What is the passing score for the CFA-Level-I?

The CFA Institute does not release a fixed passing score. Instead, they use a Minimum Passing Score (MPS) that varies by exam window to ensure consistency. Historically, the MPS for the CFA Level I exam is estimated to be between 60% and 70%.

How many questions are on the CFA® Level I exam?

The CFA Level I exam consists of 180 multiple-choice questions. It is divided into two 135-minute sessions, with 90 questions appearing in each session.

Is the CFA-Level-I exam hard?

Yes, the CFA Level I exam is considered very difficult due to the broad range of topics and the depth of knowledge required. Average pass rates typically range between 25% and 45%, and the CFA Institute recommends at least 300 hours of preparation.

How much does the CFA-Level-I exam cost?

For first-time candidates, the total cost includes a one-time enrollment fee of $350 plus a registration fee. Early registration is $940 USD, while standard registration is $1,250 USD, bringing the total cost to between $1,290 and $1,600 USD.

Cisco

CompTIA

ISC

EC-Council

EXIN

Fortinet

ITIL

Juniper

Microsoft

VMware

Avaya

SAP

Google

NVIDIA

Salesforce

Amazon

Palo Alto Networks

ISC2

Splunk

ServiceNow

All Vendors

Test Prep CFA-Level-I Exam Questions
CFA® Level I Chartered Financial Analyst

Updated On: 18-Apr-2026

Pass the CFA® Level I Chartered Financial Analyst exam with community-verified questions and a free, built-in AI Tutor.

CFA Level I candidates, primarily aspiring portfolio managers and financial analysts, must demonstrate mastery of quantitative methods, financial reporting, and derivatives valuation. The curriculum mandates rigorous application of the GIPS framework, IFRS and US GAAP accounting standards, and multifaceted statistical analysis techniques to evaluate fixed income, equity, and alternative asset classes. Proficiency in corporate finance, economics, and professional ethical standards constitutes the core foundation for decision-making. Practitioners utilize DCF modeling, binomial trees, and Black-Scholes pricing to assess complex security structures. Achieving competency requires synthesizing macroeconomic indicators with micro-level financial statement analysis to optimize risk-adjusted returns within diverse global market portfolios.

AI Tutor: Every exam has a dedicated AI tutor. Don't just memorize—understand the why behind every correct answer.

10920
Students passed the CFA-Level-I Exam using this exam dump

98.6%
Average score during Real Exams at the Testing Centre

3963
Exam Questions and Answers in this CFA-Level-I Prep

CFA Level 1 Exam

Number: 3960 Questions
Passing Score: 800
Time Limit: 120 min
File Version: 10.0

Level 1

CFA Level 1 Exam

Version 10.0

Sections
1. Ethics
2. Quantitative Methods
3. Economics
4. Financial reporting and Analysis
5. Corporate Finance
6. Portfolio Management
7. Alternative Investments
8. Equity Investment

Exam A

Exam Topics: 2

Total Questions: 3960

Browse Free CFAI Questions

Contains the Following Exam Topics:

Post your Comments and Discuss Test Prep CFA-Level-I exam dumps with other Community members:

Comments:

Name:

CFA-Level-I Exam Discussions & Posts

Community-Verified AI Explanation Commented on April 14, 2026
Question 1:

Answer: Create a YAML file based on the DNS template.

Explanation: For deploying 200 ASIM parsers with minimal admin effort, start with a YAML template based on the DNS schema. Convert that YAML to an ARM template (using the YAML-to-ARM converter) and deploy. This scales better than manual copying. (Manual copy to the Azure Monitor Logs page can be used for testing, but the YAML-based approach is the recommended first step for large-scale deployment.)

Nairobi, Kenya

Anonymous User Commented on April 14, 2026
Question 1:
Here’s the targeted reasoning for Question 1.
Goal: Ensure production-environment admins are MFA-enabled and MFA is enforced at sign-in to the Azure portal.
What to configure (two parts):

Box 1: Microsoft Entra ID Protection

- Set up the MFA registration policy so that users who manage the production environment are enrolled in MFA. - Steps (high level): - In the Azure portal, go to Microsoft Entra ID > Security > Identity Protection > MFA registration policy. - Under Assignments, include the users (All users or specific groups) who manage production. - Enforce the policy On and save. - Why: This ensures users are registered for MFA before they are prompted to sign in.

Box 2: Capolicy1 (existing Conditional Access policy)

- Add a grant control to require MFA for sign-ins to the Azure portal when managing the production environment. - This CA policy already requires a hybrid joined device; you now also require MFA (Grant: Require MFA) for those sign-ins. - Why: This enforces MFA at the point of sign-in for the production-management scenario.
In short: enable MFA enrollment via Identity Protection policy (Box 1) and enforce MFA during sign-in by configuring Capolicy1 with a “Require MFA” grant (Box 2).
Sydney, Australia

studywithsalvi Commented on April 14, 2026
Question 37:
Answer: B — Perform credential dumping

Rationale: With an internal foothold, dumping credentials (hashes/passwords) enables lateral movement and access to more confidential data, accelerating exfiltration or ransomware goals. Social engineering is typically an initial access step, compromising another endpoint is redundant after foothold, and while share enumeration helps, credentials provide broader access and impact.

