Salesforce CUSTOMER-DATA-PLATFORM Exam Actual Questions
Salesforce Customer Data Platform (CDP) (SP22) (Page 2 )

• Goal: Guests should not use cameras, but company users can.
• Correct configuration: Guest access settings in the Org-wide settings.

• External access: Controls external-domain communication, not guest capabilities inside Teams.
• Teams settings in Org-wide settings: Too generic; doesn’t specifically target guest capabilities.
• Audio & Video in the default Meeting Policy: Would affect everyone assigned to that policy. To meet the requirement without impacting internal users, you’d need separate policies or guest-specific settings; the exam focuses on the guest-access policy.

• Authenticating websites with TLS/HTTPS
• Enabling certificate-based VPN authentication
• Signing or encrypting email
• Supporting device or user authentication

• VLAN tagging: Uses network-frame tags, such as 802.1Q; it does not rely on X.509 certificates.
• LDAP: May integrate with PKI in some environments, but X.509 certificates are not most commonly associated with LDAP itself.
• MFA: Certificates can be one authentication factor, but X.509 is fundamentally a PKI technology.

• Assign users or their team an appropriate security role.
• Ensure the role has the required table privileges, such as read, create, write, and append.
• Share the app with that security role in the app designer.

• Dynamics administration center: Used for environment and service administration, not routine app access configuration.
• Manage Roles: Not the specific Dataverse area used to define app and data permissions.
• Security Roles: Define what users can access and which operations they can perform.

• A. Number ? Decimal — Correct. Salesforce Number fields are represented in Apex as Decimal.
• D. Date/Time ? Datetime — This is correct conceptually, but “Dateline” is not an Apex type. If the option literally says “Dateline,” it is incorrect.
• E. Checkbox ? Boolean — Correct. A checkbox contains true or false.

• Number ? Integer — A Number field maps to Decimal, even when its scale is zero.
• Text Area ? List<String> — A text area maps to a single String, not a list.

• Question 142: Security governance is MOST associated with which IT infrastructure component? Network / Application / Platform / Process
• Answer: D. Process

• Security governance is about how decisions are made, accountability, and oversight to ensure security objectives align with business goals. These are implemented through governance processes (policy development, risk management, assurance, monitoring, escalation, etc.).
• The other options (Network, Application, Platform) are concrete IT components; governance affects them, but it’s exercised primarily through the processes that govern how those components are managed and controlled.

• In governance-related questions, focus on the decision-making, accountability, and control processes rather than the underlying technology components.

• Network Security Groups (NSGs) control network traffic to and from Azure resources.
• By applying NSGs to the web tier and the database tier (subnets or NICs), you can:

• NSGs provide the necessary granularity (source/destination, port, protocol) to enforce the desired traffic patterns between tiers.
• For easier management you can use separate subnets for each tier or, optionally, use Application Security Groups to simplify rule management.

• The answer: Question 51: C — Request trigger.

• To invoke a Logic App from an external service (here, the Azure Application Insights availability test) you need a trigger that starts on an incoming HTTP request. In Logic Apps, this is the trigger that exposes an HTTP endpoint — typically shown as "When a HTTP request is received" and referred to as the Request trigger.
• The other options aren’t appropriate:

• Create a Logic App with the Request trigger to generate a URL.
• Configure Application Insights to post the degraded-availability payload to that URL.
• Add actions (e.g., send email, follow-up) in the Logic App to notify the customer services team.

• Correct answer: A — a clear business case has been established.

• The audit focus for IT procurement is ensuring there is a solid economic justification for the investment. A clear business case documents the expected benefits, costs, risks, and alignment with strategic objectives, which governs whether the investment is worth pursuing.
• The other options are important controls or project aspects, but they are secondary to ensuring the investment is justified financially and strategically:

• The problem describes the class updating field-level security on some profiles. To prevent updating fields that are not updateable for the current user, you should check each field’s updateability before making changes. Use DescribeFieldResult.isUpdateable() (e.g., via Field.describe() on each field) to guard updates.

• A and D (With Sharing): Running a class with Sharing affects record visibility, not whether a field can be updated by a user. It doesn’t prevent updates to fields the user shouldn’t modify.
• C (WITH SECURITY_ENFORCED in SOQL): This enforces FLS/FRC during queries, but it doesn’t control whether the Apex code updates fields or modifies permissions. It’s not addressing the update behavior directly.

• The correct answer is Mass Transfer Tool.

• The Mass Transfer Records tool is Salesforce’s built-in way to reassign ownership of existing records in bulk. In this scenario, you need to transfer ownership of the departed rep’s accounts and opportunities to a new rep while keeping the team structure intact.

