ServiceNow CIS-PPM Exam Prep
Certified Implementation Specialist - Project Portfolio Management (Page 3 )

yaml 
clusterIP: None

• CronJob: Runs Jobs on a schedule and normally does not need stable networking.
• Deployment: Manages interchangeable, stateless replicas and usually uses a regular Service.
• DaemonSet: Runs a Pod on selected nodes but does not inherently require stable Pod identities.

• A: Describes a broad purpose and direction, but is not the specific CIMA definition.
• C: “Scoping out” activities is too vague and incomplete.
• D: Combines long-term goals, strategies and policies, but describes a wider strategic-planning statement rather than the definition of strategy itself.

• Field name and label
• Data type
• Reference table
• Default value
• Whether the field is mandatory or read-only
• Field attributes and configuration

• A: Labels and translations are handled through documentation and translation-related records.
• C: Table relationships may be represented through reference fields, but this is not the primary description of the Dictionary.
• D: Spell-checking language data is unrelated to the System Dictionary.

• The S3 bucket as an origin for static content
• The Application Load Balancer (ALB) as an origin for dynamic content
• An Amazon Route 53 alias record pointing the application domain to CloudFront

Why this works

• Static data: CloudFront caches objects from S3 at edge locations, reducing latency for users worldwide.
• Dynamic data: CloudFront forwards requests that require application processing to the ALB. It can also maintain persistent connections and use the AWS global edge network to improve delivery performance.
• One domain: CloudFront behaviors can route different path patterns to different origins—for example, /static/* to S3 and other paths to the ALB.

Why the other options are incorrect

• Global Accelerator is designed primarily for accelerating traffic to applications with endpoints such as ALBs, not for caching S3 content.
• Using separate domains or splitting static and dynamic traffic adds unnecessary complexity.
• CloudFront already provides the required global edge distribution and caching, so combining it with Global Accelerator is unnecessary here.

• The current and previous versions
• Which clauses were changed
• When each revision occurred
• Potentially, who made the changes

• Version validation: Verifies a version’s accuracy or integrity but does not primarily track revisions.
• Version changes: Not the standard name for a formal document-management process.
• Version updates: Describes updating a document, not the complete process of managing and tracking its revisions.

• CCTV system — Detective control: Cameras monitor and record activity, helping identify or investigate security incidents after—or while—they occur.
• Signs about being filmed — Deterrent control: The signs discourage people from attempting unauthorized or criminal activity because they know surveillance is present.

• Preventive: Stops an incident from occurring, such as a lock or access-control system.
• Corrective: Restores systems after an incident.
• Directive: Instructs people to behave in a certain way, such as a security policy.
• Compensating: Provides an alternative control when the preferred control cannot be implemented.

• Threat perspective: Focuses on possible attacks, but may seem technical or hypothetical.
• Compliance perspective: Can motivate action, but compliance alone does not demonstrate the broader business value of governance.
• Policy perspective: Policies are important, but they are a means of implementing governance, not its primary business justification.

• Identity provider (IdP): Authenticates users and asserts their identity.
• Service provider (SP): The application being accessed—in this case, Salesforce/the employee portal.
• Identity store: A directory that stores user identities, such as Active Directory.
• Authentication store: A system used to validate credentials.

• Have a definite, clear objective (C): Know exactly what you want to communicate. A clear purpose reduces ambiguity and irrelevant information.
• Plan the communication (E): Decide what to say, who needs the information, the appropriate channel and the best timing.
• Seek feedback (F): Check that the receiver understood the message. This could involve asking for confirmation or inviting questions.

• Ask questions (A): Usually associated with the receiver checking or clarifying information, although a sender may use questions in practice.
• Give feedback (B): Feedback is generally the receiver’s response to the sender’s message. The sender’s responsibility here is to seek feedback.
• Consider their contribution (D): This is not a standard sender-focused step in the communication process. The sender should consider the receiver’s needs and perspective, but the wording is less precise than the three recognised actions above.

• CSIRT: A team that responds to and manages security incidents.
• CVSS: A scoring system for rating the severity of vulnerabilities.
• SOAR: A technology platform for automating and coordinating security operations and incident response.

• Advanced Persistent Threat (APT): A sustained, targeted attack campaign or attacker group—not a vulnerability.
• Trojan: Malware disguised as legitimate software.
• Stealthware: A general term for malware designed to avoid detection; it does not specifically mean an unknown vulnerability.

