Salesforce Certified AI Specialist Exam Prep
Certified AI Specialist (Page 8 )

• T?o m?t Systems Manager Automation runbook d? ch?y l?nh kh?i d?ng l?i ?ng d?ng trên các EC2 instance.
• T?o m?t Amazon EventBridge rule ph?n ?ng khi CloudWatch alarm chuy?n sang tr?ng thái ALARM.
• Ð?t Automation runbook làm target c?a EventBridge rule.

1. Log c?a ?ng d?ng du?c ghi vào CloudWatch Logs.
2. CloudWatch alarm phát hi?n nhi?u l?i liên quan d?n vi?c restart.
3. Alarm chuy?n sang tr?ng thái ALARM.
4. EventBridge nh?n s? ki?n thay d?i tr?ng thái này.
5. EventBridge g?i Systems Manager Automation runbook.
6. Runbook restart ?ng d?ng trên các EC2 instance, không restart c? instance.

• A: SNS không tr?c ti?p g?i Systems Manager Automation runbook nhu m?t target native.
• B: Lambda có th? th?c hi?n vi?c restart, nhung ph?i t? x? lý vi?c xác d?nh instance và ch?y l?nh t? xa.
• C: Lambda ch? làm trung gian d? g?i runbook, không c?n thi?t vì EventBridge có th? g?i runbook tr?c ti?p.

• The identified risk
• Its likelihood and potential impact
• The person or team responsible for handling it
• The response or treatment plan
• Risk thresholds, such as when escalation or action is required
• Current status and review dates

• Risk tolerance: The amount of risk an organization is willing to accept; it is a concept or limit, not usually the primary documentation.
• Risk transfer: Moving the responsibility or financial impact of a risk to another party, such as through insurance.
• Risk analysis: The process of evaluating risk likelihood and impact.

• A: Not expanding would increase its dependence.
• B: More business from the same corporation would make dependence worse.
• D: Passing work to other minority businesses does not solve its own dependence.
• E: The passage does not suggest that it can force or influence the corporation to give work to others.

• Code suggestions: Inline completions as you write code, such as lines, functions, or blocks.
• Chat: An interactive interface for asking questions, explaining code, generating code, and helping with debugging.

• Knowledge Base: Not listed as a standard Copilot Individual IDE feature in this context.
• Pull Request Diff Analysis: More closely associated with GitHub-based code review or pull-request features, not the core Individual IDE extension capabilities.

1. Identify the fact table

• Records something that happened, such as a sale, test, appointment, or measurement
• Contains foreign keys to other tables
• Contains measures or numeric results
• Has many rows

2. Identify a dimension table

• Describe people, products, dates, locations, or departments
• Contain descriptive columns
• Are referenced by the fact table
• Have fewer rows than the fact table

3. Identify the surrogate key

• System-generated
• Unique within the dimension
• Often named PatientKey, CustomerKey, or similar
• Usually an integer
• Not meaningful outside the model

• Prevention costs – costs incurred to stop defects occurring, such as staff training, quality planning and supplier evaluation.
• Appraisal costs – costs of checking whether products meet standards, such as inspection, testing and quality audits.
• Internal failure costs – costs of defects found before delivery to customers, such as scrap, rework and retesting.
• External failure costs – costs of defects found after delivery, such as warranty claims, returns, complaints and product recalls.

• A: Allow SAN certificates — SANs are used to identify valid hostnames in a certificate. They do not bypass trust validation.
• C: Open the secure LDAP port — A blocked port would normally cause a timeout or connection-refused error, not certificate errors.
• D: Increase the TLS version on the RA — The issue concerns certificate trust, not the organization’s registration authority.

• Access controls — ensuring only authorized users can access it.
• Encryption — protecting the data if it is intercepted or exposed.

• B: Developer Edition has limited user, storage, and data-volume capacity, making realistic community testing difficult.
• C: A Developer Edition org cannot contain sandboxes, so it cannot provide separate environments for development, integration, and UAT.
• E: A standalone Developer Edition org is not part of the production org’s deployment path, so change sets cannot be used to deploy from it directly to that production org. The team would need Metadata API, Salesforce CLI, or another deployment method.

apex 
for (Account updatedAccount : Trigger.new) { 
    AccountTriggerHelper.notinyxternalSystem(updatedAccount.Id); 
}

• Too many callouts: The callout occurs asynchronously in the future method, and each future transaction can perform its permitted callouts.
• Too many SOQL queries: The SOQL query is inside the future execution, not repeatedly in the trigger transaction.
• Callout from triggers not supported: Direct callouts from triggers are prohibited, but the trigger delegates the callout to asynchronous Apex, which is the correct pattern.

