Snowflake SnowPro Advanced Architect Exam Prep
SnowPro Advanced Architect (Page 6 )

• Use private connectivity from a cloud provider
• Set up SSO for federated authentication

• Private connectivity—such as a cloud provider’s private endpoint—keeps Snowflake access within the company’s private network path instead of exposing access over the public internet. This fits the VPN/VDI requirement.
• SSO for federated authentication allows Snowflake users to authenticate using the credentials already managed by the company’s identity provider—the same identity system used for VDI—eliminating separate Snowflake passwords.

• Tri-Secret Secure protects encryption keys; it does not provide private network access or credential reuse.
• A proxy Snowflake account outside the VPN conflicts with the requirement that Snowflake have no internet visibility and is not the normal solution for federated login reuse.

• principal represents the source or initiating system.
• principal.port is the source port.
• target represents the destination system.
• target.port is the destination port.

text 
principal.port = 5555

• network.ApplicationProtocol = HTTP identifies HTTP traffic but not the backdoor specifically.
• target.port = 5555 finds traffic going to port 5555, rather than originating from it.
• network.ip_protocol = TCP is too broad because many services use TCP.

• Accept: Acknowledging the risk without taking additional action.
• Transfer: Shifting responsibility or financial impact to another party, such as through insurance or outsourcing.
• Mitigate: Reducing the likelihood or impact of the risk through controls.
• Avoid: Eliminating the activity or condition that creates the risk.

• A. IDS attack signatures: An IDS primarily detects suspicious network activity and usually alerts rather than directly scanning and blocking uploaded files.
• C. Load balancer: Distributes traffic among servers but does not inspect files for malware.
• D. WAF: Protects web applications from attacks such as SQL injection, cross-site scripting, and some malicious requests. It is not primarily a PDF-malware scanning solution.

• Admin access to the deployment pipeline (B) – lets the developers use the pipeline and deploy content.
• Contributor access to the Development and Test workspaces (E) – required to deploy items into those workspaces.
• Viewer access to the Production workspace (D) – lets them view Production content without allowing deployment or modification.

• Contributor access to Production (F), because that could allow changes or deployment there.
• Viewer access to Development/Test (C), because Viewer is insufficient for deployment.
• Build permission to Production semantic models (A), because building reports on a semantic model is not required merely to view Production items.

• Normalize casing in the data source—for example, convert all values to uppercase or lowercase.
• Add an index key to provide a unique, stable identifier for each row or value.

• A — Reports: Reports are informational and don’t enforce access during an SSO transaction.
• B — Apex trigger and Permission Sets: A trigger could update permissions when a Case changes, but this creates synchronization and timing issues. It also changes Salesforce permissions rather than making a direct, real-time decision for the external system.
• C — Custom SAML JIT Provisioning: JIT provisioning is primarily for creating or updating users at login. It isn’t the appropriate mechanism for dynamically querying business records and deciding whether access should be granted.
• D — Connected App Handler: Designed for custom, programmatic control during connected-app authentication and authorization. Apex can check the user’s current open classified cases and permit or reject the SSO request.

Why B works

• AWS KMS keys are Regional resources. A normal customer managed key in Region A cannot be used directly in Region B.
• A customer managed multi-Region KMS key (MRK) has related key replicas in both Regions. The replicas share key material and key ID, although each has a Regional ARN.
• With client-side encryption, the application encrypts the data before storing it in S3. Cross-Region replication then copies already-encrypted objects, so S3 does not need to decrypt and re-encrypt them with a different Regional key.

Why the other choices are weaker

• A and C: SSE-S3 uses Amazon-managed S3 keys, not the required customer managed KMS key.
• D: SSE-KMS can work only if the solution creates and configures the appropriate KMS key or multi-Region key replica in each Region. As written, it says to create a customer managed KMS key in each Region, which implies separate keys—not the same KMS key. Replication also requires additional KMS permissions and destination encryption configuration.

• B — Single customer login across properties: Customer 360 Identity provides centralized identity services, allowing an organization to recognize a customer across multiple digital properties and applications. This helps UC understand authenticated activity as part of a broader customer identity.

