Salesforce Certified Platform Administrator II Exam Prep
Salesforce Certified Platform Administrator (Plat-Admn-201) (Page 20 )

• You haven’t added any fields to display.

• Field-level security or object permissions block visibility.

• The fields don’t exist or names don’t match.

• Conditional visibility isn’t configured or is misconfigured.

• Page not activated or not on the correct record page.

• Domínios personalizados.
• Armazenamento suficiente.
• Instâncias dedicadas.
• Balanceamento de carga.
• Menor custo entre os planos que atendem a tudo.

• The identified risk
• Its likelihood and potential impact
• The person or team responsible for handling it
• The response or treatment plan
• Risk thresholds, such as when escalation or action is required
• Current status and review dates

• Risk tolerance: The amount of risk an organization is willing to accept; it is a concept or limit, not usually the primary documentation.
• Risk transfer: Moving the responsibility or financial impact of a risk to another party, such as through insurance.
• Risk analysis: The process of evaluating risk likelihood and impact.

• A. IDS attack signatures: An IDS primarily detects suspicious network activity; it is not the best tool for scanning uploaded files.
• C. Load balancer: Improves availability and distributes traffic but does not inspect files for malware.
• D. WAF: Protects web applications against attacks such as SQL injection and command injection. It may inspect HTTP requests, but malware scanning of uploaded PDFs is the key requirement here.

• Honeypots: Deliberately vulnerable or attractive systems designed to lure attackers. Legitimate users should not access them, so activity on a honeypot is a strong indicator of compromise.
• DNS sinkholes: Redirect requests for known malicious domains to a controlled internal system instead of allowing the connection. This can identify infected hosts attempting to contact command-and-control infrastructure.

• Tokenization: Replaces sensitive data with non-sensitive tokens; it protects data but does not primarily detect attackers.
• CI/CD: Automates software development and deployment processes.
• Threat modeling: Identifies potential threats and weaknesses before or during system design.
• Data obfuscation: Makes data harder to understand, but it is not an attacker-detection method.

• The requirement explicitly says the organization wants to use SAML to secure Salesforce API access.
• The SAML Bearer Assertion Flow exchanges a SAML assertion for a Salesforce OAuth access token.
• It is intended for server-to-server or other noninteractive integrations where the application has already been authenticated by an identity provider.
• The connected app can be configured so administrators authorize or preauthorize applications that consume the APIs.

• B — JWT Bearer Flow: Uses a signed JWT, not a SAML assertion. It would be appropriate if the requirement specified JWT-based authentication.
• C — SAML Assertion Flow: This is not the standard Salesforce OAuth flow name; the relevant name is OAuth 2.0 SAML Bearer Assertion Flow.
• D — User-Agent Flow: Designed for interactive browser-based authorization, not a SAML-based server-to-server integration.

• Each team’s Bedrock workflow uses a separate IAM service role.
• The role’s Amazon S3 permissions can be limited to only that team’s customer folder or objects.
• This enforces least privilege and prevents one team’s Bedrock application from accessing another team’s data.
• Access is enforced by AWS permissions, not by asking users to provide a customer name in each request.

• A single role with broad S3 access does not provide team-level isolation.
• Asking teams to specify a customer name is not an access-control mechanism.
• Redacting data does not prevent unauthorized access.
• A bucket policy alone is insufficient unless it explicitly enforces the required team-role restrictions.

• Data Category Groups e categorias;
• Visibilidade dessas categorias para perfis ou permission sets.

• B e C: regras de compartilhamento não são o mecanismo apropriado para restringir resultados de busca do Knowledge por divisão.
• D: a role hierarchy não é o mecanismo principal para controlar a visibilidade de categorias do Knowledge. Além disso, a configuração correta é atribuir visibilidade a perfis ou permission sets.

• Cloud architecture
• Data architecture
• Platform engineering
• Data engineering
• Provisioning and modernization

• Data protection is associated mainly with security and risk management.
• Data governance belongs to the governance perspective.
• Data science is not an AWS CAF capability.

text 
heartrateheartrateheartrate

• Spark column objects can be multiplied, for example:

python 
  df["heartrate"] * 3

• A DataFrame itself cannot be multiplied, but the expression is referring to a column.
• It is also not primarily a Python syntax error; the code was parsed, then Spark failed while resolving the column name.

• Record changes — a flow can start when a record is updated or otherwise changes.
• Schedules — a flow can run at a specified date/time or on a schedule.
• Record inserts — a flow can start when a new record is created.

• Subflows are reusable flow components called by another flow; they are not normally trigger types.
• Record views do not generally initiate a Flow Designer flow.

• Tokenization: Replaces the value with a nonsensitive token, often reversible through a secure token vault.
• Hashing: Converts data into a one-way fixed-length value, generally used for integrity checks or password storage.
• Obfuscation: A broad term for making data difficult to understand; it is less precise than masking in this context.

