Salesforce ANC-201 Exam Prep
Building Lenses, Dashboards, and Apps in Tableau CRM (Page 10 )

• Required response and resolution times
• Availability or uptime targets
• Performance standards
• Support obligations
• Remedies or penalties for failing to meet the terms

• SOW (Statement of Work): Defines the project’s scope, tasks, deliverables, and schedule.
• MOA (Memorandum of Agreement): Describes agreed responsibilities between parties, often for a specific activity.
• MOU (Memorandum of Understanding): Records a mutual understanding or intention, usually less formal than a contract.

• Deterrent control: The signs warn people they may be filmed. This can discourage unauthorized activity because individuals know surveillance is present.
• Detective control: CCTV monitors and records activity, helping identify or investigate incidents after—or while—they occur.

• Preventive: Stops an incident from occurring; CCTV generally does not physically prevent access.
• Corrective: Restores systems after an incident.
• Directive: Tells people what they must do, such as a security policy.
• Compensating: An alternative control used when the preferred control cannot be implemented.

• The Intune device limit restriction does not apply in the normal way; DEM enrollment supports up to 1,000 devices.
• However, the Microsoft Entra maximum number of devices per user setting can still impose a limit when the enrollment creates an Entra device object.
• Therefore, a DEM account is not automatically unlimited. The effective limit depends on the Entra device setting and the enrollment/join type.

• B — Incorporate contextual output encoding/escaping: Encode untrusted data based on its context—HTML, attribute, JavaScript, or URL—so the browser treats it as data rather than executable code.
• D — Run untrusted HTML input through an HTML sanitization engine: Sanitization removes or neutralizes dangerous elements and attributes, such as script-related content, while preserving safe HTML where needed.

• A: Enabling client-side scripts does not prevent XSS. Script restrictions may reduce risk in some environments, but “enable” is not a general XSS control.
• C: Cookie inspection is unrelated to preventing injected scripts.
• E: The SameSite cookie attribute primarily helps mitigate CSRF, not XSS. It should not generally be described as an XSS prevention measure.

• Due diligence: Investigating and evaluating a third party before entering a business relationship.
• Attestation: An independent auditor’s examination and formal report—such as the SOC 2 report itself. The analyst is reviewing the attestation, not performing it.
• Internal audit: Examines the organization’s own processes and controls.
• Penetration testing: Actively tests systems for exploitable vulnerabilities.

• A — Improved management of storage space: Correct.

• B — Improved supplier relationships: Correct.

• C — Improved pricing decisions: Correct.

• D — Non-product-specific costs must be apportioned: Incorrect.

• E — Profitability of each customer group: Incorrect.

• Determine the project budget — Budget development is a separate cost-management activity.
• Develop a communication plan — This belongs to project communications planning, not schedule completion.
• Establish baselines — Baselines are created after the schedule and related plans have been developed and approved. They formally capture the approved plan.

• If the attachment is safe, it is released to the user.
• If malware is detected, the attachment is blocked or removed according to the policy.
• This reduces delivery delays without disabling malware scanning.

• Replace removes the original attachment and replaces it with a text file explaining that it was blocked. It does not primarily optimize delivery time.
• Block and Enable redirect blocks messages with suspicious attachments and can redirect them for review; it does not provide the required faster delivery experience.
• Monitor and Enable redirect is for observation and does not reliably block malicious attachments.

• A local network gateway represents an on-premises network—its address space and VPN device information—for an Azure Site-to-Site VPN connection.
• It does not control which connection types are allowed between Azure web servers and database servers.
• It is also unnecessary when both server groups are in the same Azure virtual network.

• Sets a high initial price for a new product.
• Targets customers willing to pay more, often called early adopters.
• Gradually reduces the price to attract more price-sensitive customers as the product becomes less novel and competition increases.

• Penetration pricing: starts with a low price to gain market share quickly.
• Premium pricing: maintains a high price to communicate superior quality or status; it does not necessarily involve later price reductions.
• Loss leader pricing: sells one product at a very low price, sometimes below cost, to attract customers who may buy other products.

