Salesforce ADX-271 Exam Prep
Salesforce Certified Community Cloud Consultant (Page 15 )

• Whether a user has a console password
• Password age and last password change
• Whether MFA is enabled
• Access key status
• Access key creation date and last-use information
• Access key age, which helps audit rotation

• IAM Access Analyzer identifies unintended access to resources; it does not report credential age or rotation.
• AWS Artifact provides AWS compliance documents and agreements, not details about your IAM users.
• AWS Audit Manager helps collect evidence for audits, but it is not the direct tool for viewing IAM credential rotation details.

• Normalize casing in the data source—for example, convert all values to uppercase or lowercase.
• Add an index key to provide a unique, stable identifier for each row or value.

1. Create or verify cost groups

1. Set up the item model group

1. Create the costing version

1. Enter or calculate item costs

1. Activate the standard costs

• A — Too infrequent: Formal strategies are often reviewed only every three to five years. This can make the organisation slow to respond to rapid changes in technology, competitors, regulation or customer needs.

• C — Relies on predicting the future: The approach assumes senior managers can make reasonably reliable forecasts and assumptions. In uncertain environments, these assumptions may quickly become invalid.

• E — Can restrict radical innovation: Formal planning tends to favour existing information, established objectives and incremental improvements. This may discourage experimental or highly innovative strategies that emerge from lower levels of the organisation.

• B concerns the difficulty of achieving competitive advantage through core competences when competing with focused specialists. It is not specifically a drawback of the formal top-down planning process.
• D is an activity organisations should undertake—continuous monitoring—not a drawback of the approach itself.

• Authentication: Verifies a user’s identity, such as username and password.
• Authorization: Determines what the authenticated user is allowed to access.
• Accounting: Records connection and usage details, such as login time or session duration.

• CIA: Confidentiality, integrity, and availability are broad security objectives, not a specific RADIUS function.
• ACL: An access control list contains permit/deny rules on systems or network devices. RADIUS can support access decisions but is not itself an ACL.
• PEM: Privacy-Enhanced Mail is also associated with certificate and key encoding formats; it is unrelated to RADIUS’s primary purpose.

• A vulnerability scanner automates discovery of known vulnerabilities and misconfigurations across systems. It can contribute to a supply-chain assessment.
• A penetration test actively attempts exploitation and is usually limited to an agreed scope.
• SCAP standardizes vulnerability and configuration assessment data; it is not the analysis itself.
• Illumination tool is not a commonly defined CompTIA Security+ term.

• The explanation states that Traffic Analytics can be enabled by a user with one of these subscription-level roles:

• Question 34 — Network Contributor: Yes
• Question 35 — Owner: Yes
• Question 36 — Reader: Yes, according to the stated explanation and documentation

• ARP poisoning: Redirects or intercepts local network traffic; monitoring would typically show suspicious ARP changes or man-in-the-middle behavior.
• Jamming: Interferes with wireless or radio signals. It would affect connectivity, not usually show a server-specific overload.
• Kerberoasting: Attempts to obtain and crack Kerberos service-account hashes; it does not normally cause a system outage.

• A: Security groups do not control traffic to an S3 gateway endpoint in this way. Gateway endpoints are configured through route tables.
• B: An S3 bucket policy may be needed for authorization, but the error specifically indicates a connectivity or endpoint-routing problem.
• C: Glue connection settings do not require a fully qualified domain name to resolve this endpoint issue.

• Code suggestions: Inline completions as you write code, such as lines, functions, or blocks.
• Chat: An interactive interface for asking questions, explaining code, generating code, and helping with debugging.

• Knowledge Base: Not listed as a standard Copilot Individual IDE feature in this context.
• Pull Request Diff Analysis: More closely associated with GitHub-based code review or pull-request features, not the core Individual IDE extension capabilities.

• Personally identifiable information (PII) detection

• Prompt Shields

• Self-harm content filtering addresses self-harm-related content.
• Violence content filtering addresses violent content.
• Neither protects customer PII or detects document-based prompt injection.

sql 
SELECT COUNT(*) FROM table;

• A: It does not normally need to scan all data files for this operation.
• B: Results are not simply reused from a query cache every time. Caching is separate from Delta’s metadata optimization.
• D: The relevant metadata is maintained through the Delta transaction log, not directly treated as a Parquet-file metadata operation in this context.

