I85PREP
⌘ K
AB-410 study materials
AB-410 study resources

AB-410 practice questions

One question at a time. Build your AB-410 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Unverified placeholder - official domain name not confirmed

In an infrastructure-as-a-service public cloud deployment, which party is responsible for applying security patches to the guest operating system?

  1. An external compliance auditor
  2. The server hardware vendor
  3. The cloud provider
  4. The customer Correct answer.

Explanation

Under the shared responsibility model, the provider secures the physical hosts, network, and hypervisor, while the tenant owns everything from the guest OS upward in IaaS. Patch management of the guest OS therefore belongs to the customer, along with the applications and data running on it.

Question 2Unverified placeholder - official domain name not confirmed

Which HTTP method is defined as idempotent and is intended to replace the full representation of a resource?

  1. POST
  2. PUT Correct answer.
  3. CONNECT
  4. PATCH

Explanation

PUT replaces the entire target resource with the enclosed representation, and repeating the same request produces the same end state, which makes it idempotent. POST creates subordinate resources and is not idempotent, while PATCH applies a partial modification.

Question 3Unverified placeholder - official domain name not confirmed

Which JSON data type represents an ordered collection of values?

  1. String
  2. Array Correct answer.
  3. Number
  4. Object

Explanation

A JSON array is an ordered sequence of values enclosed in square brackets, and its elements may be of mixed types. Objects hold unordered name-value pairs, while strings and numbers are scalar values.

Question 4Unverified placeholder - official domain name not confirmed

Which Git command creates a new branch and switches to it in a single step?

  1. git checkout -b new-feature Correct answer.
  2. git checkout --branch new-feature
  3. git branch new-feature
  4. git merge -b new-feature

Explanation

The -b flag on git checkout creates the named branch and immediately makes it the current branch. Running git branch alone only creates the branch and leaves the working tree on the current branch.

Question 5Unverified placeholder - official domain name not confirmed

Which constraint uniquely identifies each row in a relational table and disallows null values in the identifying column?

  1. PRIMARY KEY Correct answer.
  2. DEFAULT
  3. CHECK
  4. FOREIGN KEY

Explanation

A primary key enforces both uniqueness and non-nullness on the key column or column set, making every row identifiable. Foreign keys reference other tables, check constraints validate expressions, and defaults supply values when none are given.

Question 6Unverified placeholder - official domain name not confirmed

Which term describes the process of verifying who a user is, as distinct from what that user is permitted to do?

  1. Authorization
  2. Federation
  3. Authentication Correct answer.
  4. Auditing

Explanation

Authentication establishes identity, typically through credentials, certificates, or tokens. Authorization then evaluates policies to decide which actions the identified principal may perform.

Question 7Unverified placeholder - official domain name not confirmed

Which machine learning approach trains a model on labeled examples in order to predict a categorical outcome?

  1. Clustering
  2. Supervised classification Correct answer.
  3. Dimensionality reduction
  4. Reinforcement learning

Explanation

Classification is a supervised task because the training data includes the target label for each example. Clustering and dimensionality reduction are unsupervised, and reinforcement learning learns from reward signals rather than labeled outcomes.

Question 8Unverified placeholder - official domain name not confirmed

Which control most directly protects data stored on a disk from being read if the physical disk is stolen?

  1. Encryption at rest Correct answer.
  2. Input validation
  3. Rate limiting
  4. TLS in transit

Explanation

Encryption at rest renders stored ciphertext unreadable without the decryption key, which covers loss or theft of the underlying media. Transport encryption, validation, and throttling protect other aspects of the data path.

Question 9Unverified placeholder - official domain name not confirmed

A client calls an API with a syntactically valid access token that has already expired. Which HTTP status code best describes the response?

  1. 403 Forbidden
  2. 401 Unauthorized Correct answer.
  3. 404 Not Found
  4. 500 Internal Server Error

Explanation

401 indicates that authentication credentials are missing, invalid, or expired, so the caller should obtain fresh credentials. 403 is used when the caller is authenticated but lacks permission for the requested resource.

