Real Estate Licensing NCREC-Broker-N Exam Prep
North Carolina Real Estate Broker National (Page 12 )

• Amazon DynamoDB — Managed NoSQL database, not PostgreSQL.
• Amazon Athena — Serverless service for querying data in S3; intended for analytics, not OLTP.
• Amazon EMR — Managed cluster platform for big-data frameworks such as Hadoop and Spark.

• B. Data loss prevention (DLP): Helps prevent sensitive data from being copied, emailed, or exfiltrated. It is not the primary control for protecting a stolen laptop’s stored data.
• C. Operating system hardening: Reduces vulnerabilities by disabling unnecessary services and applying secure settings, but it does not necessarily protect the files if the disk is accessed directly.
• D. Boot security: Helps ensure the device starts only through trusted software or approved processes. It supports platform integrity but does not itself encrypt stored files.

• Accept: Acknowledge the risk and choose not to take additional action.
• Transfer: Shift the risk or its financial impact to another party, such as through insurance or outsourcing.
• Mitigate: Reduce the likelihood or impact of the risk, such as by implementing security controls.
• Avoid: Eliminate the activity or condition that creates the risk.

• nomes de pessoas;
• organizações;
• locais;
• datas;
• números de processos;
• leis ou contratos.

• NER = identifica informações específicas e classificáveis.
• Sumarização = reduz um documento e apresenta seus pontos principais.

sql 
GRANT ALTER ON SCHEMA::schemaA TO User1;

• TRUNCATE TABLE is a DDL operation, not a normal DELETE.
• Having DELETE permission on a table is not sufficient to truncate it.
• The minimum relevant permission is ALTER on the table.
• Granting ALTER on SCHEMA::schemaA allows the user to truncate tables within schemaA.
• It does not grant equivalent permissions on schemaB or schemaC, satisfying least privilege.

• A: Using an external OAuth 2.0 identity provider could provide unified identity, but it does not specifically address Salesforce capacity or high-volume login limits.
• B: Making the Experience Cloud community a SAML identity provider and using JIT provisioning is a possible federation pattern, but it may not be appropriate for this scale without Salesforce validation.
• C: A default account is unrelated to solving identity unification and high login throughput. Person Accounts can be supported in appropriate B2C Commerce integrations.

kusto 
Event | where EventType == "error"

• == is the KQL equality operator.
• -eq is a PowerShell operator, not KQL.
• is is not the correct equality operator in this context.

text 
Event | where EventType –eq "error"

• Event | search "error" — valid, broad search.
• search in (Event) "error" — valid, broad search.
• Event | where EventType == "error" — valid, targeted filter.

• Import: Copies data into the Power BI model. It requires scheduled or manual refresh, so it may not meet the two-minute requirement.
• Live connection: Connects to an existing Power BI semantic model or Analysis Services model; it is not the appropriate choice for connecting directly to the Azure SQL database in this scenario.

• Generates a syslog message
• Shuts down the PoE port
• Places the port into error-disabled (err-disabled) state
• Frees the power allocation

• A device starting to draw power does not necessarily generate a syslog message.
• Monitoring does not pause data traffic while checking power.
• Drawing less than the configured minimum does not automatically mean the device has failed and should be disconnected.

• Creating and managing users and roles
• Granting and revoking roles and privileges
• Managing access-control responsibilities

• SYSADMIN: Manages warehouses, databases, schemas, and other objects—not primarily users and roles.
• PUBLIC: Automatically granted to every user; it is not an administrative role.
• ACCOUNTADMIN: Has the highest level of access, but should be reserved for account-level administration and emergencies rather than routine security tasks.

• Looking up accounts, contacts, and opportunities
• Logging calls and updating Salesforce records
• Accessing previously available customer information when temporarily offline

• Salesforce Touch App: Primarily an older tablet-focused experience, not the best general solution for the sales team.
• Custom hybrid app: Unnecessary development when Salesforce provides the required capabilities natively.
• SalesforceA: Intended mainly for Salesforce administrators, not sales representatives.

• A Layer 2 switch checks the destination MAC address in its MAC address table (CAM table).
• If the destination MAC is unknown, the switch cannot select a specific outgoing port.
• It therefore performs unknown-unicast flooding, sending the frame out every other port in that VLAN.
• The frame is not sent back through the port where it arrived.

• B. The community must be built with the Customer Account Portal template.

