Salesforce DEX-403E Exam Prep
Declarative Development for Platform App Builders in Lightning- Extended (Page 18 )

• B. Data loss prevention (DLP): Helps prevent sensitive data from being copied, emailed, or exfiltrated. It is not the primary control for protecting a stolen laptop’s stored data.
• C. Operating system hardening: Reduces vulnerabilities by disabling unnecessary services and applying secure settings, but it does not necessarily protect the files if the disk is accessed directly.
• D. Boot security: Helps ensure the device starts only through trusted software or approved processes. It supports platform integrity but does not itself encrypt stored files.

• You provision the virtual machine.
• You manage the guest operating system, applications, and configuration.
• Azure manages the physical servers, datacenter, and underlying virtualization infrastructure.

• Correct answer: Power BI dataset

• The scenario says the data model already contains several measures and you want to create a report from the existing data with minimal development. Reusing a published Power BI dataset lets you inherit the existing measures and data model, so you don’t have to recreate them.
• How to do it: In Power BI Desktop, use the connector Power BI datasets (Get Data > Power BI datasets) and connect to the existing dataset, then build visuals using the pre-defined measures.
• Why the other options are less suitable:

• principal represents the source or initiating system.
• principal.port is the source port.
• target represents the destination system.
• target.port is the destination port.

text 
principal.port = 5555

• network.ApplicationProtocol = HTTP identifies HTTP traffic but not the backdoor specifically.
• target.port = 5555 finds traffic going to port 5555, rather than originating from it.
• network.ip_protocol = TCP is too broad because many services use TCP.

• Increase/decrease the number of epochs: Changes how long training runs, but does not reuse a pre-trained model.
• Unsupervised learning: Trains from unlabeled data and does not specifically address adapting an existing model.

• This is a lookup relationship. Salesforce does not cascade access from a child (Opportunity) to its parent (Account) via implicit sharing.
• To view the Account, the user must have explicit access to the Account (via its OWD/sharing, or object permissions).

• The user has Read/View (or higher) on Account via profile/permission set.
• Manual sharing or a sharing rule grants that Account to the user.
• The Account is exposed by a broader permission like View All/Modify All on Account.
• Role hierarchy with Grant Access Using Hierarchies could grant access to Accounts owned by others, if applicable.

• Multi-factor authentication
• A secure password change for users whose credentials may be compromised

• Post-Incident Review (A) is the after-action step used to capture lessons learned, identify process gaps, and drive improvements across the incident response lifecycle. This directly supports process maturity and a stronger security posture.
• Incident Analysis (D) focuses on investigating root causes during/after an incident, which is important but more of a diagnostic activity than a standalone baseline improvement to maturity.
• Fast Eradication (B) and Incident Containment (C) are tactical actions aimed at stopping the incident, not on maturing the process.

• Enable the owner dimension

• Assign a standard costing inventory model

• Batch dimension tracks batches or lots, such as expiration or production batches. It does not identify inventory ownership.
• Moving average is a costing method, but it is not the required choice for this consignment configuration.

• The correct answer is A: CCTV recordings are not regularly reviewed.

• CCTV is a monitoring/control mechanism. If recordings aren’t reviewed, security events (break-ins, policy violations, equipment tampering) can go undetected and unaddressed.
• Regular review is essential for deterrence, incident response, and forensic evidence. Without it, the entire CCTV control provides little value.

• B (records deleted after one year) affects forensic availability, but it’s a data-retention issue rather than the ongoing effectiveness of the surveillance program.
• C (footage not recorded 24x7) creates gaps in coverage, which is a concern, but regular review of available footage still supports detection; 24x7 coverage is a separate policy/perimeter issue.
• D (cameras not in break rooms) is more about privacy and space planning than core data-center security monitoring.

• Amazon DynamoDB — Managed NoSQL database, not PostgreSQL.
• Amazon Athena — Serverless service for querying data in S3; intended for analytics, not OLTP.
• Amazon EMR — Managed cluster platform for big-data frameworks such as Hadoop and Spark.

• Import — Loads data into Power BI. It requires a refresh, so it may not reflect changes within two minutes unless refresh is configured appropriately.
• Live connection — Connects to an existing Power BI semantic model or Analysis Services model; it is not the normal choice for connecting directly to an Azure SQL database.

• IKE: Negotiates security parameters for IPsec VPNs; it does not identify switch ports.
• VLAN: A logical network segmentation method, not a discovery protocol.
• netstat: Displays local network connections and listening services, but cannot identify the physical switch or port.