Question 10Unverified placeholder - official domain name not confirmed

An API must let clients retry a payment-creation request after a timeout without ever charging the customer twice. Which design is most appropriate?

  1. Increase the client request timeout substantially
  2. Return 202 Accepted for every retry and reprocess the request
  3. Use GET with a query string containing the amount and customer identifier
  4. Accept a client idempotency key and cache the result by it Correct answer.

Explanation

An idempotency key lets the server recognize a repeated attempt and return the stored result of the first successful execution instead of performing the operation again. This makes retries safe even when the original response was lost.

Question 11Unverified placeholder - official domain name not confirmed

An order table repeats the customer name and address on every order row, producing update anomalies. Which change most directly resolves this?

  1. Creating an index on the customer name column
  2. Partitioning the order table by order date and archiving older partitions to cheaper storage
  3. Moving customer attributes to a separate table keyed by a foreign key Correct answer.
  4. Adding a surrogate key to the order table

Explanation

Extracting the repeating customer attributes into their own table and referencing it by foreign key removes the redundancy that causes update, insert, and delete anomalies. Indexing, surrogate keys, and partitioning improve access patterns without changing the dependency structure.

Question 12Unverified placeholder - official domain name not confirmed

A service only needs to read objects from one storage container. Which permission assignment follows the principle of least privilege?

  1. Grant read-only access scoped to that single container Correct answer.
  2. Grant the service owner rights on the entire subscription
  3. Grant contributor rights on the enclosing resource group
  4. Grant read access to every storage account in the tenant

Explanation

Least privilege means granting the smallest set of permissions at the narrowest scope that still satisfies the requirement. Container-scoped read access covers the need without exposing unrelated resources.

Question 13Unverified placeholder - official domain name not confirmed

Read traffic overwhelms a database because a small set of records is requested repeatedly and changes rarely. Which change most directly reduces the load?

  1. Increase the database connection pool size to match peak concurrent requests
  2. Add more columns to the table and rebuild all indexes nightly
  3. Enable verbose query logging on the primary database
  4. Cache frequently read records and invalidate on write Correct answer.

Explanation

Serving repeated reads from a cache with a defined lifetime and write-based invalidation removes those queries from the database entirely. Pool sizing and schema changes do not reduce the number of read operations reaching the database.

Question 14Unverified placeholder - official domain name not confirmed

Producers occasionally emit large bursts of work items that consumers process asynchronously. Which pattern best absorbs the burst without losing items?

  1. A shared in-memory variable on a single server
  2. Longer client-side request timeouts
  3. Synchronous HTTP calls with client retries
  4. A durable queue placed between producers and consumers Correct answer.

Explanation

A durable queue buffers items when the arrival rate exceeds the processing rate and retains them until a consumer acknowledges completion. This decouples producers from consumers and survives consumer restarts.

Question 15Unverified placeholder - official domain name not confirmed

A generative model's responses vary in structure, which breaks a downstream parser. Which prompt change most reliably improves output consistency?

  1. Adding an instruction to be as creative as possible
  2. Increasing the temperature setting so responses become more varied
  3. Specifying an explicit output schema with a worked example Correct answer.
  4. Removing all examples from the prompt to shorten the input

Explanation

Constraining the response with a concrete schema plus a worked example narrows the space of acceptable outputs and demonstrates the expected shape. Lower temperature and explicit formatting rules reinforce this effect.

Question 16Unverified placeholder - official domain name not confirmed

A report must list every customer, including those who have never placed an order, along with order details where they exist. Which join produces this result when customers is the left table?

  1. INNER JOIN
  2. RIGHT JOIN from customers to orders
  3. LEFT JOIN from customers to orders Correct answer.
  4. CROSS JOIN

Explanation

A LEFT JOIN keeps every row from the left table and fills order columns with nulls when no match exists, which preserves customers without orders. INNER JOIN would drop those customers entirely.