• 16GB RAM: A 64-bit OS is needed to use more than roughly 4GB effectively, but RAM capacity does not prove the CPU supports 64-bit operation.
• 500GB HDD: Storage capacity has no bearing on OS architecture.
• 1Gbps Ethernet: Network speed is unrelated to CPU architecture.

Correct choices

• DB1: Azure Data Box Heavy
• Virtual machines: Azure Migrate

Why

• Replication with minimal downtime
• A test migration
• Final cutover after validation

• Training or coaching
• Mentoring
• Additional support or resources
• Targeted performance improvement plans

• A: Recognition may be appropriate, but awards do not address identified gaps.
• C: Rotating schedules does not necessarily improve the specific competencies that are missing.
• D: Assessment results should be handled sensitively, but keeping them entirely private prevents useful feedback and development discussions.

• SQL injection
• Cross-site scripting (XSS)
• Malicious or malformed web requests
• Some application-layer abuse

• Layer 4 firewall: Filters based mainly on IP addresses, ports, and connections; it lacks detailed web-request inspection.
• NGFW: Provides broader network security, but a WAF is more specialized for protecting web applications.
• UTM: Combines multiple security functions, but it is not necessarily optimized for web-application protection.

• Azure Cosmos DB is a globally distributed NoSQL database service. It stores and retrieves application data, but it does not provide the complete environment for building, testing, and deploying predictive analytics models.
• Azure Machine Learning is the appropriate service for this requirement. It supports creating experiments, training and testing models, and deploying them for predictions.
• Azure Machine Learning Studio provides the browser-based interface for these tasks.

1. Open the Microsoft Entra Connect wizard.
2. Select Configure.
3. Choose Customize synchronization options.
4. Authenticate when prompted.
5. On the Domain and OU filtering page, select:

1. Complete the wizard.

• Start-ADSyncSyncCycle only starts synchronization; it does not change which OUs are included.
• Manage federation configures federation settings, which are unrelated to OU filtering.
• Add-ADSyncConnectorAttributeInclusion concerns connector attributes, not selecting additional OUs for synchronization.

• Packet capture: Collects and analyzes network traffic; it does not describe the scan type.
• Privilege escalation: Attempts to gain higher permissions after obtaining access.
• System enumeration: Identifies systems, services, or resources, but is not specifically defined by the lack of credentials.
• Passive scan: Observes traffic without actively probing systems. A vulnerability scan is generally an active assessment.

• Espionage: Stealing information for intelligence or competitive purposes.
• Data exfiltration: Unauthorized removal or transfer of data.
• Nation-state attack: An attack sponsored or conducted by a government.
• Shadow IT: Technology or access methods used outside approved IT processes.

• Link-local — FE80::/10; valid only on the local link/subnet and not routed by routers.
• Multicast — FF00::/8; identifies a group of interfaces rather than a private address range.
• Global unicast — 2000::/3; publicly routable IPv6 addressing.

apex 
for (Account updatedAccount : Trigger.new) { 
    AccountTriggerHelper.notinyxternalSystem(updatedAccount.Id); 
}

• Too many callouts: The callout occurs asynchronously in the future method, and each future transaction can perform its permitted callouts.
• Too many SOQL queries: The SOQL query is inside the future execution, not repeatedly in the trigger transaction.
• Callout from triggers not supported: Direct callouts from triggers are prohibited, but the trigger delegates the callout to asynchronous Apex, which is the correct pattern.

• Accept: Acknowledges the risk without taking additional action.
• Transfer: Shifts the risk or financial impact to another party, such as an insurer.
• Mitigate: Reduces the likelihood or impact through controls like patching, MFA, or segmentation.
• Avoid: Eliminates the activity that creates the risk.

• s3:GetObject for the relevant objects
• s3:ListBucket if listing is required
• Appropriate bucket and object resource permissions

• B: Making the bucket public is insecure and unnecessary.
• C: Prompt engineering cannot override AWS IAM or encryption permissions.
• D: Data sensitivity does not determine whether the role can access it.

• IRR assumes that interim cash flows can be reinvested at the project’s own IRR. This may be unrealistic, especially when the IRR is very high.
• MIRR assumes reinvestment at a specified rate, usually the company’s cost of capital or another realistic reinvestment rate.

• B: MIRR does not specifically favour projects with long payback periods.
• C: MIRR and IRR can rank competing projects differently.
• D: MIRR is not always higher than IRR; it may be higher or lower depending on the cash flows and reinvestment rate.