• C — Multi-brand support: Customer 360 Identity can support multiple brands and user experiences. Identity services can remain centralized while correlating a customer’s activity across different corporate brands or channels.

• A: Customer 360 Identity does not automatically populate all data into Customer 360 Data Manager and Customer 360 Audiences. Integration and data configuration are still required.
• D: Tracking anonymous activity and linking it after sign-up may be possible through broader customer-data and tracking implementations, but it is not the primary Customer 360 Identity benefit tested here. Identity focuses mainly on authentication, registration, and cross-property identity correlation.

• A. IDS attack signatures: Primarily detects suspicious network activity, not necessarily malware embedded in uploaded files.
• C. Load balancer: Improves availability and distributes traffic; it does not inspect documents for malware.
• D. WAF: Protects web applications from attacks such as SQL injection and command injection, but its primary role is not scanning uploaded PDFs for malware.

• Create Power Query parameters for the Azure SQL server/database—or at least the database name.
• Use the parameter in the PBIX connection.
• Publish the same PBIX separately to the relevant development, test, and production workspaces.
• Set each dataset’s parameter value in the Power BI service so it points to the corresponding Azure SQL database.

• Development dataset ? DevelopmentDB
• Test dataset ? TestDB
• Production dataset ? ProductionDB

• The same PBIX is used for every lifecycle stage.
• Each stage consumes data from its matching database.
• Deployment pipelines are not required.
• Azure SQL is a cloud source, so gateway administration is generally avoided.
• Only the parameter value differs between published datasets, reducing maintenance.

• Replace the keyboard: More expensive and unnecessary before simpler causes are ruled out.
• Replace the key switch: Laptop keyboards generally aren’t designed for individual switch replacement.
• Replace the circuit board: Excessive for a single nonworking key and not a cost-effective first step.

• Uses on-premises data or resources
• Runs components in the cloud
• Can scale across multiple cloud environments when demand increases

• Public cloud: Resources are hosted entirely by a cloud provider.
• Private cloud: Resources are dedicated to one organization, usually in its own environment.
• Hybrid: Combines on-premises and cloud resources.

• Aggregation happens once, during the scheduled job.
• Dashboard users query a relatively small, precomputed table.
• Repeated users do not trigger expensive aggregations against the detailed sales table.
• Overwriting is appropriate because the summary is rebuilt for the reporting period.

• B: Structured Streaming is unnecessary for data that only needs daily refreshes and adds operational/compute overhead.
• C: A view recomputes the aggregation at query time, increasing latency and query cost.
• D: Delta caching may improve reads but does not replace the need to materialize the expensive aggregation, and cache availability is not the main design guarantee.

• The identified risk
• Its likelihood and potential impact
• The person or team responsible for handling it
• The response or treatment plan
• Risk thresholds, such as when escalation or action is required
• Current status and review dates

• Risk tolerance: The amount of risk an organization is willing to accept; it is a concept or limit, not usually the primary documentation.
• Risk transfer: Moving the responsibility or financial impact of a risk to another party, such as through insurance.
• Risk analysis: The process of evaluating risk likelihood and impact.

bash 
docker run -it microsoft/azure-cli:0.10.17

• docker run starts an Azure CLI container; it does not automatically connect to the AKS cluster.
• The command does not run kubectl apply.
• The container would need the appropriate Kubernetes tools and AKS credentials.
• The device or container must obtain cluster credentials, typically using an AKS credential command, before running Kubernetes commands.

bash 
az aks get-credentials --resource-group <resource-group> --name <aks-cluster> 
kubectl apply -f myapp.yaml

kusto 
Event 
| summarize make_set(EventID) by Computer

• summarize groups records.
• by Computer creates one result row per virtual machine.
• make_set(EventID) returns an array containing unique event IDs for that computer.

kusto 
| summarize make_list(EventID) by Computer

• vSmart controls the overlay control plane. It uses OMP to exchange routing information, distribute policies, and determine how WAN Edge devices reach one another.
• vManage is the centralized management and configuration platform.
• vBond is the orchestrator. It helps devices authenticate, discover controllers, and traverse NAT during onboarding.
• APIC-EM is not the SD-WAN control-plane component described here.

