Snowflake SnowPro Advanced Architect Exam Actual Questions
SnowPro Advanced Architect (Page 5 )

• Correct answer: A

• Why:

• Takeaway: For data exfiltration detection with ETD, opt for targeted data read audit logs on the designated resources to balance visibility and cost.

• Security Development Operations (SDO): a security-focused take on DevOps, integrating security into the development pipeline.
• Service Data Object (SDO): a data representation used in some middleware or enterprise apps.
• Software-Defined Overlay (SDO): a networking overlay concept.
• Secure Data Object: a generic data-security term.

• Correct options: C and D.

• The AWS Cloud Adoption Framework (CAF) security perspective focuses on capabilities to protect information and manage security risk.
• Observability (A) is primarily an operations/monitoring capability, not a core security capability under CAF.
• Incident and problem management (B) is IT service management/operations, not specifically a CAF security capability.
• Incident response (C) is a security-focused capability: detecting, containing, and recovering from security incidents.
• Infrastructure protection (D) involves applying security controls to protect the underlying infrastructure, which fits the security perspective.

• Key difference: DirectQuery leaves data in the on-prem SQL Server and queries it live. That means every visual request can trigger online processing on the source, which can be slower and adds load on the on-prem system. In contrast, Import loads data into the Power BI data model, so visuals render from the in-memory engine (faster).

• Why that helps with the requirements:

• Why not A or B: Both rely on live data via DirectQuery, which contradicts the goal to minimize online processing and visuals performance.

• Why not D: It uses Import, but refreshing hourly adds unnecessary processing and complexity when daily refresh already satisfies currency needs.

• Correct answer: B — A reservation for the server based on the MAC address.

• Why this is the best choice:

• Why the other options are less suitable:

• Quick takeaway: Use a DHCP reservation to give the file server a fixed IP while still benefiting from centralized DHCP management.

• Correct answer: B) “16 MB document and 100 MB RAM”
• Why:

• They propose a 2 MB document limit, which is not the current document size limit.
• Some options ignore the 16 MB document limit or the RAM limit.

• A recipient who already has a Microsoft account or an organizational account can authenticate by signing in.
• A recipient without a usable Microsoft identity may receive a one-time passcode by email.
• The passcode is sent to the same email address that was invited and is used to verify ownership of that address.

• AWS IoT Greengrass supports local ML inference using models trained in Amazon SageMaker.
• The model and inference code run on the factory’s local server, so processing continues even when internet connectivity is unavailable.
• A Greengrass component can:

• This provides low latency and avoids sending images to AWS for every inference.

• A: Uses AWS-hosted services and therefore depends on internet connectivity. It would fail during an outage.
• C: Snowball Edge is unnecessary for this use case and adds deployment complexity. A local Greengrass server is the intended edge-inference solution.
• D: Amazon Monitron is designed for monitoring industrial equipment health, not analyzing camera images with a custom SageMaker model.

• cloud applications only
• all Web traffic including cloud applications

• Cloud applications only: Only traffic to cloud apps is steered to Netskope for inspection/enforcement; other traffic bypasses.
• All Web traffic including cloud applications: All web-bound traffic, including cloud app traffic, is steered to Netskope.

• Browser isolation, Web traffic only, or a vague “traffic only” option are not the standard two steering modes.
• These two configurations let you decide what traffic Netskope analyzes in real time and what is bypassed.

• The “Answer(s)” field lists B and C (likely incorrect). The explanatory text correctly describes cloud applications only and all Web traffic including cloud applications as the two configurations.

• The two correct options are:

• The two incorrect options:

• Short answer: The correct term is Anti-forensics (option D), not “Felony.”

• Why: The actions described—hiding files in slack space, changing file headers, placing suspicious files in executables, and altering metadata—are classic anti-forensics techniques. They’re used to hinder or obscure forensic analysis, not to label the act as a legal category.

• About the options:

• Note: The provided answer key lists B (Felony), which is misleading for this exam objective. The exam typically tests knowledge of forensics concepts, where anti-forensics is the correct category.

• Side loading means installing software from sources outside official or trusted repositories.
• This process can bring in malicious payloads because the installed software hasn’t been vetted. A rootkit is a type of malware that hides its presence and maintains privileged access, making it a prime risk when using untrusted sources.
• Why not the other options:

• Only install apps from trusted sources; verify signatures.
• Use application whitelisting and security controls to block sideloading.
• Keep systems updated and use anti-malware tools capable of detecting rootkits.

• Answer: D. Select an IdP

• Why: To reduce the number of credentials across multiple SaaS apps, implement a single sign-on approach via an Identity Provider. The first step is choosing the IdP; once selected, you can enable SAML (A) or OAuth as supported by apps. Password vaulting (C) is not a true SSO solution, and B is not the foundational step.