• CSIRT: A Computer Security Incident Response Team that handles and coordinates incident response.
• CVSS: A scoring system used to rate the severity of vulnerabilities.
• SOAR: Security Orchestration, Automation, and Response technology used to automate security workflows.

• A. IDS attack signatures: An IDS primarily detects suspicious network activity; it is not the best tool for scanning uploaded files.
• C. Load balancer: Improves availability and distributes traffic but does not inspect files for malware.
• D. WAF: Protects web applications against attacks such as SQL injection and command injection. It may inspect HTTP requests, but malware scanning of uploaded PDFs is the key requirement here.

• A — Capacity: The system must handle all current records and anticipated future records. A system that cannot cope with volume will quickly become ineffective.
• C — Accuracy: Academic records are critical, so the new system must be at least as accurate as the existing system and comparable systems. Poor accuracy could cause serious administrative and reputational problems.
• D — Integration: Linking with the university’s financial systems supports consistency and avoids duplicate data entry, especially for registration, deregistration and fee-related transactions.

• B — Parallel running: This is a useful implementation and risk-control technique, but it is not an essential feature of the system itself. It may also be expensive and time-consuming.
• E — Internet access for all information: This creates significant confidentiality and security risks. External access might be needed for selected services, but unrestricted access to all information is not essential and would be inappropriate for student records.

1. Create a temporary Onboarding OU.
2. Move the new account into it.
3. Move the restrictive SCPs from the organization root to the Production OU.
4. Allow the account to update AWS Config.
5. Move the account into Production after onboarding.

• An SCP attached at the organization root applies to every account and OU beneath it.
• An SCP attached to the Production OU applies only to accounts in that OU.
• Therefore, moving the restrictive SCP from the root to Production temporarily exempts the onboarding account without weakening the policies for existing production accounts.
• Once onboarding is complete, moving the account into Production subjects it to the normal restrictions.

• Tokenization: Replaces the value with a nonsensitive token, often reversible through a secure token vault.
• Hashing: Converts data into a one-way fixed-length value, generally used for integrity checks or password storage.
• Obfuscation: A broad term for making data difficult to understand; it is less precise than masking in this context.

• Disaster recovery backups
• Long-term backup retention
• Data archiving that still needs occasional access

• Multi-Regional Storage: Intended for frequently accessed data needing broad geographic availability; it costs more.
• Regional Storage: Suitable for frequently accessed data within one region.
• Nearline Storage: Intended for data accessed roughly once per month, such as monthly backups.
• Coldline Storage: Better fit for backups accessed only during a disaster or occasional recovery event.

• Existing expected ROI: 15%
• New project ROI: 14%
• Cost of capital: 12%

• Project return = 14%
• Cost of capital = 12%
• It earns 2% more than the cost of capital, so it should increase shareholder value.

• A laptop
• Software access
• A password reset
• A mobile phone

• They run behind the scenes — applies more to automation or workflows.
• They are optional — catalog items are fundamental to a request-based catalog.
• They provide options — variables and variable options collect the requester’s choices for an item; they are not the catalog item itself.

• A: Allow SAN certificates — SANs are used to identify valid hostnames in a certificate. They do not bypass trust validation.
• C: Open the secure LDAP port — A blocked port would normally cause a timeout or connection-refused error, not certificate errors.
• D: Increase the TLS version on the RA — The issue concerns certificate trust, not the organization’s registration authority.

1. insert con; ? 1
2. Database.setSavepoint(); ? 2
3. update con; ? 3
4. Database.rollback(sp_admin); ? 4

• Laws and regulations
• Litigation holds
• Industry or contractual obligations
• Tax, financial, health, or privacy requirements

• Business strategy and direction: May influence retention, but cannot override legal requirements.
• Storage capacity and longevity: Practical considerations, not the primary driver.
• Business ease and value analysis: May support decisions after compliance obligations are identified.

• Active remediation actions role in Microsoft Defender for Endpoint

• Security Reader role in Azure AD/Entra ID

• Security Administrator is broader than necessary because it grants extensive security-management permissions, violating least privilege.
• Compliance Data Administrator is intended for compliance data management, not Defender for Endpoint remediation approvals.