• Identifying the communication strategy: Usually part of a business continuity or incident response plan.
• Evaluating the risk management plan: Part of risk assessment and risk management activities.
• Establishing backup and recovery procedures: Usually part of disaster recovery planning.
• Developing the incident response plan: Part of incident response planning.

• Azure Resource Manager (ARM) templates
• Or, in newer Azure terminology, Bicep files

• Import: Copies data into the Power BI model. It requires scheduled or manual refresh, so it may not meet the two-minute requirement.
• Live connection: Connects to an existing Power BI semantic model or Analysis Services model; it is not the appropriate choice for connecting directly to the Azure SQL database in this scenario.

• B. Data loss prevention (DLP): Helps prevent sensitive data from being copied, emailed, or exfiltrated. It is not the primary control for protecting a stolen laptop’s stored data.
• C. Operating system hardening: Reduces vulnerabilities by disabling unnecessary services and applying secure settings, but it does not necessarily protect the files if the disk is accessed directly.
• D. Boot security: Helps ensure the device starts only through trusted software or approved processes. It supports platform integrity but does not itself encrypt stored files.

• SQL injection (SQLi): Attacks databases by inserting malicious SQL commands.
• Cross-site scripting (XSS): Injects scripts into web pages viewed by other users.
• Sideloading: Installing an application from outside the official app store. It may install unauthorized apps, but it does not generally unlock the operating system or enable restricted system features.

• Identity provider (IdP): Authenticates users and asserts their identity.
• Service provider (SP): The application being accessed—in this case, Salesforce/the employee portal.
• Identity store: A directory that stores user identities, such as Active Directory.
• Authentication store: A system used to validate credentials.

• Mesh: WAPs communicate wirelessly with one another, often to extend coverage without wired connections. It does not specifically describe centralized WLC management.
• Point-to-point: Connects two specific devices or locations.
• Ad hoc: Wireless devices communicate directly with one another without an access point.

• Restarting the device: may fix software problems, but not a directional connection issue.
• Swollen battery: is a safety concern, but would not typically cause recognition only in one orientation.
• Failing cable: possible in general, but less likely because it works on other similar devices.
• Dirty or damaged port: best matches the symptoms. Inspect and carefully clean the port, or have it serviced if damaged.

Question 3: AWS Storage Gateway File Gateway

• A: S3 bucket per user — S3 is object storage, not a traditional shared file system; mounting it requires extra tools and is less efficient.
• B: File Gateway — Provides a local file share using standard file protocols while storing files in Amazon S3. This preserves convenient local access and extends storage capacity.
• C: WorkSpaces and WorkDocs — Designed for virtual desktops and document collaboration, not large shared file storage.
• D: EC2 with EBS — EBS is attached to one EC2 instance and is not designed for direct multi-user file sharing.

• Inherent risk: Risk that exists before controls are implemented.
• Avoided risk: Risk eliminated by choosing not to perform the risky activity.
• Operational risk: Risk arising from failures in processes, people, systems, or daily operations.

• Data lakes: scalable, low-cost storage for structured, semi-structured, and unstructured data.
• Data warehouses: reliable SQL analytics, governance, and performance features.

• Data lake: Primarily provides flexible, scalable storage but may lack warehouse-style reliability and governance.
• Data warehouse: Strong for structured analytics but less flexible for raw and unstructured data.
• All of these: The individual lake and warehouse do not, by themselves, unify the siloed architecture.

kusto 
Event 
| summarize make_set(EventID) by Computer

• summarize groups records.
• by Computer creates one result row per virtual machine.
• make_set(EventID) returns an array containing unique event IDs for that computer.

kusto 
| summarize make_list(EventID) by Computer

• User preferences change, so the model must learn from recent data.
• Keeping the existing data helps preserve knowledge of older patterns and provides a broader training distribution.
• Training only on new data can cause catastrophic forgetting and may overfit if the new dataset is small.
• The new data should not automatically be used as the test set, because it is needed for training and the model must still be evaluated on separate, representative data.

