Right answers raise buildings in your town

Certopolis is a free game where right answers raise buildings in your own town. These are SAA-C03 questions, 3,131 in the bank. No sign-up for these.

1. SAA-C03, question 1 of 5

   A multiplayer game server uses UDP and runs behind Network Load Balancers in three Regions. Players are given one connection address that must not change, and sessions must move to another Region within seconds if one Region's endpoints become unhealthy. Which approach will meet these requirements?

   Right. In the game that’s Renown for your Design Resilient Architectures building.

   Not that one: A is right. In the game your Design Resilient Architectures building would lose a little Renown, and this question would come back later.

   The answerA.Create a standard accelerator in AWS Global Accelerator with the three load balancers as endpoints, and publish its static IP addresses.The requirement names two properties that belong to Global Accelerator. The address is fixed and anycast: "By default, Global Accelerator provides you with static IP addresses that you associate with your accelerator. The static IP addresses are anycast from the AWS edge network. For IPv4, Global Accelerator provides two static IPv4 addresses."Your answerB.Create a CloudFront distribution with the three load balancers as origins, and publish the distribution's domain name.CloudFront is an HTTP content delivery network. It does not front a UDP game protocol.Your answerC.Publish the Elastic IP address of each Region's load balancer and have the client try the next address when one fails.Puts failover in the client and gives players several addresses to hold.Your answerD.Publish a Route 53 latency record for each of the Regions with health checks attached, and let each client resolve the nearest healthy Region.Moves clients by changing DNS answers, which resolvers and clients cache; the published address also changes per Region, which the requirement forbids.

   Show the full explanation and doc quotes

   The failover is at the network rather than in DNS: "Global Accelerator uses the AWS global network to route traffic to the optimal regional endpoint based on health, client location, and policies that you configure", and "the service reacts instantly to changes in health or configuration to ensure that internet traffic from clients is always directed to healthy endpoints." Route 53 latency records with health checks are the near miss, and they work by handing out different answers, which a UDP client that has already resolved and cached one will not notice for as long as the TTL lasts.

   Written from docs.aws.amazon.com/global-accelerator/latest/dg/what-is-global-accelerator.html

2. SAA-C03, question 2 of 5

   A producer sends a message to an Amazon SQS FIFO queue, receives no response because of a network fault, and retries the same send. A solutions architect must ensure the retry cannot place a duplicate on the queue or disturb the order of the messages around it. Which approach will meet these requirements?

   Right. In the game that’s Renown for your Design Resilient Architectures building.

   Not that one: D is right. In the game your Design Resilient Architectures building would lose a little Renown, and this question would come back later.

   Your answerA.Retry the send into a second FIFO queue, and have the consumer compare the two queues before it acknowledges either of the copies.Invents reconciliation across queues where the queue already offers deduplication, and FIFO order holds within one queue only.Your answerB.Retry with the same receive request attempt ID, which is the identifier that makes a repeated send idempotent on a FIFO queue.Names the consumer-side identifier. A receive request attempt ID makes a repeated ReceiveMessage safe, not a repeated send.Your answerC.Retry with a new message deduplication ID and delete the older copy after the consumer reports that it has seen both of them.Deduplication is keyed on the ID. Changing it is how a producer deliberately sends a genuinely new message with identical content.The answerD.Retry with the same message deduplication ID, which suppresses the duplicate as long as an acknowledgement arrives inside the interval.The producer-side identifier is the deduplication ID and AWS states the guarantee directly: "if a SendMessage action fails, the producer can retry sending the message multiple times with the same message deduplication ID. As long as the producer receives at least one acknowledgment before the deduplication interval expires"

   Show the full explanation and doc quotes

   The retries "do not introduce duplicate messages" and "do not disrupt message order." The consumer has the mirror-image mechanism for its own failures - "the consumer can retry as many times as necessary using the same receive request attempt ID" - and the two identifiers are not interchangeable.

   Written from docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/FIFO-queues-understanding-logic.html

3. SAA-C03, question 3 of 5

   A software vendor wants customers in other AWS accounts to reach its application privately, without the traffic crossing the internet and without the vendor managing accounts for them. The vendor already runs the application behind a load balancer in its own VPC. Which solution meets these requirements?

   Right. In the game that’s Renown for your Design Secure Architectures building.

   Not that one: A is right. In the game your Design Secure Architectures building would lose a little Renown, and this question would come back later.

   The answerA.Create a VPC endpoint service in front of a Network Load Balancer, and have each customer create an interface VPC endpoint to it.This is the shape AWS describes for sharing a service. "As the service provider, you create a Network Load Balancer in your VPC as the service front end. You then select this load balancer when you create the VPC endpoint service configuration. You grant permission to specific AWS principals so that they can connect to your service. As a service consumer, the customer creates an interface VPC endpoint, which establishes connections between the subnets that they select from their VPC and your endpoint service. The load balancer receives requests from the service consumer and routes them to the targets hosting your service." Nothing is peered, no CIDR has to be coordinated, and the vendor keeps its own account boundary.Your answerB.Create a gateway VPC endpoint in each customer's VPC that points at the vendor's Application Load Balancer by its DNS name.Gateway endpoints serve Amazon S3 and DynamoDB. A customer's private connection to a hosted service is an interface endpoint.Your answerC.Create a VPC peering connection to each customer VPC, then publish the application's private IP addresses to them.Peering joins networks and needs non-overlapping CIDRs, routing on both sides, and a new connection for every customer.Your answerD.Publish the application through an internet-facing Application Load Balancer, restricted to the customers' public IP ranges.Puts the application on the internet and defends it with an address list, which is the arrangement PrivateLink exists to replace.

   Written from docs.aws.amazon.com/vpc/latest/privatelink/privatelink-share-your-services.html

4. SAA-C03, question 4 of 5

   A company committed to three-year Reserved Instances for a workload that has since moved from one instance family to another. It wants to keep a commitment discount on the new family for the remainder of the term and to recover value from any reservation it cannot use. Which solution meets these requirements?

   Right. In the game that’s Renown for your Design Cost-Optimized Architectures building.

   Not that one: D is right. In the game your Design Cost-Optimized Architectures building would lose a little Renown, and this question would come back later.

   Your answerA.Let the reservations run to the end of the term unused, since an offering class cannot change after purchase.Offering class is indeed fixed at purchase, which is the reason to use the two exits rather than to accept the loss.Your answerB.Exchange the Standard Reserved Instances for the new family, and sell the Convertible ones in the Reserved Instance Marketplace.Reverses both halves of the table: Standard cannot be exchanged, and Convertible cannot be sold in the Marketplace.Your answerC.Modify every Reserved Instance to the new instance family, because modification covers a family change for both offering classes.Modification is available to both classes for some attributes; an exchange is what changes instance family, and only for Convertibles.The answerD.Exchange the Convertible Reserved Instances for the new family, and sell any Standard Reserved Instances in the Reserved Instance Marketplace.Each offering class has exactly one exit and they are opposites. "A Standard Reserved Instance provides a more significant discount than a Convertible Reserved Instance, but you can't exchange a Standard Reserved Instance. You can exchange Convertible Reserved Instances." On recovery, the table is explicit: a Standard "can be sold in the Reserved Instance Marketplace" and a Convertible "can't be sold in the Reserved Instance Marketplace." So the Convertibles follow the workload to the new family, and the Standards are sold rather than stranded.

   Written from docs.aws.amazon.com/AWSEC2/latest/UserGuide/reserved-instances-types.html

5. SAA-C03, question 5 of 5

   A company must fail DNS over when a private backend service degrades. The service has no public endpoint for Route 53 to call, but it already publishes a custom metric to Amazon CloudWatch, and an alarm on that metric fires when the service degrades. What should a solutions architect do to accomplish this?

   Right. In the game that’s Renown for your Design Resilient Architectures building.

   Not that one: B is right. In the game your Design Resilient Architectures building would lose a little Renown, and this question would come back later.

   Your answerA.Expose the backend service through a public listener so that an ordinary endpoint health check can reach it.Publishing a private backend so that a health checker can reach it trades the requirement away, and the endpoint would then need protecting in its own right.The answerB.Create a Route 53 health check that monitors the state of that CloudWatch alarm, and use it on the failover records.Route 53 health checks are not limited to calling an endpoint. AWS lists the three things a health check can monitor: "The health of a specified resource, such as a web server. The status of other health checks. The status of an Amazon CloudWatch alarm."Your answerC.Attach the CloudWatch alarm to the Route 53 hosted zone so the zone stops answering while in alarm.An alarm is associated with a health check, and a health check with a record. There is no binding between an alarm and a hosted zone.Your answerD.Create a calculated health check over the existing endpoint checks of the public tier in front of the service.A calculated health check combines the status of other health checks. Those checks watch the public tier, which is healthy while the backend degrades.

   Show the full explanation and doc quotes

   The third covers exactly this case, where the signal exists as a metric rather than as a reachable URL, and it is the standard way to fail over on a private or non-HTTP signal. The failover behaviour then follows the documented pattern: "If you have multiple resources that perform the same function, you can configure DNS failover so that Route 53 routes your traffic from an unhealthy resource to a healthy resource."

   Written from docs.aws.amazon.com/Route53/latest/DeveloperGuide/dns-failover.html

Certopolis is a free game where right answers raise buildings in your own town. These are DVA-C02 questions, 901 in the bank. No sign-up for these.

1. DVA-C02, question 1 of 4

   A developer turns on Lambda SnapStart for a Java function to cut cold start latency. An Amazon API Gateway REST API invokes the function through its unqualified ARN. After the release, startup latency is unchanged. Which solution will resolve this issue?

   Right. In the game that’s Renown for your Deployment building.

   Not that one: D is right. In the game your Deployment building would lose a little Renown, and this question would come back later.

   Your answerA.Increase the Lambda function's memory allocation so that Lambda restores the snapshot onto a larger environment.More memory changes the CPU available during restore, but the invocation still resolves to $LATEST, which SnapStart never snapshots. Latency is unchanged.Your answerB.Configure provisioned concurrency on the function in addition to SnapStart so that Lambda keeps a pool of pre-initialized execution environments ready.Provisioned concurrency is configured on an alias or a version, so it does nothing for an integration that still invokes the function's unqualified ARN. The requests keep resolving to $LATEST, which is initialized from scratch, and the startup latency the developer measured does not move. The two are alternative cold start strategies, and enabling both on one version is not possible.Your answerC.Move the initialization code inside the handler so that Lambda captures that work in the snapshot.Inverts the snapshot boundary; only initialization code that runs before the handler is captured, so moving work into the handler removes it from the snapshot.The answerD.Publish a function version and change the API Gateway integration to invoke that version through an alias.Lambda takes the SnapStart snapshot when a function version is published, and SnapStart can be used only on published versions and aliases that point to versions.