• Server provisioning
• Operating systems and runtime infrastructure
• Scaling
• Much of the maintenance and patching

• Thin clients reduce endpoint hardware requirements but do not specifically streamline code deployment.
• Private cloud provides dedicated cloud infrastructure but usually requires more management and expense.
• Virtual machines improve resource utilization, but administrators still manage the VMs, operating systems, and deployments.

• Vulnerability scanner: Finds technical weaknesses in systems, applications, or devices. It does not usually analyze the entire supply chain.
• Penetration test: Simulates attacks against a defined target to identify exploitable weaknesses. Its scope is narrower.
• SCAP (Security Content Automation Protocol): Provides standardized formats and methods for automating security configuration and vulnerability checks, rather than mapping the full supply chain.

• SQL injection
• Cross-site scripting (XSS)
• Malicious file uploads
• Common web-application exploits

• Layer 4 firewall: Filters primarily by IP addresses, ports, and transport protocols; it lacks detailed web-application inspection.
• NGFW: Provides advanced network filtering and may include application awareness, but a WAF is more specialized for protecting web applications.
• UTM: Combines several security functions in one device, but it is not specifically focused on web-application attacks.

• Geo-redundant storage (GRS) replicates data to a secondary Azure region, but the secondary copy is normally unavailable for read access.
• RA-GRS provides geo-replication and read-only access to the secondary region, satisfying all requirements.
• Zone-redundant storage (ZRS) replicates data across availability zones within the same Azure region, not separate geographic regions.
• Locally redundant storage (LRS) keeps copies within a single datacenter or region and does not provide geographic resiliency.

• An Anypoint VPC provides private network connectivity for CloudHub applications.
• An IPsec VPN tunnel or AWS Direct Connect connects that VPC to the customer’s on-premises network without exposing the database to the public internet.
• The VPC and on-premises firewalls must allow the required traffic, routes, and ports.

• Static IP addresses only identify the application’s outbound traffic; they do not create a private network path to the database.
• A Dedicated Load Balancer does not replace the required network connection to the on-premises environment. It is also unnecessary merely to reach individual databases.
• Moving sensitive databases to a DMZ is not the intended architecture and could reduce their protection.

• Manage multiple organizations from one hierarchy.
• Enterprise-wide policies, including repository visibility, forking, and GitHub Copilot policies.
• Centralized identity and access management, such as SAML SSO, SCIM provisioning, and—where applicable—Enterprise Managed Users.
• Centralized billing and licensing, including organization and Copilot seat management.
• Enterprise audit log, which aggregates activity across organizations.
• Security and compliance oversight, such as organization security visibility and enterprise-wide controls.
• Enterprise support and account management features, depending on the plan.

• Organization: manages its own repositories, teams, members, and local policies.
• Enterprise: governs multiple organizations and can enforce policies across them.

• BIOS language support: Useful for usability, but not whether the PC can operate electrically.
• Supply chain security: Concerns procurement and hardware trust, not deployment across countries.
• Power efficiency: Important for energy usage, but it does not ensure compatibility with local power systems.

1. Define – establish the project’s objectives, scope, feasibility and requirements.
2. Design – plan how the project will be carried out, including resources, schedules and controls.
3. Deliver – execute the project and produce the required outputs.
4. Develop – close the project formally and capture learning for future projects.

• Filing documentation and records
• Closing project and accounting systems
• Settling costs
• Handing over the completed work and obtaining sign-off
• Reviewing performance and giving feedback

• The servers run different operating systems: Windows, Linux, and Unix.
• Containers generally share the host operating system’s kernel, so they cannot normally run workloads requiring unrelated kernels, such as Windows and Linux, on the same Linux host.
• A hypervisor can create separate virtual machines, allowing each VM to run its own guest OS.
• A Type 2 hypervisor runs on top of a host operating system and can support multiple guest operating systems.