• Planning and designing products and services
• Developing and delivering them
• Managing risks, suppliers, and resources
• Measuring performance
• Continually improving value delivery

• Value stream steps describe activities used to create and deliver value; they do not themselves provide the broader capabilities.
• Vision and operating model provide direction and structure, but they are not the practical management capabilities that enable the work.
• Value chain is the operating model showing how activities combine to create value; it is enabled by practices and resources.

• Blue team: Defends systems, monitors activity, and responds to attacks.
• Purple team: Coordinates red- and blue-team activities to improve defenses.
• White team: Oversees or manages the exercise, including rules and scope.

• A user connects with their Google account.
• Google associates the user’s SSH key with that identity.
• IAM roles determine whether they can log in.
• Access can be tied to a specific employee for auditing.
• Removing the IAM role removes their login access.

• compute.osLogin: regular OS login access
• compute.osAdminLogin: OS login with administrative privileges, typically including sudo

text 
enable-oslogin=TRUE

• Existing measures
• Relationships
• Calculated columns
• Tables and fields
• Existing transformations in the model

• SharePoint folder: Reconnects to the source files. You would likely need to recreate the model and measures.
• Power BI dataflows: Primarily provide reusable data preparation and storage, but they do not automatically provide the existing semantic model and measures.
• Excel workbook: Connects directly to the source file and would also require rebuilding the model and measures.

• The servers run different operating systems: Windows, Linux, and Unix.
• Containers generally share the host operating system’s kernel, so they cannot normally run workloads requiring unrelated kernels, such as Windows and Linux, on the same Linux host.
• A hypervisor can create separate virtual machines, allowing each VM to run its own guest OS.
• A Type 2 hypervisor runs on top of a host operating system and can support multiple guest operating systems.

• Financial performance
• Customer perspective
• Internal business processes
• Learning and growth

• Increasing the number of indicators can make the scorecard cluttered and less useful. Measures should be limited to those that are strategically important.
• The scorecard is mainly a tool for implementing and monitoring strategy, not for formulating strategy.
• It should contain both leading indicators and lagging indicators. Leading indicators predict future performance, while lagging indicators measure results already achieved.

• Data loss prevention (DLP): Helps detect or prevent sensitive data from being copied or transmitted, but it does not primarily protect a stolen laptop’s stored data.
• Operating system hardening: Reduces vulnerabilities and attack surface but does not encrypt files if the device is stolen.
• Boot security: Helps ensure that only trusted software starts, but it does not fully protect the drive if an attacker accesses it offline.

CIMA P3 topics

• IT governance and systems strategy
• Systems development and implementation
• Change and project governance
• Strategic and business risk

• A — Plan for new systems: The committee should help identify and prioritise systems requirements and ensure planned systems support organisational needs.
• D — Consider competitive issues: New information systems may affect Y’s competitive position, service quality and efficiency. These strategic implications should be considered.
• E — Ensure the system meets company goals: This is a key governance responsibility. The committee should ensure the project remains aligned with Y’s objectives and delivers business value.

• B — Develop new systems: Detailed system development should be performed by IT specialists and project teams, not the steering committee.
• C — Manage the project: The project manager should handle day-to-day project management. The steering committee should provide oversight, challenge and key decisions, rather than manage daily activities.

• D — Managers focus on keeping costs low in the short term to maximise profits.

• E — Managers are given incentives to meet or undercut budgets.

• F — Managers delegate responsibility simply to reduce their workload.

• A password cracker would normally be identified by behavior such as loading password hashes or attempting dictionary/brute-force attacks.
• The question describes a routine audit, not password recovery.
• Simply encountering a protected file during an audit is characteristic of a misconfigured or insufficiently privileged FIM.

• DB1 (500 TB): Azure Data Box Heavy

• Virtual machines: Azure Migrate

• Correct exam answer: A — HKEY_LOCAL_MACHINE
• The relevant location is associated with HKEY_LOCAL_MACHINE\SAM.
• The SAM does not store passwords in plain text; it stores password hashes.

• HKEY_CURRENT_USER contains settings for the currently logged-in user, not the account-password database.
• HKEY_USERS contains user profiles and settings loaded for users.
• HKEY_CURRENT_CONFIGURATION contains hardware/profile configuration information.

• Continuous deployment: Automates software releases; it does not specifically test input handling.
• Static code analysis: Examines source or compiled code without executing it. It can find coding flaws but does not directly stress the application with malformed inputs.
• Manual peer review: Developers inspect code or design manually. Useful, but not the best practice specifically for testing how a live product handles invalid input.