• A — Custom Button: A button can launch a flow, typically by passing the flow’s URL and record context.
• D — From a Process: A Process can invoke a flow using an Apex action configured for flow invocation. However, this is automation-triggered, not directly accessed by a user.
• B — Quick Action: In current Salesforce functionality, a Flow Quick Action can launch a screen flow directly from a record page. This makes B a valid modern method.
• C — Visual Workflow Launcher: This is not generally listed as a standard access method in current Salesforce terminology; Salesforce commonly uses the Flow component on Lightning pages instead.

• An Azure pay-as-you-go subscription follows an operational expenditure (OpEx) model.
• With OpEx, the organization pays for services as they are used, typically based on consumption.
• There is no need to purchase and maintain physical servers upfront.
• This contrasts with capital expenditure (CapEx), where the company makes a significant upfront investment in infrastructure, such as on-premises Hyper-V hosts.

• The requirement explicitly says the organization wants to use SAML to secure Salesforce API access.
• The SAML Bearer Assertion Flow exchanges a SAML assertion for a Salesforce OAuth access token.
• It is intended for server-to-server or other noninteractive integrations where the application has already been authenticated by an identity provider.
• The connected app can be configured so administrators authorize or preauthorize applications that consume the APIs.

• B — JWT Bearer Flow: Uses a signed JWT, not a SAML assertion. It would be appropriate if the requirement specified JWT-based authentication.
• C — SAML Assertion Flow: This is not the standard Salesforce OAuth flow name; the relevant name is OAuth 2.0 SAML Bearer Assertion Flow.
• D — User-Agent Flow: Designed for interactive browser-based authorization, not a SAML-based server-to-server integration.

1. Product + ProductSubCategory: Inner join

1. Result + ProductCategory: Left outer join

• Cloud architecture
• Data architecture
• Platform engineering
• Data engineering
• Provisioning and modernization

• Data protection is associated mainly with security and risk management.
• Data governance belongs to the governance perspective.
• Data science is not an AWS CAF capability.

• A is correct: Days beyond the included period incur an extra daily charge.
• D is incorrect: Daily use after 10 days is not free.
• B and C: Data-transfer pricing can depend on the direction and service terms. The exam’s intended distinction is that the included device usage period is the clearly stated no-cost benefit.

Correct choices

• DB1: Azure Data Box Heavy
• Virtual machines: Azure Migrate

Why

• Replication with minimal downtime
• A test migration
• Final cutover after validation

json 
"Resource": "arn:aws:s3:::bucket-name/*"

• A: Revoking or changing an instance profile does not reliably invalidate temporary credentials that have already been issued and may still be valid.
• B: Changing the EC2 security group does not necessarily stop the attacker from using the stolen credentials from elsewhere.
• C: Amazon Macie helps discover sensitive data; Object Lock prevents modification/deletion, not reads or downloads.

1. Which host originated the infection

1. Which remaining hosts are infected

1. Select Exchange email as a location.
2. Use the built-in Azure Storage Account key sensitive information type as the condition.
3. Configure the DLP action to encrypt the email—for example, using Microsoft Purview Message Encryption.

• Writing with Apache Spark, typically as Delta tables.
• Reading with Apache Spark for processing and analysis.
• Reading with T-SQL through the lakehouse’s automatically generated SQL analytics endpoint.
• Reading with KQL through Fabric’s query capabilities that can access lakehouse data.

• Eventhouse: Optimized for real-time and KQL workloads, but it is not the natural destination for Spark-based writes or general lakehouse storage.
• Datamart: Intended mainly for relational analytics and Power BI; it is not designed for Spark-based data ingestion.
• Warehouse: Primarily T-SQL-based and structured. It does not provide the same native Spark write experience or flexibility for semi-structured data.

• SQL injection
• Cross-site scripting (XSS)
• Malicious file uploads
• Common web-application exploits

• Layer 4 firewall: Filters primarily by IP addresses, ports, and transport protocols; it lacks detailed web-application inspection.
• NGFW: Provides advanced network filtering and may include application awareness, but a WAF is more specialized for protecting web applications.
• UTM: Combines several security functions in one device, but it is not specifically focused on web-application attacks.

• vSmart controls the overlay control plane. It uses OMP to exchange routing information, distribute policies, and determine how WAN Edge devices reach one another.
• vManage is the centralized management and configuration platform.
• vBond is the orchestrator. It helps devices authenticate, discover controllers, and traverse NAT during onboarding.
• APIC-EM is not the SD-WAN control-plane component described here.