   Show the full explanation and doc quotes

   An unqualified ARN invokes $LATEST, which has no snapshot, so the integration must target a version or alias.

   Written from docs.aws.amazon.com/lambda/latest/dg/snapstart.html

2. DVA-C02, question 2 of 4

   A promotions table in Amazon DynamoDB stores discount codes, with TTL enabled on an expiresAt attribute that holds an epoch-seconds timestamp. Support tickets show that customers occasionally redeem codes hours after their expiry time, and the application's Query results still contain those codes. The application must never act on an expired code. Which solution will meet this requirement?

   Right. In the game that’s Renown for your Development with AWS Services building.

   Not that one: A is right. In the game your Development with AWS Services building would lose a little Renown, and this question would come back later.

   The answerA.Add a filter expression to the Query that excludes items whose expiresAt value is not in the future.TTL deletes expired items "typically within a few days after their expiration" — expiry marks eligibility, not the moment of deletion. Until the background process removes them, expired items continue to appear in Query and Scan results, and the documentation's own remedy is the one in the key: "Use filter expressions to remove expired items from Scan and Query results." A filter comparing expiresAt to the current request time guarantees the application never acts on an expired code, regardless of when the deletion actually lands.Your answerB.Run the Query with strongly consistent reads so that TTL deletions are reflected in the results.This is the reflex reading: stale-looking data, so demand a consistent read. But the expired codes have not been deleted from the table at all yet — TTL deletion is a background process that can lag expiry. A strongly consistent read faithfully returns the items that are still there.Your answerC.Store expiresAt at millisecond precision so that the TTL process removes codes sooner.TTL requires the expiration attribute in epoch seconds; the deletion lag after expiry is a property of the background process, not of timestamp precision. A milliseconds value is not read as a nearer time — it is an enormous epoch-seconds number, pushing expiry into the far future.Your answerD.Disable and re-enable TTL on the table so that the background deletion catches up on the backlog.The lag between expiry and deletion is documented behaviour, not a stalled process to be kicked. Recreating the TTL configuration does not change when the system gets around to deleting expired items.

   Written from docs.aws.amazon.com/amazondynamodb/latest/developerguide/TTL.html

3. DVA-C02, question 3 of 4

   A developer runs a consumer application on Amazon EC2 that calls the Amazon SQS ReceiveMessage API in a tight loop. The queue is often empty, and the AWS bill shows a large number of ReceiveMessage requests that return nothing. The company wants to lower request volume without delaying message delivery. Which solution will meet these requirements?

   Right. In the game that’s Renown for your Development with AWS Services building.

   Not that one: C is right. In the game your Development with AWS Services building would lose a little Renown, and this question would come back later.

   Your answerA.Add a fixed 20-second sleep between ReceiveMessage calls in the consumer loop.A sleep reduces calls but is blind: a message that arrives one second into the sleep waits out the remainder. Long polling returns immediately when a message appears.Your answerB.Increase the MaxNumberOfMessages parameter on each ReceiveMessage call to 10.MaxNumberOfMessages caps how many messages one response may carry. On an empty queue the response is still empty, so the request count is unchanged.The answerC.Set ReceiveMessageWaitTimeSeconds to 20 seconds on the queue to enable long polling.Long polling makes ReceiveMessage wait up to the configured WaitTimeSeconds for a message to arrive and query all Amazon SQS servers rather than a subset.Your answerD.Convert the queue to an Amazon SQS FIFO queue and enable content-based deduplication on the producers.FIFO queues guarantee order and exactly-once processing within a deduplication window. Neither property changes how many empty responses short polling produces.

   Show the full explanation and doc quotes

   That eliminates most empty and false-empty responses while still returning a message as soon as one becomes available.

   Written from docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-short-and-long-polling.html

4. DVA-C02, question 4 of 4

   A developer must encrypt 5 GB data files in the application before uploading them to Amazon S3. The developer calls the GenerateDataKey API operation with a customer managed KMS key and receives a response. What should the developer do next to follow envelope encryption best practices?

   Right. In the game that’s Renown for your Security building.

   Not that one: B is right. In the game your Security building would lose a little Renown, and this question would come back later.

   Your answerA.Encrypt each file with the plaintext data key. Store the plaintext data key in AWS Secrets Manager for later decryption.Persisting the plaintext data key anywhere — even in a secrets store — breaks envelope encryption, because the data's security no longer depends on the KMS key. The encrypted copy of the data key is the only form that should be stored.The answerB.Encrypt each file with the plaintext data key. Remove the plaintext key from memory and store the encrypted data key with the file.GenerateDataKey returns a plaintext data key and a copy encrypted under the KMS key.Your answerC.Send each file to the AWS KMS Encrypt API operation with the customer managed key. Store the returned ciphertext in Amazon S3.The KMS Encrypt operation accepts at most 4 KB of data. It is designed for wrapping small secrets such as data keys, not for encrypting 5 GB files; bulk encryption always happens client-side with a data key.Your answerD.Encrypt each file with the encrypted data key from the response. Discard the plaintext data key without using it in the workflow.The encrypted data key is opaque ciphertext that only AWS KMS can decrypt — it cannot be used as an encryption key. The plaintext copy is what encrypts the data, and it should be used immediately and then wiped from memory.

   Show the full explanation and doc quotes

   The documented workflow is to encrypt the data locally with the plaintext key, remove that key from memory as soon as possible, and store the encrypted data key safely alongside the ciphertext; at read time, KMS Decrypt recovers the plaintext key.

   Written from docs.aws.amazon.com/kms/latest/developerguide/data-keys.html

Certopolis is a free game where right answers raise buildings in your own town. These are CLF-C02 questions, 484 in the bank. No sign-up for these.

1. CLF-C02, question 1 of 5

   Which of the following becomes an AWS task when a database moves from Amazon EC2 to Amazon RDS?

   Right. In the game that’s Renown for your Cloud Technology and Services building.

   Not that one: A is right. In the game your Cloud Technology and Services building would lose a little Renown, and this question would come back later.

   The answerA.Operating system patchingThe Amazon RDS user guide compares management models: operating system patching is the customer's job on Amazon EC2 and AWS's on Amazon RDS. Hardware lifecycle is already AWS's on Amazon EC2, so it does not change hands in the move.Your answerB.Hardware lifecycleAWS already manages the hardware lifecycle when the database runs on Amazon EC2, so moving to Amazon RDS does not hand it over; it was never the customer's.Your answerC.Application optimizationApplication optimization is the customer's responsibility on premises, on Amazon EC2 and on Amazon RDS alike, so the move does not change it.Your answerD.Query performance tuningAmazon RDS leaves query tuning with the customer. The RDS guide says tuning SQL queries for performance is the customer's responsibility.

   Written from docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Welcome.html

2. CLF-C02, question 2 of 5

   Which AWS service would protect every AWS customer from common DDoS attacks at no additional charge?

   Right. In the game that’s Renown for your Security and Compliance building.

   Not that one: D is right. In the game your Security and Compliance building would lose a little Renown, and this question would come back later.

   Your answerA.AWS WAFAWS WAF filters HTTP(S) requests by rules the customer configures; the automatic DDoS protection for every customer is AWS Shield Standard.Your answerB.Amazon GuardDutyAmazon GuardDuty is a threat detection service; the automatic DDoS protection for every customer is AWS Shield Standard.Your answerC.AWS Firewall ManagerAWS Firewall Manager centrally applies protections across accounts, and its charges come from the underlying services; it is not automatic protection for every customer.The answerD.AWS ShieldAll AWS customers benefit from the automatic protection of AWS Shield Standard at no additional charge. It defends against the most common, frequently occurring network and transport layer DDoS attacks.

   Written from docs.aws.amazon.com/waf/latest/developerguide/ddos-standard-summary.html

3. CLF-C02, question 3 of 5

   Which of the following advantages of cloud computing describes paying only for the resources a company consumes?

   Right. In the game that’s Renown for your Cloud Concepts building.

   Not that one: B is right. In the game your Cloud Concepts building would lose a little Renown, and this question would come back later.

   Your answerA.Stop guessing capacityStop guessing capacity means scaling up and down as needed instead of fixing capacity in advance. The payment model is the fixed-for-variable trade.The answerB.Trade fixed expense for variable expenseTrade fixed expense for variable expense means that instead of investing heavily in data centers and servers before knowing how they will be used, a company pays only when it consumes computing resources, and only for how much it consumes.Your answerC.Benefit from massive economies of scaleMassive economies of scale lower the pay-as-you-go price itself. Paying only for consumption is the fixed-for-variable trade.Your answerD.Go global in minutesGo global in minutes is about deploying an application in multiple Regions with a few clicks, not about how resources are paid for.

   Written from docs.aws.amazon.com/whitepapers/latest/aws-overview/six-advantages-of-cloud-computing.html

4. CLF-C02, question 4 of 5

   Which of the following lets an AWS customer on Basic Support ask the community technical questions?

   Right. In the game that’s Renown for your Billing, Pricing, and Support building.

   Not that one: B is right. In the game your Billing, Pricing, and Support building would lose a little Renown, and this question would come back later.

   Your answerA.AWS Partner NetworkThe AWS Partner Network is for collaborating with AWS partners. It is not a community forum included with Basic Support.The answerB.AWS re:PostBasic Support is included for all AWS customers and gives 24/7 access to customer service, documentation, whitepapers and AWS re:Post, AWS's community resource. Paid plans add prioritized responses on re:Post, but access itself is part of Basic Support.Your answerC.AWS Prescriptive GuidanceAWS Prescriptive Guidance is published guidance to read. It is not a place where a customer posts a question to the community.Your answerD.AWS Business Support+AWS Business Support+ is a paid plan with access to Cloud Support Engineers. A customer on Basic Support does not have it.

   Written from aws.amazon.com/premiumsupport/plans/

5. CLF-C02, question 5 of 5

   Which AWS service would data scientists use to build, train, and deploy machine learning models?

   Right. In the game that’s Renown for your Cloud Technology and Services building.

   Not that one: C is right. In the game your Cloud Technology and Services building would lose a little Renown, and this question would come back later.