• prompt: the input or instruction given to the model
• completion: the desired response

json 
{"prompt":"Summarize this customer complaint.","completion":"The customer reports a delayed shipment."}

• B: A .txt file containing CSV-style lines is not automatically a valid fine-tuning dataset. The required structure and format must match the selected Bedrock model.
• C: Provisioned Throughput provides dedicated inference capacity; it does not fine-tune a model.
• D: Journals and textbooks might support domain adaptation or pretraining, but they do not provide the prompt-to-answer examples typically required for supervised fine-tuning.

• Co to znaczy: transakcje zachowuja sie tak, jakby byly wykonywane jeden po drugim. Dzieki temu nie ma brudnych odczytów, niepowtarzalnych odczytów ani phantom reads.

• Implementacja: PostgreSQL uzywa SSI (Serializable Snapshot Isolation). W praktyce oznacza to, ze jesli wykryje konflikt miedzy transakcjami, jedna z nich zostanie zakonczona bledem “serialization failure” i trzeba ja ponowic.

• Zalózmy tabele orders(customer_id int, amount int).

• Transakcja T1:

• Transakcja T2, równoczesnie:

• T1 ponownie wykonuje to zapytanie:

• Context: You’ve enabled auditing in Dataverse and need to trim audit data to free storage. The question asks which deletion options you can use.

• What the options typically mean:

• About the provided answer (A, C, D): The list includes “by column,” which isn’t a typical or supported way to purge audit data. The more plausible trio is A (by record), B (date range), and C (by table older than date). If the exam expects A, C, D, that seems incorrect or mis-stated in the source.

• Practical takeaway: To reduce audit storage, use per-record deletions, per-table purge by date, and/or date-range deletions as supported by the environment’s audit management UI or admin docs.

Why B works

• AWS KMS keys are Regional resources. A normal customer managed key in Region A cannot be used directly in Region B.
• A customer managed multi-Region KMS key (MRK) has related key replicas in both Regions. The replicas share key material and key ID, although each has a Regional ARN.
• With client-side encryption, the application encrypts the data before storing it in S3. Cross-Region replication then copies already-encrypted objects, so S3 does not need to decrypt and re-encrypt them with a different Regional key.

Why the other choices are weaker

• A and C: SSE-S3 uses Amazon-managed S3 keys, not the required customer managed KMS key.
• D: SSE-KMS can work only if the solution creates and configures the appropriate KMS key or multi-Region key replica in each Region. As written, it says to create a customer managed KMS key in each Region, which implies separate keys—not the same KMS key. Replication also requires additional KMS permissions and destination encryption configuration.

• UPS (uninterruptible power supply) provides battery backup (time to save work and shut down).
• Surge protector only blocks surges; it does not provide backup power.
• To maximize uptime for essential tasks, put the devices that must stay powered during an outage on the UPS. Put less-critical devices on the surge protector or a wall outlet.

• Put on the UPS: the desktop computer, monitor, network gear (router/modem), and any external drives or essential peripherals you need to keep running to save to the cloud.
• Put on the surge protector (or wall outlet): nonessential devices like printers, scanners, speakers, or lamps.

• Answer: The correct first step is to define a new SOC role for Company A in Google SecOps.

• Why this is right:

• Why the other options are less suitable as the first step:

• Practical note:

• B: Intégrez des résultats de due diligence tels que les évaluations de risque client.

• C: Utilisez des correspondants en aval pour enquêter et signaler les activités suspectes.

• The requirement: the support plan must allow opening new support requests (technical support incidents).
• Azure’s Basic plan does not include technical support incidents—only billing/subscription support and access to community support.
• Therefore, you must choose a paid plan to open new technical support requests: Developer, Standard, Professional Direct, or Premier.

• Problème: le système d’alertes signale des fluctuations tout en manquant les activités qui restent anormalement constantes sur une période longue. Il faut donc un scénario qui capte les anomalies qui se maintiennent dans le temps plutôt que les pics ponctuels.
• Peer: permet de comparer un client à ses pairs; utile pour repérer des écarts relatifs, mais ne cible pas nécessairement les motifs d’anomalie persistante sur plusieurs périodes.
• Revenus mapping: relie les transactions à des sources ou flux de revenus; utile pour l’analyse des fonds, mais pas directement pour détecter une anomalie longue durée.
• Below-the-line: conçu pour détecter des activités qui passent en dessous des seuils habituels ou qui demeurent anormales sur une longue période, comblant ainsi la faiblesse des alertes à long terme.

• The first step in risk management is to understand objectives, constraints, and drivers from those who care about the project. This stakeholder engagement helps identify what could go wrong and what risks are most critical.
• Only after you’ve gathered input from stakeholders should you identify risks and document them in the risk register. Updating the risk register (option C) is important, but it comes after identifying and analyzing risks.
• Options B (ensure resources) and D (revise the risk management plan) are actions that may follow once risks are identified and understood; they’re not the initial step.

