Salesforce IPQ-435 Exam Actual Questions
Build CPQ Solutions for Industries (Page 25 )

• Quick context: In a three-tier network (Access, Distribution, Core), roles are:

• Why A is correct: The Distribution layer runs Layer 2 and Layer 3 technologies. It often handles VLAN access (L2) and can perform inter-VLAN routing or connect to the core (L3). So it makes sense for the distribution layer to support both L2 and L3.

• Why B is correct: The Core layer is designed to maintain continuous connectivity when devices fail. It is built for high availability and redundancy, providing multiple paths so the network remains reachable even if some components fail.

• Why the others are not correct:

• Voice devices ? VLAN 10
• Data devices ? VLAN 20
• SVI for VLAN 10 ? 192.168.10.1
• SVI for VLAN 20 ? 192.168.20.1

• A: Describes a physical trunk interface, not an SVI.
• B: An SVI can provide management access, but that is not its primary definition here.
• D: SVI does not compensate for insufficient physical ports; it is a logical interface.

• Users retain their existing usernames and passwords.
• Existing accounts can be used to access Azure-based resources.
• Administrators avoid manually recreating thousands of accounts.
• The transition is less disruptive before the on-premises data center is retired.

• Cutover: The old system is replaced immediately. It may be fast, but any failure can cause significant disruption.
• Phased: The system is introduced in stages, which reduces implementation risk but may prolong the transition.
• Pilot: The system is first deployed to a limited group or location. This is useful for testing but does not necessarily minimize downtime for the entire organization.

• TCP is connection-oriented. It establishes a connection before data transfer using a three-way handshake (SYN, SYN-ACK, ACK), enabling reliable delivery, ordering, and flow control.

• UDP is connectionless. It sends datagrams without a prior connection and provides no guarantee of delivery, order, or protection against duplicates; any reliability is up to the application.

• B incorrectly states UDP uses acknowledgment packets; UDP has no built-in ACKs.
• C wrongly claims UDP provides reliable transfer and that TCP is connectionless.
• D misstates framing bits; neither protocol uses the listed TCP/UDP handshake bits in frames.

• Multiple nodes: Data is replicated several times in the primary region.
• Separate geography: A copy is asynchronously replicated to a secondary Azure region.
• Readable secondary: RA-GRS provides read-only access to the secondary replica, even when the primary region is available.

• GRS: Replicates to another region but the secondary copy isn’t normally readable.
• ZRS: Replicates across availability zones in the same region, not a separate geographic region.
• LRS: Keeps replicas within a single datacenter or region and provides no geographic redundancy.

• A — IDS attack signatures: An IDS generally detects suspicious network activity but does not necessarily scan uploaded PDF files or prevent them from being accepted.
• C — Load balancer: Distributes traffic among servers; it does not inspect files for malware.
• D — WAF command-injection blocking: A WAF can help block web attacks such as command injection, SQL injection, and cross-site scripting, but this option does not specifically address malicious PDF uploads.

• D. Provide public endpoints to store and retrieve data

• E. Manage the infrastructure layer and the operating system

• Classifying data
• Configuring access permissions, such as IAM policies
• Selecting or configuring available encryption options, depending on the requirement

• What it says: you can add a cost when you adjust inventory, and that cost is posted automatically to a specific GL account.
• Reality: yes, you can adjust both quantity and value via an inventory adjustment journal. The cost on the journal line affects the inventory value.

• The general ledger postings are not arbitrary. the actual accounts used are determined by your item posting group and the system’s posting definitions. In practice, the adjustment debits/credits the appropriate inventory-related accounts (e.g., Inventory asset and a related offset such as an adjustment or COGS account) based on configuration.
• So, the cost change does not go to a single “manual” GL account you pick per line unless your posting setup maps to that account.

• The concept is true (you can adjust cost and have GL impact), but the claim that it posts to a single, specific GL account is oversimplified—the accounts come from your posting configuration.

• Ensure that only users who manage the production environment sign in to the Azure portal from a hybrid Entra-joined device and authenticate with MFA.

