Salesforce IDENTITY-AND-ACCESS-MANAGEMENT-DESIGNER Exam Prep
Salesforce Certified Identity and Access Management Designer (Page 8 )

• The users currently have Office 365 Enterprise E3 licenses assigned directly.
• Assigning Microsoft 365 Enterprise E5 through a group does not automatically remove their directly assigned E3 licenses.
• From the Licenses blade, you can select the E3 product and remove it from all assigned users in one operation. This requires less effort than editing 2,500 users individually.

• Identity Governance manages access reviews, entitlement management, and related governance—not bulk license removal.
• Set-AzureAdUser does not remove product licenses.
• Set-WindowsProductKey applies Windows product keys and is unrelated to Microsoft 365 licensing.

• A: Concerns task scheduling and avoiding missed runs, not directly sizing the warehouse.
• B: The amount of data in a stream alone does not reliably determine compute needs; the SQL processing is what matters.
• D: A multi-cluster warehouse addresses concurrency, not the compute size needed for one task execution.

• netstat -tuln can show listening TCP ports.
• If the web service is not listening, or is bound only to 127.0.0.1, remote browsers cannot connect even though the server responds to ping.

• traceroute: Tests the path to the server, but ping already confirms basic reachability.
• tcpdump: Useful for detailed packet analysis, but it is more appropriate after checking whether a service is listening.
• arp: Helps troubleshoot local IP-to-MAC resolution, not an application-layer web connection.

1. Open Notepad as Administrator.
2. Open:

1. Remove or correct the line mapping the website to the wrong IP address.
2. Save the file.
3. Optionally run:

cmd 
   ipconfig /flushdns

• Determine risk tolerance: Tolerance defines how much variation or exposure the organization is willing to accept. Scenarios may help apply tolerance, but they do not primarily determine it.
• Determine risk appetite: Risk appetite is established at an enterprise or governance level. Scenarios help compare risks with the appetite; they do not normally establish it.
• Develop risk responses: Once risks are identified and assessed, scenarios support response planning. However, response development comes later.

sql 
ALTER TABLE dbo.DimCustomer 
ADD CONSTRAINT PK_DimCustomer 
PRIMARY KEY NONCLUSTERED (CustomerKey) 
NOT ENFORCED;

1. ALTER TABLE dbo.DimCustomer
2. ADD CONSTRAINT PK_DimCustomer PRIMARY KEY NONCLUSTERED (CustomerKey)
3. NOT ENFORCED

• Early units show relatively large time savings.
• Later units still take less time, but the reduction becomes progressively smaller.
• The curve therefore becomes flatter as production approaches 256 units.

• B: The reduction is not constant; learning normally diminishes over time.
• C: Time does not reduce at an increasing rate.
• D: A steady state may eventually be reached, but the question concerns the first 255 units while learning is still occurring.

• Power BI dataset — Reuses the existing tables, relationships, and measures. You mainly create new visualizations.
• SharePoint folder — Connects to the source files, but you would need to rebuild the model and measures.
• Power BI dataflows — Primarily provide reusable data preparation; they do not automatically provide the existing report’s measures and model.
• Excel workbook — Requires reconnecting to and modeling the source data again.

• Root path cost
• Port priority
• Port ID

text 
interface GigabitEthernet0/1 
 spanning-tree vlan 10 port-priority 64

• Interface number: Helps form the port ID but is not normally configured as the preference value.
• VLAN priority: Not used to select a preferred forwarding interface.
• Hello time: Controls how often BPDUs are sent; it does not select a preferred port.

• STIX: A standardized format for exchanging cyber-threat intelligence.
• OVAL: A language and framework for describing and assessing system vulnerabilities and configuration issues.
• Threat intelligence feed: Provides current indicators or threat information, but is not specifically a reference for common application exploitation techniques.
• CVE: A catalog of publicly disclosed vulnerabilities, identified by unique CVE numbers.

• A. Adjust resolution: Incorrect because an incompatible resolution usually causes no display, distortion, or an unsupported-mode message—not intermittent flickering.
• B. Swap the HDMI cable: Correct. Replacing the common, easily tested component is the appropriate troubleshooting step.
• C. Replace the projector: Incorrect because the issue also occurs with a monitor.
• D. Configure refresh rate: A mismatched refresh rate can cause visual problems, but the repeated flicker across displays points more strongly to the cable.

• Understating expenses and liabilities
• Overstating profit
• Misleading users of the financial information
• Potentially breaching integrity, objectivity, and professional competence and due care

• Reconnaissance: Gathering information about the target.
• Weaponization: Creating or combining a malicious payload with a delivery method.
• Delivery: Sending the payload, such as through phishing.
• Exploitation: Triggering a vulnerability or weakness to gain execution or access.

Correct sequence

1. Merge Sales_Region with Sales_Manager using an inner join

1. Merge Region_Manager with Manager using an inner join

1. Merge Sales_Region and Region_Manager using a right join as a new query

• Regression predicts continuous numeric outcomes, such as house price, temperature, or sales amount.
• Linear regression assumes the target can be estimated from a linear relationship between the input features and the target.
• In Azure Machine Learning, you use a labeled dataset containing:

• Classification predicts a category or class, such as “spam” or “not spam.”
• Clustering groups similar records without a known label; it is an unsupervised learning technique.

• Three DHCP scopes: Each VLAN has its own IPv4 subnet. DHCP scopes are subnet-specific, so create one scope for:

• Two DHCP relays: DHCP client discovery begins as a broadcast, and broadcasts do not cross routers or VLAN boundaries. Therefore, configure a DHCP relay on the router or Layer 3 switch interface for each client VLAN.

• Additional running costs: $800
• Less depreciation: $300

• The $100 reduction in fixed production overhead absorbed is only an accounting reallocation. It does not represent an actual saving in total fixed overhead.

• Remote and global work: Access is based on the approved device, not a specific office or geographic location.
• Seamless login: Users may not need to repeatedly enter credentials on a recognized device.
• Limited equipment: It uses devices employees already have rather than requiring separate hardware.

• Geotagging: Restricts access based on location and may prevent legitimate remote work.
• Smart cards: Require issuing and managing additional physical equipment.
• Time-based logins: Limit access by time and do not provide a seamless authentication experience.

• Scale out during the hours when customer traffic is high.
• Scale in during low-demand periods, reducing instance-hours and cost.
• Use scaling policies based on metrics such as CPU utilization or request count.

• Multiple Availability Zones: Improves availability and fault tolerance, but does not automatically reduce cost.
• Placement group: Helps with specialized performance or low-latency requirements, not cost optimization.
• Private subnets: Improve network security, but do not automatically adjust capacity or reduce EC2 usage costs.

• A password cracker would normally be identified by behavior such as loading password hashes or attempting dictionary/brute-force attacks.
• The question describes a routine audit, not password recovery.
• Simply encountering a protected file during an audit is characteristic of a misconfigured or insufficiently privileged FIM.

• IaaS: You deploy and manage virtual machines, including the operating system and installed software. Azure manages the physical datacenter, hosts, and networking infrastructure.
• PaaS: Azure manages the infrastructure and operating system, while you deploy and manage your application code. Examples include Azure App Service and Azure Functions.

• Dark web: A place where leaked credentials may be sold or shared, not usually the original source.
• Threat feeds: Collections of intelligence about threats, not a typical leakage source.
• State actors: A type of attacker, not an accidental corporate disclosure source.
• Vulnerability databases: Track known vulnerabilities, rather than leaked credentials.

• Accept: Acknowledge the risk and take no additional action.
• Transfer: Shift the risk or its financial impact to another party, such as through insurance or outsourcing.
• Mitigate: Reduce the likelihood or impact of the risk, such as by implementing security controls.
• Avoid: Eliminate the activity or exposure that creates the risk.

• Firewall
• Intrusion prevention and detection
• Antivirus or antimalware
• Web and email filtering
• Virtual private networking (VPN)
• Sometimes content filtering and centralized reporting

• A is valid:

apex 
  for (Account theAccount : AccountList) { 
      // process theAccount 
  }

• D is conceptually valid, using an index:

apex 
  for (Integer i = 0; i < AccountList.size(); i++) { 
      Account theAccount = AccountList[i]; 
  }

• B is invalid because for(AccountList) is not valid loop syntax.
• C is invalid because each item is an Account, not a List.

• Active remediation actions role in Microsoft Defender for Endpoint

• Security Reader role in Azure AD/Entra ID

• Security Administrator is broader than necessary because it grants extensive security-management permissions, violating least privilege.
• Compliance Data Administrator is intended for compliance data management, not Defender for Endpoint remediation approvals.

• Products ? OrderHistory: Products is 1, OrderHistory is many (1:*)

• Date ? OrderHistory: Date is 1, OrderHistory is many (1:*)

• up ? down ? up
• Often happens rapidly or intermittently

• Faulty or loose cable or connector
• Failing transceiver, NIC, or switch port
• Speed/duplex or auto-negotiation problems
• Power or hardware instability
• Layer 1 interference

• Nothing plugged in: the port is simply down
• Latency: does not directly trigger err-disable
• shutdown: administratively disables the port, but that is not the same as an automatically detected err-disabled condition

Statement 1 — Correct

Statement 2 — Correct

• Bronze: Raw ingested data
• Silver: Cleaned, validated, and transformed data
• Gold: Business-level data for analytics, dashboards, and reporting

• Internal hostnames and subdomains
• Network structure and naming conventions
• Servers and services
• Relationships between systems

• Determining ISP-assigned address space: Usually involves external registration and DNS information, not internal host discovery.
• Bypassing DNS sinkholing: Would require evidence that malicious DNS requests avoided redirection.
• Initial access: DNS queries alone do not show that the attacker gained access.
• Exfiltrating data: DNS tunneling can do this, but the snippet would typically show encoded or unusually long DNS queries.

• Future costs — Only costs occurring in the future can be affected by the investment decision. Past costs are sunk and irrelevant.
• Incremental costs — These are additional costs caused by choosing the investment. They are relevant because they differ between alternatives.
• Cash flows — Capital investment decisions are based on future cash inflows and outflows, usually discounted to present value.

• Committed costs have already been agreed or incurred and generally cannot be changed by the decision.
• Unavoidable costs will arise regardless of which option is selected, so they do not affect the choice.

• Instant messaging/chat: Can be abused to send malicious links or attachments, but P2P file sharing is the more direct high-risk source.
• E-mail: A common malware delivery method, but this question specifically emphasizes an application type associated with direct file exchange.
• End-to-end applications: This describes communication protection or architecture, not a specific application category known for malware distribution.

• Suspended an operator who correctly refused to use unsafe equipment.
• Rewarded another operator for using the equipment despite the broken safety guard.

• A — Management is not particularly concerned with managing risks.

• B — Employees will perceive that management does not care about health and safety risks.

• C — This factory’s safety record is likely to be poor.

1. Clear principles and boundaries — Employees have freedom, but decisions must remain within clear organizational values, policies and limits.
2. High degree of freedom — Managers are trusted to make decisions rather than seeking continual approval from senior management.
3. Frontline customer responsibility — Customer-facing managers should be empowered to manage customer relationships and respond quickly to needs.
4. Transparent and ethical information — Information should be openly available and used honestly, supporting trust and informed decision-making.

• A: Build a custom API — possible, but unnecessary as the primary solution and potentially more costly to develop and maintain.
• B: Use pre-built chatbots — these generally answer questions but may not support the required custom workflow and real-time actions.
• C: Fine-tune with sample data — improves model behavior but does not provide live database access.
• D: Google Cloud databases + Vertex AI — stores current inventory data and lets an AI agent retrieve it and take actions based on up-to-date information.

• B — Notify affected business units: Notification should follow an initial determination of scope and impact; otherwise, the organization may communicate incomplete or inaccurate requirements.
• C — Assess noncompliance risk: Risk assessment requires understanding the regulation’s requirements first.
• D — Inform senior management: Management should be informed, but with a clear summary of the regulation’s impact, risks, and recommended actions.