   Your answerA.Amazon LexLex is for building chatbots with voice and text. It does not give data scientists a place to build, train, and deploy their own models.Your answerB.Amazon PollyPolly converts text into lifelike speech. It is a finished AI capability, not a service for training models.The answerC.Amazon SageMaker AIAmazon SageMaker AI is a fully managed machine learning service. With it, data scientists and developers can build, train, and deploy ML models into a production-ready hosted environment.Your answerD.Amazon TranslateTranslate converts text from one language to another. It does not provide model building, training, or hosting.

   Written from docs.aws.amazon.com/sagemaker/latest/dg/whatis.html

Certopolis is a free game where right answers raise buildings in your own town. These are AIP-C01 questions, 415 in the bank. No sign-up for these.

1. AIP-C01, question 1 of 5

   A software company runs three internal GenAI applications in one AWS account. All three applications call the same Anthropic Claude model through the Amazon Bedrock Converse API. The finance team must see each application's Amazon Bedrock spend in AWS Cost Explorer every month so that it can charge each business unit. The applications must continue to share the same AWS account. Which solution will meet these requirements with the LEAST operational overhead?

   Right. In the game that’s Renown for your Operational Efficiency and Optimization for GenAI Applications building.

   Not that one: C is right. In the game your Operational Efficiency and Optimization for GenAI Applications building would lose a little Renown, and this question would come back later.

   Your answerA.Route each application through a different geographic cross-Region inference profile for the model. Filter Cost Explorer by AWS Region to separate each application's monthly Amazon Bedrock spend.Geographic profiles route across several Regions, so Region is not a per-application boundary in Cost Explorer.Your answerB.Enable model invocation logging to Amazon S3. Use Amazon Athena to total the input and output tokens for each application's IAM role every month, and multiply the totals by the published token prices.This rebuilds billing from token counts every month. It works, but it is the most work of any option and not in Cost Explorer.The answerC.Create an application inference profile for each application from the model, and attach a cost allocation tag to each profile. Activate the tag, and change each application to call its profile ARN.Application inference profiles exist for this: they "let you attribute Amazon Bedrock costs by application, team, or workload for the Amazon Bedrock InvokeModel and Converse APIs". Each profile "carries cost allocation tags that flow to AWS Cost Explorer", and the application uses "the profile ARN in place of the model ID in your API calls".Your answerD.Create an Amazon CloudWatch dashboard that graphs the InputTokenCount and OutputTokenCount metrics for the model. Divide the monthly total between the business units by each unit's number of users.Model-level metrics cannot separate the applications, and splitting by user count is an estimate, not attribution.

   Written from docs.aws.amazon.com/bedrock/latest/userguide/cost-mgmt-application-inference-profiles.html

2. AIP-C01, question 2 of 5

   A company's chat API uses Amazon API Gateway to start a synchronous AWS Step Functions Express workflow for each request. The workflow retrieves passages, calls an FM in Amazon Bedrock through an optimized integration, and formats the answer in an AWS Lambda function. Logging is not configured for the state machine. Users report some wrong answers, although every execution succeeds. The team must see the input and output of each state for new executions that produce wrong answers. Which solution will meet these requirements?

   Right. In the game that’s Renown for your Implementation and Integration building.

   Not that one: B is right. In the game your Implementation and Integration building would lose a little Renown, and this question would come back later.

   Your answerA.Turn on full request and response logging for the API Gateway stage. Match each wrong answer to its request in the execution logs of the stage, and read the request and response bodies there.API Gateway logs show the request to and the response from the API, not the input and output of each state inside the workflow.The answerB.Turn on logging for the state machine to a CloudWatch Logs log group at the ALL level, with execution data included. Open the new executions with wrong answers on the Executions tab of the console.The execution details page (https://docs.aws.amazon.com/step-functions/latest/dg/concepts-view-execution-details.html) says: "Standard workflow execution details are recorded in Step Functions, but the history of Express workflow executions are not. To record Express workflow executions, you must configure your Express state machines to send logs to Amazon CloudWatch." For Express workflows, "their execution history and detailed execution information are gathered through CloudWatch Logs Insights." Logging at the ALL level with execution data included (the includeExecutionData field, https://docs.aws.amazon.com/step-functions/latest/apireference/API_LoggingConfiguration.html) records every state's input and output, so the Executions tab can show them for the new wrong-answer executions.Your answerC.Turn on logging for the state machine to a CloudWatch Logs log group at the ERROR level, with execution data included. Open the new executions with wrong answers on the Executions tab of the console.Logging is the right channel, but ERROR records only failures. Every one of these executions succeeds, so none of them appears.Your answerD.Record the execution ARN that each synchronous call returns. Call the GetExecutionHistory API for the executions with wrong answers, and read the input and output of each state in the returned events.Step Functions does not record the history of Express workflow executions, and GetExecutionHistory is not supported for Express state machines.

   Written from docs.aws.amazon.com/step-functions/latest/dg/concepts-view-execution-details.html

3. AIP-C01, question 3 of 5

   An insurance company receives claim letters from hundreds of law firms as scanned single-page images. Each firm uses its own letter layout. The claim number, date of loss, and policyholder name usually appear inside sentences in the body of each letter. Before an Amazon Bedrock FM drafts a reply, the application must extract these three values from each letter. The company has no annotated sample letters and must not maintain parsing rules for each layout. Which solution will meet these requirements?

   Right. In the game that’s Renown for your Foundation Model Integration, Data Management, and Compliance building.

   Not that one: A is right. In the game your Foundation Model Integration, Data Management, and Compliance building would lose a little Renown, and this question would come back later.

   The answerA.Call Amazon Textract AnalyzeDocument with the QUERIES feature type. Pass one natural-language question with an alias for each value, and read the answers from the query result blocks in the response.Textract queries ask a document for a specific value in plain language. The Textract analyzing documents page says: "Add QUERIES to specify information you want Amazon Textract to look for in the document and get a response back in the form of a question-answer pair."Your answerB.Call Amazon Textract AnalyzeDocument with the FORMS feature type. Read the key-value pairs in the response, and match the detected keys to the three values that the application needs.Form extraction pairs a label with its value, like Name: Jane Doe. A claim number in the middle of a sentence has no label.Your answerC.Call Amazon Textract DetectDocumentText for each letter. Extract the three values from the returned lines of text with a separate set of regular expressions that is written and maintained for each firm's layout.Per-layout regular expressions are exactly the parsing rules for each layout that the company must not maintain.Your answerD.Train an Amazon Comprehend custom entity recognizer on annotated letters for the three value types. Run the recognizer on the text that Amazon Textract detects in each letter.Custom entity recognition could find the values, but only after training on labeled letters the company does not have.

   Show the full explanation and doc quotes

   Because the answer is found by meaning rather than position, the same three questions work across every firm's layout, with no training and no per-layout rules.

   Written from docs.aws.amazon.com/textract/latest/dg/how-it-works-analyzing.html

4. AIP-C01, question 4 of 5

   A retail bank streams chatbot answers to customers by calling the Amazon Bedrock InvokeModelWithResponseStream API with a guardrail attached. The guardrail's sensitive information filter masks account numbers in model responses, and its content filters block harmful output. Product managers want the first words of each answer to appear on screen as soon as possible. The compliance team requires that customers never see an unmasked account number or any content that the guardrail would block. Which solution will meet these requirements?

   Right. In the game that’s Renown for your AI Safety, Security, and Governance building.

   Not that one: C is right. In the game your AI Safety, Security, and Governance building would lose a little Renown, and this question would come back later.

   Your answerA.Call the InvokeModel API with the guardrail instead of streaming, and wait for the complete evaluated response. Show a progress indicator to the customer until the full answer is ready to display.Evaluating the whole response before display is compliant but delays the first words until the full answer is generated.Your answerB.Remove the guardrail from the streaming request, and stream each response chunk to the customer as it arrives. Call the ApplyGuardrail API on the full response after the stream ends, and clear the display if it intervenes.The customer reads the whole answer before anything checks it. Clearing the screen afterwards is too late.The answerC.Keep the default synchronous stream processing mode in the guardrail configuration of each streaming request. Return each response chunk to the customer after the guardrail has applied its policies to that chunk.Synchronous mode is the default, and in it "guardrails will buffer and apply the configured policies to one or more response chunks before the response is sent back to the user." It adds some latency per chunk but keeps streaming, and "every response chunk is scanned by guardrails before being sent to the user."Your answerD.Set streamProcessingMode to ASYNCHRONOUS in the guardrail configuration of each streaming request. Return each response chunk to the customer immediately, and rely on the guardrail to stop later chunks when it detects a violation.Asynchronous mode releases chunks before they are scanned and does not support masking, so account numbers and blocked content can reach the customer.

   Written from docs.aws.amazon.com/bedrock/latest/userguide/guardrails-streaming.html

5. AIP-C01, question 5 of 5

   A healthcare company sends Amazon Bedrock model invocation logs to an Amazon CloudWatch Logs log group. Prompts often contain patient names, US phone numbers, and health insurance claim numbers. Support engineers query the log group with CloudWatch Logs Insights to troubleshoot the application and must not see these values. A compliance team must still be able to view the original values during investigations. The model must continue to receive each prompt unchanged. Which solution will meet these requirements?

   Right. In the game that’s Renown for your AI Safety, Security, and Governance building.

   Not that one: D is right. In the game your AI Safety, Security, and Governance building would lose a little Renown, and this question would come back later.

   Your answerA.Encrypt the log group with a customer managed AWS KMS key, and allow only the compliance team's IAM role to use the key. Give the support engineers read access to the log group.Encryption at rest protects the stored log data; it does not mask individual values for one group of readers while showing them to another.Your answerB.Deliver the invocation logs to an Amazon S3 bucket instead of CloudWatch Logs, and run Amazon Macie on the bucket. Allow only the compliance team's IAM role to read the log objects that Macie flags as sensitive.Macie finds sensitive data in S3 objects but does not mask it, and moving the logs takes them away from the engineers' Logs Insights queries.Your answerC.Add a sensitive information filter to a guardrail that anonymizes names, phone numbers, and claim numbers in prompts. Apply the guardrail to every model invocation so that the logged prompts are masked.Anonymizing the prompt changes what the model receives, which breaks the requirement that the model gets each prompt unchanged.The answerD.Create a data protection policy for the log group that uses managed data identifiers for the names, phone numbers, and claim numbers. Grant the logs:Unmask permission only to the compliance team's IAM role.A CloudWatch Logs data protection policy masks sensitive values in a log group for everyone except the people allowed to see them.

   Show the full explanation and doc quotes

   The guide says that "sensitive data that matches the data identifiers you've selected is masked at all egress points, including CloudWatch Logs Insights, metric filters, and subscription filters. Only users who have the logs:Unmask IAM permission can view unmasked data." The policy acts on the log data, so the prompt the model receives is unchanged.