• Share files with the wrong people
• Use public links unnecessarily
• Fail to classify sensitive data
• Upload data to unauthorized services
• Misunderstand company sharing policies

• A — Step-up authentication: Helps protect administrator accounts, but does not directly address improper file sharing by users.
• C — Password complexity: Helps reduce password attacks, not accidental data disclosure.
• D — Mobile device management: Secures managed mobile devices, but does not directly control file-sharing behavior across the organization.

sql 
ALTER TABLE dbo.DimCustomer 
ADD CONSTRAINT PK_DimCustomer 
PRIMARY KEY NONCLUSTERED (CustomerKey) 
NOT ENFORCED;

1. ALTER TABLE dbo.DimCustomer
2. ADD CONSTRAINT PK_DimCustomer PRIMARY KEY NONCLUSTERED (CustomerKey)
3. NOT ENFORCED

1. Install a Cassandra-compatible ODBC driver.
2. Configure a data source name (DSN), if required.
3. In Power BI Desktop, select Get Data > ODBC.
4. Choose the configured DSN and connect.

• Microsoft SQL Server database: Connects to SQL Server, not Cassandra.
• OLE DB: Requires a compatible OLE DB provider; this is not the standard choice for Cassandra in Power BI.
• OData: Requires Cassandra data to be exposed through an OData service, which is not the normal direct connection method.

• Sales processes: Define the available Opportunity stages for each team.
• Record types: Connect each team to its appropriate sales process and page layout.
• Page layouts: Control which fields and related sections each team sees.

• Solar market team 1
• Solar market team 2
• Installation Services team

• One sales process: Cannot provide different Opportunity stages for each team.
• One page layout: Cannot provide different field arrangements or fields by team.
• Three page layouts alone: Page layouts control fields, but not the available stages.

• Deterrent control: The signs warning people they may be filmed discourage unauthorized or malicious behavior. They may prevent incidents by influencing behavior, but their primary purpose is to deter.
• Detective control: The CCTV system monitors and records activity so security personnel can identify suspicious or unauthorized actions.

• Preventive: Blocks or prevents an incident, such as a lock or access-control system.
• Corrective: Fixes or restores systems after an incident.
• Directive: Tells people what they must do, typically through policies or procedures.
• Compensating: Provides an alternative control when the preferred control cannot be used.

• B — The most significant risks are held by SQ.

• C — SQ should recognise the cars as inventory.

• F — SQ recognises revenue when LM sells a car to a third party.

• A: LM does not hold the most significant risks.
• D: LM does not recognise the cars as inventory.
• E: SQ should not recognise revenue when cars are merely delivered to LM.

• Three DHCP scopes: Each VLAN has its own IPv4 subnet. DHCP scopes are subnet-specific, so create one scope for:

• Two DHCP relays: DHCP client discovery begins as a broadcast, and broadcasts do not cross routers or VLAN boundaries. Therefore, configure a DHCP relay on the router or Layer 3 switch interface for each client VLAN.

Why this is correct

• Each user authenticates with their own Google account.
• Google manages the user’s SSH key association.
• IAM controls who can access instances.
• Access can be audited by user identity, so security can determine who accessed a VM.
• Granting the role to a Google group avoids managing permissions individually.

Why the others don’t apply

• A: A shared private key is difficult to distribute securely and cannot reliably identify which employee used it.
• B: Manually collecting and deploying keys on every instance is operationally inefficient and complicates auditing.
• D: A project-wide shared key has the same identity and key-management problems as option A. It also does not provide per-user accountability.

• Admin access to the deployment pipeline
• Contributor access to the Development and Test workspaces
• Viewer access to the Production workspace

• Allow the team to identify the causes of delays.
• Encourage improvements to processes, tools, and collaboration.
• Help remove impediments without dictating solutions.
• Protect quality and maintain a sustainable pace.

• A: An impediment log may help track issues, but merely recording them does not resolve the root causes.
• B: Directing teams toward solutions conflicts with the agile principle of a self-managing team.
• C: Adding impediments to the product backlog may delay their resolution and incorrectly treats them as product features.

• The selling division receives a credit based on a favourable transfer price, often market price or full cost plus a profit margin.
• The receiving division is charged a lower amount, such as marginal cost or another agreed price.
• The difference is accounted for centrally by head office or a corporate adjustment.