• The S3 bucket as an origin for static content
• The Application Load Balancer (ALB) as an origin for dynamic content
• An Amazon Route 53 alias record pointing the application domain to CloudFront

Why this works

• Static data: CloudFront caches objects from S3 at edge locations, reducing latency for users worldwide.
• Dynamic data: CloudFront forwards requests that require application processing to the ALB. It can also maintain persistent connections and use the AWS global edge network to improve delivery performance.
• One domain: CloudFront behaviors can route different path patterns to different origins—for example, /static/* to S3 and other paths to the ALB.

Why the other options are incorrect

• Global Accelerator is designed primarily for accelerating traffic to applications with endpoints such as ALBs, not for caching S3 content.
• Using separate domains or splitting static and dynamic traffic adds unnecessary complexity.
• CloudFront already provides the required global edge distribution and caching, so combining it with Global Accelerator is unnecessary here.

• Link-local — FE80::/10; valid only on the local link/subnet and not routed by routers.
• Multicast — FF00::/8; identifies a group of interfaces rather than a private address range.
• Global unicast — 2000::/3; publicly routable IPv6 addressing.

• Suspended an operator who correctly refused to use unsafe equipment.
• Rewarded another operator for using the equipment despite the broken safety guard.

• A — Management is not particularly concerned with managing risks.

• B — Employees will perceive that management does not care about health and safety risks.

• C — This factory’s safety record is likely to be poor.

• Keep earlier prompt versions.
• Identify the last version that produced acceptable output.
• Restore it as a baseline.
• Make small, controlled changes—ideally one significant change at a time.
• Test the output after each change.

• A: Discards useful information about what worked.
• B: Large simultaneous changes make it difficult to identify the cause of problems.
• D: Accepts output that does not meet the requirements.

• B: Trigger.Once + scheduled job

• C: 10-minute processing-time trigger

• File hashes
• Strings and metadata
• Binary or code structure
• Known malicious patterns
• Embedded indicators or signatures

• Sandbox: Executes the file in an isolated environment; useful for observing behavior, but usually slower.
• Network traffic analysis: Examines communications generated by a system or application, not the file itself.
• Package monitoring: Tracks software packages or installations and is not the primary method for examining malware signatures.

• A. Microsoft 365 group with Assigned membership
• C. Microsoft 365 group with Dynamic User membership

Why?

• Assigned membership: You explicitly add User1, User2, and User3.
• Dynamic User membership: Membership is automatically determined by a rule based on user attributes.

Why the other options are incorrect

• B and D: Security groups do not support the Microsoft 365 group expiration policy.
• E: Dynamic Device groups are intended for devices, not these users, and are also security groups.

• A — Increasing the minimum password length to 14 characters: Longer passwords have more possible combinations, making them harder to guess or crack through brute force.
• F — Requiring at least one special character: This increases password complexity and expands the possible character combinations.

• MD5 to SHA-512: Improves password-hash resistance, but does not stop users from choosing easy-to-guess passwords. Also, modern systems should use a password-specific hashing algorithm such as bcrypt, scrypt, or Argon2.
• Increasing maximum age to 120 days: Leaves weak passwords in use longer.
• Reducing minimum length to 10: Makes guessing easier.
• Reducing minimum age to zero: Allows immediate password changes but does not make the password itself harder to guess.

1. Define Power Platform DLP policies

1. Add custom prompt modifications

1. Conduct adversarial testing

• Required response and resolution times
• Availability or uptime targets
• Performance standards
• Support obligations
• Remedies or penalties for failing to meet the terms

• SOW (Statement of Work): Defines the project’s scope, tasks, deliverables, and schedule.
• MOA (Memorandum of Agreement): Describes agreed responsibilities between parties, often for a specific activity.
• MOU (Memorandum of Understanding): Records a mutual understanding or intention, usually less formal than a contract.

• B — Sales staff will tender for riskier contracts:

• C — Sales staff will encroach on other territories:

• D — Sales staff will look for new jobs:

• Prevent connections to malware command-and-control servers
• Identify infected systems making those DNS requests
• Collect information for incident response

• A: Attackers do not normally use sinkholes to map a company’s domain structure.
• B: Redirecting employees from legitimate sites to attacker-owned sites describes malicious DNS manipulation, not a defensive sinkhole.
• D: Attracting attackers away from real resources is more closely associated with a honeypot or deception system.

• Amazon EC2 instances — ???????? ?? ?? ??????? CPU, memory ??? instance size ???????? ???????
• AWS Lambda functions — memory configuration ?????????? ???????
• Amazon EBS volumes — volume type ?? size optimize ???? ???????
• ??????? ECS workloads — resource configuration ? cost optimization-?? ???????