Nixa, United States

Anonymous User Commented on April 14, 2026
Question 1:

I can’t view the exhibit image, but based on the text, the destination is a single host: 10.10.13.10/32.

The correct route type is host route.

- A host route is a specific route to one IP address, shown with a /32 mask. - Routing selects routes by longest prefix match; a /32 is more specific than any network route (e.g., /24) or the default route (0.0.0.0/0). - Therefore, R1 will use the host route to reach 10.10.13.10.

Why not the others:

- Default route: used only if no more specific route exists. - Network route: for a whole network
Markham, Canada

Anonymous User Commented on April 14, 2026
Question 7:

Answer: FALSE

Why: Enterprise technology architecture describes the structure of technology assets (infrastructure, platforms, applications, integration) and how they support business capabilities. Its dependencies are on business strategy, processes, standards, security, and governance—not on “acting on specified data according to business requirements.” That focus belongs to enterprise data architecture, which covers data models, data quality, data flows, and data governance.

Jeddah, Saudi Arabia

Anonymous User Commented on April 14, 2026
Question 5:
Question 5: Which of the following threat vectors is most commonly utilized by insider threat actors attempting data exfiltration? Unidentified removable devices Default network device credentials Spear phishing emails Impersonation of business units through typosquatting
Answer: A — Unidentified removable devices
Explanation:

Insider threats often exfiltrate data using uncontrolled/removable media, which allows covert copying of sensitive data offsite without triggering external defenses.

Why the others are less likely:

Default network device credentials: mainly a privilege/access misuse issue, not specifically data exfiltration.

Spear phishing emails: external social engineering to gain access, not typically an insider’s data-leak method.

Impersonation via typosquatting: external impersonation tactic, not an insider exfiltration vector.

Mitigation ideas:

Enforce USB/device control and disable unmanaged removable media.

Implement DLP and encryption for sensitive data.

Monitor data transfers and apply least-privilege access.

New York, United States

Anonymous User Commented on April 14, 2026
Question 2:

Correct answer: D) Solution approach

Why: In enterprise analysis, one of the standard outputs is the Solution approach—the recommended way to address the business need (high-level plan, architecture, and procurement/implementation strategy). The other options are typically inputs or later-phase artifacts rather than outputs of enterprise analysis:

- Assumptions and constraints are inputs considered during analysis. - Stakeholder concerns are captured from stakeholders and used in analysis. - Solution performance assessment is primarily part of Solution Evaluation, not the enterprise-analysis outputs.
Hanoi, Vietnam

Anonymous User Commented on April 14, 2026
Question 2:

Correct answer: A

Why: When replacing drives to reduce performance degradation, you want the replacement with better or matching performance to avoid bottlenecks. In practice, pick the drive with higher IOPS and lower latency than the others, and ensure it’s compatible with the server (capacity, interface, RAID). This minimizes the hit to overall app performance.

Why not the others: The other options likely offer slower performance or higher latency, which would worsen degradation. Without seeing the exact charts, they would correspond to drives that are less capable than the chosen option (A).

Quick takeaway: Compare drive performance metrics (IOPS, latency, throughput) in the charts and select the drive that provides at least equal or better performance to keep the application
Mexico

Anonymous User Commented on April 14, 2026
Question 7:

Correct answer: D. The charging port is dirty or damaged

Why: The issue is tied to the device’s charging port rather than the cable. If flipping the cable occasionally fixes it, contact within the port (debris, bent pins, or damage) is likely causing intermittent connectivity. Since other devices charge fine with the same cable, the problem isn’t the cable itself.

Why not the others:

- The device needs to be restarted: unlikely to fix a physical port issue. - The battery may be swelling and needs inspection: would show other symptoms (sudden battery issues, safety concerns). - The cable is failing: would affect multiple devices, not just one, and flipping wouldn’t consistently resolve it.

Quick takeaway: If one device has intermi
Singapore

Anonymous User Commented on April 14, 2026
Question 3:
I don’t have the text for Question 3 in front of me. Please paste the exact question (including any exhibits or screenshots) and I’ll give a targeted explanation with the correct answer and reasoning.
If you want a quick prep approach in the meantime:

Identify the required framework and components (e.g., CAF for migration, DMF for data, ALM Accelerator for lifecycle, Well-Architected for UX and security).

Map requirements to the tool/framework features (e.g., SSOT with Dataverse, telemetry and escalation flows, ROI calculations).

Look for keywords like “conversational UX,” “SSOT,” “telemetry,” “escalation,” and “ROI” to pick the most appropriate framework and steps.

European Union

Anonymous User Commented on April 14, 2026
Question 1:
Question 1 asks you to configure a home network so you can remotely access a Windows PC and let the game console use chat/services over the wireless network.
Key setup to understand:

Wireless AP LAN

- LAN IP: 192.168.10.1 - Encryption: WPA2 PSK - Purpose: provides wireless connectivity to the devices and secures the wireless link.

Router (port-forward rule)

- Forward TCP port 3389 to the Windows PC - Purpose: enables remote desktop access from the Internet to the PC (RDP uses TCP 3389).

Firewall (screened subnet side)

- LAN IP: 10.100.0.1 - Purpose: acts as the gateway/firewall for the screened subnet, filtering traffic entering that segment.

