Postgresql PGCES-02 Exam Prep
PGCES-02 PostgreSQL CE 8 Silver (Page 10 )

• Domeny tworza restrykcjony razem z typem. Wykorzystujesz je w kolumnach, aby miec spójna walidacje danych w wielu miejscach.
• To nie jest pelny niestandardowy typ z wlasnym input/output funkcjonowaniem. Aby stworzyc typ z wlasnym I/O i operacjami, uzylbys CREATE TYPE (lub rozszerzen w C). Domeny to uproszczona forma ograniczen na istniejacy typ.

• CREATE DOMAIN positive_int AS integer NOT NULL CHECK (VALUE > 0);
• CREATE TABLE orders (id serial, qty positive_int);

• latwo wymuszaja wspólne reguly dla wielu kolumn/naglówków,
• zmiana regul w jednym miejscu (domena) automatycznie wplywa na wszystkie kolumny ja uzywajace.

• Co to znaczy: transakcje zachowuja sie tak, jakby byly wykonywane jeden po drugim. Dzieki temu nie ma brudnych odczytów, niepowtarzalnych odczytów ani phantom reads.

• Implementacja: PostgreSQL uzywa SSI (Serializable Snapshot Isolation). W praktyce oznacza to, ze jesli wykryje konflikt miedzy transakcjami, jedna z nich zostanie zakonczona bledem “serialization failure” i trzeba ja ponowic.

• Zalózmy tabele orders(customer_id int, amount int).

• Transakcja T1:

• Transakcja T2, równoczesnie:

• T1 ponownie wykonuje to zapytanie:

• Normalize casing in the data source—for example, convert all values to uppercase or lowercase.
• Add an index key to provide a unique, stable identifier for each row or value.

• B: Moving the task may affect the critical path and should not be done before evaluating the planned response and impacts.
• C: Excluding a required task is not appropriate without formal analysis and stakeholder approval.
• D: Lessons learned and the risk log should be updated, but only after or alongside managing the immediate issue; updating them is not the first action.

• Azure Resource Manager (ARM) templates define Azure resources in a declarative JSON file.
• You can deploy the same template repeatedly for each business unit, ensuring that identical resources are created consistently.
• Templates reduce manual administrative effort and support repeatable, automated deployments.
• Parameters can customize values such as names, regions, and sizes while keeping the overall resource configuration the same.

• A laptop
• Software access
• A password reset
• A mobile phone

• They run behind the scenes — applies more to automation or workflows.
• They are optional — catalog items are fundamental to a request-based catalog.
• They provide options — variables and variable options collect the requester’s choices for an item; they are not the catalog item itself.

• Training or coaching
• Mentoring
• Additional support or resources
• Targeted performance improvement plans

• A: Recognition may be appropriate, but awards do not address identified gaps.
• C: Rotating schedules does not necessarily improve the specific competencies that are missing.
• D: Assessment results should be handled sensitively, but keeping them entirely private prevents useful feedback and development discussions.

json 
{ 
  "Effect": "Deny", 
  "NotAction": [ 
    "iam:*", 
    "route53:*", 
    "cloudfront:*", 
    "support:*" 
  ], 
  "Resource": "*", 
  "Condition": { 
    "StringNotEquals": { 
      "aws:RequestedRegion": "eu-west-1" 
    } 
  } 
}

• SCPs set maximum permissions; they do not grant permissions. The default SCP allows actions, so the restriction must be an explicit Deny.
• aws:RequestedRegion checks the Region targeted by an API request.
• StringNotEquals: eu-west-1 denies requests directed to every other Region.
• NotAction allows designated global services to remain usable because they do not operate in a single AWS Region.
• Attaching the SCP to the OU makes it apply to existing accounts and accounts later added to that OU.