• C. An experience ID (expid) or placeholder parameter must be used in the URL.

• A: The Visualforce + Salesforce Tabs template does not provide this dynamic branding capability.
• D: An external CMS is not required. The branding configuration is handled within Salesforce Experience Cloud.

• Import mode loads the data into the Power BI model. Visuals query the in-memory model, which generally provides faster calculation and rendering than DirectQuery.
• Import mode also minimizes online processing because report interactions do not send queries back to the dataflow or SQL Server.
• A daily refresh can load data through the previous day, satisfying the freshness requirement without unnecessary hourly processing.

• DirectQuery keeps querying the data source or dataflow during report use, increasing online processing and potentially slowing visuals.
• Adding a gateway enables connectivity for on-premises sources, but it does not remove the performance disadvantages of DirectQuery.
• An hourly Power Automate refresh is unnecessary when the requirement is only data through the previous day and creates additional processing overhead.

• A — Increasing the minimum password length to 14 characters: Longer passwords have more possible combinations, making them harder to guess or crack through brute force.
• F — Requiring at least one special character: This increases password complexity and expands the possible character combinations.

• MD5 to SHA-512: Improves password-hash resistance, but does not stop users from choosing easy-to-guess passwords. Also, modern systems should use a password-specific hashing algorithm such as bcrypt, scrypt, or Argon2.
• Increasing maximum age to 120 days: Leaves weak passwords in use longer.
• Reducing minimum length to 10: Makes guessing easier.
• Reducing minimum age to zero: Allows immediate password changes but does not make the password itself harder to guess.

• Encryption to preserve confidentiality
• Integrity protection to detect alteration
• Authentication of the server through certificates

• SHA-256: A hashing algorithm; it does not encrypt data for transmission.
• SSL 3.0: Obsolete and insecure. It should not be used.
• AES-256: A strong encryption algorithm, but by itself it does not provide the complete secure communication protocol needed for data in transit.

• Updating the CRL: Revokes compromised certificates, but does not fix the CA flaw that allowed them to be created.
• Changing passwords: May be necessary if accounts were compromised, but it does not address the certificate-generation vulnerability.
• Implementing SOAR: Improves security automation and response; it does not remediate the underlying PKI weakness.

• A limited lifetime
• Permissions defined by an IAM role or policy
• The ability to access AWS APIs without using long-term IAM user credentials

• Amazon API Gateway — Builds and manages APIs; it does not generally issue AWS credentials for applications.
• IAM users — Usually use long-term credentials, which are less suitable for applications.
• IAM instance profiles — Provide temporary role credentials to applications running on EC2 instances, but are specifically tied to EC2. The broader requirement described is best met by AWS STS.

• Data lakes: scalable, low-cost storage for structured, semi-structured, and unstructured data.
• Data warehouses: reliable SQL analytics, governance, and performance features.

• Data lake: Primarily provides flexible, scalable storage but may lack warehouse-style reliability and governance.
• Data warehouse: Strong for structured analytics but less flexible for raw and unstructured data.
• All of these: The individual lake and warehouse do not, by themselves, unify the siloed architecture.

• Coordinate and manage the assessment team
• Assign assessment activities
• Direct interviews, examinations, and tests
• Ensure the assessment follows the CAP

• Answer key: Lead Assessor — likely wrong
• CAP-based answer: C3PAO

• Storage accounts: storage1, storage2, and storage3
• Log Analytics workspace: Analytics3

• Azure Backup reports can send the AzureBackupReports diagnostic log to eligible storage accounts. The storage account’s subscription and region do not have to match the Recovery Services vault, so all three listed storage accounts are valid.
• The Log Analytics workspace must be in the same region as the Recovery Services vault for this configuration. Vault1 and Analytics3 are both in West Europe, making Analytics3 the valid workspace.

• Increase/decrease the number of epochs: Changes how long training runs, but does not reuse a pre-trained model.
• Unsupervised learning: Trains from unlabeled data and does not specifically address adapting an existing model.

• Users logging in more frequently than average
• Logins occurring during non-business hours
• Patterns that may indicate compromised credentials or suspicious access

• Login History: Shows individual login attempts and basic details, but does not provide behavioral analysis or averages.
• Login Inspector: Used to troubleshoot or inspect a specific login attempt, rather than analyze organization-wide patterns.
• Login Report: May provide reportable login information, but it is not the specialized tool for forensic behavioral analysis.