New York, United States

Anonymous User Commented on April 14, 2026
Question 2:

Answer: Dataverse

Why:

- Power Apps apps hosted in Teams commonly use Dataverse as their data store. Connecting via the Dataverse connector lets you pull the actual tables used by the app into Power BI. - The other options aren’t correct here: - Microsoft Teams: accesses Teams content (messages, meetings), not the app’s data tables. - SQL Server: only if the app’s data is stored in SQL Server (not specified). - Dataflows: used for data preparation ingest, not a direct live connection to the app’s data.

Austin, United States

Mohammed Commented on April 14, 2026
Question 526:
Question 526 tests how org-wide defaults (OWD) and account-based sharing interact with role-based access to Opportunities.

Key concept: With OWD set to private, you only see opportunities you own unless you have additional sharing (e.g., access rights on accounts or sharing rules) that grant view/edit on opportunities related to accounts you manage.

Evaluate options:

- A. Kathy can edit and view her own opportunities. True (owner access allows edit/view). - B. Kathy can EDIT and VIEW her Jennifer’s opportunities. False (not stated; Jennifer’s opportunities aren’t described as accessible for edit). - C. Kathy can edit and view Phil’s opportunities. True if Phil’s opportunities are on accounts Kathy manages; she has edit/view on those. - D. Kathy can view but cannot EDIT Phil’s opportunities.
United Arab Emirates

Community-Verified AI Explanation Commented on April 14, 2026
You have an Azure subscription that contains a Microsoft Sentinel workspace. The workspace contains a Microsoft Defender for Cloud data connector. You need to customize which details will be included when an alert is created for a specific event. What should you do? Enable User and Entity Behavior Analytics (UEBA). Create a Data Collection Rule (DCR). Modify the properties of the connector. Create a scheduled query rule.

Correct answer: Create a Data Collection Rule (DCR).

Why:

- A DCR configures what data is ingested from connectors and how it’s parsed, directly shaping the details included in alerts. - UEBA is for anomaly detection, not alert payload customization. - Modifying the connector’s properties isn’t the standard method to tailor alert content for a specific event. - A scheduled query rule creates alerts from a query, not per-event alert detail customization.
Nairobi, Kenya

Anonymous User Commented on April 14, 2026
Question 11:
Question 11 asks for a design to store each employee’s contact details and high-resolution photos using native AWS services, enabling search and retrieval via AWS APIs.

Correct answer: B — Store each employee's contact information in a DynamoDB table along with the object keys for the photos stored in S3.

- Why: This pattern keeps metadata in a fast, scalable NoSQL store (DynamoDB) and uses S3 for large binary data (photos). The DynamoDB item can include the S3 object key, so your app can fetch the details from DynamoDB and then retrieve the photo from S3 (or generate a presigned URL). It provides low operational overhead and strong scalability.

Why the other options are less suitable:

- A: Encoding photos in Base64 and storing them in DynamoDB is inefficient (drives up item size and cost) and isn’t the recommended pattern for large binary data. - C: Using Cognito as a SaaS employee directory isn’t appropriate for storing and serving employee data and photos. - D: Storing metadata in RDS with photos in EFS adds operational overhead and is less scalable for a scalable, serverless directory.
Key concept: separate metadata in DynamoDB and binary data in S3; keep a pointer (S3 key) in DynamoDB for retrieval.
Bengaluru, India

Peter Commented on April 14, 2026
Hope able to view qns
Singapore, Singapore

Anonymous User Commented on April 14, 2026
Question 1:

Correct answer: Transfer (B)

Why:

A risk transfer strategy moves the financial impact of a risk to a third party. By purchasing cyber insurance, the company shifts potential losses (e.g., breach costs) to the insurer.

This is not reducing likelihood or impact directly (that would be Mitigate), nor eliminating the risk (Avoid), nor simply acknowledging it (Accept).

The risk register is the document listing risks, owners, thresholds, and mitigation actions; insurance addresses the financial consequence of those risks rather than the controls themselves.

Doha, Qatar

Anonymous User Commented on April 14, 2026
Question 1:

The correct answer: Clinical investigations (Option C).

Why: When developing a clinical evaluation document (CER) for a device that is similar to already available ones, the first step is to identify and evaluate any existing clinical investigations related to the device or its class. This provides direct, device-specific evidence of safety and performance to base your evaluation on.

How this fits with the other data: After assessing clinical investigations, you supplement with other sources (e.g., literature search, adverse event reports, and clinical experience) to complete the evidence base and address gaps. Starting with clinical investigations helps you anchor the CER in primary, device-specific data before gathering broader external evidence.

Beijing, China

Anonymous User Commented on April 14, 2026
Question 1:

Correct answer: B – a reduced workload for the customer service agents.

Explanation:

A webchat bot handles many routine inquiries automatically, often 24/7, and can triage or answer common questions.

This reduces the number of tasks agents must handle, freeing them for more complex issues and enabling higher efficiency.

Increased sales or improved product reliability are not guaranteed direct outcomes of a chatbot; sales uplift is possible but not the primary expected benefit here, and product reliability is unrelated to the chatbot’s function.

Ways to measure impact include deflection rate (queries resolved by bot), agent utilization, and average handling time.

