SAP C_TS460_2021 Exam Prep
SAP Certified Application Associate - SAP S/4HANA Sales 2021 Upskilling (RETIRED) (Page 4 )

• Guest access: Controls external users invited into your teams as guests. It is not the primary setting for restricting federated communication by domain.
• Messaging policy: Controls messaging features, such as chat or message editing, rather than which organizations users can communicate with.
• Org-wide Teams settings: Contains broad Teams-wide configuration, but domain-based external communication is configured under External access.

• B — AWS DataSync: Transfers data between storage systems. It is not a marketplace or integration service for third-party datasets.
• C — Kinesis Data Streams and CodeCommit: CodeCommit stores source code, not third-party analytical datasets. Kinesis is for streaming data, not retrieving datasets from repositories.
• D — Kinesis Data Streams and ECR: Amazon ECR stores container images, not third-party datasets.

• Behavioral and anomaly detection
• Threat intelligence integration
• User and entity behavior analytics
• Automated response actions, often through SOAR integration

• Virus signatures: Associated primarily with antivirus or endpoint protection.
• Security agent deployment: Usually an endpoint-management or EDR function.
• Vulnerability scanning: Typically performed by vulnerability-management tools, though a SIEM may integrate their results.

1. It examines the source MAC address and learns it on the incoming port.
2. It examines the destination MAC address.
3. If the destination MAC is already in the MAC/CAM table, it forwards the frame only through the associated port.
4. If the destination MAC is unknown, it performs unknown-unicast flooding:

• Correct exam answer: A — HKEY_LOCAL_MACHINE
• The relevant location is associated with HKEY_LOCAL_MACHINE\SAM.
• The SAM does not store passwords in plain text; it stores password hashes.

• HKEY_CURRENT_USER contains settings for the currently logged-in user, not the account-password database.
• HKEY_USERS contains user profiles and settings loaded for users.
• HKEY_CURRENT_CONFIGURATION contains hardware/profile configuration information.

• Un AG puede tener réplicas en Windows y Linux desde SQL Server 2017; por tanto, una réplica Windows y otra Linux es posible.
• Sin embargo, las réplicas de un AG deben utilizar normalmente la misma versión principal de SQL Server. Una instancia SQL Server 2017 no puede tener directamente una réplica secundaria SQL Server 2019 como configuración normal y permanente.
• En tu escenario, SQL Server 2017 en Windows y SQL Server 2019 en Linux no se pueden añadir directamente como réplicas equivalentes de AG1. Primero habría que realizar un proceso de actualización/migración compatible, por ejemplo mediante una actualización gradual o una tecnología de migración como log shipping o distributed availability groups, según el diseño.

• Tipo de clúster y mecanismo de quorum.
• Failover normalmente manual en configuraciones multiplataforma.
• Edición y características compatibles.
• Configuración de endpoints y permisos.
• Limitaciones específicas de SQL Server en Linux.

• Row counts
• Minimum and maximum values for columns
• Distinct-value information
• Other characteristics used for optimization

• Denial-of-service: Prevents users from accessing a service; it does not normally redirect them.
• Social engineering: Manipulates people into taking an action, such as clicking a malicious link, but does not directly alter DNS resolution.
• ARP spoofing: Associates the attacker’s MAC address with another device’s IP address on a local network. It can intercept traffic, but the described website redirection is most specifically DNS poisoning.

• Response and resolution time frames
• Availability or uptime requirements
• Performance targets
• Support obligations
• Penalties for failing to meet requirements

• SOW (Statement of Work): Defines the project’s scope, tasks, and deliverables.
• MOA (Memorandum of Agreement): Describes cooperation and responsibilities between parties.
• MOU (Memorandum of Understanding): Records a general mutual understanding, usually without detailed enforceable service targets.