• Install unauthorized or unsupported software
• Access features blocked by the manufacturer or operating system
• Customize system behavior beyond normal settings

• Box 1: No — The rule requires user.department to equal Engineering. Engineer does not match, so User1 is not in AU1. Admin1 cannot reset User1’s password.
• Box 2: No — Admin1’s role is scoped to AU1 and cannot manage users outside that AU.
• Box 3: Yes — Admin2 is a Global Administrator and can reset User3’s password.

• On VirtualNetworkA: enable Allow gateway transit.
• On VirtualNetworkB: enable Use remote gateways.

• One network address
• Two usable host addresses—one for each router
• One broadcast address

• Router A: 10.2.1.1
• Router B: 10.2.1.2

• Route table: Controls how traffic is routed within a VPC; it does not use the AWS worldwide network to accelerate internet traffic.
• AWS Transit Gateway: Connects multiple VPCs and on-premises networks through a central gateway, but it is not primarily an internet traffic acceleration service.
• Amazon VPC: Provides isolated virtual networking in AWS, but it does not itself accelerate traffic globally.

• Labels control access and protection, not blanket exclusion.
• If the user has permission to open a labeled file—especially if the label allows authenticated users to view it—Copilot can use that file in a summary.
• If the label applies encryption and the user lacks the required usage rights, Copilot should not use the file or reveal its contents.
• Copilot honors the user’s existing permissions, so it should not expose labeled content to an unauthorized user.

• Identity: User-assigned managed identity

• Authorization: Azure RBAC

• Authentication: Verifies who the user is.
• Authorization: Determines what the authenticated user is allowed to access.
• Accounting: Records login activity and resource usage.

• CIA: Confidentiality, integrity, and availability—the core security objectives.
• ACL: Access Control List; rules that permit or deny traffic or access.
• PEM: A format and standard commonly associated with encoded certificates and keys.

• A. IDS attack signatures: An IDS primarily detects suspicious network activity; it is not the best tool for scanning uploaded files.
• C. Load balancer: Improves availability and distributes traffic but does not inspect files for malware.
• D. WAF: Protects web applications against attacks such as SQL injection and command injection. It may inspect HTTP requests, but malware scanning of uploaded PDFs is the key requirement here.

• Reconnaissance: Gathering information about the target.
• Weaponization: Creating or combining a malicious payload with a delivery method.
• Delivery: Sending the payload, such as through phishing.
• Exploitation: Triggering a vulnerability or weakness to gain execution or access.

• A class/teacher fact should contain one row per Class ID. It can support the count of classes and contain attributes such as Teacher First Name and Period Number.
• An attendance fact should contain one row per attendance event, such as Class ID + student + date. It supports attendance counts by day and monthly averages.

• Teacher First Name ? Teacher fact
• Period Number ? Attendance fact

• terraform init is normally required first, especially for a new or changed working directory. It installs providers/modules and configures the backend.
• terraform plan previews the proposed changes.
• terraform apply applies those changes. It also creates a plan internally if you have not supplied a saved plan.

text 
terraform init 
terraform validate       # optional but recommended 
terraform plan 
terraform apply

• netstat -tuln can show listening TCP ports.
• If the web service is not listening, or is bound only to 127.0.0.1, remote browsers cannot connect even though the server responds to ping.

• traceroute: Tests the path to the server, but ping already confirms basic reachability.
• tcpdump: Useful for detailed packet analysis, but it is more appropriate after checking whether a service is listening.
• arp: Helps troubleshoot local IP-to-MAC resolution, not an application-layer web connection.

• Unrestricted data mining: Data mining is not automatically a privacy violation. It becomes an issue when personal data is collected or used improperly.
• Identity theft: This is a possible consequence of inadequate privacy protection, but it is not the central focus of privacy regulations.
• Human rights protection: Privacy can be considered a human right, but this option is broader than the specific regulatory focus.
• Identifiable personal data: Regulations such as HIPAA focus directly on controlling the collection, use, disclosure, and protection of personal information.

• QuickVisualize is used to create and render a Power BI report from a DataFrame.
• The typical pattern is:

python 
PBI_visualize = QuickVisualize( 
    get_dataset_config(df), 
    auth=device_auth 
) 


PBI_visualize

• get_dataset_config(df) prepares the dataset configuration.
• auth=device_auth supplies authentication for the Power BI connection.
• Evaluating PBI_visualize renders the report in the notebook.