Frankfurt Am Main, Germany

Anonymous User Commented on April 14, 2026
Question 17:

This question asks for the run order of CodeDeploy hooks in an in-place deployment.

Correct answer: B — ApplicationStop -> BeforeInstall -> AfterInstall -> ApplicationStart

(Note: there can also be an optional ValidateService hook after ApplicationStart, but the option shown ends with ApplicationStart.)

Why this order:

- ApplicationStop stops the currently running application to ensure a clean upgrade. - BeforeInstall runs tasks that should occur before installing the new version. - AfterInstall handles post-install steps such as installing dependencies or moving files. - ApplicationStart starts the application with the new version. - If configured, ValidateService (health checks) can run after startup to verify the deployment.
Sydney, Australia

Anonymous User Commented on April 13, 2026
Question 12:

Correct answer: /sbin/init

Why: When using SysV init, the kernel starts the first user-space process with PID 1. That initial program is /sbin/init. It cannot exit and is responsible for starting the rest of the system (by reading /etc/inittab to determine the runlevel and starting the appropriate scripts in /etc/rc.d or /etc/init.d). The other options are not the initial program used by the kernel:

- /lib/init.so: a library, not an executable. - /etc/rc.d/rcinit: not the standard first program. - /proc/sys/kernel/init: not an executable program. - /boot/init: not a standard init program.

Quick note: On SysV systems, after /sbin/init starts, it spawns the runlevel scripts to bring the system to the desired state. Some systems may use /bin/init as a link to /sbin/init, but the key concept is that the kernel starts the initial user-space process.

Barueri, Brazil

Anonymous User Commented on April 13, 2026
Question 1:
For Question 1, the two correct options are A and D.

A. A rapid conversion of their existing SAP ERP/ECC environment to a modern, cloud-based architecture

- Why: RISE with SAP S/4HANA Cloud, private edition offers a faster, streamlined path to the cloud, reducing migration time and risk by moving to a modern cloud architecture.

D. Gaining the full Enterprise Management scope as a subscription

- Why: The offering provides the full scope of Enterprise Management available as a subscription, aligning licensing and ongoing updates with a cloud model.
Why the others aren’t correct here:

B (Reimagining processes and standardized best practices) is a benefit of transformation in general but not a specific migration advantage highlighted for this question.

C (Keep ECC 6.0 and minimize changes during migration) is not correct because you upgrade/migrate to S/4HANA; ECC 6.0 cannot be retained as-is in S/4HANA Cloud, private edition.

Gaborone, Botswana

Anonymous User Commented on April 13, 2026
Question 2:

This question tests how SmartConsole handles concurrent admin editing sessions on the Security Management Server.

When an admin opens SmartConsole, a separate editing session starts. Changes are local to that admin until they are published.

Other admins will see a lock on objects/rules that are being edited, but will not see the unpublished changes yet.

Therefore, if Jon is editing rule no.6 but has not published his changes, Dave will not see rule no.6 in his view. Dave only sees the rule once Jon publishes.

The correct answer is: D — Jon is currently editing rule no.6 but has not yet published his changes.

Glurns, Italy

Anonymous User Commented on April 13, 2026
Question 28:

Answer: B

Explanation:

- AWS Glue is a serverless data integration service ideal for creating data ingestion pipelines from data stored in S3. It handles ETL, clean/transform, and cataloging with minimal overhead. - Amazon SageMaker Studio Classic provides an integrated environment to build, train, and deploy ML models, making it suitable for creating the model deployment pipelines. - This pairing minimizes operational overhead: Glue handles ingestion and preparation of raw data, while Studio Classic handles deployment workflows and endpoints. - Why not other options: - Data Firehose is mainly for streaming ingestion, not batch ETL. - Redshift ML isn’t focused on ingestion pipelines. - Using a SageMaker notebook alone isn’t ideal for production deployment pipelines.
In short, use Glue for ingesting/transforming S3 data and Studio Classic for deploying the trained models.
Toyoda, Japan

Community-Verified AI Explanation Commented on April 13, 2026
Question 73:
The correct choices are C and D.

C: Replace the bastion host's SG to only allow inbound SSH (port 22) from the company’s external IP range. This ensures the bastion is reachable only from known on-premise networks, reducing exposure.

D: Replace the application instances’ SG to only allow inbound SSH from the bastion host’s private IP address. This enforces SSH access to apps only via the bastion over the private path inside the VPC.

Why these work:

They implement a secure bastion-based SSH flow: on-prem access goes to the bastion, then from the bastion’s private IP to the app instances.

Using the bastion’s private IP for the app SSH source prevents SSH from the bastion’s public endpoint, avoiding exposure to the internet.

Why the others are incorrect:

A: Limiting the bastion to inbound from application IPs blocks the initial SSH from on-prem to the bastion.

B: Allowing only internal IPs would block on-prem access via the internet to the bastion.

E: Allowing SSH to apps from the bastion’s public IP would expose the app tier to the internet and bypass the private path.

San Miguel De Allende, Mexico

Community-Verified AI Explanation Commented on April 13, 2026
Question 66:

Correct answer: C

Why: Use a lifecycle policy to move data from S3 Standard to S3 Standard-Infrequent Access (S3 Standard-IA) after 30 days. The data is frequently accessed in the first 30 days, then rarely accessed but still needs immediate retrieval. S3 Standard-IA provides cost savings after the initial period while preserving instant access, and it supports a 4-year retention.