   Written from docs.aws.amazon.com/AmazonCloudWatch/latest/logs/mask-sensitive-log-data.html

Certopolis is a free game where right answers raise buildings in your own town. These are Claude questions, 936 in the bank. No sign-up for these.

1. Claude, question 1 of 5

   You run a classification prompt with thinking off. You've noticed accuracy improves when Claude "talks through" the edge cases first, but your downstream parser must receive only the final label, with the talk-through reliably removable. What's the correct approach to structure this?

   Right. In the game that’s Renown for your Prompt Engineering, Structured Output and Retrieval building.

   Not that one: D is right. In the game your Prompt Engineering, Structured Output and Retrieval building would lose a little Renown, and this question would come back later.

   Your answerA.Ask Claude to reason step by step, then extract the last line of the response as the label.Free-form reasoning followed by heuristic extraction is exactly the ambiguity tags eliminate: <answer> bounds the label on both sides regardless of how long the reasoning ran.Your answerB.Set output_config: {effort: "low"} so the model reasons briefly and outputs mostly the label.Low effort trims work — the opposite of the goal, which is more explicit reasoning. And even a brief response has no machine-readable boundary without tags.Your answerC.Ask for reasoning first and the label second, separated by a --- divider the parser splits on.Dividers are unstructured text with no semantics for the model. XML tags are the mechanism the docs name because Claude treats them as content structure, not prose.The answerD.Have Claude reason in <thinking> tags and put the label in <answer> tags; parse the latter.This is the docs' manual chain-of-thought fallback for thinking-off requests: encourage step-by-step reasoning and use structured tags like <thinking> and <answer> to cleanly separate reasoning from the final output.

   Show the full explanation and doc quotes

   The parser reads <answer> and discards <thinking>.

   Written from platform.claude.com/docs/en/build-with-claude/prompt-engineering/claude-prompting-best-practices

2. Claude, question 2 of 5

   Your gateway presents the tools of four Model Context Protocol (MCP) servers to one agent as a single catalogue. Two of the servers each expose a tool named search, and the agent's calls meant for one of them are reaching the other. Both servers are third-party and neither will rename its tool. Which approach should you take?

   Right. In the game that’s Renown for your Tool Design, MCP and Server Tools building.

   Not that one: A is right. In the game your Tool Design, MCP and Server Tools building would lose a little Renown, and this question would come back later.

   The answerA.Prefix each tool name with a server identifier in the gateway, and map it back when routing the call.Tool name uniqueness is scoped to a single server. A client or proxy that aggregates several servers is expected to "implement a disambiguation strategy such as prefixing tool names with a server identifier" — the collision is anticipated, and the fix belongs in the aggregator rather than in the servers. Prefixing gives the gateway a name it can route on and a reverse mapping to the original tool.Your answerB.Prefix each tool description with a server identifier in the gateway, and let the model pick the one it means.A description influences which tool the model chooses, but the call still arrives carrying a bare name. Two identical names leave the gateway guessing, which is the failure being reported.Your answerC.Drop the duplicate from the catalogue and expose only the server your agent calls more often.This trades the problem for a smaller catalogue. The agent can no longer reach one of the two search tools at all, and the gateway still has no general answer for the next collision.Your answerD.Route by the server's reported name, since two servers cannot report the same name to one client.The specification is explicit that the server name "is not guaranteed to be unique across servers and SHOULD NOT be relied upon for disambiguation." A routing key chosen from it can collide exactly as the tool names did.

   Written from modelcontextprotocol.io/specification/2026-07-28/server/tools

3. Claude, question 3 of 5

   Your grant-summary tool produces summaries scored by an explicit checklist your editors wrote. Reviewers say quality climbs sharply when a summary is revised against that checklist, but you currently generate five summaries at once and pick the best-scoring one, discarding the rest. What change would most effectively improve summary quality?

   Right. In the game that’s Renown for your Agent Architecture and Orchestration building.

   Not that one: B is right. In the game your Agent Architecture and Orchestration building would lose a little Renown, and this question would come back later.

   Your answerA.Raise the parallel count from five to twenty, still keeping the top summary by checklist score.Sampling more independent attempts widens the batch you choose from, but the best of twenty is bounded by what a single unguided pass can produce. None of the twenty is ever told what the checklist found.The answerB.Feed each summary's score back into a regenerating call, repeating until the checklist finds no faults.Both the current design and the alternative are legitimate ways to spend extra calls on quality, which is what the qualifier settles.Your answerC.Split the work into fixed subtasks, so one call gathers facts and a second writes and scores the summary.Decomposing into fixed subtasks makes each call an easier task, which helps when a single call is overloaded. It produces one pass over the summary rather than repeated improvement of it.Your answerD.Classify each grant by funder type first, so a funder-specific prompt writes and scores the summary.Routing by funder type selects a specialised generating prompt. Specialisation improves the starting draft; it does not act on the score once the draft exists.

   Show the full explanation and doc quotes

   Voting takes several independent attempts and keeps the best; evaluator-optimizer takes one attempt and improves it against stated criteria, which Anthropic says is "particularly effective when we have clear evaluation criteria, and when iterative refinement provides measurable value". The editors' checklist supplies the criteria and the observed climb under revision supplies the measurable value, so feeding the score back beats sampling more attempts.

   Written from www.anthropic.com/engineering/building-effective-agents

4. Claude, question 4 of 5

   Your multi-step agent calls internal tools before answering. Its eval scores only the final answer against a rubric, and scores are stable. In production the agent frequently reaches correct answers after several wasted tool calls, and occasionally reaches a correct answer from a tool result it misread. What change would most effectively address this issue?

   Right. In the game that’s Renown for your Context Management and Reliability building.

   Not that one: A is right. In the game your Context Management and Reliability building would lose a little Renown, and this question would come back later.

   The answerA.Score the recorded trajectory as well as the final answer, with criteria for tool choice and use.Both failure modes are invisible to outcome-only scoring because the final answer is correct in each.Your answerB.Raise the number of golden-set cases so rare tool-selection failures appear more often.More cases produce more instances of a behaviour the harness does not measure. Volume cannot make an unobserved dimension observable.Your answerC.Replace the rubric judge with deterministic assertions on the final answer's exact content.Deterministic assertions on the final answer are valuable and cheap, but both described failures produce a correct final answer, so an answer-level check passes either way.Your answerD.Score the final answer with two independent judges and fail the build when they disagree.Two judges will agree that a correct answer is correct. Their agreement says nothing about how many tool calls were wasted on the way to it.

   Show the full explanation and doc quotes

   Capturing the tool-call trajectory and scoring it — was the right tool chosen, were arguments well formed, were results interpreted correctly, was the path efficient — measures the process that outcome scoring cannot see.

   Written from www.anthropic.com/engineering/demystifying-evals-for-ai-agents

5. Claude, question 5 of 5

   Your summariser's prompt carries four examples, and each one condenses a two-page memo into about eighty words. In production the summaries come back at roughly that length whatever the source: long filings lose material, and short notes are padded out. The instructions ask for length proportionate to the source. How should you restructure the example set?

   Right. In the game that’s Renown for your Prompt Engineering, Structured Output and Retrieval building.

   Not that one: D is right. In the game your Prompt Engineering, Structured Output and Retrieval building would lose a little Renown, and this question would come back later.

   Your answerA.Add four more examples of the same kind of memo, so the set gives twice as many summaries to copy.More examples that share the property causing the failure make that property more strongly demonstrated, not less. The guidance suggests three to five examples for best results, so the useful lever here is variety rather than volume.Your answerB.Add four more examples of memos from a different product area, so the set covers more of the subject matter the service meets.Examples from a different product area diversify the subject matter while leaving every summary at the same length. Diversity has to be along the dimension that is failing to break the unintended pattern.Your answerC.Swap two of the four for examples with the length decision shown in <thinking> tags, so the set shows how each summary was planned.Showing reasoning inside <thinking> tags is a real technique for steering how Claude reasons. It cannot help when every example reasons its way to the same eighty-word answer, because the pattern being copied is the outcome.The answerD.Swap two of the four for examples whose summaries run much longer and much shorter, so the set shows no single length to copy.Examples teach everything they have in common, not only what you meant them to teach.

   Show the full explanation and doc quotes

   The prompting guidance asks that they be "Diverse: Cover edge cases and vary enough that Claude doesn't pick up unintended patterns." Four summaries of a similar length are a demonstration of that length, which is why it survives an instruction asking for proportionality. Varying the lengths removes the pattern the model is copying.

   Written from platform.claude.com/docs/en/build-with-claude/prompt-engineering/claude-prompting-best-practices

Certopolis is a free game where right answers raise buildings in your own town. These are Terraform questions, 138 in the bank. No sign-up for these.

1. Terraform, question 1 of 4

   Every resource inside a module must wait for a policy created in the root, and no attribute of it is referenced. Which of the following expresses that?

   Right. In the game that’s Renown for your Terraform modules building.

   Not that one: C is right. In the game your Terraform modules building would lose a little Renown, and this question would come back later.

   Your answerA.A provider argument on the moduleThe providers argument decides which provider configurations the module uses, not when its work happens.Your answerB.depends_on inside each resourceThe module would have to take the policy as an argument and each resource would have to name it — an edit to a shared module to satisfy one caller.The answerC.depends_on on the module blockdepends_on on a module block orders the whole module against another object. It belongs to the caller, which is the only place that knows about the policy.Your answerD.An output from the root moduleAn output carries a value out of a module. It creates no ordering at all.

   Written from developer.hashicorp.com/terraform/language/meta-arguments/depends_on

2. Terraform, question 2 of 4

   Terraform splits the work between its own core and the provider plugins. Which of the following is the provider's responsibility rather than core's?

   Right. In the game that’s Renown for your Terraform fundamentals building.

   Not that one: A is right. In the game your Terraform fundamentals building would lose a little Renown, and this question would come back later.

   The answerA.Making the API calls that create an objectCore parses the configuration, builds the graph, decides the order and manages state. The provider knows the remote API and makes the calls.Your answerB.Building the dependency graph from referencesThe graph is built by core from attribute references in the configuration. No provider is consulted to build it.Your answerC.Reading and writing the state fileState is core's, and where it lives is the backend's. A provider never sees the state file.Your answerD.Deciding the order resources are worked onOrdering falls out of the graph, so it is core's decision. The provider is told what to do and when.