• Use Microsoft Entra ID Protection (Identity Protection) to enforce MFA enrollment:

• Update the existing Capolicy1 (a Conditional Access policy):

• Identity Protection MFA registration policy ensures users are enrolled in MFA (Box 1 choice).
• CA policy Capolicy1 with aGrant control of “Require MFA” enforces MFA during sign-in (Box 2 choice).
• Both work together with the hybrid-joined device requirement to satisfy the authentication/authorization rules.

• Apply the MFA registration policy to the production-management users.
• Apply the MFA grant to Capolicy1 for those same users/groups.

• A recipient who already has a Microsoft account or an organizational account can authenticate by signing in.
• A recipient without a usable Microsoft identity may receive a one-time passcode by email.
• The passcode is sent to the same email address that was invited and is used to verify ownership of that address.

• Correct answer: Power BI dataset

• The scenario says the data model already contains several measures and you want to create a report from the existing data with minimal development. Reusing a published Power BI dataset lets you inherit the existing measures and data model, so you don’t have to recreate them.
• How to do it: In Power BI Desktop, use the connector Power BI datasets (Get Data > Power BI datasets) and connect to the existing dataset, then build visuals using the pre-defined measures.
• Why the other options are less suitable:

• Ablauf: Er wird in der gleichen Transaktion ausgeführt, bei der z. B. ein Datensatz erstellt oder aktualisiert wird. Der Benutzer wartet, bis der Workflow abgeschlossen ist.
• Stufen: Kann vor dem Vorgang (pre-operation) oder nach dem Vorgang (post-operation) laufen.
• Zweck: Sofortige Validierung oder Anpassung von Daten, ggf. auch das Verhindern eines Vorgangs, wenn Bedingungen nicht erfüllt sind.

• Automatisierte Flows (Power Automate, automatisierte/ Background Flows) laufen asynchron im Hintergrund, nachdem der Trigger erkannt wurde, und blockieren den Benutzer nicht.

• The Well-Architected Framework has five pillars: Operational Excellence, Security, Reliability, Performance Efficiency, and Cost Optimization.
• Operational Excellence: how you run and improve your systems—monitoring, incident response, and evolving processes.
• Reliability: the ability of a workload to recover from failures, maintain uptime, and scale as demand changes.

• Availability (A) is not a pillar name; it’s an outcome that relates to Reliability.
• Scalability (C) isn’t a pillar name; scalability touches on Performance Efficiency.
• Responsive design (D) is not a pillar in the Well-Architected Framework.

• I can’t view the images, so I can’t tell which table is labeled as A in your screenshot. But here’s how to decide:

• How to identify the fact table:

• How to identify the surrogate key in the Patient table:

• Relationship:

• Permanent table (E): Correct. A dropped permanent table can be restored with UNDROP TABLE during its Time Travel retention period. Permanent tables also have Fail-safe protection.
• Transient table: It can also generally be restored during its shorter Time Travel period, although it has no Fail-safe. Therefore, excluding it makes the question questionable.
• Temporary table: Usually cannot be recovered after it is dropped; its lifecycle is limited to the session.
• Materialized view (D): The answer key treats it as recoverable, but recovery behavior depends on the specific Snowflake object/version capabilities. It should not be confused with an ordinary view.

• Residual neural network (ResNet): Primarily used for computer vision tasks such as image classification.
• Support vector machine (SVM): Commonly used for classification and regression, not natural-language query generation.
• WaveNet: Designed mainly for generating or modeling audio and speech.

• The correct answer: C. Tokenization

• Why:

• Why the others are weaker:

• Context: You’ve enabled auditing in Dataverse and need to trim audit data to free storage. The question asks which deletion options you can use.

• What the options typically mean:

• About the provided answer (A, C, D): The list includes “by column,” which isn’t a typical or supported way to purge audit data. The more plausible trio is A (by record), B (date range), and C (by table older than date). If the exam expects A, C, D, that seems incorrect or mis-stated in the source.

• Practical takeaway: To reduce audit storage, use per-record deletions, per-table purge by date, and/or date-range deletions as supported by the environment’s audit management UI or admin docs.