Why the other options are not as good:

- A: Moving to S3 Glacier incurs retrieval latency; not ideal for immediate access needs in the first 30 days. - B: One Zone-IA has lower durability (Single AZ) and is riskier for critical data. - D: Moving to Glacier after 4 years adds unnecessary retrieval steps; Standard-IA already meets long-term, infrequent-access needs with immediate retrieval.
San Miguel De Allende, Mexico

Community-Verified AI Explanation Commented on April 13, 2026
Question 49:
Question 49: Explanation

Correct answer: B — Store individual files in Amazon S3 Intelligent-Tiering. Use S3 Lifecycle policies to move the files to S3 Glacier Flexible Retrieval after 1 year.

Why: Data under 1 year stays in a fast, automatically tiered storage class, while older data moves to a cheaper archival tier. This matches the pattern of frequent access for recent data and infrequent access for older data, with cost-effective analytics via Amazon Athena on current data and Glacier retrieval for older data when needed.

Why the other options are not suitable:

- A: Glacier Instant Retrieval isn’t ideal for ongoing analytics on data under 1 year; querying directly from Glacier is not efficient. - C: Relying solely on Athena without automatic tiering misses the cost optimization for data that ages into cheaper storage. - D: Overly complex (uses RDS for metadata) and uses Glacier Deep Archive, which is too slow for the near-term data and adds unnecessary components.

Key concept: Use a tiering strategy with S3 Intelligent-Tiering for active data and Glacier Flexible Retrieval for long-term archival, enabling cost-effective, fast access to recent data and inexpensive storage for older data.

San Miguel De Allende, Mexico

Community-Verified AI Explanation Commented on April 13, 2026
Question 48:
Question 48: Explanation

Correct answer: D — Move catalog to an Amazon EFS file system.

Why: EC2 instance store is ephemeral; data is not durable and is lost if the instance stops/terminates or fails. To achieve high availability and durability, you need shared, durable storage that multiple EC2 instances can mount.

Why other options are not suitable:

- A ElastiCache for Redis is in-memory caching, not durable storage for a catalog. - B Increasing instance size with instance store doesn’t provide durability or multi-AZ availability. - C S3 Glacier Deep Archive is archival storage with high latency, not suitable for a catalog requiring frequent access.

Key concept: Use Amazon EFS for a durable, scalable, shared filesystem that is accessible from multiple EC2 instances and replicated across AZs, delivering high availability and durability for the catalog data.

San Miguel De Allende, Mexico

Anonymous User Commented on April 13, 2026
Question 10:

Answer: AWS Lake Formation

Why this is correct:

- Lake Formation is a data lake governance service that helps centralize and catalog data from multiple sources (e.g., S3, on-prem databases via connectors), enabling unified datasets for analytics and ML. - It provides a single data catalog, centralized access control, and data preparation capabilities, making it easier to aggregate and prepare data from disparate sources for fraud-detection modeling.

Why the other options are not as suitable:

- Amazon EMR Spark jobs: Good for large-scale data processing, but not primarily for central data aggregation and governance across varied sources. - Amazon Kinesis Data Streams: Designed for real-time streaming data ingestion, not for batch data aggregation from multiple sources. - Amazon DynamoDB: A NoSQL database; not intended for integrating and aggregating heterogeneous training data from multiple sources.
Toyoda, Japan

Anonymous User Commented on April 13, 2026
SC-200 Learning Guide

Exam overview

- Domains and skills measured for Microsoft 365 Defender and security operations.

Module 1: Core Defender capabilities

- Defender for Endpoint: threat protection, remediation, device isolation, investigations. - Defender for Identity: monitoring and protecting domain controllers. - Defender for Cloud Apps (MCAS): anomaly detection, app control, blocked unsanctioned apps. - Defender for Office 365: phishing/aggregation protections, threat investigation.

Module 2: Azure Sentinel integration

- Create and configure analytics rules; automatic playbook (Logic Apps) execution.
Cape Town, South Africa

Aamir Commented on April 13, 2026
Great Content to understand the basics of terraform for exam point of view.
Islamabad, Pakistan

Anonymous User Commented on April 13, 2026
Question 128:
Answer: False
Explanation:

ACCOUNTADMIN is the highest-level admin role in Snowflake. Granting a newly created custom role to ACCOUNTADMIN would effectively extend that role’s privileges to the entire account, bypassing the principle of least privilege and jeopardizing separation of duties.

Best practice: create the custom role with only the specific privileges required, then grant that role to the appropriate users or to other roles that need those privileges. Reserve ACCOUNTADMIN for core admin tasks and avoid attaching additional privileges to it.

This approach improves governance and auditing, reduces the risk of privilege abuse, and makes privilege management more manageable.

Hyderabad, India

Anonymous User Commented on April 13, 2026
Question 119:

Answer: True.

Why:

- In Snowflake, a larger warehouse (e.g., 4X-Large) requires provisioning more compute resources (more nodes) than a smaller warehouse (X-Small). This extra provisioning work can take additional time. - If a warehouse is resized while running, Snowflake may need to reallocate resources, which can introduce a brief pause. - Provisioning time can also vary by cloud provider, region, and current load, so the larger size may occasionally take longer to provision than a smaller size.
Hyderabad, India

Community-Verified AI Explanation Commented on April 13, 2026
Question 193:

Correct answer: B. Use Amazon ElastiCache for Redis.