   Written from developer.hashicorp.com/terraform/plugin

3. Terraform, question 3 of 4

   An organisation wants to know when a workspace's real infrastructure stops matching its state, without waiting for the next run. Which of the following reports that?

   Right. In the game that’s Renown for your HCP Terraform building.

   Not that one: B is right. In the game your HCP Terraform building would lose a little Renown, and this question would come back later.

   Your answerA.A run trigger from the workspaceA run trigger starts a run in a different workspace when this one applies. It assesses nothing.The answerB.Health assessments on the workspaceHealth assessments run periodically against a workspace and report resources that no longer match state. Everything else here needs someone to start a run first.Your answerC.A policy set on the workspaceA policy set is evaluated during a run, between plan and apply. With no run, no policy is evaluated.Your answerD.The workspace's run historyRun history tells you what happened when someone ran a plan. Drift that appeared since then is invisible until the next one.

   Written from developer.hashicorp.com/terraform/cloud-docs/workspaces/health

4. Terraform, question 4 of 4

   An apply was killed mid-run and every later run reports that the state is locked. Which of the following clears it?

   Right. In the game that’s Renown for your Terraform state management building.

   Not that one: A is right. In the game your Terraform state management building would lose a little Renown, and this question would come back later.

   The answerA.terraform force-unlock with the lock idterraform force-unlock LOCK_ID releases a lock a run could not release itself. The id is printed in the error, and the command is deliberately explicit because unlocking a lock that is genuinely held allows two writers.Your answerB.Delete the state file and run init againDeleting state throws away Terraform's map of every object it manages. The next plan proposes to create all of it again.Your answerC.terraform state pull followed by state pushPulling and pushing state moves the document. The lock is a separate object held by the backend and survives the round trip.Your answerD.terraform apply -lock=false from now onThis works around the lock rather than clearing it. Everyone else still meets it, and you have now given up the protection permanently.

   Written from developer.hashicorp.com/terraform/cli/commands/force-unlock

Certopolis is a free game where right answers raise buildings in your own town. These are N10-009 questions, 634 in the bank. No sign-up for these.

1. N10-009, question 1 of 5

   A user signs in with a single USB hardware key that must be unlocked with a PIN before it signs the server's challenge. Which of the following describes this authentication?

   Right. In the game that’s Renown for your Network Security building.

   Not that one: A is right. In the game your Network Security building would lose a little Renown, and this question would come back later.

   The answerA.Multifactor authenticationNIST SP 800-63B classes this authenticator as a multi-factor cryptographic device: it is 'something you have, and it SHALL be activated by either something you know or something you are'.Your answerB.Single-factor authenticationA single factor would be the hardware key on its own, signing the challenge as soon as it is plugged in. Requiring a PIN to unlock it adds a knowledge factor; NIST's definition of a multi-factor cryptographic device is exactly a possession authenticator that must be activated by something you know or something you are.Your answerC.Time-based authenticationTime-based authentication produces a code derived from the current time, as a one-time-password token does. The hardware key here signs a challenge sent by the server; the clock plays no part, and whether the method is single or multifactor is a separate question from how the secret is generated.Your answerD.Role-based access controlRole-based access control is an authorization mechanism: it decides what an already-authenticated user may do according to their role. The scenario is entirely about proving who the user is.

   Show the full explanation and doc quotes

   The PIN is a memorized secret, which the same document defines as something you know. Two different factors are therefore in play, possession of the key and knowledge of the PIN, even though the user presents only one object.

   Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-63b.pdf

2. N10-009, question 2 of 5

   A workstation on a wired office network reports an address beginning 169.254 and cannot reach any server. Which of the following is the most likely reason?

   Right. In the game that’s Renown for your Networking Concepts building.

   Not that one: D is right. In the game your Networking Concepts building would lose a little Renown, and this question would come back later.

   Your answerA.Another host on the network is already using the workstation's configured address.A duplicate address produces a conflict warning or intermittent connectivity on the configured address; it does not make a host switch to 169.254. RFC 3927 says link-local addresses are used only where stable, routable addresses are not available.Your answerB.The DHCP server leased the workstation an address from a public range.The 169.254/16 prefix is reserved for IPv4 link-local use and a DHCP server does not lease addresses from it. A host configures such an address itself, precisely because no lease arrived.Your answerC.The default gateway is handing out addresses from the wrong subnet.A default gateway forwards traffic off the local network; it does not assign addresses. And a wrong-subnet lease would give the workstation an address from that subnet, not one beginning 169.254.The answerD.The DHCP server did not respond, so the workstation assigned itself a link-local address.RFC 3927 describes how a host 'may automatically configure an interface with an IPv4 address within the 169.254/16 prefix' when no address configuration is available, such as when no DHCP server answers.

   Show the full explanation and doc quotes

   Such an address is valid only on the local link, which is why the workstation cannot reach any server.

   Written from www.rfc-editor.org/rfc/rfc3927.html

3. N10-009, question 3 of 5

   A web server's listener shows hundreds of half-open connections from addresses that never complete the handshake, and new clients are refused. Which of the following attacks is occurring?

   Right. In the game that’s Renown for your Network Security building.

   Not that one: B is right. In the game your Network Security building would lose a little Renown, and this question would come back later.

   Your answerA.MAC floodingMAC flooding fills a switch's forwarding table with made-up source addresses so that the switch floods frames out every port. It is an attack on a switch, not on a server's TCP listener.The answerB.SYN floodRFC 4987 describes the TCP SYN flooding attack as one that exhausts the backlog of half-open connections associated with a listening port by sending a barrage of SYN segments from addresses, often spoofed, that never reply to the SYN-ACKs.Your answerC.DNS poisoningDNS poisoning puts false records into a resolver so that clients are directed to the wrong address. Clients would reach the wrong server, not leave half-open connections on the right one.Your answerD.ARP spoofingARP spoofing sends forged ARP replies so that a LAN host sends traffic to the attacker's MAC address. It redirects frames on the local segment and does not create incomplete TCP handshakes.

   Show the full explanation and doc quotes

   With the backlog full of bogus half-opened connections, legitimate connection requests are rejected, which is exactly the symptom the server shows.

   Written from www.rfc-editor.org/rfc/rfc4987.txt

4. N10-009, question 4 of 5

   A wireless heat map shows that a conference room AP's usable signal reaches the public sidewalk outside the building. Which of the following locations should the AP be moved to?

   Right. In the game that’s Renown for your Network Operations building.

   Not that one: D is right. In the game your Network Operations building would lose a little Renown, and this question would come back later.

   Your answerA.A window facing away from the sidewalkSP 800-97 says to keep APs 'away from exterior walls and windows'. A window on any side of the building is an exterior opening that radio passes through easily, so the signal would simply leak somewhere else.Your answerB.The exterior wall nearest the sidewalkAn AP on the wall nearest the sidewalk would be as close as possible to the boundary it is already crossing. That is the placement the guidance is written to avoid.Your answerC.The corridor outside the roomA corridor placement serves the corridor rather than the conference room, and corridors often run along outer walls. The guidance is to center the AP in the room it covers so that coverage is strongest inside and weakest at the perimeter.The answerD.The center of the roomNIST SP 800-97's site survey recommendation says 'the estimated usable range of each AP should not extend beyond the physical boundaries of the facility whenever possible' and that 'to best achieve this result, APs should be located near the center of rooms and away from exterior walls and windows'.

   Show the full explanation and doc quotes

   Moving the AP to the room's center puts the most building between the radio and the sidewalk.

   Written from nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-97.pdf

5. N10-009, question 5 of 5

   A technician weighs a divide-and-conquer approach against working top-to-bottom through the OSI model before deciding what is most likely wrong. Which of the following troubleshooting steps is the technician performing?

   Right. In the game that’s Renown for your Network Troubleshooting building.

   Not that one: C is right. In the game your Network Troubleshooting building would lose a little Renown, and this question would come back later.

   Your answerA.Identify the problemIdentify the problem is the first step: gather information, question users, identify symptoms, determine if anything has changed and duplicate the problem. Choosing how to work through the OSI model belongs to the next step.Your answerB.Test the theory to determine the causeTesting the theory is the third step, where a theory is confirmed or rejected. The technician here has not settled on a theory yet; they are choosing how to reach one.The answerC.Establish a theory of probable causeThe N10-009 objectives list 'Consider multiple approaches', with 'Top-to-bottom/bottom-to-top OSI model' and 'Divide and conquer', as sub-items of 'Establish a theory of probable cause', the second step of the troubleshooting methodology.Your answerD.Establish a plan of actionEstablishing a plan of action is the fourth step, done once the cause is known, and covers how to fix the problem and what the fix might affect.

   Written from lecbyo.files.cmp.optimizely.com/download/35a7403ab73211ef9dcda6f347fbf652

Certopolis is a free game where right answers raise buildings in your own town. These are SY0-801 questions, 580 in the bank. No sign-up for these.

1. SY0-801, question 1 of 5

   Within an hour, dozens of servers that no one had logged in to were running the same standalone malicious program, which spread by exploiting a flaw in a file-sharing service. Which of the following malware types best explains this?

   Right. In the game that’s Renown for your Threats, Vulnerabilities, and Attacks building.

   Not that one: B is right. In the game your Threats, Vulnerabilities, and Attacks building would lose a little Renown, and this question would come back later.

   Your answerA.Logic bombA logic bomb is code that runs when a condition is met on a system it already occupies. It does not copy itself across dozens of servers.The answerB.WormNIST SP 800-83r1 defines a worm as a self-replicating, self-contained program that usually executes itself without user intervention, and a network service worm as one that exploits a vulnerability in a network service to propagate.Your answerC.VirusA virus also self-replicates, but SP 800-83r1 says it inserts copies of itself into host programs or data files and is often triggered by user interaction. This program is standalone and spread with no one logged in.Your answerD.TrojanSP 800-83r1 describes a Trojan horse as a non-replicating program that appears benign. This program copied itself from server to server on its own.

   Show the full explanation and doc quotes

   A standalone program spreading through a service flaw to servers no one was using matches the worm, not the virus.

   Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-83r1.pdf

2. SY0-801, question 2 of 5

   A company leases a backup facility that has power, environmental controls and floor space for servers but no computer equipment. Replacement equipment would be shipped there after a disaster. Which of the following best describes this facility?

   Right. In the game that’s Renown for your Security Architecture building.

   Not that one: C is right. In the game your Security Architecture building would lose a little Renown, and this question would come back later.