• Controlar o fluxo de dados entre S3 e SageMaker;
• Aplicar regras de segurança por meio da VPC;
• Reduzir a exposição dos dados;
• Permitir acesso privado ao bucket do S3.

• Amazon Inspector: avalia vulnerabilidades, mas não gerencia o fluxo de dados.
• Amazon Macie: ajuda a descobrir e proteger dados sensíveis no S3, mas não cria a conexão com o SageMaker.
• S3 Glacier Deep Archive: é uma classe de armazenamento para arquivamento, não uma solução de conectividade.

1. Create a temporary Onboarding OU.
2. Move the new account into it.
3. Move the restrictive SCPs from the organization root to the Production OU.
4. Allow the account to update AWS Config.
5. Move the account into Production after onboarding.

• An SCP attached at the organization root applies to every account and OU beneath it.
• An SCP attached to the Production OU applies only to accounts in that OU.
• Therefore, moving the restrictive SCP from the root to Production temporarily exempts the onboarding account without weakening the policies for existing production accounts.
• Once onboarding is complete, moving the account into Production subjects it to the normal restrictions.

• Matching hashes: The software is likely unchanged.
• Different hashes: The software or its contents have been modified.

• Encryption: Protects confidentiality, not primarily integrity.
• Baselines: Document expected configurations and support comparison, but hashing is more directly suited to verifying file integrity.
• Tokenization: Replaces sensitive data with tokens and is unrelated to software tampering.

• The audience and stakeholders
• The complexity and type of requirements
• The communication method and level of detail needed
• Whether to use diagrams, models, documents, demonstrations, or slides

• B: Authority to host the presentation is not the key preparation activity.
• C: Stakeholder sign-off may occur later; presenting requirements does not always require formal approval beforehand.
• D: A scribe may be useful in a meeting, but hiring one is not a core preparation requirement for presenting.

• desktopwidth:i:1280
• desktopheight:i:1024

• Connection information: Controls connection-related settings, not the desktop resolution.
• Scaling plan: Controls when session hosts start, stop, or scale based on demand.
• Session behaviour: Controls behavior such as disconnect or logoff handling.
• Display settings: Specifically controls RDP display properties, making it the appropriate choice.

• Driver node: Coordinates Spark jobs and runs in the compute environment.
• Worker node: Executes tasks and processes data.
• Databricks Filesystem (DBFS): Provides storage access for data used by compute resources.

• Training data for potential bias before model training
• Trained models for bias in predictions
• Model features to help explain how they influence predictions

• A: RAG workflows are typically built using services such as Amazon Bedrock, knowledge bases, and data sources.
• B: Monitoring model quality in production is primarily associated with SageMaker Model Monitor.
• C: Documenting model details is handled by capabilities such as SageMaker Model Cards.

• The connected switch
• The switch’s port/interface
• Device and port descriptions
• Sometimes VLAN or management information

• IKE: Establishes security associations for IPsec VPNs.
• VLAN: Defines logical network segmentation; it does not identify a physical switch port.
• netstat: Displays local network connections and statistics, not the upstream switch and port.

• Customize Opportunity Contact Role
• Add the Opportunity Contact Role related list to the Opportunity page layout

• Customers may boycott V’s products.
• Supermarket customers may stop buying from V.
• Investors may view V as having higher legal, ethical and reputational risk.
• V could face fines, lawsuits, contract losses and higher costs.
• Expected future profits may fall.

• B — AWS DataSync: Transfers data between storage systems. It is not a marketplace or integration service for third-party datasets.
• C — Kinesis Data Streams and CodeCommit: CodeCommit stores source code, not third-party analytical datasets. Kinesis is for streaming data, not retrieving datasets from repositories.
• D — Kinesis Data Streams and ECR: Amazon ECR stores container images, not third-party datasets.

• Identifies which user or department owns the device
• Supports inventory and compliance requirements
• Enables tracking of lost, stolen, retired, or unauthorized devices
• Helps enforce security controls such as mobile-device management and secure configuration