• Disable default accounts: Default or unused accounts may have known usernames or predictable settings, making them targets. They should be disabled, removed, or securely configured.
• Remove unnecessary services: Every running service creates potential vulnerabilities. Removing services the server does not need reduces exploitable entry points.

• Add the server to the asset inventory: Important for asset management, but not a hardening step.
• Document default passwords: Default passwords should be changed or eliminated—not documented for continued use.
• Send server logs to the SIEM: Valuable for monitoring and detection, but generally performed as part of logging/monitoring configuration.
• Join the server to the corporate domain: May be necessary operationally, but does not itself harden the server.

• Create a CodeCommit repository in the secondary Region.
• Use CodeBuild to run a Git mirror operation from the primary repository to the secondary repository.
• Use EventBridge to detect relevant repository events, such as a pull request being merged.
• Invoke a Lambda function, which starts the CodeBuild project.

• B: Amazon S3 is object storage, not a Git repository that developers can use as a CodeCommit remote.
• C: CodeArtifact is intended for packages and artifacts, not source-code repository mirroring.
• D: An AWS Cloud9 environment is not an appropriate automated replication mechanism and would require manual or persistent infrastructure management.

• Filtering harmful or inappropriate content
• Blocking specified topics
• Detecting and masking sensitive information
• Enforcing content policies suitable for children

• Amazon Rekognition analyzes images and videos; it does not control text generated by a language model.
• Amazon Bedrock playgrounds are for testing models and prompts, not enforcing production safety policies.
• Agents for Amazon Bedrock help models complete tasks and use tools; they do not primarily provide content-safety controls.

• The current and previous versions
• Which clauses were changed
• When each revision occurred
• Potentially, who made the changes

• Version validation: Verifies a version’s accuracy or integrity but does not primarily track revisions.
• Version changes: Not the standard name for a formal document-management process.
• Version updates: Describes updating a document, not the complete process of managing and tracking its revisions.

• An Adj-SID does not necessarily need manual configuration.
• It can often be dynamically allocated by the router, although manual configuration may also be possible.
• The adjacency information is advertised through the IGP, such as IS-IS or OSPF.

• It is identified by an Adj-SID.
• It represents a particular adjacency of a node.
• Its meaning is generally local to the advertising node; unlike a Node-SID, it is not a globally reusable instruction across the network.

• Streams — track change data for tables or views.
• External tables — reference data stored in an external cloud storage location.

• Role — account-level security object.
• Warehouse — account-level compute resource.
• User — account-level security object.
• Share — account-level object used to share data.

• Amazon EC2 instances — ???????? ?? ?? ??????? CPU, memory ??? instance size ???????? ???????
• AWS Lambda functions — memory configuration ?????????? ???????
• Amazon EBS volumes — volume type ?? size optimize ???? ???????
• ??????? ECS workloads — resource configuration ? cost optimization-?? ???????

• Memory ? compute usage ?????????? ???? custom code ????? ???? development ? maintenance ??????
• Cost allocation tags ???? ????? ??? ?????? ???? ??????? ???; inefficient resource ??????? ?? recommendation ???? ???
• CloudTrail resource ???? ?? API activity ??????, resource utilization ????

• Required response and resolution times
• Availability or uptime targets
• Performance standards
• Support obligations
• Remedies or penalties for failing to meet the terms

• SOW (Statement of Work): Defines the project’s scope, tasks, deliverables, and schedule.
• MOA (Memorandum of Agreement): Describes agreed responsibilities between parties, often for a specific activity.
• MOU (Memorandum of Understanding): Records a mutual understanding or intention, usually less formal than a contract.

• Group1 — security-enabled: Eligible.
• Group2 — mail-enabled and security-enabled: Eligible because it is still a security group.
• Group3 — Microsoft 365 group: Not eligible for group-based licensing.
• Group4 — Microsoft 365 group, not security-enabled: Not eligible.

• Espionage: Stealing confidential information, often for a competitor or government.
• Data exfiltration: Unauthorized transfer of data outside the organization. This could occur, but the question focuses on using unapproved access methods.
• Nation-state attack: An attack sponsored or conducted by a government.
• Shadow IT: Employees using technology or access methods outside the organization’s approved security controls.

• A — Securing information assets: This is the responsibility of management and operational/security teams.
• B — Validating protection: Correct. The auditor checks whether controls—such as access restrictions, encryption, retention, and handling procedures—match the asset’s classification.
• C — Ensuring alignment with regulations: Management and legal/compliance functions typically establish classification requirements; the auditor may assess compliance but does not primarily define alignment.
• D — Defining classification levels: This is a management responsibility based on business needs, risk, and regulatory obligations.

• Internal interface ? connected toward the corporate network/internal firewall
• External interface ? connected toward the Internet-facing firewall

1. A route for the internal corporate network through the internal-facing interface/firewall.
2. A default route (0.0.0.0/0) through the Internet-facing interface/firewall.