   Your answerA.Warm siteA warm site already holds some of the information systems and telecommunications equipment. This facility has no computer equipment at all.Your answerB.Hot siteA hot site is fully operational, with hardware and software already in place. This facility would have to receive equipment first.The answerC.Cold siteThe NIST glossary, from SP 800-34 Rev. 1, defines a cold site as a backup facility with the necessary electrical and physical components of a computer facility but without the computer equipment in place, ready to receive replacement equipment if the organization must move to an alternate site.Your answerD.Failover clusterA failover cluster keeps a service running by moving it between live nodes. It does not describe an empty facility awaiting equipment.

   Show the full explanation and doc quotes

   That matches a facility with power and space but no equipment.

   Written from csrc.nist.gov/glossary/term/cold_site

3. SY0-801, question 3 of 5

   As recovery from a data breach concludes, the incident response team meets to review what happened, what actions were taken, and how effective those actions were. Which of the following is the team conducting?

   Right. In the game that’s Renown for your Security Operations building.

   Not that one: D is right. In the game your Security Operations building would lose a little Renown, and this question would come back later.

   Your answerA.Tabletop exerciseA tabletop exercise walks through a hypothetical incident as preparation; this meeting reviews a breach that actually occurred.Your answerB.Threat huntingThreat hunting searches proactively for threats that have not been detected; it is an identification activity, not a review.Your answerC.E-discoveryDiscovery collects electronic information for legal proceedings; it is not a team review of response effectiveness.The answerD.Lessons learnedNIST SP 800-61r3 notes that improvements are often identified by holding lessons learned meetings as an incident's recovery is concluding, reviewing what happened, what actions were taken and how effective they were.

   Show the full explanation and doc quotes

   That review is the lessons learned activity in the post-incident stage of the SY0-801 objectives.

   Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r3.pdf

4. SY0-801, question 4 of 5

   During market research, a company wants to screen potential backup suppliers and collect evidence about their security practices before soliciting any bids. Which of the following should the company issue?

   Right. In the game that’s Renown for your Security Program Management and Oversight building.

   Not that one: C is right. In the game your Security Program Management and Oversight building would lose a little Renown, and this question would come back later.

   Your answerA.RFPA request for proposal solicits bids at the procurement step, released with a statement of work. The company is still screening suppliers and has not asked for bids.Your answerB.RFQTreats a request for pricing as a way to gather early security evidence, though it is a bid solicitation released with the RFP at the procurement step.The answerC.RFISP 800-161 Rev. 1 says that during market research an enterprise may use requests for information, sources sought notices and due diligence questionnaires to screen potential suppliers and collect evidence from them.Your answerD.SOWA statement of work describes the work to be performed and is released with the RFP or RFQ. It does not collect evidence from potential suppliers.

   Show the full explanation and doc quotes

   The procurement step comes later, releasing a statement of work with a request for proposal or request for quote.

   Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-161r1-upd1.pdf

5. SY0-801, question 5 of 5

   A proposed change to a production database has been recorded in the change management system. Which of the following should take place before the change advisory board approves the change?

   Right. In the game that’s Renown for your General Security Concepts building.

   Not that one: A is right. In the game your General Security Concepts building would lose a little Renown, and this question would come back later.

   The answerA.Testing the changeNIST SP 800-128 orders configuration change control as request, record, decide whether control applies, analyze security impact, test, approve, implement, verify and close.Your answerB.Implementing the changeImplementing the change comes after approval. Making it first would bypass the board the process exists to involve.Your answerC.Verifying the implementationVerification confirms that an implemented change was deployed correctly, so it can only happen after approval and implementation.Your answerD.Closing the change requestClosing the change request is the last step, after implementation and verification.

   Show the full explanation and doc quotes

   Testing confirms the change's security and functional impacts so they can be presented to the board before it approves.

   Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-128.pdf

Certopolis is a free game where right answers raise buildings in your own town. These are 220-1202 questions, 315 in the bank. No sign-up for these.

1. 220-1202, question 1 of 5

   Several employees in a company's finance department receive emails that greet them by name, mention a real supplier invoice, and ask them to open an attached file. No other department received the message. Which of the following describes this attack?

   Right. In the game that’s Renown for your Security building.

   Not that one: D is right. In the game your Security building would lose a little Renown, and this question would come back later.

   Your answerA.WhalingWhaling is spear phishing aimed at the most senior people, such as executives. These emails went to finance department staff, so the narrower label does not fit.Your answerB.QR code phishingQR code phishing gets victims to scan a code that leads to a malicious site. These emails asked staff to open an attached file, and what sets them apart is who they were aimed at.Your answerC.SmishingSmishing uses SMS text messages. These were emails with an attached file, so it is not smishing.The answerD.Spear phishingThis is phishing aimed at specific people: it uses their names, a real supplier invoice, and goes only to one department.

   Show the full explanation and doc quotes

   MITRE ATT&CK describes targeted phishing at a specific individual, company or industry as spearphishing, as opposed to untargeted mass spam.

   Written from attack.mitre.org/techniques/T1566/

2. 220-1202, question 2 of 5

   A technician must install a 32-bit accounting application on a workstation running 64-bit Windows 11 Pro. The vendor offers no 64-bit version. Which of the following should the technician do?

   Right. In the game that’s Renown for your Operating Systems building.

   Not that one: A is right. In the game your Operating Systems building would lose a little Renown, and this question would come back later.

   The answerA.Run its installer normally.Microsoft states that WOW64 lets 32-bit Windows applications run seamlessly on 64-bit Windows, and that WOW64 is provided with the operating system and does not have to be explicitly enabled. The application installs and runs as usual.Your answerB.Turn on 32-bit support in Windows Features first.Microsoft says the component that runs 32-bit applications on 64-bit Windows is provided with the operating system and does not have to be explicitly enabled.Your answerC.Install it in a 32-bit virtual machine.A virtual machine is unnecessary: Microsoft says 32-bit applications run seamlessly on 64-bit Windows.Your answerD.Reinstall Windows as a 32-bit edition.Reinstalling the OS is unnecessary because 64-bit Windows runs 32-bit applications seamlessly through a built-in component.

   Written from learn.microsoft.com/en-us/windows/win32/winprog64/running-32-bit-applications

3. 220-1202, question 3 of 5

   A technician has disconnected an infected workstation from the network. The malware had been contacting an external host on a regular schedule. Which of the following should the technician do next?

   Right. In the game that’s Renown for your Software Troubleshooting building.

   Not that one: B is right. In the game your Software Troubleshooting building would lose a little Renown, and this question would come back later.

   Your answerA.Leave it offline until the next scheduled scan.NIST SP 800-83r1 says handlers should not assume that disconnecting a host prevents further damage; waiting for a scheduled scan leaves the malware running.The answerB.Begin removing the malware as soon as possible.NIST SP 800-83r1 warns that stopping the spread of malware does not necessarily prevent further damage to the host.Your answerC.Reconnect it so the malware stops retrying.Reconnecting gives the malware its network path back, undoing the containment step.Your answerD.Return it to the user for offline work.The malware is still on the workstation and may keep damaging data, so handing it back for use is unsafe.

   Show the full explanation and doc quotes

   Some malware that loses its periodic connection to another host may overwrite all the data on the drive, so handlers should not assume a disconnected host is safe and should begin eradication as soon as possible.

   Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-83r1.pdf

4. 220-1202, question 4 of 5

   A technician runs a full backup of a workstation every Sunday. The user wants the nightly backups on the other days to finish as quickly as possible and use the least storage media. Which of the following backup types should the technician schedule for those nights?

   Right. In the game that’s Renown for your Operational Procedures building.

   Not that one: C is right. In the game your Operational Procedures building would lose a little Renown, and this question would come back later.

   Your answerA.DifferentialA differential is faster than a full backup, but NIST says it takes longer than an incremental because the data changed since the last full backup grows every day until the next full backup.Your answerB.Synthetic fullA synthetic full produces a complete backup set each run, which uses much more storage than backing up only changed files.The answerC.IncrementalAn incremental backup copies only the files created or changed since the last backup of any type, so each nightly job is small, fast and economical with media. NIST notes the trade-off: a restore may need the full backup plus every incremental since it.Your answerD.FullRunning a full backup every night copies files that have not changed, which NIST says leads to excessive, unnecessary media use.

   Written from nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-34r1.pdf

5. 220-1202, question 5 of 5

   A data center wants people to pass from the lobby to the server floor one at a time, with the inner door staying locked until the outer door has closed and the person is authorized. Which of the following should be installed?

   Right. In the game that’s Renown for your Security building.

   Not that one: C is right. In the game your Security building would lose a little Renown, and this question would come back later.

   Your answerA.BollardsBollards are physical barriers that stop vehicles. They do not control people passing through doors one at a time.Your answerB.Badge readerA badge reader can check each person's card, but on its own it does not hold someone between two doors or stop another person following through.The answerC.Access control vestibuleAn access control vestibule is a space between two sets of interlocking doors.Your answerD.Video surveillanceCameras record who passes, which helps afterward, but they do not lock doors or limit entry to one person at a time.

   Show the full explanation and doc quotes

   NIST describes interlocking door controllers that limit how many individuals enter a controlled access point and provide a containment area while authorization is verified, which is the one-at-a-time behavior the data center wants.

   Written from nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf

Certopolis is a free game where right answers raise buildings in your own town. These are 220-1201 questions, 287 in the bank. No sign-up for these.

1. 220-1201, question 1 of 5

   A laser printer prints a thin white streak down every page, always in the same position, through areas that should be solid black. The toner level is reported as good. Which of the following is most likely causing the issue?

   Right. In the game that’s Renown for your Hardware and Network Troubleshooting building.

   Not that one: C is right. In the game your Hardware and Network Troubleshooting building would lose a little Renown, and this question would come back later.

   Your answerA.Low tonerLow toner makes the whole page fade, and this printer reports its toner level as good.Your answerB.Incorrect paper typeThe paper type setting affects how toner fuses and can cause specks or light print, but not a single streak in a fixed position.The answerC.Debris inside the machineA white line down the page is a strip where toner is blocked from reaching the paper.Your answerD.Contaminated fuserA contaminated fuser is a cause of black lines and ghost images. A white streak means toner is missing from that strip, which points to something blocking it.

   Show the full explanation and doc quotes

   Brother's first check for white lines down the page is that foreign material such as torn paper, sticky notes or dust is not inside the machine; a damaged drum or toner cartridge comes next.