Why:

The goal is to reduce reads against RDS while keeping high availability. Using Redis as an in-memory cache sits in front of RDS, so frequently read data is served from memory instead of hitting the database.

ElastiCache for Redis supports replication and automatic failover, providing high availability for the cache layer itself.

Redis offers richer data structures and persistence options, making it more suitable than Memcached in this scenario.

Options A (EC2 MySQL) and C (Route 53 caching) do not reduce DB reads or provide appropriate caching/HA. D (Memcached) is an alternative but Redis is generally preferred for its features and resilience.

San Miguel De Allende, Mexico

Community-Verified AI Explanation Commented on April 12, 2026
Question 189:
The correct answers are B and D.

B: Use S3 Object Lock in compliance mode. This enforces immutable, write-once behavior for the retention period, preventing any overwrites or deletions during the 5 years.

D: Use server-side encryption with AWS KMS customer managed keys (CMKs) and enable automatic key rotation. This provides at-rest encryption with automated rotation for long-term data.

Why the others aren’t correct:

A uses Object Lock in governance mode, which can be overridden; not guaranteed immutability for the full period.

C uses SSE-S3 (no key rotation control).

E uses imported keys, which require manual rotation and more overhead.

San Miguel De Allende, Mexico

Community-Verified AI Explanation Commented on April 12, 2026
Question 188:
The correct answer is A.
Why A works:

They need a highly available, low-ops SFTP solution that writes to an S3 data lake. AWS Transfer Family provides a fully managed SFTP server with an S3 backend, handling scaling, availability, and server maintenance automatically.

It offers a public endpoint (or VPC endpoints if private access is needed) and integrates with IAM for authentication and access control, meeting partner onboarding and security needs without managing servers.

Why the others don’t:

B (S3 File Gateway) is for on-premises file access to S3 and does not natively provide an SFTP server for partners.

C–E require running and maintaining EC2 instances and custom upload logic (cron jobs), which adds operational overhead and is less available than a managed service.

Key concept: For a managed, highly available SFTP interface to S3 with minimal ops, use AWS Transfer Family with an S3 backend.
San Miguel De Allende, Mexico

Community-Verified AI Explanation Commented on April 12, 2026
Question 172:

Answer: Configure a CloudFront field-level encryption profile.

Why this is correct:

- Field-level encryption (FLE) encrypts specific data fields at the CloudFront edge, so sensitive information stays encrypted throughout the request journey to the origin. - Only designated applications that hold the corresponding decryption keys can access the sensitive fields, meeting the requirement to restrict access.

Why the other options are not suitable:

- A) CloudFront signed URL: controls access to content, not per-field data encryption. - B) CloudFront signed cookies: also access control, not per-field encryption. - D) Origin Protocol Policy HTTPS Only: secures transport to the origin but does not encrypt specific fields or restrict field-level access.

Quick implementation idea (conceptual):

- Create a field-level encryption profile/config and specify which fields to encrypt. - Upload a public key to CloudFront for encryption; keep the private key with the designated applications (or your origin) for decryption. - Deploy so the origin can decrypt and handle data only by authorized apps.
San Miguel De Allende, Mexico

Community-Verified AI Explanation Commented on April 12, 2026
Question 164:

Correct answer: C — Use Amazon SQS (standard queue) with a dead-letter queue, and integrate both applications with the queue.

Why this is correct:

SQS standard queue provides durable, highly scalable message storage and supports at-least-once delivery. Messages can be retained for up to 14 days, satisfying the requirement to keep messages if processing fails.

A dead-letter queue (DLQ) collects messages that fail repeatedly, preventing them from blocking others and enabling separate investigation.

Decoupling sender and processor improves operational efficiency; components scale independently and you avoid managing servers.

Why the other options are less suitable:

A: EC2 + Redis requires managing infrastructure and does not inherently guarantee durable persistence or robust message processing semantics.

B: Kinesis is a streaming service with more complex semantics and retention, and is not as straightforward for per-message retry with a DLQ.

D: SNS is publish/subscribe, not a durable queue; it can lose messages and lacks built-in dead-letter semantics for processing failures.

Key concepts:

Use a durable queue for decoupling and reliability.

Implement idempotent processing on the consumer side to handle potential duplicates from SQS.

San Miguel De Allende, Mexico

Community-Verified AI Explanation Commented on April 12, 2026
Question 159:
Question 159 asks how to block unauthorized requests to a publicly accessible API built with API Gateway and Lambda when botnet traffic spikes.

Correct: A and C

- A: Create a usage plan with an API key shared only with genuine users. This restricts access to known users and allows quota controls at the API level. - C: Implement an AWS WAF rule to target malicious requests and filter them out at the edge before they reach Lambda.
Why the others aren’t correct

B: Filtering inside Lambda is brittle (IP spoofing, botnets) and adds processing cost; edge-based controls are more reliable.

D: Turning into a private API would block legitimate public users.

E: DNS redirection is not a proper access control measure and can disrupt users.

F: Creating an IAM role per user is not scalable for a public API.