• Storage usage of files stored in Microsoft Teams: SharePoint site usage report

• Number of active users per team: Microsoft Teams usage report

1. SharePoint site usage report
2. Microsoft Teams usage report

• VLAN 10 for data
• VLAN 20 for voice

• A: Describes physical trunking or logical switch ports, not an SVI.
• B: An SVI can provide management access, but that is only one use—not the best description here.
• D: SVI use is not related to running out of physical ports.

text 
ip route vrf Customer1 172.16.1.0 255.255.255.0 172.16.1.1 global 
ip route vrf Customer2 192.168.1.200 255.255.255.255 192.168.1.1 global 
ip route 192.168.1.0 255.255.255.0 Vlan10 
ip route 172.16.1.0 255.255.255.0 Vlan20

• The route in Customer1 VRF provides a path back to the Customer2 subnet, 172.16.1.0/24.
• The route in Customer2 VRF provides a path to the FTP server, 192.168.1.200.
• The keyword global tells the router to resolve the next hop using the global routing table, enabling controlled route leaking between the VRF and global table.
• The global routes identify the VLAN interfaces used to reach each customer network.

• NIDS: Monitors network traffic for suspicious activity and network-based attacks targeting the application or its supporting services.
• HIPS: Protects an individual host by monitoring processes, files, and system activity. It can help secure the web server, but it is not focused specifically on the application’s network attack surface.
• SIEM: Aggregates and correlates logs; it does not directly prevent attacks.
• Honeypot: A decoy system, not the primary protection for a production web application.
• Certificate revocation list: Deals with certificate trust, not application exploitation.

• A static IP gives the surveillance system a predictable local address, so users can reliably reach it on the LAN.
• However, a static IP does not block internet-based login attempts. If the router exposes the device through port forwarding, attackers could still reach it.
• Port mapping normally exposes an internal service externally, so A is a poor choice as written.
• Subnetting alone also does not block traffic; it would require routing/firewall rules.

• CSIRT: A team that responds to and manages security incidents.
• CVSS: A scoring system for rating the severity of vulnerabilities.
• SOAR: A technology platform for automating and coordinating security operations and incident response.

• SAML (Security Assertion Markup Language): Commonly used for enterprise SSO between an identity provider and cloud applications. It sends signed authentication assertions to the service provider.
• RADIUS: Primarily used for centralized authentication to network devices, VPNs, and wireless networks.
• EAP: An authentication framework commonly used with network access technologies; it is not typically the SSO protocol for SaaS applications.
• OpenID: Related to identity authentication, but traditional enterprise SSO questions involving cloud applications generally expect SAML. OpenID Connect is a newer authentication layer built on OAuth 2.0.

1. Convert text and images into numerical embeddings.
2. Store or compare those embeddings.
3. Retrieve the most semantically similar items.

• Embedding model: Best for similarity search and retrieval.
• Generation model: Best for producing new text or other content from multimodal input.

• IaaS: você gerencia a VM e o sistema operacional.
• PaaS: o Azure gerencia a infraestrutura; você se concentra no aplicativo.

• Escape to host: A virtualization attack where code escapes a guest VM and accesses the host system. Nothing in the scenario mentions virtualization.
• Browser extension: Can redirect or manipulate web-browser traffic, but not normally database-server traffic.
• Valid accounts: Describes using stolen or compromised credentials, not redirecting network traffic.
• Process injection: Injecting malicious code into a legitimate database or networking process could allow an attacker to alter how that process handles outgoing traffic.

• The application failing to start or becoming unhealthy
• An incorrect probe path, port, or protocol
• The application needing more startup time
• Dependency or configuration failures
• A liveness probe being too aggressive

bash 
kubectl describe pod <pod-name> 
kubectl logs <pod-name> --previous

• Scale to more replicas: may hide the issue but does not diagnose it.
• Decrease initialDelaySeconds: makes probes run earlier and could worsen startup failures.
• Drain and reboot the node: node metrics are normal, so rebooting is not justified as the first step.

• D — Managers focus on keeping costs low in the short term to maximise profits.

• E — Managers are given incentives to meet or undercut budgets.

• F — Managers delegate responsibility simply to reduce their workload.

• C: Develop the rule in the Rules Editor, define the events, match, and condition sections, then use the test rule feature. This directly validates the YARA-L rule without enabling it in production.
• A: UDM Search can help investigate data and refine filters, but it does not fully test YARA-L logic—especially complex event joins, match windows, and conditions.

• You can configure different pre-shared keys for different device groups.
• All cameras could use one key.
• All scanners could use another key.
• Each key can be associated with an appropriate role or access policy.

