USMLE STEP2 Exam Prep
Step2 (Page 28 )

• Tactics: The attacker’s overall goal, such as gaining persistence or exfiltrating data
• Techniques: The methods used to achieve that goal
• Procedures: The specific implementation or sequence of actions

• IP addresses and hash values: Useful indicators, but they can change quickly.
• Indicators of compromise: TTPs may help identify IOCs, but their main value is describing behavior.
• Tools: Attackers can replace tools or use legitimate administrative utilities.

1. Get Data ? Folder in Power BI Desktop.
2. In Power Query Editor, expand the Attributes column to expose metadata such as hidden status and other file attributes.
3. Remove the Content column (and any other data columns you do not need).

• Name
• Extension
• Date accessed
• Date modified
• Folder Path
• Attributes
• Content

• File1.png — Yes: User1 can apply Label1 with the Microsoft Purview Information Protection client. The client supports labeling image files such as .png in this scenario.

• Folder2 — No: Folder2 is the root folder. The client does not allow labeling the root folder itself. Although the client can label ordinary folders, selecting one applies the label to existing files and subfolders—not automatically to future files.

• File1.docx — Yes: .docx is a supported Microsoft Word file type, so User1 can apply Label1 to it.

• Whether a user has a console password
• Password age and last password change
• Whether MFA is enabled
• Access key status
• Access key creation date and last-use information
• Access key age, which helps audit rotation

• IAM Access Analyzer identifies unintended access to resources; it does not report credential age or rotation.
• AWS Artifact provides AWS compliance documents and agreements, not details about your IAM users.
• AWS Audit Manager helps collect evidence for audits, but it is not the direct tool for viewing IAM credential rotation details.

• B — Reviewing the strategy: Usually performed by a security steering committee or other governance body.
• C — Communicating the strategy: The security manager may help communicate it, but communication is not the primary governance responsibility tested here.
• D — Approving the strategy: Approval belongs to executive management or the appropriate governing authority, not the person who develops it.

• Personally identifiable information (PII) detection

• Prompt Shields

• Self-harm content filtering addresses self-harm-related content.
• Violence content filtering addresses violent content.
• Neither protects customer PII or detects document-based prompt injection.

• A: Daily involvement is unnecessary and may not solve the availability problem.
• C: Clarifying all requirements at the start conflicts with agile’s iterative refinement.
• D: Simply reviewing based on availability leaves the problem unresolved and allows rework to continue.

• A. A virtual network gateway
• D. A virtual network

• Azure virtual machines must be connected to an Azure virtual network (VNet). The VNet provides private IP addressing and network connectivity for the VMs.
• A virtual network gateway enables communication between the Azure VNet and the on-premises network, typically through a site-to-site VPN or ExpressRoute connection.

• Load balancer: Distributes traffic among Azure VMs; it does not connect Azure to an on-premises network.
• Application gateway: Provides web-application load balancing and Layer 7 routing; it is not the normal resource for on-premises connectivity.
• Gateway subnet: A gateway subnet is required inside the VNet when deploying a virtual network gateway, but the question’s intended two primary resources are the VNet and virtual network gateway.

• Cloud architecture
• Data architecture
• Platform engineering
• Data engineering
• Provisioning and modernization

• Data protection is associated mainly with security and risk management.
• Data governance belongs to the governance perspective.
• Data science is not an AWS CAF capability.

• 800 devices ? a scalable, centralized solution is needed.
• Four hardware/vendor classes ? the tool must handle different drivers and images.
• Two user groups ? it should allow different configurations for each group.
• “Distribute custom images” ? an imaging/deployment tool is required, not just a file-copy utility.

• Reviewing and validating generated code
• Checking security, licensing, and quality concerns
• Testing the implementation
• Making the final design and coding decisions

• A: Copilot is not a complete replacement for developers.
• C: Human input, review, and oversight are still required.
• D: Copilot Chat supports many tasks beyond debugging, including explanation, generation, refactoring, and testing assistance.

• Server provisioning
• Operating systems and runtime infrastructure
• Scaling
• Much of the maintenance and patching

• Thin clients reduce endpoint hardware requirements but do not specifically streamline code deployment.
• Private cloud provides dedicated cloud infrastructure but usually requires more management and expense.
• Virtual machines improve resource utilization, but administrators still manage the VMs, operating systems, and deployments.

• Authentication: Verifies a user’s identity, such as username and password.
• Authorization: Determines what the authenticated user is allowed to access.
• Accounting: Records connection and usage details, such as login time or session duration.