• Unfamiliar locations or IP addresses
• Anonymous or malicious IP addresses
• Leaked credentials
• Unusual sign-in behavior

• Internal interface ? connected toward the corporate network/internal firewall
• External interface ? connected toward the Internet-facing firewall

1. A route for the internal corporate network through the internal-facing interface/firewall.
2. A default route (0.0.0.0/0) through the Internet-facing interface/firewall.

• A Layer 2 switch checks the destination MAC address in its MAC address table (CAM table).
• If the destination MAC is unknown, the switch cannot select a specific outgoing port.
• It therefore performs unknown-unicast flooding, sending the frame out every other port in that VLAN.
• The frame is not sent back through the port where it arrived.

• Open or insecure ports
• Enabled legacy or insecure protocols
• Known vulnerabilities and misconfigurations
• Weak services and outdated software

• curl tests web requests and HTTP-based services.
• Wireshark captures and analyzes network traffic; it does not normally scan servers for weaknesses.
• netcat can test connectivity to individual ports and sometimes grab service banners, but it is not a comprehensive vulnerability scanner.

1. Define – establish the project’s objectives, scope, feasibility and requirements.
2. Design – plan how the project will be carried out, including resources, schedules and controls.
3. Deliver – execute the project and produce the required outputs.
4. Develop – close the project formally and capture learning for future projects.

• Filing documentation and records
• Closing project and accounting systems
• Settling costs
• Handing over the completed work and obtaining sign-off
• Reviewing performance and giving feedback

• Virtual machine disks
• Databases
• Storage accounts
• File systems

• Site-to-site VPN: protects data moving between networks
• HTTPS: protects data moving between a client and website
• Encrypted email: generally protects the message while being transmitted

• At rest = stored data
• In transit = moving data
• In use = data currently being processed by a system

• Documented and evaluated
• Assessed for security, cost, and operational impact
• Reviewed and approved by the appropriate personnel
• Tested before implementation
• Tracked with version history and rollback procedures

• Risk management process: May help assess the issues, but it does not authorize and manage design changes.
• Product design process: Applies primarily while creating a new design.
• Design review process: Normally evaluates a design before release; this design is already released.

• The user starts in the corporate portal.
• The portal launches the Salesforce resource.
• The IdP sends the SAML response to Salesforce.

• Connected App + OAuth is for OAuth authorization and API/app access, not this SAML-based seamless login scenario.
• SP-initiated SSO would begin when the user first requests the Salesforce resource and Salesforce redirects them to the IdP. That is not the described starting point.

• A. IDS attack signatures: Primarily detects suspicious network activity, not necessarily malware embedded in uploaded files.
• C. Load balancer: Improves availability and distributes traffic; it does not inspect documents for malware.
• D. WAF: Protects web applications from attacks such as SQL injection and command injection, but its primary role is not scanning uploaded PDFs for malware.

1. Determine which host was infected first—the originating host.
2. Decide whether each other host is clean or infected based on communication and event logs.

• Compare timestamps and find the earliest suspicious event.
• Look for the host that initiated the malicious connection, file transfer, exploit, or command—not merely a host that later received traffic.
• Follow the timeline through the firewall:

• A host is likely infected if it both receives suspicious activity and then initiates related malicious traffic.
• A host may be clean if the firewall blocked the connection and there is no evidence of execution or follow-on communication.

• 10 TB with maximum I/O performance: Use EC2 instance store. It provides very high-throughput, low-latency local storage suitable for temporary video-processing data. The application must tolerate data loss because instance store is ephemeral.
• 300 TB of highly durable media: Use Amazon S3, which is designed for highly durable object storage and can scale to this size.
• 900 TB of inactive archival media: Use S3 Glacier, which provides lower-cost storage for data that is rarely accessed.

• A: Amazon EBS offers high performance but is not the best fit for the question’s “maximum possible I/O” requirement compared with local instance store.
• B: Amazon EFS is durable and shared, but is generally more expensive and less suitable for very large archival storage.
• C: Uses EC2 instance store for performance, but incorrectly uses EFS for the 300-TB durable tier and S3 rather than Glacier for archival data.