• Go to Setup > Data Management > Mass Transfer Records.
• Choose the object: Accounts (and then Opportunities, if needed).
• Set “Transfer From” (the leaving rep) and “Transfer To” (the new rep).
• Decide whether to transfer related records as well (e.g., opportunities tied to accounts) and proceed.
• Review and confirm.

• Data Loader / Data Import Wizard are for bulk import/export, not bulk reassigning ownership.
• Dataloader.io is a third-party tool; the built-in Mass Transfer tool is the standard Salesforce method for this task.

• In Microsoft Teams Phone System, a single Auto Attendant can handle multiple time-based greetings by using separate schedules for office hours, after hours, weekends, and holidays.
• You can configure one Auto Attendant with four distinct greetings mapped to:

• Open the Teams admin center > Voice > Auto attendants, edit or create an Auto Attendant.
• Under Time-based routing, define four rules:

• Create a Holiday schedule with the relevant dates (e.g., Easter, Christmas) and assign the Holiday greeting.
• Save the configuration.

• If your environment cannot separate weekend from after-hours within a single Auto Attendant, you might technically need more than one Auto Attendant.

• According to the provided answer key, the four options are: Upload File, User Criteria, HR Profiles, HR Criteria (options B, D, F, G).

• Upload File: Filter by a file you upload (e.g., CSV) that provides data for bulk case creation.
• User Criteria: Filter by criteria related to users (e.g., role, department) to select target users.
• HR Profiles: Filter by HR profile data associated with users.
• HR Criteria: Filter by HR-related criteria or attributes.

• Cross-account access is typically implemented with an IAM role. You create a role in the target account (where the resources live) and configure a trust policy that allows principals from the source account to assume that role.
• Users in the source account then assume the role (via Switch Role in the console or STS:AssumeRole) and receive temporary credentials with the role’s permissions to access the resources.

• IAM group: Groups exist inside a single account; they don’t grant cross-account access.
• IAM tag: Tags are metadata and do not grant access.
• IAM Access Analyzer: It analyzes and identifies public or cross-account access but does not grant access itself.

• IaaS: You deploy and manage virtual machines, operating systems, disks, and networking. Azure manages the physical datacenter and host infrastructure.
• PaaS: Azure manages the operating system and runtime so you can focus on deploying applications, such as with Azure App Service or Azure Functions.
• SaaS: You consume a complete, provider-managed application.

• In Spark, an executor is a JVM that can have multiple cores. Each task can consume some CPUs (spark.task.cpus).
• The executor’s resources are effectively partitioned into slots, where each slot can run one task. The number of slots per executor is roughly spark.executor.cores / spark.task.cpus.
• Therefore, multiple tasks can run in parallel within the same executor (via these slots). So the statement “Tasks run in parallel via slots” is correct.

• A: A slot is not another name for an executor; a slot is a unit inside an executor.
• B: There’s no requirement that there must be fewer executors than tasks; tasks can be scheduled over time across the available slots.
• C: An executor can run more than one core; it’s not limited to a single core.
• D: There isn’t a rule that there must be more slots than tasks; tasks can wait if slots aren’t available, and you can have equal or even fewer slots than concurrent tasks.

• C — Schema.describeSObjects(new String[]{myObject})[0].fields.getMap()

• D — Schema.getGlobalDescribe().get(myObject).getDescribe().fields.getMap()

• A: sObjectType is not used this way, and fieldSet() is not the appropriate method for retrieving all fields.
• B: mySObject.myObject is not valid dynamic Apex syntax.

• B — Prompts and suggestions retained for 28 days
• C — User engagement data kept for two years

• The key distinction is between content data—your prompts, code context, and generated suggestions—and engagement data, such as usage activity.
• Do not confuse retention with training: enterprise Copilot data is generally not used to train GitHub’s models without appropriate authorization.
• For a current exam, verify the policy version cited by the exam provider. The key’s C is likely correct, but B should be treated cautiously and may no longer reflect the current policy.

• The policy is confidential, and the requester is no longer authorized merely because they used to work for the organization.
• The security professional should not disclose it by email or display it on a device without authorization.
• Using official channels allows the organization’s owner or information custodian to verify:

• The first step in risk management is to understand objectives, constraints, and drivers from those who care about the project. This stakeholder engagement helps identify what could go wrong and what risks are most critical.
• Only after you’ve gathered input from stakeholders should you identify risks and document them in the risk register. Updating the risk register (option C) is important, but it comes after identifying and analyzing risks.
• Options B (ensure resources) and D (revise the risk management plan) are actions that may follow once risks are identified and understood; they’re not the initial step.

• IaaS provides virtualized infrastructure, including VMs, disks, and networking. You manage the guest operating system and software installed on the VM.
• PaaS provides a managed platform for deploying applications without managing the underlying VMs or operating systems. Examples include Azure App Service and Azure Functions.

• Dynamics 365 Remote Assist — used for remote collaboration and mixed-reality scenarios.
• Dynamics 365 Finance — supports financial and operational management.
• Dynamics 365 Business Central — designed primarily for small and medium-sized businesses’ finance and operations.
• Dynamics 365 for Phones — provides mobile access to Dynamics 365 apps, including Sales, through the mobile Unified Interface.

• Correct options: C and D.

• The AWS Cloud Adoption Framework (CAF) security perspective focuses on capabilities to protect information and manage security risk.
• Observability (A) is primarily an operations/monitoring capability, not a core security capability under CAF.
• Incident and problem management (B) is IT service management/operations, not specifically a CAF security capability.
• Incident response (C) is a security-focused capability: detecting, containing, and recovering from security incidents.
• Infrastructure protection (D) involves applying security controls to protect the underlying infrastructure, which fits the security perspective.

• What the scenario asks: You have a Power BI semantic model that pulls from multiple sources (Azure SQL Database and SharePoint Online), must support a single dataset for three reports, keep data current (daily refresh by 7 AM PT), and apply RLS to limit sales data by region. You need to choose a storage mode for the tables.

• Correct choice: Dual storage mode.

• Why Dual fits:

• Key concepts:

• The inference container image or built-in algorithm
• The location of model artifacts in Amazon S3
• IAM permissions through the execution role
• Optional environment variables and networking settings

1. Create AWS::SageMaker::Model
2. Create an AWS::SageMaker::EndpointConfig that references the model
3. Create AWS::SageMaker::Endpoint that references the endpoint configuration

• AWS::SageMaker::Endpoint hosts a model but does not define the model itself.
• AWS::SageMaker::NotebookInstance provides a development environment.
• AWS::SageMaker::Pipeline orchestrates ML workflow steps.

• The problem: Guest users can’t create posts in the Monthly Reports channel.
• The recommended fix (answer B): Modify the Guest access settings in the Teams admin center.

• Guest access settings control what guests are allowed to do across Teams (for example, posting, chat, and channel participation). If guests are restricted from posting, enabling the appropriate guest permissions will let them post in channels like Monthly Reports.
• The other options don’t directly change guest permissions in the way that affects posting:

Why B works

• AWS KMS keys are Regional resources. A normal customer managed key in Region A cannot be used directly in Region B.
• A customer managed multi-Region KMS key (MRK) has related key replicas in both Regions. The replicas share key material and key ID, although each has a Regional ARN.
• With client-side encryption, the application encrypts the data before storing it in S3. Cross-Region replication then copies already-encrypted objects, so S3 does not need to decrypt and re-encrypt them with a different Regional key.

Why the other choices are weaker

• A and C: SSE-S3 uses Amazon-managed S3 keys, not the required customer managed KMS key.
• D: SSE-KMS can work only if the solution creates and configures the appropriate KMS key or multi-Region key replica in each Region. As written, it says to create a customer managed KMS key in each Region, which implies separate keys—not the same KMS key. Replication also requires additional KMS permissions and destination encryption configuration.

• The 99.99% availability SLA for VMs is achieved when you run VMs across two or more Availability Zones.
• Two VMs in a single Availability Zone do not meet the 99.99% target (their SLA is lower, e.g., around 99.95% or less depending on configuration).

• Deploy at least two VMs across two different Availability Zones (one VM in each zone, or both in two zones with a load balancer).
• This provides the required zone redundancy and the 99.99% SLA.

• Ablauf: Er wird in der gleichen Transaktion ausgeführt, bei der z. B. ein Datensatz erstellt oder aktualisiert wird. Der Benutzer wartet, bis der Workflow abgeschlossen ist.
• Stufen: Kann vor dem Vorgang (pre-operation) oder nach dem Vorgang (post-operation) laufen.
• Zweck: Sofortige Validierung oder Anpassung von Daten, ggf. auch das Verhindern eines Vorgangs, wenn Bedingungen nicht erfüllt sind.

• Automatisierte Flows (Power Automate, automatisierte/ Background Flows) laufen asynchron im Hintergrund, nachdem der Trigger erkannt wurde, und blockieren den Benutzer nicht.

• Correct answer: All four statements are true (A, B, C, and D). The given key (A,B) is likely incorrect.

• A) Customers can change the size of the Warehouse after creation — Yes. You can resize a virtual warehouse after it’s created using ALTER WAREHOUSE ... SET WAREHOUSE_SIZE.
• B) A Warehouse can be resized while running — Yes. Snowflake supports online resizing; you can change the size without stopping queries.
• C) A Warehouse can be configured to suspend after a period of inactivity — Yes. You can enable auto-suspend with a delay (AUTO_SUSPEND).
• D) A Warehouse can be configured to auto-resume when new queries are submitted — Yes. You can enable auto-resume (AUTO_RESUME) so a suspended warehouse automatically resumes on new queries.

• Example commands:

• Even if a warehouse is resizing or auto-suspending, queries will be queued and then executed once the warehouse has the appropriate capacity.

• What the scenario tests: How monitoring paths on a Universal Forwarder (UF) behave when you deploy an app via the Deployment Server.
• How monitoring is configured: Log paths to monitor are defined in inputs.conf (within apps/local on the UF). Splunk on the UF merges inputs from all apps and local config.
• Key point: Deploying a new app that adds a monitor for a log file does not typically remove existing monitors. The UF will continue monitoring any previously configured paths and will add the new ones from the deployed app.

• Correct answer: C) /var/log/maillog and /var/log/messages.

• Storage accounts: storage1, storage2, and storage3
• Log Analytics workspace: Analytics3

• Azure Backup reports can send the AzureBackupReports diagnostic log to eligible storage accounts. The storage account’s subscription and region do not have to match the Recovery Services vault, so all three listed storage accounts are valid.
• The Log Analytics workspace must be in the same region as the Recovery Services vault for this configuration. Vault1 and Analytics3 are both in West Europe, making Analytics3 the valid workspace.

• Why this is correct: In Azure Virtual Desktop, user access to a host pool is controlled through App Groups. The default app group for a host pool publishes the full desktop, so adding members to that app group grants them sign-in and access to the desktop (and any RemoteApps in that group). This is the standard way to give users access to AVD resources.

• Why the other options are not correct:

• Practical steps (high level):

• The stage has a default file format defined (e.g., when you create the stage with FILE_FORMAT = (...)), and Snowflake will use that default.

• You use a named file format attached to the stage, or you specify an inline format in the COPY command, e.g., COPY INTO my_table FROM @my_stage FILE_FORMAT = (TYPE = 'CSV');

• Use a stage default: omit FILE_FORMAT in COPY.
• Or rely on a named/inline format: specify FILE_FORMAT in COPY or set a format on the stage.

• What it says: you can add a cost when you adjust inventory, and that cost is posted automatically to a specific GL account.
• Reality: yes, you can adjust both quantity and value via an inventory adjustment journal. The cost on the journal line affects the inventory value.

• The general ledger postings are not arbitrary. the actual accounts used are determined by your item posting group and the system’s posting definitions. In practice, the adjustment debits/credits the appropriate inventory-related accounts (e.g., Inventory asset and a related offset such as an adjustment or COGS account) based on configuration.
• So, the cost change does not go to a single “manual” GL account you pick per line unless your posting setup maps to that account.

• The concept is true (you can adjust cost and have GL impact), but the claim that it posts to a single, specific GL account is oversimplified—the accounts come from your posting configuration.

1. Ingestion Lambda receives requests from API Gateway and places messages in an SQS queue.
2. Processing Lambda is triggered by the queue and loads records into Aurora PostgreSQL.

• Decoupling: API request handling is separated from database loading.
• Buffering: SQS absorbs bursts when incoming traffic exceeds the database’s processing capacity.
• Controlled concurrency: Configure the SQS-triggered Lambda’s concurrency and batch size to avoid overwhelming Aurora or exhausting database connections.
• Automatic retries: Messages that fail processing can return to the queue and be retried. A dead-letter queue can capture persistent failures.
• Lower operational effort: The solution remains serverless and avoids managing EC2 servers or Kubernetes clusters.

• A: EC2 and Tomcat add server-management overhead.
• B: DynamoDB/DAX would require changing the database model and does not solve the Aurora ingestion design.
• C: SNS is useful for notifications and fanout, but SQS is better for durable buffering and backpressure in this producer-consumer workflow.

• A. IDS attack signatures: An IDS primarily detects suspicious network activity and usually alerts rather than directly scanning and blocking uploaded files.
• C. Load balancer: Distributes traffic among servers but does not inspect files for malware.
• D. WAF: Protects web applications from attacks such as SQL injection, cross-site scripting, and some malicious requests. It is not primarily a PDF-malware scanning solution.

• Admin access to the deployment pipeline (B) – lets the developers use the pipeline and deploy content.
• Contributor access to the Development and Test workspaces (E) – required to deploy items into those workspaces.
• Viewer access to the Production workspace (D) – lets them view Production content without allowing deployment or modification.

• Contributor access to Production (F), because that could allow changes or deployment there.
• Viewer access to Development/Test (C), because Viewer is insufficient for deployment.
• Build permission to Production semantic models (A), because building reports on a semantic model is not required merely to view Production items.

• The correct AAA mapping (per Cisco objectives) is:

• Why the given options aren’t fully correct:

• Quick takeaway: when you configure AAA, you should conceptually map them as:

• Example commands (to reinforce concepts):

• Correct answer: A. System characterization

• Why the other options are not correct:

• Transact-SQL (T-SQL) is used to query relational data in Azure SQL Database, not telemetry data from monitoring services.
• To analyze monitoring data from Azure SQL Database Intelligent Insights and Azure Application Insights, you should use the Kusto Query Language (KQL) in Azure Monitor Logs/Log Analytics (and in Application Insights Analytics).
• Using KQL lets you query telemetry tables such as requests, dependencies, pageViews, and customEvents (from App Insights) and any integrated monitoring data you’ve ingested into Log Analytics.

• Ensure Intelligent Insights and Application Insights data is available in a Log Analytics workspace or accessible via Application Insights Analytics.
• Go to Azure Monitor > Logs (or Application Insights > Analytics) and write KQL queries, e.g.:

• IPv6 address types you’ll typically see:

• Unique Local Addresses (ULAs)

• If an address begins with fdXX:… or fc00:…, place it under “Unique Local Address” (ULA).
• If it begins with 2000::/3, place it under “Global Unicast.”
• If it begins with fe80::, place it under “Link-local.”
• If it begins with ff00::, place it under “Multicast.”

• Control plane: Managed by Databricks and contains the Databricks web application, workspace services, cluster management, and job orchestration.
• Data plane: Runs in your cloud account and contains compute resources such as:

• Worker node: Data plane compute.
• Driver node: Data plane compute.
• JDBC data source: Usually an external data system.
• Databricks Filesystem (DBFS): Provides storage access and is backed by cloud object storage rather than being entirely part of the control plane.

• Correct answer: B — A reservation for the server based on the MAC address.

• Why this is the best choice:

• Why the other options are less suitable:

• Quick takeaway: Use a DHCP reservation to give the file server a fixed IP while still benefiting from centralized DHCP management.

• The correct answer is A: CCTV recordings are not regularly reviewed.

• CCTV is a monitoring/control mechanism. If recordings aren’t reviewed, security events (break-ins, policy violations, equipment tampering) can go undetected and unaddressed.
• Regular review is essential for deterrence, incident response, and forensic evidence. Without it, the entire CCTV control provides little value.

• B (records deleted after one year) affects forensic availability, but it’s a data-retention issue rather than the ongoing effectiveness of the surveillance program.
• C (footage not recorded 24x7) creates gaps in coverage, which is a concern, but regular review of available footage still supports detection; 24x7 coverage is a separate policy/perimeter issue.
• D (cameras not in break rooms) is more about privacy and space planning than core data-center security monitoring.

• Pull: Downloads changes from the central repository and updates the local repository.
• Push: Sends local commits to the central repository.
• Commit: Records local changes in the repository’s history.
• Merge: Combines changes from different branches.
• Clone: Creates a new local copy of a repository.

• Windows 10 VMs
• Windows Server 2012 or later VMs
• Running VMs—they do not need to be shut down
• Debian 8.2+ VMs, assuming the specific version is supported
• Stopped or deallocated VMs

• Answer: C – netstat -an

• netstat -an lists all active connections and listening ports with numeric addresses, without resolving names. This lets you spot DoS patterns such as a flood of connections to a specific port or many connections from a single or few IPs.
• The other options don’t help as directly:

• Windows: netstat -an and look for numerous ESTABLISHED connections to a service or many SYNs to a port.
• Filter by port, e.g., netstat -an | findstr :80, or on Linux: ss -tunap | grep ':80'.

• Netstat provides a snapshot. DoS detection often benefits from continuous monitoring, flow data, and IDS/IPS logs.

• Increase/decrease the number of epochs: Changes how long training runs, but does not reuse a pre-trained model.
• Unsupervised learning: Trains from unlabeled data and does not specifically address adapting an existing model.