Question 17Unverified placeholder - official domain name not confirmed

A downstream service intermittently returns 503 responses during peak load. Which client behavior is most appropriate?

  1. Retry immediately in a tight loop
  2. Disable retries and treat the failure as permanent
  3. Retry with exponential backoff and jitter Correct answer.
  4. Retry continuously with no attempt limit

Explanation

Exponential backoff spaces out attempts so an overloaded service can recover, and jitter prevents synchronized retry storms from many clients. Retries should also be bounded and applied only to transient failures.

Question 18Unverified placeholder - official domain name not confirmed

User-supplied text is concatenated directly into SQL statements. Which practice best prevents SQL injection?

  1. Escaping single quotation marks in the input
  2. Using parameterized queries Correct answer.
  3. Suppressing detailed database error messages
  4. Limiting input to 255 characters

Explanation

Parameterized queries send the statement structure and the values separately, so input is never parsed as SQL syntax. This blocks injection regardless of the characters contained in the value.

Question 19Unverified placeholder - official domain name not confirmed

A model scores well on its training data but performs poorly on held-out data. What is the most likely explanation?

  1. The held-out set is larger than expected
  2. The training labels are evenly balanced
  3. The model was trained for too few epochs
  4. The model overfits the training data Correct answer.

Explanation

A large gap between training and validation performance is the classic signature of overfitting, where the model memorizes noise instead of generalizable patterns. Remedies include more data, regularization, and early stopping.

Question 20Unverified placeholder - official domain name not confirmed

An application needs a database password to connect at startup. Which approach best protects that credential?

  1. Embedding it in client-side JavaScript delivered to browsers
  2. Sending it to the team in a chat message
  3. Retrieving it at runtime from a managed secret store Correct answer.
  4. Hard-coding it in the application source repository

Explanation

A managed secret store centralizes storage, access control, auditing, and rotation of credentials, and the application fetches the value only when needed. Secrets kept in code or messages are widely copied and hard to rotate.

Question 21Unverified placeholder - official domain name not confirmed

A business workflow writes to two independent services and must not leave one write applied if the other fails. Which approach addresses this requirement?

  1. A longer HTTP timeout on both calls
  2. A saga that runs compensating actions for each completed step Correct answer.
  3. Fire-and-forget calls to both services with no tracking
  4. A single local database transaction that spans both independent services

Explanation

A saga coordinates a sequence of local transactions and triggers compensating actions to undo completed steps when a later step fails. Because each service owns its own datastore, a single atomic transaction across them is not available.

Question 22Unverified placeholder - official domain name not confirmed

Reads are served from replicas that lag behind the primary. After saving an edit, a user reloads the page and sees stale data. Which change fixes the user experience while keeping read scaling?

  1. Increase the tolerated replica lag on the read balancer
  2. Route read-after-write traffic to the primary until replication catches up Correct answer.
  3. Remove all read replicas and serve every read from a single primary database
  4. Disable browser caching for the application

Explanation

Read-your-writes consistency requires that a client observe its own recent writes, which can be achieved by directing that client's reads to the primary for a short period or until the replica has applied the change. Other traffic can still be served by replicas.

Question 23Unverified placeholder - official domain name not confirmed

An assistant must answer questions using an internal document collection and cite the source of each answer. Which architecture best satisfies this?

  1. Retrieve relevant document chunks at query time and supply them as context Correct answer.
  2. Rely on the model's pretrained knowledge of the organization
  3. Increase the maximum output token limit of the model
  4. Fine-tune the model on the full document corpus every night so it memorizes the content

Explanation

Retrieval-augmented generation grounds each answer in chunks fetched from the current document store, and the chunk metadata supplies citations. Retrieval also avoids retraining when documents change.

Question 24Unverified placeholder - official domain name not confirmed

Two clients read the same record and both submit updates, and the second write silently overwrites the first. Which mechanism detects this lost-update conflict?