• CIA: Confidentiality, integrity, and availability are broad security objectives, not a specific RADIUS function.
• ACL: An access control list contains permit/deny rules on systems or network devices. RADIUS can support access decisions but is not itself an ACL.
• PEM: Privacy-Enhanced Mail is also associated with certificate and key encoding formats; it is unrelated to RADIUS’s primary purpose.

• Secure: uses encryption, such as HTTPS or SFTP.
• Cross-platform: supported by many languages and operating systems.
• Internet-friendly: designed to communicate across networks, usually using standard Internet protocols.

• JSON/REST over HTTPS — widely supported, secure, and Internet-friendly.
• SOAP over HTTPS — also secure and highly cross-platform, though more heavyweight.
• XML over SFTP — secure file-based exchange, but it is not an API-style interface.

• A. Number ? Decimal — Correct. Salesforce Number fields are represented in Apex as Decimal.
• D. Date/Time ? Datetime — This is correct conceptually, but “Dateline” is not an Apex type. If the option literally says “Dateline,” it is incorrect.
• E. Checkbox ? Boolean — Correct. A checkbox contains true or false.

• Number ? Integer — A Number field maps to Decimal, even when its scale is zero.
• Text Area ? List<String> — A text area maps to a single String, not a list.

• Transfer — przeniesienie skutków lub kosztów ryzyka na inna organizacje, np. przez ubezpieczenie lub umowe.
• Akceptacja — firma swiadomie przyjmuje ryzyko bez dodatkowych dzialan.
• Mitigacja — zmniejszenie prawdopodobienstwa wystapienia ryzyka lub jego wplywu, np. przez wdrozenie kontroli bezpieczenstwa.
• Unikanie — calkowite wyeliminowanie ryzykownej dzialalnosci.

• 16 VMs: one failure loses 25 GB and 10 cores—only 6.25% of memory.
• 8 VMs: one failure loses 12.5% of memory.
• 4 VMs: one failure loses 25%.
• 1 VM: one failure loses the entire application environment.

• Data loss prevention (DLP): Helps detect or prevent sensitive data from being copied or transmitted, but it does not primarily protect a stolen laptop’s stored data.
• Operating system hardening: Reduces vulnerabilities and attack surface but does not encrypt files if the device is stolen.
• Boot security: Helps ensure that only trusted software starts, but it does not fully protect the drive if an attacker accesses it offline.

• A larger question bank with verified answers
• Explanations tied to ISACA exam domains
• Current content aligned with the exam blueprint
• Useful review or progress features

• B. The community must be built with the Customer Account Portal template.

• C. An experience ID (expid) or placeholder parameter must be used in the URL.

• A: The Visualforce + Salesforce Tabs template does not provide this dynamic branding capability.
• D: An external CMS is not required. The branding configuration is handled within Salesforce Experience Cloud.

• A. Tuning system software: This is a corrective action, not an analysis method. Tuning should be based on measured performance data.
• B. User dissatisfaction reports: Useful as an indicator, but subjective and insufficient for diagnosing the cause.
• D. Off-peak utilization and response time: This may hide problems occurring during peak periods. Performance analysis should cover representative or peak workloads.

• Each Azure VM must have at least one network interface (NIC).
• A single NIC can have:

• Therefore, each of the five VMs needs only one NIC:

• Microservices: An application-design approach that divides an application into smaller services. It does not inherently reduce the number of operating systems.
• Virtualization: Creates virtual machines, but each VM generally requires its own complete operating system. This improves isolation but does not minimize OS instances as effectively.
• Infrastructure as code: Uses code to automate infrastructure deployment and configuration. It improves consistency but does not determine how many operating systems are used.

• A. Modify CommunitiesSelfRegController

• C. Configure Communities registration to use a custom Visualforce page

• B. Modify the self-registration trigger — There is no standard “self-registration trigger” intended for this configuration. The registration logic is handled by the Visualforce controller.
• D. Configure a custom Apex controller — The standard approach is to modify the provided CommunitiesSelfRegController, rather than simply selecting a separate controller configuration.

• The inference container image or built-in algorithm
• The location of model artifacts in Amazon S3
• IAM permissions through the execution role
• Optional environment variables and networking settings

1. Create AWS::SageMaker::Model
2. Create an AWS::SageMaker::EndpointConfig that references the model
3. Create AWS::SageMaker::Endpoint that references the endpoint configuration

• AWS::SageMaker::Endpoint hosts a model but does not define the model itself.
• AWS::SageMaker::NotebookInstance provides a development environment.
• AWS::SageMaker::Pipeline orchestrates ML workflow steps.

• The connecting host keeps the private key securely.
• The destination host stores the corresponding public key in its authorized keys.
• Authentication can occur without a person entering credentials each time.
• SSH also provides encrypted communication and host authentication.