• Memory ? compute usage ?????????? ???? custom code ????? ???? development ? maintenance ??????
• Cost allocation tags ???? ????? ??? ?????? ???? ??????? ???; inefficient resource ??????? ?? recommendation ???? ???
• CloudTrail resource ???? ?? API activity ??????, resource utilization ????

• A. IDS attack signatures: An IDS primarily detects suspicious network activity; it is not the best control for scanning uploaded documents for malware.
• C. Load balancer: Distributes traffic among servers and improves availability, but does not inspect files for malware.
• D. WAF: Protects web applications against attacks such as SQL injection and command injection. It may help secure the upload function, but malware scanning is the key requirement here.

• Outer packet: 10.5.1.1 > 52.165.16.154
• IPv4 protocol field: 41, which indicates IPv6 encapsulation
• Inner packet: IPv6 traffic between 2001:... addresses

• MAC address spoofing: Changes Layer 2 addressing; it does not explain the IPv6-in-IPv4 structure.
• Steganography: Hides data inside files or media, not visibly in a tunneled protocol.
• Broken encryption: No evidence of encryption being cracked.
• On-path sniffing: Involves intercepting traffic, not sending data to an external host.

• Digitally signing the software: Verifies authenticity and integrity. It does not hide how the software works.
• Limiting third-party libraries: May reduce dependencies and attack surface, but does not directly prevent reverse engineering.
• Using compile flags: Some compiler options can remove debugging information or optimize code, which may provide limited protection, but this is not the primary technique identified for preventing reverse engineering.

• NIDS: Monitors network traffic for suspicious activity and network-based attacks targeting the application or its supporting services.
• HIPS: Protects an individual host by monitoring processes, files, and system activity. It can help secure the web server, but it is not focused specifically on the application’s network attack surface.
• SIEM: Aggregates and correlates logs; it does not directly prevent attacks.
• Honeypot: A decoy system, not the primary protection for a production web application.
• Certificate revocation list: Deals with certificate trust, not application exploitation.

• Default network device credentials: More associated with external attackers or poor device configuration.
• Spear phishing emails: Commonly used to compromise users, but less characteristic of an insider who already has access.
• Typosquatting and impersonation: Primarily social-engineering techniques aimed at deceiving users.
• Unidentified removable devices: Provide a direct way to transfer data outside the organization and may bypass network monitoring.

• Disaster recovery backups
• Long-term backup retention
• Data archiving that still needs occasional access

• Multi-Regional Storage: Intended for frequently accessed data needing broad geographic availability; it costs more.
• Regional Storage: Suitable for frequently accessed data within one region.
• Nearline Storage: Intended for data accessed roughly once per month, such as monthly backups.
• Coldline Storage: Better fit for backups accessed only during a disaster or occasional recovery event.

• Online payment fraud
• Account takeover
• Fake account creation
• Suspicious transactions

• BCP (Business Continuity Plan): Ensures the organization can continue its broader business operations during and after a disruption. It is broader than the IT-focused recovery required here.
• Communication plan: Defines how information is shared with employees, the public, and other stakeholders; it does not restore systems.
• IRP (Incident Response Plan): Handles and contains security incidents, such as malware or unauthorized access. A tornado is a disaster, not primarily a cybersecurity incident.

• Gaia Portal: Controlled by Gaia administration settings, not SmartConsole Trusted Clients.
• SSH: Controlled by Gaia or operating-system SSH access settings.
• Security Gateway(s): SmartConsole connects to the Security Management Server, not directly to gateways for this purpose.

• Unfamiliar locations or IP addresses
• Anonymous or malicious IP addresses
• Leaked credentials
• Unusual sign-in behavior

• T?o m?t Systems Manager Automation runbook d? ch?y l?nh kh?i d?ng l?i ?ng d?ng trên các EC2 instance.
• T?o m?t Amazon EventBridge rule ph?n ?ng khi CloudWatch alarm chuy?n sang tr?ng thái ALARM.
• Ð?t Automation runbook làm target c?a EventBridge rule.

1. Log c?a ?ng d?ng du?c ghi vào CloudWatch Logs.
2. CloudWatch alarm phát hi?n nhi?u l?i liên quan d?n vi?c restart.
3. Alarm chuy?n sang tr?ng thái ALARM.
4. EventBridge nh?n s? ki?n thay d?i tr?ng thái này.
5. EventBridge g?i Systems Manager Automation runbook.
6. Runbook restart ?ng d?ng trên các EC2 instance, không restart c? instance.

• A: SNS không tr?c ti?p g?i Systems Manager Automation runbook nhu m?t target native.
• B: Lambda có th? th?c hi?n vi?c restart, nhung ph?i t? x? lý vi?c xác d?nh instance và ch?y l?nh t? xa.
• C: Lambda ch? làm trung gian d? g?i runbook, không c?n thi?t vì EventBridge có th? g?i runbook tr?c ti?p.