  1. A database index on the primary key column
  2. A short cache lifetime on the record
  3. A read replica dedicated to reporting queries
  4. An optimistic concurrency token compared at write time Correct answer.

Explanation

With optimistic concurrency, each read returns a version or ETag that must be supplied with the update, and the write is rejected if the stored version has changed. This surfaces the conflict to the second client instead of silently overwriting.

Question 25Unverified placeholder - official domain name not confirmed

An API must evolve its response format without breaking existing integrations. Which approach best preserves backward compatibility?

  1. Add a new versioned endpoint and deprecate the old one gradually Correct answer.
  2. Change field data types in place and document the change
  3. Return different response shapes based on the caller's region
  4. Remove unused response fields as soon as they are identified

Explanation

Versioning lets existing clients continue to call the contract they were built against while new clients adopt the new shape, and a deprecation window gives integrators time to migrate. In-place breaking changes and region-dependent shapes create unpredictable contracts.

Question 26Unverified placeholder - official domain name not confirmed

A service receives a JSON Web Token and must confirm that it was issued by the trusted identity provider and has not been altered in transit. Which step accomplishes this?

  1. Verify the token's signature with the identity provider's published public key. Correct answer.
  2. Compare the token string against the provider's revocation list on every request.
  3. Decode the payload and check that the iss claim names the identity provider.
  4. Re-sign the token's header and payload with the service's own private key.

Explanation

A JWT is integrity-protected by a digital signature that only the issuer can produce; a consumer validates it with the issuer's public key. Reading claims from the payload proves nothing about authenticity because the payload is merely base64url-encoded.

Question 27Unverified placeholder - official domain name not confirmed

An application must store user passwords so that it can later verify a login attempt. Which storage approach is appropriate?

  1. Store the plaintext password in a table that only administrator accounts can query.
  2. Encrypt each password with the application's symmetric key so it can be decrypted during verification.
  3. Store a fast digest of the password, such as a single round of SHA-256, without a salt.
  4. Store a salted hash produced by a deliberately slow algorithm such as Argon2 or bcrypt. Correct answer.

Explanation

Password verification only requires recomputing a hash and comparing it, so the original value never needs to be recoverable. A per-user salt defeats precomputed tables, and a deliberately slow function raises the cost of offline guessing.

Question 28Unverified placeholder - official domain name not confirmed

A mobile client calls a public HTTPS API. Which protection does TLS provide for that connection?

  1. It prevents the client from sending malformed request bodies.
  2. It guarantees that the server will never log the request contents.
  3. It encrypts the traffic and lets the client authenticate the server. Correct answer.
  4. It hides the client's IP address from the API server.

Explanation

TLS provides confidentiality and integrity for data in transit, and the certificate chain lets the client confirm it is talking to the intended server. It does not police payload shape, conceal network addresses, or constrain what the server does with data after receipt.

Question 29Unverified placeholder - official domain name not confirmed

A team extracts fields from the same document many times and needs the same output on every submission. Which model setting most directly supports this?

  1. Raise the top-p sampling value.
  2. Increase the maximum output token limit.
  3. Set the sampling temperature to zero. Correct answer.
  4. Add a system prompt that describes the target JSON schema.

Explanation

Temperature controls how much randomness is applied when the model selects tokens; setting it to zero makes the model pick the highest-probability continuation each time, which is the closest a sampling model gets to reproducible output. Other settings change format or length but leave sampling stochastic.

Question 30Unverified placeholder - official domain name not confirmed

Application logs are shipped to a third-party analytics service. Some entries contain full card numbers and government identifiers. What should be done before those entries leave the application?

  1. Base64-encode the fields so they are unreadable to casual readers.
  2. Rely on the analytics vendor's access controls to restrict the fields.
  3. Retain the fields but shorten the log retention period to seven days.
  4. Redact or tokenize those fields before the entry is written. Correct answer.