• Correct choices: A and D.

• Why not B, C, or E?

• Correct answer: B (No, it does not).

• A purchase agreement in Dynamics 365 SCM is a vendor-side price arrangement. It sets prices/discounts for what your company buys from suppliers, not for what you sell to customers.
• The objective in Question 2 is to give clients a quantity-based discount on items they purchase from you. To accomplish this, you should configure a sales price / trade agreement (on the customer/sales side), not a purchase agreement.
• In a sales price trade agreement, you can define quantity breaks such as:

• Create a Sales price trade agreement for the item and relevant customer (or customer group).
• Add quantity breaks: 51–100 with 10% discount, 101+ with 15% discount.
• Ensure the agreement is active for the desired date range.

• The user needs the chosen occasion to remain available as they navigate through the current shopping experience. Session scope stores data for the duration of the user’s session.
• Request scope data is cleared with each HTTP request; Page scope only lasts for rendering a single page; Content slots are for page/content presentation, not user data.
• Since you don’t want to persist the selection in system/custom objects, session scope is the right level: it preserves state across pages during the same session but isn’t stored long-term.

• Answer: No

• Salesforce search results are filtered by the current user's permissions and sharing rules. This is part of the security model at the record level.
• If two users have different profiles, permission sets, or sharing access, they may see different records in the results for the same keyword.
• If both users have identical access, their results should be the same; differences arise from differences in visibility rather than the search itself.

• In Microsoft Entra (Azure AD), admin roles can be scoped to either the entire directory (tenant) or to an Administrative Unit (AU). To assign a role at an AU scope, the user must be a member of that AU.

• Roles in question: Security Administrator and User Administrator can be scoped either to the Directory or to a specific AU.

• User1 is a member of AU1. Therefore, User1 can be assigned either at the AU scope (AU1) or at the Directory scope (global).

• User2 is not a member of AU1. Therefore, User2 cannot be assigned at the AU scope; the valid scope for User2 is only the Directory scope.

• User1: can be assigned at AU1 and at Directory scopes.
• User2: can be assigned only at the Directory scope.

• Control plane: Managed by Databricks and contains the Databricks web application, workspace services, cluster management, and job orchestration.
• Data plane: Runs in your cloud account and contains compute resources such as:

• Worker node: Data plane compute.
• Driver node: Data plane compute.
• JDBC data source: Usually an external data system.
• Databricks Filesystem (DBFS): Provides storage access and is backed by cloud object storage rather than being entirely part of the control plane.

• The requirement is a fully managed file server that natively supports Microsoft workloads and file systems and uses the SMB protocol. FSx for Windows File Server is built specifically for Windows workloads, provides native SMB file shares, and supports Windows permissions/Active Directory integration.
• Why the others don’t fit:

• Answer: A) Clear the Windows event logs

• Windows event logs (System, Security, Application) are key forensic artifacts. If an attacker clears these logs, there’s no built-in local record of actions taken, making it harder for investigators to trace what happened.

• Modify the system time: may misalign timestamps but does not erase past events and can be easily detected.
• Alter log permissions: could prevent new log entries, but it doesn’t remove existing ones and can raise alarms due to permission changes.
• Reduce log retention settings: affects only future logs; it doesn’t wipe already recorded activity.

• In real environments, defenders mitigate this risk with tamper-evident, centralized logging (remote SIEM, write-once storage, log integrity checks) to preserve evidence even if a host is compromised.

• Answer: D

• The strongest security comes from enforcing access at the storage layer. An IAM policy scoped to the Cognito identity prefix restricts each user to their own S3 prefix (folder), so users can only access their own files regardless of client or server code.
• This per-user isolation reduces risk of cross-user data access and is more robust than UI validation or Lambda/API validation alone.
• Implementation note: attach a policy to the Cognito identity role that allows actions on arn:aws:s3:::your-bucket/${cognito-identity.amazonaws.com:sub}/* (per-user prefix). Ensure TLS in transit and enable at-rest encryption (SSE-S3 or SSE-KMS). Use multipart upload for large files up to 300 MB.

• Source: on-premises SQL Server Database1
• Destination: Fabric Warehouse Warehouse1
• Connectivity: on-premises data gateway

• Dataflow Gen1: Primarily for Power Query transformations and isn’t the best Fabric-native choice for this copy operation.
• KQL queryset: Queries data; it does not orchestrate copying from SQL Server.
• Notebook: Could perform custom code-based movement, but it is unnecessary and less direct than a pipeline.

• Why this is correct: In Azure Virtual Desktop, user access to a host pool is controlled through App Groups. The default app group for a host pool publishes the full desktop, so adding members to that app group grants them sign-in and access to the desktop (and any RemoteApps in that group). This is the standard way to give users access to AVD resources.