• Wireshark captures packets and allows you to examine their contents, potentially revealing usernames and passwords sent without encryption.
• Netcat creates network connections and can send or receive data, but it is not primarily a packet-analysis tool.
• Nessus scans for known vulnerabilities and configuration issues; it generally would not prove that credentials are visible in transit.
• Nmap performs network discovery and port/service scanning, not detailed packet-content inspection.

1. insert con; ? 1
2. Database.setSavepoint(); ? 2
3. update con; ? 3
4. Database.rollback(sp_admin); ? 4

• Deploy five individual VMs: This does not create a VM scale set.
• Modify Availability Zones or Size settings: These actions do not create the required scale set and add unnecessary steps.
• VM orchestration mode: This is Flexible orchestration, intended for more individually managed VMs and mixed configurations. It is not the best choice for a straightforward group of identical instances.

• A — Securing information assets: This is the responsibility of management and operational/security teams.
• B — Validating protection: Correct. The auditor checks whether controls—such as access restrictions, encryption, retention, and handling procedures—match the asset’s classification.
• C — Ensuring alignment with regulations: Management and legal/compliance functions typically establish classification requirements; the auditor may assess compliance but does not primarily define alignment.
• D — Defining classification levels: This is a management responsibility based on business needs, risk, and regulatory obligations.

• The product is already in production.
• The organization is examining the product’s functions and cost drivers.
• The objective is to reduce cost without reducing perceived value or required quality.

• Kaizen costing focuses on continuous, usually incremental, cost reductions during the manufacturing stage. It is not specifically the systematic examination of a product’s functions.
• Standard costing compares actual costs with predetermined standards; it is a control technique, not a product redesign method.
• Process innovation concerns developing significantly improved production processes, rather than analysing the product’s functions and value.

• 16GB RAM: A 64-bit OS is needed to use more than roughly 4GB effectively, but RAM capacity does not prove the CPU supports 64-bit operation.
• 500GB HDD: Storage capacity has no bearing on OS architecture.
• 1Gbps Ethernet: Network speed is unrelated to CPU architecture.

• AWS Network Firewall can inspect and block traffic across a VPC when traffic is routed through the firewall. A Drop action rule can deny traffic from the suspicious source IP.
• GuardDuty findings are sent to Security Hub.
• A Lambda function can be invoked when Security Hub receives a new GuardDuty finding, extract the source IP, and update the Network Firewall policy with a blocking rule.

• GuardDuty threat lists: Used to identify or increase the severity of findings; they do not directly block VPC traffic.
• AWS WAF: Protects supported web applications, such as CloudFront or Application Load Balancers. It does not provide general VPC-wide traffic blocking.
• GuardDuty suppression rules: Suppress or hide findings. They do not block the suspicious traffic.

• The type of change: standard, normal, or emergency
• The risk, impact, and complexity
• The change model being used

• A standard change may be pre-authorized through its change model.
• A normal change may require assessment and approval by an appropriate change authority.
• An emergency change may be authorized by an emergency change authority, often using an expedited process.

• Change authorities are not only needed for emergency changes.
• They are not assigned only when a change is deployed.
• They are not only required for normal changes.

• A — Too infrequent: Formal strategies are often reviewed only every three to five years. This can make the organisation slow to respond to rapid changes in technology, competitors, regulation or customer needs.

• C — Relies on predicting the future: The approach assumes senior managers can make reasonably reliable forecasts and assumptions. In uncertain environments, these assumptions may quickly become invalid.

• E — Can restrict radical innovation: Formal planning tends to favour existing information, established objectives and incremental improvements. This may discourage experimental or highly innovative strategies that emerge from lower levels of the organisation.

• B concerns the difficulty of achieving competitive advantage through core competences when competing with focused specialists. It is not specifically a drawback of the formal top-down planning process.
• D is an activity organisations should undertake—continuous monitoring—not a drawback of the approach itself.

• Existing expected ROI: 15%
• New project ROI: 14%
• Cost of capital: 12%

• Project return = 14%
• Cost of capital = 12%
• It earns 2% more than the cost of capital, so it should increase shareholder value.

• Accept: Acknowledges the risk without taking additional action.
• Transfer: Shifts the risk or financial impact to another party, such as an insurer.
• Mitigate: Reduces the likelihood or impact through controls like patching, MFA, or segmentation.
• Avoid: Eliminates the activity that creates the risk.

• B. Users accessing Salesforce from public Wi-Fi

• C. Users choosing the same password as their Facebook password

• A: 2FA does not protect an already-authenticated, unlocked session if someone accesses an unattended laptop.
• D: Weak password-reset questions are an account-recovery weakness. 2FA primarily strengthens login authentication, not necessarily the security-question reset process.