• On-Demand: You pay by the hour with no long-term commitment. This is ideal for workloads that are infrequent or have highly variable usage. Since this job runs only 24 hours once per year, you pay only for those 24 hours, with no wasted upfront or long-term payments.
• Reserved Instances: Require a 1- or 3-year commitment and pay for capacity whether you use it or not. For a workload that runs just 24 hours a year, you’d be paying for most of the term unused, making it far less cost-efficient.
• Spot Instances: Can be interrupted whenever AWS needs capacity, which is unacceptable for an uninterruptible workload.
• Dedicated Instances: Generally more expensive and aimed at licensing or compliance requirements; not needed for this use case.

• Startup scripts run at computer startup, before any user logs on, making them ideal for machine-wide configuration on each new VM.
• They execute under the Local System account, which is appropriate for initial setup tasks.
• Linking a GPO to the OU ensures every new VM in that domain automatically receives the configuration—great for scalability.

• A) SetupComplete.cmd runs only once, right after Windows Setup, not on every boot, so it isn’t ideal for provisioning multiple VMs consistently.
• B) Logon scripts run per user, not per machine, so they aren’t reliable for initial VM configuration before a user signs in.
• D) Placing scripts in a VHD doesn’t automatically execute them.

• A. Configure prompt modifications to enforce tone, disclaimers, and refusal behavior at the system level.

• D. Configure Power Platform DLP policies to restrict unauthorized data connectors.

• B: Manual topic-by-topic disclaimer edits are specifically discouraged.
• C: Channel settings do not replace agent-level Responsible AI controls.
• E: Publishing before enabling safety filters violates the stated deployment sequence. Responsible AI filters should be enabled before publication, not afterward.

• Network Security Groups (NSGs) control network traffic to and from Azure resources.
• By applying NSGs to the web tier and the database tier (subnets or NICs), you can:

• NSGs provide the necessary granularity (source/destination, port, protocol) to enforce the desired traffic patterns between tiers.
• For easier management you can use separate subnets for each tier or, optionally, use Application Security Groups to simplify rule management.

• The missing piece is to configure an event source mapping between the DynamoDB stream and the Lambda function. Enabling DynamoDB Streams alone doesn’t trigger the function—you must wire the stream to Lambda so events invoke the function.
• Note that changing StreamViewType (A) only affects what data is delivered (e.g., NEW_IMAGE) and does not trigger invocations. Options C and D are not required for invocation: you don’t need SNS, and increasing the timeout won’t enable the trigger.

• Correct answer: A) Hashing

• Why: Hashing produces a fixed-size digest of the software. If the final build is altered in any way, the hash will change, enabling you to detect tampering by comparing the stored digest with a freshly computed one.

• Why not the others:

• Answer: C — Spot Instances

• Why: The workload is a test environment that can be interrupted and does not need to run continuously. Spot Instances let you bid on unused EC2 capacity at a deep discount, making them the most cost-effective option for interruptible workloads.

• Why not the others:

• Quick tips:

• Batch processing, such as scheduled data transformations
• Streaming processing, such as continuously ingesting events

• Manipulating data with multiple languages: Mainly a benefit of Databricks and Spark.
• Real-time notebook collaboration: A workspace/notebook feature.
• Alerts for query failures: A Databricks SQL or job-monitoring feature.
• Distributing complex operations: Primarily a Spark compute capability.

• Multiple AWS accounts: Create a separate account for each department or workload. This provides clear isolation and makes it easier to track each department’s usage and costs for chargeback.
• Consolidated billing: AWS Organizations can combine billing for multiple accounts into one central payer account. The company can still view costs by account while managing payment centrally.

• Placement groups: Control how EC2 instances are physically placed for networking or performance; they do not provide departmental billing separation.
• Edge locations: Infrastructure used by services such as Amazon CloudFront; unrelated to chargeback.
• AWS Config: Records and evaluates resource configurations and compliance; it is not a billing-separation mechanism.

• Key difference: DirectQuery leaves data in the on-prem SQL Server and queries it live. That means every visual request can trigger online processing on the source, which can be slower and adds load on the on-prem system. In contrast, Import loads data into the Power BI data model, so visuals render from the in-memory engine (faster).

• Why that helps with the requirements:

• Why not A or B: Both rely on live data via DirectQuery, which contradicts the goal to minimize online processing and visuals performance.

• Why not D: It uses Import, but refreshing hourly adds unnecessary processing and complexity when daily refresh already satisfies currency needs.

• AWS IoT Greengrass supports local ML inference using models trained in Amazon SageMaker.
• The model and inference code run on the factory’s local server, so processing continues even when internet connectivity is unavailable.
• A Greengrass component can:

• This provides low latency and avoids sending images to AWS for every inference.

• A: Uses AWS-hosted services and therefore depends on internet connectivity. It would fail during an outage.
• C: Snowball Edge is unnecessary for this use case and adds deployment complexity. A local Greengrass server is the intended edge-inference solution.
• D: Amazon Monitron is designed for monitoring industrial equipment health, not analyzing camera images with a custom SageMaker model.

• Source: on-premises SQL Server Database1
• Destination: Fabric Warehouse Warehouse1
• Connectivity: on-premises data gateway

• Dataflow Gen1: Primarily for Power Query transformations and isn’t the best Fabric-native choice for this copy operation.
• KQL queryset: Queries data; it does not orchestrate copying from SQL Server.
• Notebook: Could perform custom code-based movement, but it is unnecessary and less direct than a pipeline.

• Correct answer: only new data added to the eventhouse (option E).
• Why: When you enable OneLake availability for the eventhouse, OneLake starts syncing data going forward. It does not automatically backfill or copy over data that already exists in the eventhouse before the enablement.
• What that means in practice: Any data added to the eventhouse after you enable OneLake will appear in OneLake (and be visible from OneLake file explorer). Pre-existing data in the eventhouse stays there unless you perform a separate backfill/copy operation outside the standard OneLake enablement.
• How to verify: add a small new dataset to the eventhouse after enabling OneLake availability, then check OneLake to confirm the new dataset appears.

• Basic: Self-help only; no technical support or design assessment.
• Developer/Standard: Technical support, but generally not the full proactive architecture guidance required here.
• Professional Direct: Includes proactive guidance and architecture recommendations.
• Premier: Also supports this, but is not the minimum-cost option.

• prompt: the input or instruction given to the model
• completion: the desired response

json 
{"prompt":"Summarize this customer complaint.","completion":"The customer reports a delayed shipment."}

• B: A .txt file containing CSV-style lines is not automatically a valid fine-tuning dataset. The required structure and format must match the selected Bedrock model.
• C: Provisioned Throughput provides dedicated inference capacity; it does not fine-tune a model.
• D: Journals and textbooks might support domain adaptation or pretraining, but they do not provide the prompt-to-answer examples typically required for supervised fine-tuning.

• Short answer: The correct term is Anti-forensics (option D), not “Felony.”

• Why: The actions described—hiding files in slack space, changing file headers, placing suspicious files in executables, and altering metadata—are classic anti-forensics techniques. They’re used to hinder or obscure forensic analysis, not to label the act as a legal category.

• About the options:

• Note: The provided answer key lists B (Felony), which is misleading for this exam objective. The exam typically tests knowledge of forensics concepts, where anti-forensics is the correct category.

• Assignment
• Decision
• Get Records
• Loop

• Screen flow: Would include a Screen element.
• Inactive version: Inactive status does not restrict the available elements.
• Activated version: Activation status also does not determine the toolbox contents.

• Basic: No technical or architectural guidance.
• Standard: Technical support, but not the required design-assessment service.
• Professional Direct: Provides advisory and architecture guidance.
• Premier: Provides it too, but is unnecessarily expensive for this requirement.

• The correct AAA mapping (per Cisco objectives) is:

• Why the given options aren’t fully correct:

• Quick takeaway: when you configure AAA, you should conceptually map them as:

• Example commands (to reinforce concepts):

powershell 
Get-AzureVM -ServiceName <service-name> -Name <vm-name> | 
  Set-AzureStaticVNetIP -IPAddress <private-ip> | 
  Update-AzureVM

• New-AzureRMVMConfig configures VM settings but does not itself assign the static IP.
• Set-AzureSubnet is not the appropriate cmdlet for assigning a VM’s private IP.
• The Azure portal option mentioned in the question was not the intended method for this older deployment model.
• Changing settings in Windows Network and Sharing Center is incorrect because Azure assigns the IP through the VM’s virtual network interface; manually configuring it inside the guest can cause conflicts.