• Box 1: No
• Box 2: Yes
• Box 3: Yes

• Microsoft Foundry is an enterprise platform for developers, data scientists, and IT teams.
• It supports the full AI application lifecycle: selecting models, connecting enterprise data, developing, evaluating, deploying, monitoring, and scaling solutions.
• It can include visual tools and low-code experiences, but it is not primarily designed to enable business users to build complete generative AI solutions independently.

• B: You still need to select and configure an appropriate model.
• C: Business users may participate through visual tools, but they are not the primary target audience.
• D: Foundry includes low-code tools, but it is not fundamentally a low-code-only platform.

• Response and resolution times
• Availability or uptime
• Performance targets
• Support obligations
• Penalties for failing to meet commitments

• SOW (Statement of Work): Describes the work, deliverables, scope, and tasks.
• MOA (Memorandum of Agreement): Documents a formal agreement about roles or responsibilities.
• MOU (Memorandum of Understanding): Records a general mutual understanding, often without detailed service metrics.

• Process Builder: Automates actions based on record changes but does not create interactive forms.
• Approval Process: Routes records for approval; it is not designed to collect information through a wizard.
• Outbound Message: Sends information to an external system; it does not provide a user interface.

• Data only needs to be current at 7 AM each day, so scheduled refresh is sufficient.
• Import mode provides the fastest report interaction because data is stored in Power BI’s in-memory engine.
• It supports row-level security (RLS), including the USERNAME() filter.
• You can limit the imported data to the current year and previous three years to reduce model size.
• DirectQuery would generally provide slower visual response times and is unnecessary here.
• Dual is mainly useful in composite models where some tables use DirectQuery and others use Import. That is not required by this scenario.
• Live connection is not appropriate because you are creating the semantic model.

• C — Create a form extension and implement validation

• D — Use Chain of Command (CoC) with a form extension class

• User2 is in Group1, so CA2 applies.
• CA2 targets Office 365.
• CA2 requires MFA OR an app protection policy.
• User2 has no app protection policy, but if User2 successfully completes MFA, the OR condition is satisfied.
• The device being noncompliant does not matter because CA2 does not require device compliance.
• CA1 applies only to Global Administrators. Unless User2 is also a Global Administrator, CA1 does not apply.

1. Start with the number of devices: 260 usable addresses.
2. Use the formula:

1. Test the host-bit values:

1. IPv4 has 32 total bits:

• /24: 254 usable — too small
• /23: 510 usable — sufficient
• /22: 1,022 usable — more waste
• /21: 2,046 usable — even more waste

• Prevention costs – costs incurred to stop defects occurring, such as staff training, quality planning and supplier evaluation.
• Appraisal costs – costs of checking whether products meet standards, such as inspection, testing and quality audits.
• Internal failure costs – costs of defects found before delivery to customers, such as scrap, rework and retesting.
• External failure costs – costs of defects found after delivery, such as warranty claims, returns, complaints and product recalls.

• Footprinting is reconnaissance used to map an organization’s network, hosts, naming conventions, and services.
• A name such as fshare.int.complia.org suggests an internal file-sharing host (fshare) and an internal naming structure (int).
• This can reveal useful information to an attacker before attempting exploitation.

• ISP-assigned address space: Usually determined through public registration and DNS data, not an internal hostname.
• DNS sinkhole bypass: Would involve avoiding redirected malicious-domain queries.
• Initial access: DNS reconnaissance alone does not compromise the server.
• Data exfiltration: DNS tunneling typically generates many encoded or unusually long subdomain queries, not simply a meaningful internal hostname.

• Microsoft manages the physical datacenter, hardware, and virtualization.
• You manage the virtual machine’s operating system, installed software, configuration, and data.
• You choose the VM size, storage, networking, and scaling options.

• SaaS: You consume a complete application managed by the provider, such as Microsoft 365.
• PaaS: You deploy applications without managing the underlying operating system or VM infrastructure, such as Azure App Service.

• Assign endpoints to a group based on the result of one policy.
• Use that group as the scope of another policy.
• This effectively passes the endpoints from one policy’s processing flow to another.