• Actual filename: Document.xml.txt
• Explorer displays: Document.xml
• File type: Text Document (.txt)

text 
Document.txt ? Document.xml

• Azure Resource Manager (ARM) templates define Azure resources in a declarative JSON file.
• You can deploy the same template repeatedly for each business unit, ensuring that identical resources are created consistently.
• Templates reduce manual administrative effort and support repeatable, automated deployments.
• Parameters can customize values such as names, regions, and sizes while keeping the overall resource configuration the same.

1. Remote access to a Windows PC
2. Full chat and optional game-console functions

• Windows Remote Desktop (RDP) uses TCP 3389. The router needs a port-forwarding rule that sends incoming traffic on that port to the Windows PC’s internal IP address.
• The game console should connect through the wireless AP. Using WPA2-PSK provides the required wireless security while allowing normal online, chat, and optional services.
• The firewall should separate the internal network from the screened subnet. Its screened-subnet-side address is shown as 10.100.0.1.
• Devices must be placed in the correct network locations: the PC behind the router, the console on the wireless AP, and the firewall between the appropriate network segments.

• Multiple AWS accounts: Create a separate account for each department or workload. This provides clear isolation and makes it easier to track each department’s usage and costs for chargeback.
• Consolidated billing: AWS Organizations can combine billing for multiple accounts into one central payer account. The company can still view costs by account while managing payment centrally.

• Placement groups: Control how EC2 instances are physically placed for networking or performance; they do not provide departmental billing separation.
• Edge locations: Infrastructure used by services such as Amazon CloudFront; unrelated to chargeback.
• AWS Config: Records and evaluates resource configurations and compliance; it is not a billing-separation mechanism.

• A. IDS attack signatures: Primarily detects suspicious network activity, not necessarily malware embedded in uploaded files.
• C. Load balancer: Improves availability and distributes traffic; it does not inspect documents for malware.
• D. WAF: Protects web applications from attacks such as SQL injection and command injection, but its primary role is not scanning uploaded PDFs for malware.

• Sending calls to available agents quickly
• Balancing interactions across agents
• Preventing calls from being handled manually one at a time

• Workforce Management: Forecasts demand and schedules enough staff; it supports wait-time reduction but does not directly distribute calls.
• Skill-based Routing: Routes calls based on agent skills and may improve the customer experience, but the question is asking about the core feature that distributes calls efficiently.
• IVR: Lets callers navigate menus and self-service options; it does not primarily assign calls to agents.

• The listener has a virtual IP address on the load balancer.
• The active SQL Server replica must respond using the listener’s IP address, not its own VM IP.
• Floating IP allows the listener IP to be preserved and returned by the active replica.
• This is required for the SQL Always On listener configuration.

• A health probe for the SQL listener/cluster role
• The SQL Server listener port, commonly 1433
• Appropriate backend pool membership

• An Azure pay-as-you-go subscription follows an operational expenditure (OpEx) model.
• With OpEx, the organization pays for services as they are used, typically based on consumption.
• There is no need to purchase and maintain physical servers upfront.
• This contrasts with capital expenditure (CapEx), where the company makes a significant upfront investment in infrastructure, such as on-premises Hyper-V hosts.

• Issuer: Identifies the party issuing a SAML message—usually the identity provider in the assertion. It is not the Salesforce-specific identifier the architect should provide for differentiating Salesforce.
• Identity Provider Login URL: The endpoint where users are sent to authenticate.
• SAML identity location: Determines where the user identity is found in the SAML assertion, such as the subject or an attribute.

• You provision the virtual machine.
• You manage the guest operating system, applications, and configuration.
• Azure manages the physical servers, datacenter, and underlying virtualization infrastructure.