• Online payment fraud
• Account takeover
• Fake account creation
• Suspicious transactions

• B — AWS DataSync: Transfers data between storage systems, such as S3, file systems, and on-premises storage. It is not a marketplace or catalog for third-party datasets.
• C — Kinesis Data Streams and CodeCommit: CodeCommit is a source-code repository, not a third-party data provider. Kinesis is for streaming data ingestion.
• D — Kinesis Data Streams and ECR: ECR stores container images, not datasets. Kinesis does not provide access to ECR data as an external dataset source.

• Virtual machine disks
• Databases
• Storage accounts
• File systems

• Site-to-site VPN: protects data moving between networks
• HTTPS: protects data moving between a client and website
• Encrypted email: generally protects the message while being transmitted

• At rest = stored data
• In transit = moving data
• In use = data currently being processed by a system

• Azure creates a corresponding service principal in Microsoft Entra ID.
• The identity’s lifecycle is tied to the Azure resource.
• If the resource is deleted, Azure automatically deletes the identity.
• Only the associated resource can use that identity to request tokens.
• You can grant the identity permissions to access services such as Key Vault or Storage without storing credentials in code.

• Updating the CRL: Revokes compromised certificates, but does not fix the CA flaw that allowed them to be created.
• Changing passwords: May be necessary if accounts were compromised, but it does not address the certificate-generation vulnerability.
• Implementing SOAR: Improves security automation and response; it does not remediate the underlying PKI weakness.

• Equipment and hardware
• Facilities
• Inventory
• Backup media
• Supplies stored at an alternate or remote location

• Personal belongings of staff: Usually not organizational assets.
• DR line-item revenues: Revenue is a financial impact, not a physical asset.
• Cloud-based applications: These are primarily logical or information-processing assets, even though they depend on physical infrastructure.

• The legacy system creates a signed JWT assertion.
• Salesforce validates the assertion using a certificate configured on a Connected App.
• Salesforce issues an access token for the integration user.
• No refresh token is required; the system can request a new access token when needed.

• Web Server Flow: normally uses a client secret and authorization/refresh tokens.
• Username-Password Flow: requires storing Salesforce credentials and is discouraged for integrations where stronger options are available.
• User Agent Flow: intended for user-interactive applications, not unattended server-to-server processing.

• Restarting the device: May fix software glitches, but would not usually make cable orientation matter.
• Swollen battery: A safety concern, but it would not typically cause recognition only in one cable orientation.
• Failing cable: Possible, but less likely because the problem occurs with this particular device and not other devices of the same type.

• Import mode loads the data into the Power BI model. Visuals query the in-memory model, which generally provides faster calculation and rendering than DirectQuery.
• Import mode also minimizes online processing because report interactions do not send queries back to the dataflow or SQL Server.
• A daily refresh can load data through the previous day, satisfying the freshness requirement without unnecessary hourly processing.

• DirectQuery keeps querying the data source or dataflow during report use, increasing online processing and potentially slowing visuals.
• Adding a gateway enables connectivity for on-premises sources, but it does not remove the performance disadvantages of DirectQuery.
• An hourly Power Automate refresh is unnecessary when the requirement is only data through the previous day and creates additional processing overhead.

• Internal interface ? connected toward the corporate network/internal firewall
• External interface ? connected toward the Internet-facing firewall

1. A route for the internal corporate network through the internal-facing interface/firewall.
2. A default route (0.0.0.0/0) through the Internet-facing interface/firewall.

• Due Date
• Order Date
• Delivery Date

DAX 
Order Date = 'Due Date' 
Delivery Date = 'Due Date'

• Due Date[Date] ? Sales[Due Date]
• Order Date[Date] ? Sales[Order Date]
• Delivery Date[Date] ? Sales[Delivery Date]

• Review iteration length: Changing duration does not resolve unclear requirements.
• Limit work in progress: Useful when excessive multitasking is the problem, but it does not directly clarify requirements.
• Review individual performance: The issue is a process and backlog-quality problem, not necessarily an individual performance problem.