• Biometric: Requires a human user and is difficult to automate.
• Smart card: Often requires user interaction or card access.
• Hard-coded password: Unsafe because passwords stored in scripts or applications can be exposed, reused, or difficult to manage securely.

• Microsoft Teams: Connects to Teams-related data, but it isn’t the primary connector for the Power Apps data tables.
• Personal Analytics: Provides personal productivity insights, not application data.
• SQL Server database: Only applies if the app explicitly uses SQL Server as its data source.
• Dataflows: Used for preparing and centralizing data, not as the normal direct connection to a Power Apps app.

• A vulnerability scanner automates discovery of known vulnerabilities and misconfigurations across systems. It can contribute to a supply-chain assessment.
• A penetration test actively attempts exploitation and is usually limited to an agreed scope.
• SCAP standardizes vulnerability and configuration assessment data; it is not the analysis itself.
• Illumination tool is not a commonly defined CompTIA Security+ term.

• Threat perspective: Focuses on possible attacks, but may seem technical or hypothetical.
• Compliance perspective: Can motivate action, but compliance alone does not demonstrate the broader business value of governance.
• Policy perspective: Policies are important, but they are a means of implementing governance, not its primary business justification.

• User preferences change, so the model must learn from recent data.
• Keeping the existing data helps preserve knowledge of older patterns and provides a broader training distribution.
• Training only on new data can cause catastrophic forgetting and may overfit if the new dataset is small.
• The new data should not automatically be used as the test set, because it is needed for training and the model must still be evaluated on separate, representative data.

• Entradas grandes, de até aproximadamente 1 GB.
• Processamentos demorados, que podem levar até cerca de 1 hora.
• O cliente envia a solicitação e consulta o resultado depois, sem precisar manter uma conexão aberta durante todo o processamento.

• Real-time inference: indicada para respostas imediatas, com entradas menores e processamento rápido.
• Serverless inference: adequada para cargas variáveis e solicitações menores; não é ideal para processamento longo e arquivos grandes.
• Batch transform: processa grandes volumes em lote, mas não atende à necessidade de respostas próximas do tempo real.

• Writing with Apache Spark, typically as Delta tables.
• Reading with Apache Spark for processing and analysis.
• Reading with T-SQL through the lakehouse’s automatically generated SQL analytics endpoint.
• Reading with KQL through Fabric’s query capabilities that can access lakehouse data.

• Eventhouse: Optimized for real-time and KQL workloads, but it is not the natural destination for Spark-based writes or general lakehouse storage.
• Datamart: Intended mainly for relational analytics and Power BI; it is not designed for Spark-based data ingestion.
• Warehouse: Primarily T-SQL-based and structured. It does not provide the same native Spark write experience or flexibility for semi-structured data.

• Create a record-triggered Flow on Opportunity.
• Run it when the record is created or updated.
• Add entry criteria such as Probability > 50%.
• Use Create Records to create the related Sales Demo Request, populating its Opportunity lookup.

• Apex Trigger: Possible, but unnecessary custom code for a straightforward automation requirement.
• Workflow Rule: Cannot create a related custom record.
• Process Builder: Could create a record, but Flow is Salesforce’s preferred and more capable declarative automation tool.

• vSmart controls the overlay control plane. It uses OMP to exchange routing information, distribute policies, and determine how WAN Edge devices reach one another.
• vManage is the centralized management and configuration platform.
• vBond is the orchestrator. It helps devices authenticate, discover controllers, and traverse NAT during onboarding.
• APIC-EM is not the SD-WAN control-plane component described here.

1. Define – establish the project’s objectives, scope, feasibility and requirements.
2. Design – plan how the project will be carried out, including resources, schedules and controls.
3. Deliver – execute the project and produce the required outputs.
4. Develop – close the project formally and capture learning for future projects.

• Filing documentation and records
• Closing project and accounting systems
• Settling costs
• Handing over the completed work and obtaining sign-off
• Reviewing performance and giving feedback

Correct choices

• DB1: Azure Data Box Heavy
• Virtual machines: Azure Migrate

Why

• Replication with minimal downtime
• A test migration
• Final cutover after validation

• SharePoint search: Finds documents based on search terms, but it does not reliably identify every 32-character account number for DLP enforcement.
• A hunting query in Microsoft 365 Defender: Used for security investigations, not for defining sensitive content in a DLP policy.
• Azure Information Protection: Uses classification and labeling; it does not automatically identify this specific account-number pattern unless configured with a matching sensitive information type.
• RegEx pattern matching: Best suited for structured identifiers with a known format, such as account numbers, employee IDs, or policy numbers.