• Why the other options are not correct:

• Practical steps (high level):

• Authenticating websites with TLS/HTTPS
• Enabling certificate-based VPN authentication
• Signing or encrypting email
• Supporting device or user authentication

• VLAN tagging: Uses network-frame tags, such as 802.1Q; it does not rely on X.509 certificates.
• LDAP: May integrate with PKI in some environments, but X.509 certificates are not most commonly associated with LDAP itself.
• MFA: Certificates can be one authentication factor, but X.509 is fundamentally a PKI technology.

• Shadow IT describes employees using unsanctioned tools or methods to access systems, often without IT oversight (e.g., bypassing the VPN).
• Not A (Espionage): this implies external covert actors; here the activity is internal.
• Not B (Data exfiltration): there’s no explicit data transfer shown, just bypassing the VPN.
• Not C (Nation-state attack): this involves external political/strategic actors; not the internal behavior described.

• Implement policy and training to enforce approved tools.
• Use IAM, VPN enforcement, and network access controls to ensure only sanctioned access.
• Monitor for unsanctioned tools and provide secure, approved alternatives.

• 345 Patch management: 3.0 - Implementation
• 346 Obfuscation: 2.0 - Architecture and Design
• 347 Host isolation: 4.0 - Operations and Incident Response
• 348 IoT unencrypted traffic: 1.0 - Threats, Attacks and Vulnerabilities
• 349 Tabletop exercise: 4.0 - Operations and Incident Response
• 350 CVSS: 1.0 - Threats, Attacks and Vulnerabilities
• 351 Conflict of interest: 5.0 - Governance, Risk and Compliance
• 352 Fail-open (availability focus): 4.0 - Operations and Incident Response (can vary by version)

• Why: Table.Profile returns a per-column profile that includes statistics such as count, null count, distinct count, and standard deviation. It also provides min/max and average where applicable, which matches the requested metrics (Count, Average, Null count, Distinct count, Standard deviation).
• Syntax: Table.Profile(table as table, optional additionalAggregates as nullable list) as table
• How it helps: After running Table.Profile on your table, you can extract the per-column stats you need and display them in your semantic model or report.

• It is a sequence of distinct phases that flow one after another (requirements ? design ? implementation ? verification ? maintenance).
• Requirements are defined up front and changes are costly; the project often requires formal sign-off before moving to the next phase.
• It emphasizes heavy documentation and minimal iteration after a phase is completed.

• Sustainability is not a CAF perspective (it's not one of the CAF perspectives).
• Performance efficiency and Reliability are pillars of the AWS Well-Architected Framework, not CAF.

• The requirement: SQL authentication cannot be used for any databases on Server1, and the solution must be enforced centrally at the server level.
• Correct choice (C): Enable Microsoft Entra-only authentication for Server1.

• Why not the others:

• Sales Processes define the set of Opportunity stages for a given workflow.
• Record Types let you have different data models (different fields and picklist values) on the same object.
• Page Layouts control which fields are shown/required for each record type.

• Create three Sales Processes so each team can use its own stages.
• Create three Record Types so each team has its own fields and picklist values.
• Create three Page Layouts so each record type shows the appropriate fields.

• The Act requires:

• It does not, as a public obligation, mandate publishing a detailed report on the training data used.
• Also, the Act does not specify a fixed “six months” retention for system logs in a way that would clearly make A required; logs for traceability are implied, but the six-month period is not a defined, universal requirement.

• The Well-Architected Framework has five pillars: Operational Excellence, Security, Reliability, Performance Efficiency, and Cost Optimization.
• Operational Excellence: how you run and improve your systems—monitoring, incident response, and evolving processes.
• Reliability: the ability of a workload to recover from failures, maintain uptime, and scale as demand changes.

• Availability (A) is not a pillar name; it’s an outcome that relates to Reliability.
• Scalability (C) isn’t a pillar name; scalability touches on Performance Efficiency.
• Responsive design (D) is not a pillar in the Well-Architected Framework.

• Drop violating frames
• Log or alert on the violation
• Shut down or restrict the port

• Load balancer: Distributes application traffic; it does not control switch MAC learning.
• IPS: May detect some network attacks but is not the primary control for switch MAC-table exhaustion.
• NGFW: Protects traffic crossing network boundaries, while MAC flooding occurs at the switching/LAN layer.

• DNS????????????????

• ???????????

• ????????????????

• RPO and RTO definitions:

• Why B and D meet these goals:

• How they complement each other:

• Quick tips:

• The correct AAA mapping (per Cisco objectives) is:

• Why the given options aren’t fully correct:

• Quick takeaway: when you configure AAA, you should conceptually map them as:

• Example commands (to reinforce concepts):

• Correct answer: C — The model is deployed at UK border checkpoints.

• The EU AI Act applies to AI systems used within the EU or by entities established in the EU. So: