Test Prep CFA-Level-I Exam Prep
CFA® Level I Chartered Financial Analyst (Page 166 )

• File1.png — Yes: User1 can apply Label1 with the Microsoft Purview Information Protection client. The client supports labeling image files such as .png in this scenario.

• Folder2 — No: Folder2 is the root folder. The client does not allow labeling the root folder itself. Although the client can label ordinary folders, selecting one applies the label to existing files and subfolders—not automatically to future files.

• File1.docx — Yes: .docx is a supported Microsoft Word file type, so User1 can apply Label1 to it.

• Tracking who accessed or changed customer information
• Detecting unauthorized activity
• Supporting accountability and investigations
• Providing evidence for compliance and incident response

• Single sign-on not enabled: SSO improves convenience and centralized authentication, but it is not essential for access control.
• Complex passwords not required: This weakens authentication, but other controls may reduce the risk.
• Security baseline not consistently applied: A concern, but it is less specific and less immediately damaging than having no activity records at all.

• Labels control access and protection, not blanket exclusion.
• If the user has permission to open a labeled file—especially if the label allows authenticated users to view it—Copilot can use that file in a summary.
• If the label applies encryption and the user lacks the required usage rights, Copilot should not use the file or reveal its contents.
• Copilot honors the user’s existing permissions, so it should not expose labeled content to an unauthorized user.

• Behavioral and anomaly detection
• Threat intelligence integration
• User and entity behavior analytics
• Automated response actions, often through SOAR integration

• Virus signatures: Associated primarily with antivirus or endpoint protection.
• Security agent deployment: Usually an endpoint-management or EDR function.
• Vulnerability scanning: Typically performed by vulnerability-management tools, though a SIEM may integrate their results.

• Azure Cosmos DB is a globally distributed NoSQL database service. It stores and retrieves application data, but it does not provide the complete environment for building, testing, and deploying predictive analytics models.
• Azure Machine Learning is the appropriate service for this requirement. It supports creating experiments, training and testing models, and deploying them for predictions.
• Azure Machine Learning Studio provides the browser-based interface for these tasks.

• VLAN 10 for data
• VLAN 20 for voice

• A: Describes physical trunking or logical switch ports, not an SVI.
• B: An SVI can provide management access, but that is only one use—not the best description here.
• D: SVI use is not related to running out of physical ports.

• Liability accounts (2000–2999) would incorrectly require dimensions, although they should have none.
• Expense accounts (6000–6998) would incorrectly require Customer, which should be optional.
• Account 6999 needs a separate rule because it requires all four dimensions, including Customer.

• 2000–2999: no dimensions
• 4000–4999: Department and Division required; Project and Customer optional
• 6000–6998: Department, Division, and Project required; Customer optional
• 6999: Department, Division, Project, and Customer required

• Active-active routers: Provide redundant Internet connections/devices. Both can operate, so traffic can fail over or be load-balanced.
• Active-active firewalls: Avoid a single firewall becoming a failure point while maintaining security inspection.
• Load balancers: Distribute requests across multiple web servers. If one server fails, traffic can go to the other.
• Redundant power supplies: A server with separate power supplies should connect to independent power sources or circuits.
• UPS A and UPS B: Provide backup power and redundancy. Ideally, each power supply is connected to a different UPS.
• SONET ring: A ring topology provides alternate paths if a fiber link or segment fails.

• File is shared externally ? Access level

• File is labeled “Internal only” ? Sensitivity label

• Box 1: No — The rule requires user.department to equal Engineering. Engineer does not match, so User1 is not in AU1. Admin1 cannot reset User1’s password.
• Box 2: No — Admin1’s role is scoped to AU1 and cannot manage users outside that AU.
• Box 3: Yes — Admin2 is a Global Administrator and can reset User3’s password.

Why this is correct

• Each user authenticates with their own Google account.
• Google manages the user’s SSH key association.
• IAM controls who can access instances.
• Access can be audited by user identity, so security can determine who accessed a VM.
• Granting the role to a Google group avoids managing permissions individually.

Why the others don’t apply

• A: A shared private key is difficult to distribute securely and cannot reliably identify which employee used it.
• B: Manually collecting and deploying keys on every instance is operationally inefficient and complicates auditing.
• D: A project-wide shared key has the same identity and key-management problems as option A. It also does not provide per-user accountability.

• Penetration test: Tests for exploitable vulnerabilities; it does not provide a broad opinion on whether security controls operate effectively.
• Annual self-assessment: Not independent, so it provides less assurance.
• Allow each client the right to audit: Inefficient because every customer may conduct a separate audit, creating duplicated effort and disruption.

• A — Technical review by business owner: A business owner may approve the business impact, but a technical review is normally performed by technical personnel.
• C — Cost-benefit analysis after implementation: Cost-benefit analysis should occur before implementation to support the approval decision.
• D — Business continuity testing: This can be appropriate for major changes, but it is primarily part of business continuity and disaster recovery planning—not a universal change-management activity.

• Required response and resolution times
• Availability or uptime targets
• Performance standards
• Support obligations
• Remedies or penalties for failing to meet the terms

• SOW (Statement of Work): Defines the project’s scope, tasks, deliverables, and schedule.
• MOA (Memorandum of Agreement): Describes agreed responsibilities between parties, often for a specific activity.
• MOU (Memorandum of Understanding): Records a mutual understanding or intention, usually less formal than a contract.

• A is valid:

apex 
  for (Account theAccount : AccountList) { 
      // process theAccount 
  }

• D is conceptually valid, using an index:

apex 
  for (Integer i = 0; i < AccountList.size(); i++) { 
      Account theAccount = AccountList[i]; 
  }

• B is invalid because for(AccountList) is not valid loop syntax.
• C is invalid because each item is an Account, not a List.

• New investment: $536,500
• Resulting NPV: $0

• Business risks
• Potential financial, operational, legal, or reputational impact
• How governance reduces risk to organizational objectives
• How much risk the organization is willing to accept

1. Product + ProductSubCategory: Inner join

1. Result + ProductCategory: Left outer join

• B: Não é preciso implantar o modelo em um endpoint do Amazon SageMaker, pois o Bedrock já oferece a infraestrutura de inferência.
• C: O SageMaker Model Registry é usado para gerenciar modelos no SageMaker, não é requisito para modelos customizados no Bedrock.
• D: Não existe uma etapa geral de “conceder acesso” ao modelo customizado como requisito principal de uso. O ponto essencial é adquirir o Provisioned Throughput.

• Encryption to preserve confidentiality
• Integrity protection to detect alteration
• Authentication of the server through certificates

• SHA-256: A hashing algorithm; it does not encrypt data for transmission.
• SSL 3.0: Obsolete and insecure. It should not be used.
• AES-256: A strong encryption algorithm, but by itself it does not provide the complete secure communication protocol needed for data in transit.

• The connected switch
• The switch’s port/interface
• Device and port descriptions
• Sometimes VLAN or management information

• IKE: Establishes security associations for IPsec VPNs.
• VLAN: Defines logical network segmentation; it does not identify a physical switch port.
• netstat: Displays local network connections and statistics, not the upstream switch and port.

• How quickly the vendor must respond to incidents or requests
• Availability or uptime requirements
• Resolution time targets
• Performance expectations and penalties for failing to meet them

• SOW (Statement of Work): Describes the work, deliverables, scope, and schedule.
• MOA (Memorandum of Agreement): Documents an agreement in which parties commit to specific responsibilities.
• MOU (Memorandum of Understanding): Records a general intention to cooperate; it may not be legally binding.

• Amazon SageMaker — charges apply for compute, storage, and other resources used.
• AWS Config — generally charges for configuration recording and rule evaluations.
• Amazon CloudWatch — has a limited free tier, but many metrics, logs, alarms, and API usage can incur charges.

• The identified risk
• Its likelihood and potential impact
• The person or team responsible for handling it
• The response or treatment plan
• Risk thresholds, such as when escalation or action is required
• Current status and review dates

• Risk tolerance: The amount of risk an organization is willing to accept; it is a concept or limit, not usually the primary documentation.
• Risk transfer: Moving the responsibility or financial impact of a risk to another party, such as through insurance.
• Risk analysis: The process of evaluating risk likelihood and impact.

• Share files with the wrong people
• Use public links unnecessarily
• Fail to classify sensitive data
• Upload data to unauthorized services
• Misunderstand company sharing policies

• A — Step-up authentication: Helps protect administrator accounts, but does not directly address improper file sharing by users.
• C — Password complexity: Helps reduce password attacks, not accidental data disclosure.
• D — Mobile device management: Secures managed mobile devices, but does not directly control file-sharing behavior across the organization.

• Create a CodeCommit repository in the secondary Region.
• Use CodeBuild to run a Git mirror operation from the primary repository to the secondary repository.
• Use EventBridge to detect relevant repository events, such as a pull request being merged.
• Invoke a Lambda function, which starts the CodeBuild project.

• B: Amazon S3 is object storage, not a Git repository that developers can use as a CodeCommit remote.
• C: CodeArtifact is intended for packages and artifacts, not source-code repository mirroring.
• D: An AWS Cloud9 environment is not an appropriate automated replication mechanism and would require manual or persistent infrastructure management.

• SQL injection
• Cross-site scripting (XSS)
• Malicious file uploads
• Common web-application exploits

• Layer 4 firewall: Filters primarily by IP addresses, ports, and transport protocols; it lacks detailed web-application inspection.
• NGFW: Provides advanced network filtering and may include application awareness, but a WAF is more specialized for protecting web applications.
• UTM: Combines several security functions in one device, but it is not specifically focused on web-application attacks.

• A — Capacity: The system must handle all current records and anticipated future records. A system that cannot cope with volume will quickly become ineffective.
• C — Accuracy: Academic records are critical, so the new system must be at least as accurate as the existing system and comparable systems. Poor accuracy could cause serious administrative and reputational problems.
• D — Integration: Linking with the university’s financial systems supports consistency and avoids duplicate data entry, especially for registration, deregistration and fee-related transactions.

• B — Parallel running: This is a useful implementation and risk-control technique, but it is not an essential feature of the system itself. It may also be expensive and time-consuming.
• E — Internet access for all information: This creates significant confidentiality and security risks. External access might be needed for selected services, but unrestricted access to all information is not essential and would be inappropriate for student records.

• The audience and stakeholders
• The complexity and type of requirements
• The communication method and level of detail needed
• Whether to use diagrams, models, documents, demonstrations, or slides

• B: Authority to host the presentation is not the key preparation activity.
• C: Stakeholder sign-off may occur later; presenting requirements does not always require formal approval beforehand.
• D: A scribe may be useful in a meeting, but hiring one is not a core preparation requirement for presenting.

• Honeypots: Deliberately vulnerable or attractive systems designed to lure attackers. Legitimate users should not access them, so activity on a honeypot is a strong indicator of compromise.
• DNS sinkholes: Redirect requests for known malicious domains to a controlled internal system instead of allowing the connection. This can identify infected hosts attempting to contact command-and-control infrastructure.

• Tokenization: Replaces sensitive data with non-sensitive tokens; it protects data but does not primarily detect attackers.
• CI/CD: Automates software development and deployment processes.
• Threat modeling: Identifies potential threats and weaknesses before or during system design.
• Data obfuscation: Makes data harder to understand, but it is not an attacker-detection method.

• Microsoft Purview portal: Create and manage sensitivity labels and configure support for sensitivity labels used with Office files in SharePoint and OneDrive.
• SharePoint admin center: Primarily manages SharePoint settings. Older guidance and PowerShell procedures used SharePoint tenant configuration, which can make this question confusing.
• IRM: Concerns Information Rights Management and is a separate protection mechanism; it should not be used to identify the portal for configuring Microsoft Purview sensitivity labels.

• Install unauthorized or unapproved applications
• Access system areas normally restricted
• Add features unavailable in the default software
• Modify the device’s operating system

• SQL injection (SQLi): Attacks databases by inserting malicious SQL commands.
• Cross-site scripting (XSS): Injects malicious scripts into web pages viewed by users.
• Sideloading: Installs an application from outside the official app store, but it does not necessarily remove the phone’s operating-system restrictions.

• User1 (user1@contoso.com) — This is an external guest in the Fabrikam tenant. Assuming the guest uses email one-time passcode authentication, Azure AD emails a passcode to user1@contoso.com.
• User2 (user2@outlook.com) — An Outlook.com address can authenticate with a Microsoft account, so Azure AD uses that account’s authentication rather than sending an email OTP. The fact that User2 has never accessed Fabrikam resources does not by itself trigger OTP.
• User3 (user3@fabrikam.com) — This is an internal Fabrikam user, so the user signs in with the organization’s normal credentials and does not receive a guest OTP.

• S3 Glacier Deep Archive is designed for long-term archival data with very infrequent access and has a lower storage cost than S3 One Zone-IA.
• The documents are copies stored elsewhere, so reduced availability and delayed retrieval are acceptable.
• An S3 interface VPC endpoint allows private access from the VPC without exposing the bucket through the public internet.
• A bucket policy can restrict access to requests coming through that endpoint.

• A — Use getRecordTypeInfosByDeveloperName()

apex 
  Id rtId = Schema.SObjectType.Account 
      .getRecordTypeInfosByDeveloperName() 
      .get('Business_Account') 
      .getRecordTypeId();

• C — Query the RecordType object

apex 
  RecordType rt = [ 
      SELECT Id 
      FROM RecordType 
      WHERE SObjectType = 'Account' 
      AND Name = 'Business Account' 
      LIMIT 1 
  ];

• B: An outbound SOAP call is unnecessary and inefficient.
• D: Hardcoding an ID is not dynamic, and IDs can differ between orgs.

• MTTC: Time required to contain or limit the incident’s impact — best match.
• MTTR: Time required to remediate or recover from the incident; this may include eradication, restoration, and cleanup, which goes beyond merely stopping spread.
• MTTD: How long it takes to discover the incident.
• MTBF: Average time between failures, generally a reliability metric.