• Accept: Acknowledges the risk without taking additional action.
• Transfer: Shifts the risk or financial impact to another party, such as an insurer.
• Mitigate: Reduces the likelihood or impact through controls like patching, MFA, or segmentation.
• Avoid: Eliminates the activity that creates the risk.

• Run the backup with WITH CHECKSUM
• Store the backup on an SMB network share

sql 
BACKUP DATABASE DB1 
TO DISK = '\\FileServer\SqlBackups\DB1_full.bak' 
WITH CHECKSUM;

• DMS does not create the SQL Server backups for you.
• You must provide a valid full database backup.
• You must continue taking transaction log backups while the source database remains online.
• The full backup and subsequent log backups must be available in the SMB share that DMS can access.
• WITH CHECKSUM enables backup checksum validation, helping detect backup corruption.

• Which host first communicated with the suspected malicious source
• Whether that host initiated suspicious traffic or merely received it
• Which other hosts show evidence of infection, such as connections from the originating host
• Which hosts have no related suspicious activity and are therefore clean

• An outbound connection to a suspicious external address
• A downloaded or executed malicious file
• Later lateral connections from that host to other internal systems
• Firewall logs showing the direction and timing of the traffic

• Accept: Acknowledge the risk and take no additional action.
• Transfer: Shift the risk or financial impact to another party, such as through insurance or a contract.
• Mitigate: Reduce the likelihood or impact using controls, such as firewalls, training, or backups.
• Avoid: Eliminate the activity that creates the risk.

• Matching hashes: The software is likely unchanged.
• Different hashes: The software or its contents have been modified.

• Encryption: Protects confidentiality, not primarily integrity.
• Baselines: Document expected configurations and support comparison, but hashing is more directly suited to verifying file integrity.
• Tokenization: Replaces sensitive data with tokens and is unrelated to software tampering.

• Bronze: Raw ingested data
• Silver: Cleaned, validated, and transformed data
• Gold: Business-level data for analytics, dashboards, and reporting

• VLAN 10 for data
• VLAN 20 for voice

• A: Describes physical trunking or logical switch ports, not an SVI.
• B: An SVI can provide management access, but that is only one use—not the best description here.
• D: SVI use is not related to running out of physical ports.

• On-premises resources, such as an existing database
• Cloud resources, such as Azure services or virtual machines
• Connectivity that allows the application to use both environments

• Public cloud: resources are entirely provided through a public cloud provider.
• Private cloud: resources are dedicated to one organization, typically on-premises or privately hosted.

• Annual interest payments net of tax relief (A): future cash outflows for the issuer.
• Redemption value (B): the final cash outflow when the bond is redeemed.
• Market value now (C): the cash proceeds received now, acting as the initial cash flow in the IRR calculation.

• A — Tables
• B — Named file formats
• C — Schemas
• E — Databases

Why these are correct

• Tables: Can be cloned using CREATE TABLE ... CLONE. The clone initially uses zero-copy cloning, so storage is shared until changes are made.
• Named file formats: Can be cloned as database objects, preserving the file-format definition.
• Schemas: A schema and its eligible objects can be cloned.
• Databases: A database and its eligible schemas and objects can be cloned.

Why the others are incorrect

• Shares: A share is an account-level data-sharing object, not a normal cloneable database object.
• Users: Users are security principals and cannot be cloned with CLONE.

• CPU: Number of virtual CPUs and, where applicable, CPU reservations.
• Memory: Amount of memory and memory reservations.

• Network interface: Usually configured through the VM or workload networking configuration.
• PCI devices: Specialized hardware and not a standard VM Class resource in this context.
• Storage: Typically selected through storage policies or the VM’s storage configuration.

• The message came from the claimed sender (authentication)
• The message was not altered in transit (integrity)
• The sender cannot easily deny having signed and sent it (non-repudiation)

• Compliance standards: May be a reason in some organizations, but it is not the primary security benefit.
• Increase delivery rates: Digital signatures do not generally improve email delivery.
• Block phishing attacks: Signatures can help recipients verify legitimate messages, but they do not block phishing by themselves.