   Written from support.brother.com/g/s/id/htmldoc/printer/cv_hll2310d/use/html/GUID-EEC1EE16-C8ED-4BC3-B3C4-27B0AACF0D44_124.html

2. 220-1201, question 2 of 5

   A user wants to mirror a smartphone's screen on a conference room TV whose only video inputs are HDMI. The phone has a USB-C port, and the room has no wireless display receiver. Which of the following should the technician provide?

   Right. In the game that’s Renown for your Mobile Devices building.

   Not that one: D is right. In the game your Mobile Devices building would lose a little Renown, and this question would come back later.

   Your answerA.Lightning to HDMI adapterA Lightning plug does not fit a USB-C port, so this adapter cannot connect to the phone.Your answerB.microUSB to HDMI adapterA microUSB plug does not fit a USB-C port, so this adapter cannot connect to the phone.Your answerC.USB-C to DisplayPort cableThe phone can send DisplayPort video over USB-C, but this TV has only HDMI inputs, so a DisplayPort cable has nowhere to plug in.The answerD.USB-C to HDMI adapterA USB-C phone that supports external displays can connect to an HDMI display or TV with a USB-C to HDMI adapter or cable. The connected display mirrors the phone's built-in screen.

   Written from support.apple.com/en-us/105099

3. 220-1201, question 3 of 5

   An office keeps its shared documents on a central server. Staff must open, edit and save those documents in place from their workstations over the network, without first downloading copies. Which of the following protocols should the server provide?

   Right. In the game that’s Renown for your Networking building.

   Not that one: A is right. In the game your Networking building would lose a little Renown, and this question would come back later.

   The answerA.SMBMicrosoft describes SMB as a network file sharing protocol that lets an application, or its user, access files at a remote server and read, create and update them there. That is the in-place editing of shared documents the office needs.Your answerB.FTPFTP transfers files between computers. Staff would download a copy, edit it and upload it again instead of working on the file on the server.Your answerC.LDAPLDAP is used to query a directory, such as user and group accounts. It does not let staff open documents on a file server.Your answerD.RDPRDP gives a user a remote desktop on another computer. It does not let a workstation open and save a server's files directly.

   Written from learn.microsoft.com/en-us/windows-server/storage/file-server/file-server-smb-overview

4. 220-1201, question 4 of 5

   Before release, a software team must check that a new application runs correctly on several operating systems, starting every check from an identical clean configuration and without buying hardware for each OS. Which of the following virtual machine purposes does this describe?

   Right. In the game that’s Renown for your Virtualization and Cloud Computing building.

   Not that one: B is right. In the game your Virtualization and Cloud Computing building would lose a little Renown, and this question would come back later.

   Your answerA.SandboxA sandbox confines untrusted software. The team's need is a clean, repeatable baseline on several operating systems, which is test development.The answerB.Test developmentVirtual machines let an organization test an application on multiple operating systems without separate hardware for each OS, and keeping a known-good copy of each guest lets testers start every test from a fresh copy that restores the baseline.Your answerC.Legacy software/OSThe legacy software/OS purpose keeps an old application running on an older OS. This team is checking a new release.Your answerD.Cross-platform virtualizationCross-platform virtualization runs software built for another platform. The team needs guests of several operating systems to verify its own release.

   Show the full explanation and doc quotes

   That is the test development purpose.

   Written from nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-125.pdf

5. 220-1201, question 5 of 5

   A technician installs a graphics card that needs an 8-pin power connector. The modular power supply's spare 8-pin cable, labeled for the processor, will not seat in the card's socket. Which of the following cables should the technician connect instead?

   Right. In the game that’s Renown for your Hardware building.

   Not that one: D is right. In the game your Hardware building would lose a little Renown, and this question would come back later.

   Your answerA.SATA power cableA SATA power cable feeds drives. It does not fit the graphics card's 8-pin power socket.Your answerB.Molex power cableA Molex cable is an older peripheral power connector and does not fit the graphics card's 8-pin socket.Your answerC.4-pin CPU power cableThe 4-pin processor connector is keyed for the processor's power header, just like the 8-pin processor cable that already failed to seat.The answerD.PCIe power cableIntel's power supply design guide says the processor connector is a 4-pin or 8-pin connector and the graphics card connector a 6-pin or 8-pin PCI Express connector.

   Show the full explanation and doc quotes

   Both carry 12V, but they use different pin locations and keying, so they are not interchangeable. The card needs the power supply's PCIe cable.

   Written from www.intel.com/content/dam/www/public/us/en/documents/design-guides/resellers-power-supply-design-guide-changes.pdf

Certopolis is a free game where right answers raise buildings in your own town. These are CAPM questions, 770 in the bank. No sign-up for these.

1. CAPM, question 1 of 5

   Which technique is used to find the longest continuous sequence of activities through a schedule, which sets the earliest date the program can finish?

   Right. In the game that’s Renown for your Predictive, Plan-Based Methodologies building.

   Not that one: B is right. In the game your Predictive, Plan-Based Methodologies building would lose a little Renown, and this question would come back later.

   Your answerA.Resource levelingResource leveling shifts activity starts or assignments to smooth resource demand. It works within the network, it does not identify its longest path.The answerB.Critical path methodGAO defines the critical path as the longest continuous sequence of activities in a schedule, which sets the program's earliest completion date. The critical path method derives these critical activities.Your answerC.Rolling wave planningRolling wave planning details near-term work and keeps far-term work at a higher level until it draws closer. It does not find the longest path.Your answerD.Earned value managementEarned value management compares work performed and its cost with the plan. It does not determine the earliest finish date.

   Written from www.gao.gov/assets/d1689G.pdf

2. CAPM, question 2 of 5

   A project team decides not to start the activity that would give rise to a significant threat. Which technique is used to respond to the threat in this way?

   Right. In the game that’s Renown for your Project Management Fundamentals and Core Concepts building.

   Not that one: A is right. In the game your Project Management Fundamentals and Core Concepts building would lose a little Renown, and this question would come back later.

   The answerA.Risk avoidanceThe Orange Book describes avoiding the risk, where feasible, as deciding not to start or continue with the activity that gives rise to it.Your answerB.Risk retentionRisk retention keeps the risk by informed decision while the activity goes ahead.Your answerC.Risk sharingRisk sharing passes part of the risk to another party, for example through a contract; the activity still goes ahead.Your answerD.Contingency planningThe Orange Book places contingency activities under changing the consequences, which only applies if the activity goes ahead.

   Written from www.gov.uk/government/publications/orange-book/the-orange-book-management-of-risk-principles-and-concepts

3. CAPM, question 3 of 5

   During Product Backlog refinement, a Scrum Team adds size estimates to items while the Product Owner explains the trade-offs involved. What is an agile role responsible for the sizing?

   Right. In the game that’s Renown for your Agile Frameworks/Methodologies building.

   Not that one: C is right. In the game your Agile Frameworks/Methodologies building would lose a little Renown, and this question would come back later.

   Your answerA.Product OwnerThe Product Owner helps the Developers understand trade-offs, but the Developers do the sizing.Your answerB.Project sponsorA sponsor is outside the Scrum Team; sizing belongs to the Developers who will do the work.The answerC.DevelopersThe Scrum Guide says the Developers who will be doing the work are responsible for the sizing; the Product Owner may influence them by helping them understand and select trade-offs.Your answerD.Scrum MasterThe Scrum Master is accountable for the team's effectiveness, not for sizing backlog items.

   Written from scrumguides.org/scrum-guide.html

4. CAPM, question 4 of 5

   A scheduler needs the latest dates by which each activity must start and finish for the program to be completed on time. Which technique is used?

   Right. In the game that’s Renown for your Predictive, Plan-Based Methodologies building.

   Not that one: D is right. In the game your Predictive, Plan-Based Methodologies building would lose a little Renown, and this question would come back later.

   Your answerA.Forward passThe forward pass adds durations from the start to give early dates, when an activity may start and finish. The latest dates come from the backward pass.Your answerB.Rolling wave planningRolling wave planning details near-term work and leaves distant work in planning packages; it does not calculate late dates.Your answerC.CrashingCrashing is a way to shorten the schedule by adding resources. It changes durations; the late dates are still calculated by the backward pass.The answerD.Backward passThe backward pass subtracts durations from late finishes, working back from the program's finish, to give each activity's late start and late finish: the latest dates it must start and finish for the program to be completed on time.

   Written from www.gao.gov/assets/d1689G.pdf

5. CAPM, question 5 of 5

   In Scrum, one accountability is maximizing the value of the product that results from the Scrum Team's work. What is an agile role that holds it?

   Right. In the game that’s Renown for your Business Analysis Frameworks building.

   Not that one: B is right. In the game your Business Analysis Frameworks building would lose a little Renown, and this question would come back later.

   Your answerA.DevelopersDevelopers create the Sprint Backlog and instil quality through the Definition of Done; maximizing product value is the Product Owner's accountability.The answerB.Product OwnerThe Scrum Guide makes the Product Owner accountable for maximizing the value of the product resulting from the Scrum Team's work, and for effective Product Backlog management.Your answerC.Product managerThe Scrum Guide defines three accountabilities: Developers, Product Owner and Scrum Master. Product manager is not one of them.Your answerD.Scrum MasterThe Scrum Guide makes the Scrum Master accountable for establishing Scrum and for the team's effectiveness, not the product's value.

   Written from scrumguides.org/scrum-guide.html

Certopolis is a free game where right answers raise buildings in your own town. These are PMP questions, 569 in the bank. No sign-up for these.

1. PMP, question 1 of 5

   The project manager has told the sponsor that a spouse works for one of the vendors under evaluation. The sponsor acknowledged it but has given no further direction. Which of the following should the project manager do?

   Right. In the game that’s Renown for your People building.

   Not that one: D is right. In the game your People building would lose a little Renown, and this question would come back later.

   Your answerA.Lead the evaluation as plannedDisclosure is only the first of three conditions; without an approved mitigation plan and consent, leading the evaluation still influences the outcome.Your answerB.Abstain only from the final voteScoring and discussion influence the result even if the final vote is skipped.Your answerC.Ask that vendor to withdrawPushing the vendor out treats the vendor as the problem; the Code's conditions apply to the project manager's own participation.The answerD.Recuse until mitigation and consentThe PMI Code of Ethics' mandatory Fairness standard says a practitioner with a real or potential conflict of interest stays out of the decision-making, and does not try to influence outcomes, until three things are in place: full disclosure to the appropriate stakeholders, an approved mitigation plan, and the stakeholders' consent to proceed.

   Show the full explanation and doc quotes

   Here only the disclosure has happened.