• Laws and regulations
• Litigation holds
• Industry or contractual obligations
• Tax, financial, health, or privacy requirements

• Business strategy and direction: May influence retention, but cannot override legal requirements.
• Storage capacity and longevity: Practical considerations, not the primary driver.
• Business ease and value analysis: May support decisions after compliance obligations are identified.

• Gaia Portal: Controlled by Gaia administration settings, not SmartConsole Trusted Clients.
• SSH: Controlled by Gaia or operating-system SSH access settings.
• Security Gateway(s): SmartConsole connects to the Security Management Server, not directly to gateways for this purpose.

• Espionage: Stealing information for intelligence or competitive purposes.
• Data exfiltration: Unauthorized removal or transfer of data.
• Nation-state attack: An attack sponsored or conducted by a government.
• Shadow IT: Unapproved technology or methods used to access organizational resources.

• Default network device credentials: More associated with external attackers or poor device configuration.
• Spear phishing emails: Commonly used to compromise users, but less characteristic of an insider who already has access.
• Typosquatting and impersonation: Primarily social-engineering techniques aimed at deceiving users.
• Unidentified removable devices: Provide a direct way to transfer data outside the organization and may bypass network monitoring.

• Tokens: Individual units of text processed by a model, such as words, subwords, or characters.
• Models: Systems that learn patterns and generate predictions or outputs.
• Binaries: Data represented using the binary number system, not semantic representations.

• Transfer — przeniesienie skutków lub kosztów ryzyka na inna organizacje, np. przez ubezpieczenie lub umowe.
• Akceptacja — firma swiadomie przyjmuje ryzyko bez dodatkowych dzialan.
• Mitigacja — zmniejszenie prawdopodobienstwa wystapienia ryzyka lub jego wplywu, np. przez wdrozenie kontroli bezpieczenstwa.
• Unikanie — calkowite wyeliminowanie ryzykownej dzialalnosci.

• s3:GetObject for the relevant objects
• s3:ListBucket if listing is required
• Appropriate bucket and object resource permissions

• B: Making the bucket public is insecure and unnecessary.
• C: Prompt engineering cannot override AWS IAM or encryption permissions.
• D: Data sensitivity does not determine whether the role can access it.

• Data loss prevention (DLP): Helps detect or prevent sensitive data from being copied or transmitted, but it does not primarily protect a stolen laptop’s stored data.
• Operating system hardening: Reduces vulnerabilities and attack surface but does not encrypt files if the device is stolen.
• Boot security: Helps ensure that only trusted software starts, but it does not fully protect the drive if an attacker accesses it offline.

• C — Some risks cannot be eliminated.

• D — Accepting residual risk does not imply recklessness.

• E — Most companies in this industry will say something similar.

• Packet capture: Collects and analyzes network traffic; it does not describe the scan type.
• Privilege escalation: Attempts to gain higher permissions after obtaining access.
• System enumeration: Identifies systems, services, or resources, but is not specifically defined by the lack of credentials.
• Passive scan: Observes traffic without actively probing systems. A vulnerability scan is generally an active assessment.

• Which host first communicated with the suspected malicious source
• Whether that host initiated suspicious traffic or merely received it
• Which other hosts show evidence of infection, such as connections from the originating host
• Which hosts have no related suspicious activity and are therefore clean

• An outbound connection to a suspicious external address
• A downloaded or executed malicious file
• Later lateral connections from that host to other internal systems
• Firewall logs showing the direction and timing of the traffic

• A — Too infrequent: Formal strategies are often reviewed only every three to five years. This can make the organisation slow to respond to rapid changes in technology, competitors, regulation or customer needs.

• C — Relies on predicting the future: The approach assumes senior managers can make reasonably reliable forecasts and assumptions. In uncertain environments, these assumptions may quickly become invalid.

• E — Can restrict radical innovation: Formal planning tends to favour existing information, established objectives and incremental improvements. This may discourage experimental or highly innovative strategies that emerge from lower levels of the organisation.

• B concerns the difficulty of achieving competitive advantage through core competences when competing with focused specialists. It is not specifically a drawback of the formal top-down planning process.
• D is an activity organisations should undertake—continuous monitoring—not a drawback of the approach itself.

• Microservices: An application-design approach that divides an application into smaller services. It does not inherently reduce the number of operating systems.
• Virtualization: Creates virtual machines, but each VM generally requires its own complete operating system. This improves isolation but does not minimize OS instances as effectively.
• Infrastructure as code: Uses code to automate infrastructure deployment and configuration. It improves consistency but does not determine how many operating systems are used.

• GPS coordinates
• Date and time the image was taken
• Camera or device information
• Image dimensions and software used

• Log data: Records generated by systems or applications, not normally embedded in image files.
• Encrypted data: Information intentionally encoded to prevent unauthorized access.
• Sensitive data: A broad classification, not the specific type of information being extracted.