• Disable default accounts: Default or unused accounts may have known usernames or predictable settings, making them targets. They should be disabled, removed, or securely configured.
• Remove unnecessary services: Every running service creates potential vulnerabilities. Removing services the server does not need reduces exploitable entry points.

• Add the server to the asset inventory: Important for asset management, but not a hardening step.
• Document default passwords: Default passwords should be changed or eliminated—not documented for continued use.
• Send server logs to the SIEM: Valuable for monitoring and detection, but generally performed as part of logging/monitoring configuration.
• Join the server to the corporate domain: May be necessary operationally, but does not itself harden the server.

• Relationship cardinality:

• Filter direction:

• Active versus inactive relationships: only active relationships automatically propagate filters.
• Blank or unmatched values: a fact-table value without a matching dimension row can create the model’s blank/unknown member.
• Uniqueness: the “one” side must contain unique values; duplicate keys generally belong on the “many” side.

• IDS attack signatures: Primarily detects suspicious network activity; it is not the best control for scanning uploaded documents.
• Load balancer: Distributes traffic and can improve availability, but does not inspect files for malware.
• WAF: Helps block web attacks such as command injection and SQL injection, but it is not primarily a malware-scanning solution.

• A: Describes an update-set conflict, not a Dictionary Override.
• B: Describes a configuration item or change concept.
• C: Describes an approval or workflow activity.

• Understating expenses and liabilities
• Overstating profit
• Misleading users of the financial information
• Potentially breaching integrity, objectivity, and professional competence and due care

• A. IDS attack signatures: An IDS primarily detects suspicious network activity; it is not the best tool for scanning uploaded files.
• C. Load balancer: Improves availability and distributes traffic but does not inspect files for malware.
• D. WAF: Protects web applications against attacks such as SQL injection and command injection. It may inspect HTTP requests, but malware scanning of uploaded PDFs is the key requirement here.

• VPC: A logically isolated virtual network within a cloud provider; it describes network design, not the user-access model.
• NFV: Runs network services as software instead of on dedicated hardware.
• SaaS: Delivers software over the internet. Although the application may be delivered as SaaS, the question emphasizes its availability to multiple user groups, which points to multitenancy.

• The users currently have Office 365 Enterprise E3 licenses assigned directly.
• Assigning Microsoft 365 Enterprise E5 through a group does not automatically remove their directly assigned E3 licenses.
• From the Licenses blade, you can select the E3 product and remove it from all assigned users in one operation. This requires less effort than editing 2,500 users individually.

• Identity Governance manages access reviews, entitlement management, and related governance—not bulk license removal.
• Set-AzureAdUser does not remove product licenses.
• Set-WindowsProductKey applies Windows product keys and is unrelated to Microsoft 365 licensing.

• Deterrent control: The signs warning that people may be filmed can discourage unauthorized activity. They do not physically prevent the activity, but they may influence behavior.
• Detective control: CCTV detects or records activity so security personnel can identify incidents and investigate them later.

• Preventive: Stops an incident from occurring, such as a locked door.
• Corrective: Restores systems after an incident, such as backups.
• Directive: Instructs people what to do, such as security policies or warning instructions.
• Compensating: Provides an alternative control when the preferred control cannot be used.

• Honeypots: Decoy systems designed to attract attackers. Legitimate users should not access them, so activity there is a strong indication of unauthorized access.
• DNS sinkholes: Redirect requests for known malicious domains to a controlled internal destination instead of the real attacker infrastructure. Security teams can then identify infected systems making those requests.

• Tokenization: Replaces sensitive data with non-sensitive tokens; it protects data but does not detect intruders.
• CI/CD: Software development and deployment processes.
• Threat modeling: Identifies potential threats before or during system design, rather than detecting successful infiltration.
• Data obfuscation: Makes information harder to understand, but is not an attacker-detection mechanism.