• Ease of exploitation
• Required privileges
• User interaction
• Impact on confidentiality, integrity, and availability

• CVE: Identifies and names a specific publicly known vulnerability; it does not measure severity.
• OSINT: Refers to intelligence gathered from publicly available sources.
• SOAR: Automates and coordinates security operations, such as alert response and playbooks.

• A is correct: Days beyond the included period incur an extra daily charge.
• D is incorrect: Daily use after 10 days is not free.
• B and C: Data-transfer pricing can depend on the direction and service terms. The exam’s intended distinction is that the included device usage period is the clearly stated no-cost benefit.

• Azure Resource Manager (ARM) templates define Azure resources in a declarative JSON file.
• You can deploy the same template repeatedly for each business unit, ensuring that identical resources are created consistently.
• Templates reduce manual administrative effort and support repeatable, automated deployments.
• Parameters can customize values such as names, regions, and sizes while keeping the overall resource configuration the same.

• An Azure pay-as-you-go subscription follows an operational expenditure (OpEx) model.
• With OpEx, the organization pays for services as they are used, typically based on consumption.
• There is no need to purchase and maintain physical servers upfront.
• This contrasts with capital expenditure (CapEx), where the company makes a significant upfront investment in infrastructure, such as on-premises Hyper-V hosts.

• Secret scope: A named container that groups related secrets and defines access permissions. Example: finance-prod.
• Secret key: The name of an individual secret stored inside that scope. Example: db-password.

text 
Scope: finance-prod 
  Key: db-username 
  Key: db-password

python 
dbutils.secrets.get( 
    scope="finance-prod", 
    key="db-password" 
)

• Microsoft 365 groups can contain users, but generally can’t contain other groups as members.
• Security groups can contain users and, where supported, other security groups.
• Distribution groups have different nesting restrictions and aren’t equivalent to security groups.
• Dynamic groups can’t be manually populated with members; their membership is calculated from rules.
• A group’s membership type (Assigned or Dynamic) and group type determine whether it can be added to another group.

• Digitally signing the software: Verifies authenticity and integrity. It does not hide how the software works.
• Limiting third-party libraries: May reduce dependencies and attack surface, but does not directly prevent reverse engineering.
• Using compile flags: Some compiler options can remove debugging information or optimize code, which may provide limited protection, but this is not the primary technique identified for preventing reverse engineering.

• The requirement explicitly says the organization wants to use SAML to secure Salesforce API access.
• The SAML Bearer Assertion Flow exchanges a SAML assertion for a Salesforce OAuth access token.
• It is intended for server-to-server or other noninteractive integrations where the application has already been authenticated by an identity provider.
• The connected app can be configured so administrators authorize or preauthorize applications that consume the APIs.

• B — JWT Bearer Flow: Uses a signed JWT, not a SAML assertion. It would be appropriate if the requirement specified JWT-based authentication.
• C — SAML Assertion Flow: This is not the standard Salesforce OAuth flow name; the relevant name is OAuth 2.0 SAML Bearer Assertion Flow.
• D — User-Agent Flow: Designed for interactive browser-based authorization, not a SAML-based server-to-server integration.

• Create and manage approved IT services as products
• Control which users can deploy those products
• Apply governance, permissions, and constraints
• Use and manage infrastructure-as-code templates, such as AWS CloudFormation templates

• AWS Resource Explorer: Helps find and browse AWS resources; it does not govern IaC deployments.
• AWS Organizations: Manages accounts, consolidated billing, and organization-wide policies.
• AWS Systems Manager: Provides operational management, such as patching, automation, and parameter storage, but it is not primarily used to catalog and govern IaC-based service deployments.

• Detect risky sign-ins from unfamiliar or unidentified IP addresses
• Evaluate user or sign-in risk
• Automatically require a password change because of a risky sign-in

• User risk policy: Can require a user to securely change their password when the account may be compromised.
• Sign-in risk policy: Can require MFA or block access based on the risk of a particular sign-in.

• B: Moving the task may affect the critical path and should not be done before evaluating the planned response and impacts.
• C: Excluding a required task is not appropriate without formal analysis and stakeholder approval.
• D: Lessons learned and the risk log should be updated, but only after or alongside managing the immediate issue; updating them is not the first action.