• Elicited and documented customer requirements
• Converted them into clear, measurable specifications
• Validated the requirements with the customer
• Used them as the basis for design, quality checks, and acceptance

• A: Requirements should reflect the customer’s needs—not the supplier’s standards.
• B: Iteration review planning does not replace proper requirements collection.
• D: A retrospective occurs after work is completed and is mainly for process improvement, not initial requirements definition.

• Correct answer: A — a clear business case has been established.

• The audit focus for IT procurement is ensuring there is a solid economic justification for the investment. A clear business case documents the expected benefits, costs, risks, and alignment with strategic objectives, which governs whether the investment is worth pursuing.
• The other options are important controls or project aspects, but they are secondary to ensuring the investment is justified financially and strategically:

• Cutover: The old system is replaced immediately. It may be fast, but any failure can cause significant disruption.
• Phased: The system is introduced in stages, which reduces implementation risk but may prolong the transition.
• Pilot: The system is first deployed to a limited group or location. This is useful for testing but does not necessarily minimize downtime for the entire organization.

• The inference container image or built-in algorithm
• The location of model artifacts in Amazon S3
• IAM permissions through the execution role
• Optional environment variables and networking settings

1. Create AWS::SageMaker::Model
2. Create an AWS::SageMaker::EndpointConfig that references the model
3. Create AWS::SageMaker::Endpoint that references the endpoint configuration

• AWS::SageMaker::Endpoint hosts a model but does not define the model itself.
• AWS::SageMaker::NotebookInstance provides a development environment.
• AWS::SageMaker::Pipeline orchestrates ML workflow steps.

• A. Configure prompt modifications to enforce tone, disclaimers, and refusal behavior at the system level.

• D. Configure Power Platform DLP policies to restrict unauthorized data connectors.

• B: Manual topic-by-topic disclaimer edits are specifically discouraged.
• C: Channel settings do not replace agent-level Responsible AI controls.
• E: Publishing before enabling safety filters violates the stated deployment sequence. Responsible AI filters should be enabled before publication, not afterward.

• 2000::/3 — Global unicast, used for publicly routable IPv6 addresses.
• FC00::/7 — Unique local, used for private internal addressing.
• FE80::/10 — Link-local, used only on the local network segment and not routed between subnets.

• OpenID Connect (OIDC) is an authentication layer built on OAuth 2.0.
• It returns an ID token, normally a JWT containing identity claims such as the user’s subject, name, email, or other permitted attributes.
• The wellness application can consume those claims without needing a separate user-information call.

• JWT Bearer Token Flow: intended for server-to-server authorization and does not primarily provide an end-user ID token.
• Web Server Flow: is an OAuth authorization-code flow. It can be used with OIDC in some implementations, but “Web Server Flow” alone does not specifically guarantee an ID token.
• User Agent Flow: describes an OAuth flow, not the identity protocol itself.

• Answer: B — Improve employee training and awareness

• Why this is correct:

• Why the other options are less effective here:

• Quick practical note:

• Correct answer: D. AWS CloudShell

• Why: AWS CloudShell is a browser-based shell that runs in the AWS Console and uses the current authenticated session. It provides a pre-authenticated, ready-to-use command-line environment directly from the Management Console, with AWS CLI and common tools installed.

• Why the other options aren’t correct:

• Assign users or their team an appropriate security role.
• Ensure the role has the required table privileges, such as read, create, write, and append.
• Share the app with that security role in the app designer.

• Dynamics administration center: Used for environment and service administration, not routine app access configuration.
• Manage Roles: Not the specific Dataverse area used to define app and data permissions.
• Security Roles: Define what users can access and which operations they can perform.

• What the scenario asks: You have a Power BI semantic model that pulls from multiple sources (Azure SQL Database and SharePoint Online), must support a single dataset for three reports, keep data current (daily refresh by 7 AM PT), and apply RLS to limit sales data by region. You need to choose a storage mode for the tables.

• Correct choice: Dual storage mode.

• Why Dual fits:

• Key concepts:

json 
{ 
  "Effect": "Deny", 
  "NotAction": [ 
    "iam:*", 
    "route53:*", 
    "cloudfront:*", 
    "support:*" 
  ], 
  "Resource": "*", 
  "Condition": { 
    "StringNotEquals": { 
      "aws:RequestedRegion": "eu-west-1" 
    } 
  } 
}

• SCPs set maximum permissions; they do not grant permissions. The default SCP allows actions, so the restriction must be an explicit Deny.
• aws:RequestedRegion checks the Region targeted by an API request.
• StringNotEquals: eu-west-1 denies requests directed to every other Region.
• NotAction allows designated global services to remain usable because they do not operate in a single AWS Region.
• Attaching the SCP to the OU makes it apply to existing accounts and accounts later added to that OU.

• A Layer 2 switch checks the destination MAC address in its MAC address table (CAM table).
• If the destination MAC is unknown, the switch cannot select a specific outgoing port.
• It therefore performs unknown-unicast flooding, sending the frame out every other port in that VLAN.
• The frame is not sent back through the port where it arrived.

• Basic: Self-help only; no technical support or design assessment.
• Developer/Standard: Technical support, but generally not the full proactive architecture guidance required here.
• Professional Direct: Includes proactive guidance and architecture recommendations.
• Premier: Also supports this, but is not the minimum-cost option.

• 6-phone boxes: 6x
• 8-phone boxes: 8x

• vSmart controls the overlay control plane. It uses OMP to exchange routing information, distribute policies, and determine how WAN Edge devices reach one another.
• vManage is the centralized management and configuration platform.
• vBond is the orchestrator. It helps devices authenticate, discover controllers, and traverse NAT during onboarding.
• APIC-EM is not the SD-WAN control-plane component described here.

• What the dataflow options mean:

• Why C fits best:

Flat organisation

• Few levels of management
• A wide span of control—managers supervise many employees
• Shorter communication channels
• More employee autonomy and quicker decisions
• Fewer formal promotion levels

Tall organisation

• Many levels of management
• A narrow span of control—managers supervise relatively few employees
• A clear hierarchy and reporting structure
• More formal supervision and communication channels
• More obvious promotion and career stages

• Alice is co-resident on the same physical host and exploits shared hardware (the processor cache) to infer secrets. This is the classic definition of a side-channel attack—information leakage through implementation details (like timing or cache behavior) rather than by breaking a protocol or injecting code.

• Observing cache timing or access patterns to deduce cryptographic keys or plaintext data from the victim VM.

• Man-in-the-cloud attack: targets cloud trust/auth, not local hardware sharing.
• SQL injection: exploits input to run SQL commands, not a VM/caching vector.
• Service hijacking: takes control of a service, not about covert data leakage via shared hardware.

• Notice phrases like “shared hardware resources,” “co-resident,” or “cache”—these indicate a side-channel vector.

• Correct answer: C) After installing ES on the search head(s) and running the distributed configuration management tool.

• ES requires the Splunk_TA_ForIndexes.spl add-on on indexers to apply index-time configurations. It should be deployed via the distributed configuration management (DCM) flow after ES is installed on the search heads, so the indexers receive the proper configuration in a controlled, versioned bundle.

• A) Deploying when adding apps to the deployment server isn’t the ES-specific order; it bypasses the ES-instantiated workflow.
• B) Installing Splunk_TA_ForIndexes.spl first isn’t the recommended order; ES needs to be installed on the search heads first.
• D) It isn’t limited to indexer cluster sites or cluster master commands; the standard flow uses DCM to push the TA to indexers in general.

• Workspace: Stores notebooks, libraries, jobs, and other project resources.
• Notebooks: Interactive documents containing code, queries, visualizations, and explanations. Common languages include Python, SQL, Scala, and R.
• Clusters: Groups of virtual machines that run Spark workloads. Clusters can be started, stopped, and automatically scaled.
• Data access: Databricks can read from services such as Azure Data Lake Storage, Azure Blob Storage, and Azure SQL.
• Jobs: Automate notebooks or data-processing workflows on a schedule or in response to events.

• Hardware and infrastructure
• System software
• Networks and communications
• Technology platforms and services

• Business Architecture: Defines business strategy, organization, functions, and processes.
• Data Architecture: Defines the structure and management of enterprise data.
• Application Architecture: Describes application systems and how they interact to support business and data processing.

1. Start with the 48-bit MAC address.
2. Split it into two 24-bit halves.
3. Insert FF:FE between the halves, creating a 64-bit value.
4. Invert the U/L bit—the seventh bit from the left in the first MAC byte.

text 
MAC:       00:1A:2B:3C:4D:5E 
EUI-64:    02:1A:2B:FF:FE:3C:4D:5E

• FE80 is the prefix commonly used for an IPv6 link-local address, not part of the EUI-64 interface ID.
• The interface ID is not random.
• The MAC address is modified by inserting FF:FE and changing the U/L bit.

1. Get Data ? Folder in Power BI Desktop.
2. In Power Query Editor, expand the Attributes column to expose metadata such as hidden status and other file attributes.
3. Remove the Content column (and any other data columns you do not need).

• Name
• Extension
• Date accessed
• Date modified
• Folder Path
• Attributes
• Content

• staff use the new system;
• transactions and reports are checked;
• problems are corrected;
• feedback is collected.

• Phased changeover: different parts or functions are introduced in stages, often according to a planned sequence.
• Pilot changeover: one representative department, branch or group acts as a test site before wider implementation.
• Parallel changeover: old and new systems operate at the same time.
• Direct changeover: the old system is stopped and the new one starts immediately.

• GPU: A failure may cause no video output, but the PC usually still powers on.
• RAM: Can prevent booting or produce error beeps, but fans and power indicators generally work.
• CPU: Can prevent startup or booting, but it usually does not cause a completely lifeless system.

• Answer: Internal load balancers (ILB) — option C.

• An ILB has a frontend IP address that must be a private IP within the subnet’s address space. You pick this IP when you create the ILB, and it can be Static or Dynamic.
• Other options don’t require a per-subnet IP:

• Goal: Identify the host that originated the infection, then label each remaining host as infected or clean based on log evidence.

• Logs to review (across hosts and firewall):

• How to identify the origin:

• How to classify other hosts:

• Quick tip: use the Reset All option if you want to re-run the scenario and practice again.

• Improve QA testing efficiency: A prototype may help discover defects early, but that is not its greatest benefit.
• Decrease time allocated for user testing and review: Prototyping usually requires additional user involvement and review, not less.
• Minimize scope changes: Prototypes can actually reveal new requirements or cause scope changes. However, discovering those changes early is beneficial.

• Sending calls to available agents quickly
• Balancing interactions across agents
• Preventing calls from being handled manually one at a time

• Workforce Management: Forecasts demand and schedules enough staff; it supports wait-time reduction but does not directly distribute calls.
• Skill-based Routing: Routes calls based on agent skills and may improve the customer experience, but the question is asking about the core feature that distributes calls efficiently.
• IVR: Lets callers navigate menus and self-service options; it does not primarily assign calls to agents.

• Assignment
• Decision
• Get Records
• Loop

• Screen flow: Would include a Screen element.
• Inactive version: Inactive status does not restrict the available elements.
• Activated version: Activation status also does not determine the toolbox contents.

• Amazon GuardDuty: Detects suspicious activity and threats using security-related data sources; it is not primarily a software vulnerability scanner.
• Amazon Detective: Helps investigate and analyze the root cause of security findings after an event.
• Amazon Cognito: Provides user authentication and authorization for applications.

• The files are stored in a document library, which is exposed through the SharePoint Folder connector.
• The connector returns file metadata, including Folder Path, Name, and Content.
• In Power Query, filter Folder Path so only files in the manufacturing reports folder are retained.
• You can then combine the remaining Excel files because they all have the same structure.

• SharePoint List is for SharePoint lists, not document-library files.
• Combine & Load combines files immediately, before you filter to the required folder, and may include unwanted files.
• Transform gives you the opportunity to filter the file list first, which is more efficient and targeted.

• A: Daily involvement is unnecessary and may not solve the availability problem.
• C: Clarifying all requirements at the start conflicts with agile’s iterative refinement.
• D: Simply reviewing based on availability leaves the problem unresolved and allows rework to continue.

• A is correct: Days beyond the included period incur an extra daily charge.
• D is incorrect: Daily use after 10 days is not free.
• B and C: Data-transfer pricing can depend on the direction and service terms. The exam’s intended distinction is that the included device usage period is the clearly stated no-cost benefit.

• View/inspect configuration: Possible.
• Modify the installed application or its S-Controls: Typically restricted in a test-drive org.

• Correct answer: C: Amazon Comprehend.

• Why: The library wants to classify books based on their text content. This is an NLP (natural language processing) task. Amazon Comprehend is AWS’s managed NLP service that can perform content classification (including creating custom classifiers) and extract meaningful information from text. The other services are not focused on text classification:

• Quick note: In practice, you’d store the books in S3, extract text if needed (e.g., from PDFs with Textract), and then use Comprehend to classify the documents into topics or genres.