• A. Microsoft 365 group with Assigned membership
• C. Microsoft 365 group with Dynamic User membership

Why?

• Assigned membership: You explicitly add User1, User2, and User3.
• Dynamic User membership: Membership is automatically determined by a rule based on user attributes.

Why the other options are incorrect

• B and D: Security groups do not support the Microsoft 365 group expiration policy.
• E: Dynamic Device groups are intended for devices, not these users, and are also security groups.

• Financial performance
• Customer perspective
• Internal business processes
• Learning and growth

• Increasing the number of indicators can make the scorecard cluttered and less useful. Measures should be limited to those that are strategically important.
• The scorecard is mainly a tool for implementing and monitoring strategy, not for formulating strategy.
• It should contain both leading indicators and lagging indicators. Leading indicators predict future performance, while lagging indicators measure results already achieved.

1. Identify every Region containing a replica.
2. Schedule deletion of the KMS key in each Region.
3. Use the minimum KMS waiting period: 7 days.

• A — Use the root user: Root access does not eliminate the need to schedule deletion for every regional replica. The problem is the multi-Region structure, not insufficient administrative permissions.

• C — Update the key policy: The policy already grants kms:* to IAM principals. Changing permissions does not delete the key or its replicas.

• D — Disable the key and schedule deletion in 30 days: Disabling can stop cryptographic use, but 30 days is slower than the permitted 7-day waiting period. It also does not address replicas in other Regions.

• The requirement explicitly says the organization wants to use SAML to secure Salesforce API access.
• The SAML Bearer Assertion Flow exchanges a SAML assertion for a Salesforce OAuth access token.
• It is intended for server-to-server or other noninteractive integrations where the application has already been authenticated by an identity provider.
• The connected app can be configured so administrators authorize or preauthorize applications that consume the APIs.

• B — JWT Bearer Flow: Uses a signed JWT, not a SAML assertion. It would be appropriate if the requirement specified JWT-based authentication.
• C — SAML Assertion Flow: This is not the standard Salesforce OAuth flow name; the relevant name is OAuth 2.0 SAML Bearer Assertion Flow.
• D — User-Agent Flow: Designed for interactive browser-based authorization, not a SAML-based server-to-server integration.

python 
def add_integers(a, b): 
    return a + b

• Uses def to define a function.
• Accepts two parameters, a and b.
• Uses return to send their sum back to the caller.
• Uses indentation to define the function body.

python 
result = add_integers(3, 4) 
result is 7

• A. IDS attack signatures: Primarily detects suspicious network activity, not necessarily malware embedded in uploaded files.
• C. Load balancer: Improves availability and distributes traffic; it does not inspect documents for malware.
• D. WAF: Protects web applications from attacks such as SQL injection and command injection, but its primary role is not scanning uploaded PDFs for malware.

• Application management: Controls which apps can be installed or used; it does not remove existing data after theft.
• Full-disk encryption: Protects data when the device is powered off or locked, but it may not help if the attacker has already unlocked the device.
• Containerization: Separates corporate data from personal data, but the attacker may still access the corporate container using the stolen credentials.

• Supervised learning requires labeled examples to learn how to classify customers.
• Reinforcement learning learns through actions, rewards, and penalties, which is not the main task here.
• RLHF uses human feedback to improve model behavior, typically for generative AI, not customer segmentation.

• The user starts in the corporate portal.
• The portal launches the Salesforce resource.
• The IdP sends the SAML response to Salesforce.

• Connected App + OAuth is for OAuth authorization and API/app access, not this SAML-based seamless login scenario.
• SP-initiated SSO would begin when the user first requests the Salesforce resource and Salesforce redirects them to the IdP. That is not the described starting point.

• Import: Copies data into the Power BI model. It requires scheduled or manual refresh, so it may not meet the two-minute requirement.
• Live connection: Connects to an existing Power BI semantic model or Analysis Services model; it is not the appropriate choice for connecting directly to the Azure SQL database in this scenario.

• Matching hashes: The software is unchanged.
• Different hashes: The software was modified or corrupted.

• Encryption: Protects confidentiality.
• Baselines: Define approved configurations or normal performance.
• Tokenization: Replaces sensitive data with tokens.

• ARP poisoning: Redirects or intercepts local network traffic; monitoring would typically show suspicious ARP changes or man-in-the-middle behavior.
• Jamming: Interferes with wireless or radio signals. It would affect connectivity, not usually show a server-specific overload.
• Kerberoasting: Attempts to obtain and crack Kerberos service-account hashes; it does not normally cause a system outage.