• Replaces the verbal message — this describes non-verbal communication being used instead of words.
• Substitutes for verbal communication — similar; it means communicating without speech.
• Confuses the verbal message — this occurs when non-verbal signals contradict or obscure the spoken message.

• Vertical scaling (scale up) means increasing the size of an existing VM—for example, adding CPU or RAM.
• Vertical scaling down means reducing the VM’s size when less capacity is needed.
• Horizontal scaling (scale out) means adding more VM instances rather than making one VM larger.
• Elasticity is the broader ability to automatically adjust resources based on demand; it does not specifically mean adding CPU or memory to one VM.
• Agility refers to the ability to provision or change resources quickly.

• Remote and global access: Employees can authenticate from anywhere, not just a specific location.
• Seamless login: The device can authenticate in the background, reducing repeated password or MFA prompts.
• Minimal equipment: It uses devices employees already have, rather than requiring separate hardware.

• Geotagging: Identifies location but is not a complete authentication method and can be spoofed.
• Smart cards: Can provide strong authentication, but require cards and often readers, adding equipment and user steps.
• Time-based logins: Restrict access by time but do not verify the user or device adequately.

• AWS AppSync is designed for serverless applications that need to retrieve and combine data from multiple sources.
• A pipeline resolver can invoke multiple functions or data-source resolvers, including resolvers connected to different DynamoDB tables.
• The application can receive the combined result through one GraphQL request, without requiring custom aggregation logic in the application.
• This is operationally efficient because AppSync manages the API layer and resolver execution.

• Athena Federated Query is intended primarily for analytics and ad hoc querying, not low-latency application data retrieval.
• Querying DynamoDB through Athena can consume DynamoDB read capacity and may affect table performance.
• It also introduces analytical-query overhead and is not the normal choice for a microservice web application.

• AWS Budgets lets you create a cost or usage budget and configure alerts when actual or forecasted spending reaches a threshold. Notifications can be sent through email or Amazon SNS.
• Amazon CloudWatch can monitor AWS billing metrics and trigger an alarm when estimated charges exceed a specified amount.

• Amazon SQS is a message queue, not a cost-monitoring service.
• Cost Explorer analyzes spending but does not directly provide threshold notifications.
• AWS Cost and Usage Report delivers detailed billing data for analysis; it does not itself send threshold alerts.

• Due Date
• Order Date
• Delivery Date

DAX 
Order Date = 'Due Date' 
Delivery Date = 'Due Date'

• Due Date[Date] ? Sales[Due Date]
• Order Date[Date] ? Sales[Order Date]
• Delivery Date[Date] ? Sales[Delivery Date]

• Create a record-triggered Flow on Opportunity.
• Run it when the record is created or updated.
• Add entry criteria such as Probability > 50%.
• Use Create Records to create the related Sales Demo Request, populating its Opportunity lookup.

• Apex Trigger: Possible, but unnecessary custom code for a straightforward automation requirement.
• Workflow Rule: Cannot create a related custom record.
• Process Builder: Could create a record, but Flow is Salesforce’s preferred and more capable declarative automation tool.

• Fileless malware: Nothing in the command indicates malware executing only in memory.
• Living-off-the-land binaries: Mimikatz is a credential-access tool, not a normal system utility used for LOLBin abuse.
• Social engineering: The command shows technical credential abuse, not manipulation of an accountant.

• Compensating control: The server is end-of-life, so it may no longer receive security patches or support. Placing it on a restricted VLAN provides an alternative layer of protection by reducing who can access it and limiting its exposure.
• Technical control: VLAN segmentation and access control lists (ACLs) are technology-based mechanisms that enforce network access restrictions automatically.

• Managerial: Policies, procedures, and governance—not network configuration.
• Physical: Locks, guards, or barriers.
• Corrective: Restores systems after an incident.
• Detective: Identifies suspicious activity rather than restricting access.
• Deterrent: Discourages behavior but does not enforce access rules.