Flat organisation

• Few levels of management
• A wide span of control—managers supervise many employees
• Shorter communication channels
• More employee autonomy and quicker decisions
• Fewer formal promotion levels

Tall organisation

• Many levels of management
• A narrow span of control—managers supervise relatively few employees
• A clear hierarchy and reporting structure
• More formal supervision and communication channels
• More obvious promotion and career stages

• B: Moving the task may affect the critical path and should not be done before evaluating the planned response and impacts.
• C: Excluding a required task is not appropriate without formal analysis and stakeholder approval.
• D: Lessons learned and the risk log should be updated, but only after or alongside managing the immediate issue; updating them is not the first action.

bash 
docker run -it microsoft/azure-cli:0.10.17

• docker run starts an Azure CLI container; it does not automatically connect to the AKS cluster.
• The command does not run kubectl apply.
• The container would need the appropriate Kubernetes tools and AKS credentials.
• The device or container must obtain cluster credentials, typically using an AKS credential command, before running Kubernetes commands.

bash 
az aks get-credentials --resource-group <resource-group> --name <aks-cluster> 
kubectl apply -f myapp.yaml

• Secret scope: A named container that groups related secrets and defines access permissions. Example: finance-prod.
• Secret key: The name of an individual secret stored inside that scope. Example: db-password.

text 
Scope: finance-prod 
  Key: db-username 
  Key: db-password

python 
dbutils.secrets.get( 
    scope="finance-prod", 
    key="db-password" 
)

• Who performed the action
• What action occurred
• When it occurred
• Where it originated
• Whether it succeeded or failed

• Investigating suspicious activity: Important, but investigation depends on having adequate audit data first.
• Storage allocation: Necessary for retention, but storage does not help if the records lack meaningful details.
• Actions after audit failure: Part of operational planning, not the primary assessment of the application’s audit capability.

• Vertical scaling (scale up) means increasing the size of an existing VM—for example, adding CPU or RAM.
• Vertical scaling down means reducing the VM’s size when less capacity is needed.
• Horizontal scaling (scale out) means adding more VM instances rather than making one VM larger.
• Elasticity is the broader ability to automatically adjust resources based on demand; it does not specifically mean adding CPU or memory to one VM.
• Agility refers to the ability to provision or change resources quickly.

• Failed login attempts
• The account being targeted
• The source user or system
• Time and frequency of attempts

• Two-factor authentication: Helps prevent unauthorized access, but does not primarily detect the employee’s attempts.
• Firewall: Controls network traffic; it generally does not monitor individual login attempts.
• Intrusion prevention system (IPS): Can detect certain network attacks, but this scenario is best addressed through authentication and audit logging.

• Geo-redundant storage (GRS) replicates data to a secondary Azure region, but the secondary copy is normally unavailable for read access.
• RA-GRS provides geo-replication and read-only access to the secondary region, satisfying all requirements.
• Zone-redundant storage (ZRS) replicates data across availability zones within the same Azure region, not separate geographic regions.
• Locally redundant storage (LRS) keeps copies within a single datacenter or region and does not provide geographic resiliency.

• A: Reduce management overhead — This is generally an advantage of public cloud, not hybrid cloud. Hybrid environments can increase management complexity.
• B: Cross-platform virtualization — Not the defining advantage of hybrid cloud.
• D: Leverage IaaS and PaaS — Public clouds commonly provide both IaaS and PaaS, so this is not unique to hybrid cloud.

• Amazon GuardDuty: Detects suspicious activity and threats using security-related data sources; it is not primarily a software vulnerability scanner.
• Amazon Detective: Helps investigate and analyze the root cause of security findings after an event.
• Amazon Cognito: Provides user authentication and authorization for applications.

• R-squared (R²): mede quanto da variação dos valores reais é explicada pelo modelo. É mais usado em regressão, não em classificação.

• Accuracy (acurácia): mede a proporção de previsões corretas em relação ao total. É adequada para a classificação de imagens da questão.

• RMSE (Root Mean Squared Error): mede o tamanho médio dos erros entre valores previstos e reais, penalizando erros maiores. É usado principalmente em regressão.

• Learning rate (taxa de aprendizado): controla o tamanho dos ajustes feitos pelo modelo durante o treinamento. Não é uma métrica de avaliação; é um hiperparâmetro.

python 
import azure.cognitiveservices.speech as speechsdk 


speech_config = speechsdk.SpeechConfig( 
    subscription="YOUR_KEY", 
    region="YOUR_REGION" 
)

Important Azure Speech SDK classes

• SpeechConfig

• AudioConfig

python 
  audio_config = speechsdk.audio.AudioConfig( 
      use_default_microphone=True 
  )

• SpeechRecognizer

python 
  recognizer = speechsdk.SpeechRecognizer( 
      speech_config=speech_config, 
      audio_config=audio_config 
  )

• SpeechSynthesizer

• AudioOutputConfig

 Bogotá, Colombia