• A — conformant: Incorrect because one explicit requirement is violated.
• B — consistent: “Consistent” is not sufficient where the implementation contradicts a mandatory specification. The RPC mechanism is covered by the architecture, and the implementation differs from it.
• C — consistent: Incorrect reasoning: the RPC mechanism does have a defined architectural requirement, so conformance must be assessed.
• D — non-conformant: Correct because the implementation fails to follow the specified RPC/threading requirement.

• 25 — Traditional SMTP server-to-server mail transfer; not normally used for secure client submission.
• 110 — POP3, used to retrieve email and typically unencrypted.
• 143 — IMAP, used to access email and typically unencrypted.

1. Get Data ? Folder in Power BI Desktop.
2. In Power Query Editor, expand the Attributes column to expose metadata such as hidden status and other file attributes.
3. Remove the Content column (and any other data columns you do not need).

• Name
• Extension
• Date accessed
• Date modified
• Folder Path
• Attributes
• Content

• The two correct options are:

• The two incorrect options:

Why B works

• AWS KMS keys are Regional resources. A normal customer managed key in Region A cannot be used directly in Region B.
• A customer managed multi-Region KMS key (MRK) has related key replicas in both Regions. The replicas share key material and key ID, although each has a Regional ARN.
• With client-side encryption, the application encrypts the data before storing it in S3. Cross-Region replication then copies already-encrypted objects, so S3 does not need to decrypt and re-encrypt them with a different Regional key.

Why the other choices are weaker

• A and C: SSE-S3 uses Amazon-managed S3 keys, not the required customer managed KMS key.
• D: SSE-KMS can work only if the solution creates and configures the appropriate KMS key or multi-Region key replica in each Region. As written, it says to create a customer managed KMS key in each Region, which implies separate keys—not the same KMS key. Replication also requires additional KMS permissions and destination encryption configuration.

• A. IDS attack signatures: An IDS primarily detects suspicious network activity and usually alerts rather than directly scanning and blocking uploaded files.
• C. Load balancer: Distributes traffic among servers but does not inspect files for malware.
• D. WAF: Protects web applications from attacks such as SQL injection, cross-site scripting, and some malicious requests. It is not primarily a PDF-malware scanning solution.

• Why Ishikawa:

• Why not the others:

• RPO (Recovery Point Objective) — maximum acceptable data loss, measured in time. It specifies how far back in time you can tolerate data loss. Example: RPO of 2 hours means backups must occur at least every 2 hours.

• ARO (Annualized Rate of Occurrence) — expected frequency of a threat occurring per year. It estimates how often a risk is likely to happen on average (used in risk calculations).

• MTTR (Mean Time To Recover) — average time to recover/restore service after an incident. It includes detection, repair, and restoration time, and helps gauge downtime and alignment with RTO.

• Drop violating frames
• Log or alert on the violation
• Shut down or restrict the port

• Load balancer: Distributes application traffic; it does not control switch MAC learning.
• IPS: May detect some network attacks but is not the primary control for switch MAC-table exhaustion.
• NGFW: Protects traffic crossing network boundaries, while MAC flooding occurs at the switching/LAN layer.

• Review the risk register.
• Use the previously defined risk response plan, such as assigning a backup resource, reprioritizing work, or using another qualified engineer.
• Implement the response promptly because the task is on the critical path.

• B: Revising the schedule without first applying the planned response may be premature.
• C: Excluding a required task could compromise the project’s objectives and requirements.
• D: Updating the risk and lessons learned records is appropriate, but it should happen after managing the immediate issue, not as the next primary action.

• S3 Versioning stores all versions of an object. If an object is overwritten or deleted, you can recover the previous version using its version ID.
• This protects against accidental deletion or overwriting because the original data remains accessible as an older version.
• How to enable:

• Practical notes:

• S3 Lifecycle rules: automate moving/expiring data, not specifically protection against deletion.
• S3 bucket policies: control access but don’t inherently preserve previous data.
• S3 server-side encryption: protects data at rest, not against deletion/overwrite.