• vSmart controls the overlay control plane. It uses OMP to exchange routing information, distribute policies, and determine how WAN Edge devices reach one another.
• vManage is the centralized management and configuration platform.
• vBond is the orchestrator. It helps devices authenticate, discover controllers, and traverse NAT during onboarding.
• APIC-EM is not the SD-WAN control-plane component described here.

• Updating the CRL: Revokes compromised certificates, but does not fix the CA flaw that allowed them to be created.
• Changing passwords: May be necessary if accounts were compromised, but it does not address the certificate-generation vulnerability.
• Implementing SOAR: Improves security automation and response; it does not remediate the underlying PKI weakness.

• Restarting the device: May fix software glitches, but would not usually make cable orientation matter.
• Swollen battery: A safety concern, but it would not typically cause recognition only in one cable orientation.
• Failing cable: Possible, but less likely because the problem occurs with this particular device and not other devices of the same type.

• Users logging in more frequently than average
• Logins occurring during non-business hours
• Patterns that may indicate compromised credentials or suspicious access

• Login History: Shows individual login attempts and basic details, but does not provide behavioral analysis or averages.
• Login Inspector: Used to troubleshoot or inspect a specific login attempt, rather than analyze organization-wide patterns.
• Login Report: May provide reportable login information, but it is not the specialized tool for forensic behavioral analysis.

• Red team: Simulates attackers; exploits weaknesses to test security.
• Blue team: Defends systems; monitors, detects, and responds to attacks.
• Purple team: Combines red- and blue-team efforts to improve detection and defense.
• White team: Oversees or manages the test, defining rules, scope, and authorization.

• Data lakes: scalable, low-cost storage for structured, semi-structured, and unstructured data.
• Data warehouses: reliable SQL analytics, governance, and performance features.

• Data lake: Primarily provides flexible, scalable storage but may lack warehouse-style reliability and governance.
• Data warehouse: Strong for structured analytics but less flexible for raw and unstructured data.
• All of these: The individual lake and warehouse do not, by themselves, unify the siloed architecture.

• Customer contains one row per customer and the customer’s Address ID.
• Address contains one row per address and the corresponding location details.

1. Select the Customer query.
2. Choose Merge Queries.
3. Match Customer[Address ID] with Address[Address ID].
4. Use a Left outer join so every customer is retained.
5. Expand the merged Address column and select City, State/Region, and Country.

• Append adds rows vertically and is used for tables with the same structure.
• Group By summarizes rows rather than adding related columns.
• Transpose switches rows and columns and does not establish a relationship.

• Periodic vulnerability assessments: Identify technical weaknesses but do not establish governance or ensure risks are managed.
• Established information security metrics: Help measure performance and report status, but measurement alone does not make governance effective.
• Advanced security technologies: Support security operations, but governance is primarily about direction, accountability, decision-making, and alignment with business objectives.

• B — Prompts and suggestions retained for 28 days
• C — User engagement data kept for two years

• The key distinction is between content data—your prompts, code context, and generated suggestions—and engagement data, such as usage activity.
• Do not confuse retention with training: enterprise Copilot data is generally not used to train GitHub’s models without appropriate authorization.
• For a current exam, verify the policy version cited by the exam provider. The key’s C is likely correct, but B should be treated cautiously and may no longer reflect the current policy.

• Identified risks
• Risk owners or responsible parties
• Likelihood and impact
• Risk response plans
• Current status
• Risk thresholds or trigger conditions

• Risk tolerance: The amount and type of risk an organization is willing to accept; it is not primarily a tracking document.
• Risk transfer: Moving the financial or operational impact of a risk to another party, such as through insurance or outsourcing.
• Risk analysis: The process of evaluating a risk’s likelihood and impact.

