.
• Mitigate: Reducing the likelihood or impact through controls, such as patching or employee training.
• Avoid: Eliminating the activity or condition that creates the risk.
• Transfer: Shifting the consequences—usually financial—to another party, such as an insurer.

• Each Azure VM must have at least one network interface (NIC).
• A single NIC can have:

• Therefore, each of the five VMs needs only one NIC:

• If the Facebook user is new, Salesforce invokes createUser.
• If the user already exists, Salesforce can invoke updateUser.
• The handler can read the latest data from Facebook, such as name, email, or other profile attributes, and update the corresponding Salesforce user.

• B: A scheduled job is unnecessary and would not provide real-time synchronization during authentication.
• C: A Facebook signed request is not the standard mechanism for updating Salesforce user records in this authentication-provider setup.
• D: SAML Just-in-Time provisioning applies to SAML identity providers, not Facebook OAuth authentication.

• B: Trigger.Once + scheduled job

• C: 10-minute processing-time trigger

CIMA P3 topics

• IT governance and systems strategy
• Systems development and implementation
• Change and project governance
• Strategic and business risk

• A — Plan for new systems: The committee should help identify and prioritise systems requirements and ensure planned systems support organisational needs.
• D — Consider competitive issues: New information systems may affect Y’s competitive position, service quality and efficiency. These strategic implications should be considered.
• E — Ensure the system meets company goals: This is a key governance responsibility. The committee should ensure the project remains aligned with Y’s objectives and delivers business value.

• B — Develop new systems: Detailed system development should be performed by IT specialists and project teams, not the steering committee.
• C — Manage the project: The project manager should handle day-to-day project management. The steering committee should provide oversight, challenge and key decisions, rather than manage daily activities.

• GPU: A failure may cause no video output, but the PC usually still powers on.
• RAM: Can prevent booting or produce error beeps, but fans and power indicators generally work.
• CPU: Can prevent startup or booting, but it usually does not cause a completely lifeless system.