   Written from www.pmi.org/-/media/pmi/documents/public/pdf/ethics/pmi-code-of-ethics.pdf

2. PMP, question 2 of 5

   On a predictive project using earned value management, the sponsor asks how efficiently the work completed so far has used its budget. Which of the following should the project manager report?

   Right. In the game that’s Renown for your Process building.

   Not that one: D is right. In the game your Process building would lose a little Renown, and this question would come back later.

   Your answerA.Percent completeIn GAO's table, percent complete answers how much progress has been made, not how efficiently the budget has been used.Your answerB.To-complete performance indexGAO uses TCPI to answer whether the program will finish within budget. That is a forecast, not a measure of efficiency so far.Your answerC.Schedule performance indexSPI is the schedule half of the efficiency question. The sponsor asked about the budget.The answerD.Cost performance indexGAO's Cost Estimating and Assessment Guide (Table 25) answers the question of how efficiently a program is meeting its cost and schedule objectives with the cost and schedule performance indexes.

   Show the full explanation and doc quotes

   A question about cost efficiency so far calls for the cost performance index.

   Written from www.gao.gov/assets/d20195G.pdf

3. PMP, question 3 of 5

   Midway through a long project, several uncertainties that could not be described at kickoff have become clearer. The list of threats and opportunities compiled at kickoff has not been revisited since. Which of the following should the project manager do?

   Right. In the game that’s Renown for your Business Environment building.

   Not that one: A is right. In the game your Business Environment building would lose a little Renown, and this question would come back later.

   The answerA.Reassess the risk registerGAO says that as a program progresses some uncertainties are revealed and can be defined in the risk register as threats or opportunities, so prudent organizations reevaluate the risk register periodically.Your answerB.Raise the schedule contingencyMore contingency might be a response later, but first the newly defined threats and opportunities need to be in the risk register.Your answerC.Keep the list until closingGAO describes periodic reevaluation of the risk register precisely because uncertainties become better defined over time.Your answerD.Log the uncertainties as issuesNothing has occurred here. These uncertainties have become definable potential events, which GAO places in the risk register as threats or opportunities.

   Written from www.gao.gov/assets/d1689G.pdf

4. PMP, question 4 of 5

   A department head proposes naming a lead Developer inside a Scrum Team to decide each day who works on what and in which order. Which of the following should the project manager recommend?

   Right. In the game that’s Renown for your People building.

   Not that one: B is right. In the game your People building would lose a little Renown, and this question would come back later.

   Your answerA.Have the Scrum Master assign workThe Scrum Master coaches the team in self-management rather than allocating its work.The answerB.Keep the team self-managingThe Scrum Guide says Scrum Teams are self-managing: they decide internally who does what, when and how, and there are no sub-teams or hierarchies within a Scrum Team. The organization structures and empowers them to manage their own work.Your answerC.Let the Product Owner assign tasksThe Product Owner orders the Product Backlog but does not hand out the Developers' tasks.Your answerD.Make a senior Developer team leadA team lead creates a hierarchy inside the Scrum Team, which the Scrum Guide says has none.

   Written from scrumguides.org/scrum-guide.html

5. PMP, question 5 of 5

   At the Sprint Review, stakeholders report that a newly announced regulation will change what customers need. The project manager supports the Scrum Team in responding. Which of the following should follow?

   Right. In the game that’s Renown for your Business Environment building.

   Not that one: C is right. In the game your Business Environment building would lose a little Renown, and this question would come back later.

   Your answerA.Raise a formal change requestA change-control submission is how a predictive project handles scope change. In Scrum, the Sprint Review is the working session where attendees respond and the Product Backlog absorbs the change.Your answerB.Revise the current Sprint BacklogThe Sprint Backlog is the Developers' plan for the Sprint that is ending; new needs belong in the Product Backlog for future Sprints.The answerC.Adjust the Product Backlog togetherThe Scrum Guide says that at the Sprint Review the Scrum Team and stakeholders review what was accomplished and what has changed in their environment, then collaborate on what to do next; the Product Backlog may be adjusted to meet new opportunities.Your answerD.Defer it to the Sprint RetrospectiveThe Retrospective is about the team's own processes and tools. A change in the product's environment is handled at the Sprint Review.

   Written from scrumguides.org/scrum-guide.html

Certopolis is a free game where right answers raise buildings in your own town. These are CFA Level I questions, 908 in the bank. No sign-up for these.

1. CFA Level I, question 1 of 5

   Ana Ruiz, CFA, is an investment adviser in Country M. An insurance company pays her a fee for each client she refers to it. Country M's securities law requires advisers to disclose no such payments. Which action is most appropriate for Ruiz?

   Right. In the game that’s Renown for your Ethical and Professional Standards building.

   Not that one: C is right. In the game your Ethical and Professional Standards building would lose a little Renown, and this question would come back later.

   Your answerA.Disclose the referral fees only to clients who askWaiting for clients to ask means most of them never learn that Ruiz is paid for referrals. The Code and Standards require her to disclose the fees, which is stricter than Country M's law.Your answerB.Follow Country M's law, which governs her practice thereCountry M's law is the minimum, not the ceiling. When law and the Code and Standards differ, Standard I(A) requires the stricter of the two, and the Code and Standards require referral fees to be disclosed.The answerC.Disclose the referral fees to her clients and prospective clientsUnder Standard I(A) Knowledge of the Law, members must follow the more strict of applicable law and the Code and Standards.

   Show the full explanation and doc quotes

   CFA Institute's own illustration is referral fees: where law does not require them to be disclosed, the Code and Standards do, so the member must disclose them.

   Written from www.cfainstitute.org/standards/professionals/code-ethics-standards/standards-of-practice-i-a

2. CFA Level I, question 2 of 5

   A one-year government bill offers a nominal yield of 12.0%, and an investor expects inflation of 8.0% over the same year. Both rates are annually compounded. The investor's expected real rate of return is closest to:

   Right. In the game that’s Renown for your Quantitative Methods building.

   Not that one: A is right. In the game your Quantitative Methods building would lose a little Renown, and this question would come back later.

   The answerA.3.70%The exact relation for annually compounded rates is (1 + nominal) = (1 + inflation)(1 + real). Solving for the real rate: real = 1.12 / 1.08 − 1 = 1.037037 − 1 = 3.70%. Check: 3.7037% + 8.0% + (3.7037% × 8.0%) = 3.7037% + 8.0% + 0.2963% = 12.0%.Your answerB.4.00%4.00% is 12.0% − 8.0%, the simple subtraction. It leaves out the cross-product of the real rate and inflation (about 0.30 percentage points here), so it overstates the real rate when inflation is this high.Your answerC.4.32%Applies the inflation factor the wrong way round: (12.0% − 8.0%) × 1.08 = 4.32%, multiplying by (1 + inflation) instead of dividing by it.

   Written from www.richmondfed.org/~/media/richmondfedorg/publications/research/economic_review/1983/pdf/er690301.pdf

3. CFA Level I, question 3 of 5

   An analyst proposes to report the six-month crude oil futures price to clients as a direct measure of the spot price that market participants expect for oil six months from now. Which statement about this proposal is most accurate?

   Right. In the game that’s Renown for your Derivatives building.

   Not that one: B is right. In the game your Derivatives building would lose a little Renown, and this question would come back later.

   Your answerA.It is unsound, because futures prices hold no information about later pricesFutures prices do embody market participants' expectations; the issue is that they embody the market price of risk as well, so they are informative but not a pure expectation.The answerB.It is unsound, because the futures price also reflects a risk premiumUnder standard equilibrium asset pricing theory, forward and futures prices are the sum of an expectations component and a risk premium component.Your answerC.It is sound, because the futures price equals the market's expected future spot priceThis is the tempting reading. A futures price combines expectations with a risk premium, so it equals the expected spot price only if that premium is zero, which tests of forecast efficiency reject for most instruments studied.

   Show the full explanation and doc quotes

   They are therefore not generally pure measures of market expectations, and reading the oil futures price as the expected spot price can give a biased forecast.

   Written from www.federalreserve.gov/pubs/ifdp/2004/808/ifdp808.pdf

4. CFA Level I, question 4 of 5

   Under IAS 2, Meridal SA holds 5,000 units of inventory costing EUR50 each. Each unit is expected to sell for EUR51, after further completion costs of EUR3 per unit and selling costs of EUR2 per unit. The inventory write-down is closest to:

   Right. In the game that’s Renown for your Financial Statement Analysis building.

   Not that one: C is right. In the game your Financial Statement Analysis building would lose a little Renown, and this question would come back later.

   Your answerA.EUR5,000This NRV leaves out the completion costs: 51 − 2 = 49 and (50 − 49) × 5,000 = 5,000. NRV deducts both the costs to complete and the costs to sell.Your answerB.EUR10,000This NRV leaves out the selling costs: 51 − 3 = 48 and (50 − 48) × 5,000 = 10,000. NRV deducts the costs necessary to make the sale as well as completion costs.The answerC.EUR20,000IAS 2 measures inventory at the lower of cost and net realisable value, where NRV is the estimated selling price less costs of completion and costs necessary to make the sale.

   Show the full explanation and doc quotes

   NRV = 51 − 3 − 2 = EUR46 per unit, below cost of EUR50. Write-down = (50 − 46) × 5,000 = EUR20,000.

   Written from www.ifrs.org/issued-standards/list-of-standards/ias-2-inventories/

5. CFA Level I, question 5 of 5

   Quillon Media completed an IPO of Class A common shares carrying one vote each. Its founders kept Class B shares carrying ten votes each, equal to 20% of the company's equity. Which statement about this dual-class structure is most accurate?

   Right. In the game that’s Renown for your Equities building.

   Not that one: A is right. In the game your Equities building would lose a little Renown, and this question would come back later.

   The answerA.The founders can control the company without a majority of sharesIn a dual-class structure the super-voting shares give their holders a far larger share of the votes than their equity stake.Your answerB.Class A holders' voting power equals their 80% equity stakeVotes per share differ between the classes, so voting power does not track equity. Class A's 80 votes against Class B's 200 give Class A about 29% of the votes, well short of its 80% stake.Your answerC.Class B shares typically keep ten votes each after the founders sell themThe SEC's IPO bulletin notes that super-voting stock generally converts to the lesser-voting class when its initial holder sells it, so the extra votes usually stay with the founders.

   Show the full explanation and doc quotes

   Here Class B has 20 x 10 = 200 votes for every 80 x 1 = 80 Class A votes, about 71% of the votes from 20% of the equity, so the founders control Quillon without a majority of its shares.

   Written from www.investor.gov/introduction-investing/general-resources/news-alerts/alerts-bulletins/investor-bulletins-17