• DB1 (500 TB): Azure Data Box Heavy

• Virtual machines: Azure Migrate

• Espionage: Stealing information for intelligence or competitive purposes.
• Data exfiltration: Unauthorized removal or transfer of data.
• Nation-state attack: A sophisticated attack sponsored by a government.
• Shadow IT: Unapproved technology or access methods used by employees.

• STP elects the switch with the lowest Bridge ID as the root bridge.
• The Bridge ID consists mainly of bridge priority + MAC address.
• If multiple switches have the same priority, the switch with the lower MAC address is preferred.
• STP bridge priority values are configured in increments of 4096, such as 0, 4096, 8192, and so on. 32768 is the standard default value.

• Admin access to the deployment pipeline
• Contributor access to the Development and Test workspaces
• Viewer access to the Production workspace

• C — Custom buttons display at the top and bottom of a page: Correct. In Salesforce Classic, buttons can appear in the page’s button areas, including the top and bottom of record pages.
• D — Custom buttons are available for Person Accounts: Correct. Person Accounts use the Account object, so Account custom buttons can be available on Person Account layouts.
• E — Custom buttons can reference an external app: Correct. A URL custom button can launch or navigate to an external application or website.

• A: JavaScript custom buttons are a Salesforce Classic feature and are not supported in Lightning Experience. They do not enhance Lightning Experience.
• B: The User object does not generally support custom buttons in the same way standard business objects do.

• Azure Resource Manager (ARM) templates define the virtual machines and related Azure resources declaratively. You can deploy the same template repeatedly, ensuring consistent VM sizes, networking, storage, extensions, and other infrastructure settings.

• PowerShell DSC extension applies and maintains the required Windows configuration inside each VM. DSC is state-based: if a setting changes or becomes incorrect, DSC can bring it back to the desired configuration.

• Azure Pipelines deployment groups organize deployment targets, but they do not primarily enforce ongoing VM configuration.
• Custom Script Extension runs setup scripts, but it is generally less maintainable and does not continuously enforce configuration like DSC.
• Pipeline stage templates reuse pipeline workflow definitions; they do not configure the VMs themselves.

• Existing expected ROI: 15%
• New project ROI: 14%
• Cost of capital: 12%

• Project return = 14%
• Cost of capital = 12%
• It earns 2% more than the cost of capital, so it should increase shareholder value.

Correct reasoning

• Create storage5 as a General-purpose v2 (StorageV2) account.
• Configure Blob object replication from storage5 to an existing compatible storage account.
• The destination must support object replication—typically another StorageV2 or premium block blob account.
• Blob versioning must be enabled on both accounts.
• Blob change feed must be enabled on the source account.
• The accounts must meet Azure’s object-replication requirements, including being in supported regions and having compatible configuration.

text 
interface GigabitEthernet0/0.10 
 encapsulation dot1Q 3

• .10 is the router’s local subinterface number.
• dot1Q 3 identifies the 802.1Q VLAN tag carried on the trunk.

text 
interface GigabitEthernet0/0.3 
 encapsulation dot1Q 3

text 
interface GigabitEthernet0/0.2 
 encapsulation dot1Q 2

• A script of cloud CLI commands: IaC because the commands can be saved, reviewed, versioned, and rerun consistently.
• Manually run curl commands: Not necessarily IaC; they are manual actions unless organized into an automated script.
• A sequence of REST requests passed to an API: Could represent automation, but the wording does not explicitly say they are stored and executed as reusable code.
• Commands entered into a cloud console: Manual operation, not IaC.

• Firewall
• Intrusion prevention and detection
• Antivirus or antimalware
• Web and email filtering
• Virtual private networking (VPN)
• Sometimes content filtering and centralized reporting

1. Install a Cassandra-compatible ODBC driver.
2. Configure a data source name (DSN), if required.
3. In Power BI Desktop, select Get Data > ODBC.
4. Choose the configured DSN and connect.

• Microsoft SQL Server database: Connects to SQL Server, not Cassandra.
• OLE DB: Requires a compatible OLE DB provider; this is not the standard choice for Cassandra in Power BI.
• OData: Requires Cassandra data to be exposed through an OData service, which is not the normal direct connection method.

• vBond — orchestration plane: Authenticates devices, helps them discover each other, and assists with NAT traversal and initial control-connection setup.
• vSmart — control plane: Distributes routing and policy information to WAN Edge devices using the overlay control plane.
• vManage — management plane: Provides centralized configuration, monitoring, and orchestration through its GUI/API.
• WAN Edge — data plane: Forwards user traffic across the SD-WAN fabric.