Concepts:

Use API keys with a usage plan to control access to public APIs.

Use AWS WAF at API Gateway to block or rate-limit malicious traffic before it reaches backend services.

San Miguel De Allende, Mexico

Community-Verified AI Explanation Commented on April 12, 2026
Question 157:
Question 157 asks how to meet 5-year data retention and indefinite audit logs for an Aurora PostgreSQL DB, given automated backups are already configured.

Correct: D and E

- D: Configure an Amazon CloudWatch Logs export for the DB cluster. This stores database activity/audit logs in CloudWatch Logs indefinitely, satisfying the requirement to keep audit logs long-term. - E: Use AWS Backup to take the backups and keep them for 5 years. AWS Backup provides centralized lifecycle management and can retain backups for a fixed 5-year period, meeting the data-retention requirement beyond what Aurora automated backups offer.
Why the others aren’t correct

A (Take a manual snapshot): not automated and not suitable for long-term retention.

B (Lifecycle policy for automated backups): not a defined feature for RDS/Aurora automated backups.

C (Automated backup retention for 5 years): automated backups in Aurora have a limited retention window (not indefinite 5 years) and don’t cover audit-log retention.

Concepts:

Use CloudWatch Logs exports to preserve audit logs beyond DB lifecycle.

Use AWS Backup for long-term retention and centralized policy control for backups.

San Miguel De Allende, Mexico

Community-Verified AI Explanation Commented on April 12, 2026
Question 154:
The correct answer is B.

B. Use S3 Object Lock in compliance mode with a retention period of 365 days.

Why: Compliance mode enforces write-once-read-many for all objects for the retention period, and cannot be overridden, meeting the requirement that no one can modify or delete files for at least 1 year after creation. This also allows the few scientists to add new files, while existing files remain immutable for the retention window.
Why the others aren’t correct:

A. Governance mode with a legal hold of 1 year.

Governance mode can be overridden by users with special permissions; not truly immutable for all users as required.

C. IAM role to restrict deletions.

IAM alone cannot guarantee immutability or prevent overwrites/deletes once objects are added.

D. Lambda to track hashes.

Hash tracking does not enforce immutability or prevent deletions/modifications.
San Miguel De Allende, Mexico

Community-Verified AI Explanation Commented on April 12, 2026
Question 150:
Answer: A — Create CloudWatch composite alarms where possible.

Composite alarms let you combine multiple underlying alarms (e.g., CPU > 50% and disk read IOPS high) and trigger only when all are in ALARM (AND logic). This matches the requirement to act only when both conditions occur, reducing false alarms from short CPU bursts.

Why not the others:

- Dashboards visualize data but don’t raise alarms or automate actions. - Synthetics canaries monitor availability, not real-time infrastructure metric correlation. - CloudWatch doesn’t support “single alarm with multiple thresholds” for correlated metrics; composite alarms are designed for this use case.
San Miguel De Allende, Mexico

Anonymous User Commented on April 12, 2026
Question 41:

Correct answer: Create an NS record named research in the adatum.com zone.

Why: Delegating a subdomain to another DNS server is done by adding an NS record in the parent zone (adatum.com) with the name of the subdomain (research) and pointing to the subdomain’s authoritative name servers. This tells resolvers to query the delegated server for research.adatum.com.

Why the others are wrong:

- PTR record is for reverse DNS, not delegation. - SOA record is the zone’s start of authority, not used for delegating a subdomain. - An A record for *.research would only map a wildcard host, not delegate authority.

Quick note: After creating the NS record, ensure the target DNS server is set up to serve research.adatum.com (likely with its own NS records) and register the appropriate NS at the registrar if needed.

Hyderabad, India

Community-Verified AI Explanation Commented on April 12, 2026
Question 143:

Answer: D: Host the application on Amazon ECS. Set up an Application Load Balancer with ECS as the target.

Why this is correct:

- You want to break the monolith into smaller, independently managed microservices with minimal operational overhead. ECS provides managed container orchestration, enabling multiple teams to own distinct services. - An Application Load Balancer routes traffic to the appropriate containerized services and supports auto scaling, enhancing scalability.

Why other options aren’t as suitable:

- A: Using Lambda is serverless but often requires substantial refactoring for a monolith moving to microservices; may introduce startup latency and stateful handling issues. - B: Amplify is frontend-focused and not designed to orchestrate multiple backend microservices. - C: Pure EC2 with ASG gives control but higher operational overhead vs a managed container approach for breaking into multiple services.
San Miguel De Allende, Mexico

Community-Verified AI Explanation Commented on April 12, 2026
Question 142:

Correct answer: C

Why:

AWS Global Accelerator provides any-to-any UDP support, static IP addresses, and routes traffic to the nearest edge location, delivering the lowest latency for UDP-based traffic.

It can forward traffic to a Network Load Balancer (NLB), which is suitable for UDP/TCP workloads and supports static IPs.

Using EC2 instances in an Auto Scaling group gives control over kernel/UDP handling and allows scalable, highly available front-end servers.

Why the others aren’t as good:

A: Route 53 with ALB targets HTTP/HTTPS, not UDP, and lacks static edge IPs.

B: CloudFront is HTTP/HTTPS oriented and doesn’t support UDP at edge; NLB behind CloudFront adds complexity and latency.