• nomes de pessoas;
• organizações;
• locais;
• datas;
• números de processos;
• leis ou contratos.

• NER = identifica informações específicas e classificáveis.
• Sumarização = reduz um documento e apresenta seus pontos principais.

• BCP: Maintains essential business operations during and after disruption. It is broader than IT recovery, but the question focuses on restoring the destroyed data center.
• Communication plan: Defines how the organization communicates with staff, the public, and other stakeholders.
• IRP: Handles security incidents such as malware, unauthorized access, or data breaches—not physical disaster recovery.

• Help the team identify the causes of delays.
• Encourage continuous improvement through retrospectives.
• Support the team in changing its process, tools, or collaboration methods.
• Help remove impediments that the team cannot resolve independently.

• A: An impediment log may help, but simply maintaining it does not ensure the impediments are resolved.
• B: Directing the team to solutions conflicts with agile self-management.
• C: Adding impediments to the product backlog could delay their resolution and treats them like product features.

• Customer contains one row per customer and the customer’s Address ID.
• Address contains one row per address and the corresponding location details.

1. Select the Customer query.
2. Choose Merge Queries.
3. Match Customer[Address ID] with Address[Address ID].
4. Use a Left outer join so every customer is retained.
5. Expand the merged Address column and select City, State/Region, and Country.

• Append adds rows vertically and is used for tables with the same structure.
• Group By summarizes rows rather than adding related columns.
• Transpose switches rows and columns and does not establish a relationship.

• A — Correct: Identify the data required by Salesforce, its dependencies, and how it should be validated. Verification scripts help confirm record counts, relationships, field mappings, and data integrity after migration.
• D — Correct: Use a full sandbox and perform trial migrations using realistic—or appropriately masked—legacy data. This exposes transformation, volume, dependency, and integration issues before production cutover.
• B — Less appropriate: Phased user migration and parallel operation primarily address user adoption and rollout risk, not the technical risks of data migration.
• C — Less appropriate: Although sandbox testing and integration testing are valuable, the option emphasizes test-data generation rather than validating the migration with representative legacy data. “A full sandbox for all systems” may also be impractical.

• A: Person Accounts cannot be merged directly with standard Contact records.
• C: There is no Account Setup option that automatically merges Person Account duplicates.
• D: Matching rules and duplicate rules can help identify or prevent duplicates, but they do not automatically merge Person Accounts. Also, relationship considerations do not change the basic merge capability.

• Sensitive document shared during a Teams chat: Teams chat
• Sensitive document stored/shared in a Teams channel: Teams channel messages

• Files shared in a chat are generally stored in the sender’s OneDrive, but the relevant DLP context is the Teams chat message and its attachment.
• Files shared in a channel are stored in the team’s SharePoint site, but the relevant context is the Teams channel message.
• The DLP rule can then use an action such as restrict access to the content to prevent guest users from opening the sensitive document.

• C series: CPU-optimized instances; not designed primarily for LLM training.
• G series: GPU instances generally optimized for graphics and some machine learning workloads, but not specifically large-scale model training efficiency.
• P series: Powerful GPU instances for ML training, but typically consume more energy than Trainium-based instances for suitable training workloads.

• ARP poisoning: Redirects or intercepts local network traffic; it would more likely affect communication paths or cause man-in-the-middle behavior.
• Jamming: Interferes with wireless signals. The scenario does not indicate a wireless outage.
• Kerberoasting: Attempts to obtain service-account password hashes from Kerberos; it is a credential attack, not typically a direct service outage.

• Use private connectivity from a cloud provider
• Set up SSO for federated authentication

• Private connectivity—such as a cloud provider’s private endpoint—keeps Snowflake access within the company’s private network path instead of exposing access over the public internet. This fits the VPN/VDI requirement.
• SSO for federated authentication allows Snowflake users to authenticate using the credentials already managed by the company’s identity provider—the same identity system used for VDI—eliminating separate Snowflake passwords.

• Tri-Secret Secure protects encryption keys; it does not provide private network access or credential reuse.
• A proxy Snowflake account outside the VPN conflicts with the requirement that Snowflake have no internet visibility and is not the normal solution for federated login reuse.