• Check whether the data is accurate, complete, and properly prepared.
• Confirm that the pattern is not caused by an outlier, data-quality problem, or modeling issue.
• If the data is valid, treat the result as a potentially valuable new business insight.

• A: A data scientist may help, but expert validation and data-quality checking come first.
• C: Filtering out inconvenient data risks hiding a valid insight.
• D: Einstein’s result should not be accepted without verification simply because it produced the finding.

1. Start with the Customer table.
2. Use Merge Queries and select the Address table.
3. Match Customer[Address ID] to Address[Address ID].
4. Use a Left Outer join so every customer is retained.
5. Expand only City, State/Region, and Country.

• Append adds rows vertically; it is for stacking similarly structured tables.
• Group By summarizes rows and does not retrieve address columns.
• Transpose swaps rows and columns and is unrelated to table relationships.

1. Select Exchange email as a location.
2. Use the built-in Azure Storage Account key sensitive information type as the condition.
3. Configure the DLP action to encrypt the email—for example, using Microsoft Purview Message Encryption.

• Detect risky sign-ins from unfamiliar or unidentified IP addresses
• Evaluate user or sign-in risk
• Automatically require a password change because of a risky sign-in

• User risk policy: Can require a user to securely change their password when the account may be compromised.
• Sign-in risk policy: Can require MFA or block access based on the risk of a particular sign-in.

• A — Custom Button: A button can launch a flow, typically by passing the flow’s URL and record context.
• D — From a Process: A Process can invoke a flow using an Apex action configured for flow invocation. However, this is automation-triggered, not directly accessed by a user.
• B — Quick Action: In current Salesforce functionality, a Flow Quick Action can launch a screen flow directly from a record page. This makes B a valid modern method.
• C — Visual Workflow Launcher: This is not generally listed as a standard access method in current Salesforce terminology; Salesforce commonly uses the Flow component on Lightning pages instead.

1. Identify the fact table

• Records something that happened, such as a sale, test, appointment, or measurement
• Contains foreign keys to other tables
• Contains measures or numeric results
• Has many rows

2. Identify a dimension table

• Describe people, products, dates, locations, or departments
• Contain descriptive columns
• Are referenced by the fact table
• Have fewer rows than the fact table

3. Identify the surrogate key

• System-generated
• Unique within the dimension
• Often named PatientKey, CustomerKey, or similar
• Usually an integer
• Not meaningful outside the model

• Forecasting lets sales leaders predict revenue for upcoming fiscal periods, compare forecasts with targets, and review performance by salesperson or team.
• Opportunity Stages help determine the likelihood that opportunities will close. Each stage can have a probability, which contributes to forecast calculations.

• Sales Quotes: Used to present pricing or product proposals to customers; they do not provide revenue forecasting.
• Opportunity List View: Helps users filter and view opportunities, but it is not the forecasting tool.

• Inherent risk: Risk that exists before controls are implemented.
• Avoided risk: Risk eliminated by choosing not to perform the risky activity.
• Operational risk: Risk arising from failures in processes, people, systems, or daily operations.

Correct choices

• DB1: Azure Data Box Heavy
• Virtual machines: Azure Migrate

Why

• Replication with minimal downtime
• A test migration
• Final cutover after validation

• Regional leads — Customer Community Plus

• Capacity planners — External Identity

• Customer Community does not provide the enhanced reporting/dashboard access required by regional leads.
• An Identity license is generally for internal Salesforce identity use and does not fit the external capacity-planning users as well as External Identity.

• Reviewing security objectives to ensure they support business goals.
• Ensuring security requirements are integrated consistently across business units.
• Coordinating security policies, risk management, controls, and awareness activities.

• Executive management: Provides direction, funding, and support, but usually does not manage day-to-day security integration.
• Board of directors: Provides governance and oversight, not operational security coordination.
• Steering committee: Helps coordinate and prioritize initiatives, but the CISO typically owns the overall security program and ensures its integration.