D: API Gateway targets HTTP traffic; not suitable for UDP and doesn’t provide static edge IPs.

San Miguel De Allende, Mexico

Community-Verified AI Explanation Commented on April 12, 2026
Question 141:

Correct answer: A

Why:

Use CloudFront with the ALB as the origin. CloudFront caches static content at edge locations worldwide, so users get static assets from nearby edges.

For dynamic content, CloudFront forwards requests to the origin (the ALB in the single region). The near edge location still reduces the round-trip time to the origin, improving latency for dynamic responses.

A single region is sufficient because edge caching at CloudFront delivers content globally without duplicating back-end deployments; latency is minimized by the edge network rather than multi-region routing.

Why the others aren’t as good:

B adds multi-region deployment and Route 53 latency routing, which is unnecessary since CloudFront already optimizes global delivery.

C only caches static content; dynamic content would still travel to the ALB and be slower.

D uses geolocation routing to a closest region but loses CloudFront’s global edge caching benefits and adds complexity.

San Miguel De Allende, Mexico

Community-Verified AI Explanation Commented on April 12, 2026
Question 140:
Correct answers: A and C

A. Use Spot Instances for the data ingestion layer. The data ingestion on EC2 is sporadic and can tolerate interruptions, making Spot Instances the most cost-efficient option for this layer.

C. Purchase a 1-year Compute Savings Plan for the front end and API layer. The front end runs on Fargate and the API on Lambda. A 1-year Compute Savings Plan covers compute usage across EC2, Fargate, and Lambda, providing significant savings with flexibility across these services.

Why others are less optimal:

B On-Demand is more expensive for the ingestion layer than Spot.

D All Upfront RI for the ingestion layer is inflexible and doesn't suit potentially interrupted workloads.

E Savings Plan for EC2 only ignores Fargate/Lambda, which would miss savings on those services.

San Miguel De Allende, Mexico

Community-Verified AI Explanation Commented on April 12, 2026
Question 139:

Answer: D

Why this is correct:

- Enable S3 Replication between the source and analysis buckets so new objects are automatically copied as they arrive, with minimal manual effort. - Use EventBridge to propagate ObjectCreated events from the analysis bucket to Lambda (for pattern matching) and to SageMaker Pipelines (for the ML pipeline), enabling event-driven processing.

Why the other options aren’t as good:

- A: Copies done by a Lambda function would add overhead, risk duplicates, and require custom logic instead of built-in replication. - B: Relying on EventBridge alone won’t ensure immediate cross-bucket replication. - C: Lacking EventBridge routing means coordinating Lambda and SageMaker without centralized event-driven triggers. - E: S3 replication is already the key; using a single root or assorting per-bucket rules adds unnecessary complexity.
San Miguel De Allende, Mexico

Community-Verified AI Explanation Commented on April 12, 2026
Question 135:
Question 135 asks how to connect privately to a service hosted in an external provider’s VPC, with access restricted to that service and initiated only from your VPC.

Correct answer: D) Use AWS PrivateLink to connect to the target service. Create a VPC endpoint for the target service.

The provider creates a VPC Endpoint Service; you create an Interface Endpoint in your VPC to connect. Traffic stays on the AWS network and is restricted to that service.

Why:

- PrivateLink creates a private, service-specific connection that originates from your VPC and remains within the AWS network. - It limits access to the single target service, satisfying the security requirement.

Why the other options are incorrect:

- A: VPC peering connects entire VPCs, not a single service; traffic may reach other resources and isn’t PrivateLink-based. - B: A provider-side VPN/Gateway doesn’t restrict access to just one service and isn’t PrivateLink. - C: NAT gateway exposes traffic to the internet and does not establish a private, service-scoped connection.
San Miguel De Allende, Mexico

Community-Verified AI Explanation Commented on April 12, 2026
Question 134:
Question 134 asks for a serverless, globally replicated data analytics solution for data in S3, with encryption and minimal ops.

Correct answer: C) Load into the existing S3 bucket. Enable CRR with SSE-S3. Use Athena to query the data.

Why:

- Using a single data store (S3) with serverless analytics (Athena) minimizes operational overhead. - Enable CRR to replicate encrypted objects to another region, fulfilling global availability and DR needs. - SSE-S3 keeps encryption managed by S3 with no extra key management.

Why the other options are less suitable:

- A: Requiring SSE-KMS multi-Region keys adds key management overhead and potential latency; although valid, it's unnecessary for least overhead. - B: Recommends RDS, which is not serverless analytics and increases operational overhead. - D: Also uses RDS, which introduces database management and is not aligned with a serverless analytics model.
Key concepts:

CRR replicates S3 objects between regions.

SSE-S3 provides server-side encryption with minimal management.

Athena enables serverless SQL queries directly on S3 data.

San Miguel De Allende, Mexico

Test Prep CFA-Level-I Exam Questions CFA® Level I Chartered Financial Analyst

Pass the CFA® Level I Chartered Financial Analyst exam with community-verified questions and a free, built-in AI Tutor.

Exam Topics: 2

Total Questions: 3960

CFA-Level-I Exam Discussions & Posts

Test Prep CFA-Level-I Exam Questions
CFA® Level I Chartered Financial Analyst