Explanation

Sensitive values should be removed at the point of logging so they never leave the trust boundary of the application. Encoding is reversible, vendor controls are outside your control, and shorter retention still ships the data to a third party.

Question 31Unverified placeholder - official domain name not confirmed

A database credential is kept in a managed secrets service and is used by two application instances. Which practice limits the harm if that credential is later exposed?

  1. Granting the credential to every service in the account so usage stays consistent.
  2. Keeping a second copy of the credential inside the deployment configuration.
  3. Lengthening the credential to at least 64 random characters.
  4. Rotating the credential on a schedule and after any suspected exposure. Correct answer.

Explanation

Rotation bounds the useful lifetime of a leaked secret: once replaced, the old value stops working. It is the control that turns a one-time exposure into a time-limited incident rather than a permanent compromise.

Question 32Unverified placeholder - official domain name not confirmed

A batch pipeline renders image thumbnails, and any unit of work can be restarted from a checkpoint without side effects. Which compute purchasing option most reduces cost for this workload?

  1. Spot or preemptible instances combined with checkpointing. Correct answer.
  2. On-demand instances sized for peak concurrency.
  3. Reserved instances purchased for a three-year term.
  4. Dedicated hosts confined to a single availability zone.

Explanation

Spot and preemptible capacity is heavily discounted because it can be reclaimed at short notice, which is acceptable for fault-tolerant work that resumes from a checkpoint. Committed and dedicated options trade flexibility for guarantees this workload does not need.

Question 33Unverified placeholder - official domain name not confirmed

An engineer edits a security group rule directly in the cloud console. A later infrastructure-as-code apply restores the original rule. Which concept describes this situation?

  1. Idempotency
  2. Configuration drift Correct answer.
  3. Immutable infrastructure
  4. Blue-green deployment

Explanation

Configuration drift is the divergence between the declared, version-controlled state and the live environment, usually caused by manual out-of-band changes. Reapplying the code converges the environment back to its declared state.

Question 34Unverified placeholder - official domain name not confirmed

A single-page application calls an API on behalf of a signed-in user. It runs entirely in the browser and cannot keep a client secret confidential. Which OAuth 2.0 configuration is appropriate?

  1. Authorization code flow with PKCE, exchanging the code from the browser client. Correct answer.
  2. Client credentials flow, treating the application itself as the end user.
  3. Implicit flow, returning an access token in the URL fragment.
  4. Resource owner password credentials flow with the client secret embedded in the page.

Explanation

Public clients such as browser apps cannot hold a secret, so PKCE binds the authorization request to the later token request with a one-time verifier and blocks code interception. The authorization code never travels through the user agent in a form an attacker can replay.

Question 35Unverified placeholder - official domain name not confirmed

An API lists a large collection that changes constantly. Clients paging with numeric offsets see duplicates and missed records as new items are inserted. Which change fixes this?

  1. Increase the page size to the maximum the service allows.
  2. Randomize the sort order on every request so inserts distribute evenly.
  3. Return pages using a stable cursor anchored to the last item the client saw. Correct answer.
  4. Cache the full result set on the server for each client session.

Explanation

Cursor pagination derives the next page from a stable, ordered position rather than a row count, so concurrent inserts cannot shift the window and cause skips or repeats. Larger pages or per-session caches only reduce how often the underlying defect appears.

Question 36Unverified placeholder - official domain name not confirmed

A user requests a record that exists but belongs to a different tenant. The service must not reveal whether that record exists. Which response is most appropriate?

  1. 403 Forbidden with a message naming the owning tenant.
  2. 404 Not Found. Correct answer.
  3. 400 Bad Request stating that the record identifier is unknown.
  4. 200 OK with an empty body.

Explanation

Responding 404 for both missing and unauthorized records makes the two cases indistinguishable, preventing enumeration of other tenants' identifiers. A 403 confirms existence, which is exactly the disclosure being avoided.

Question 37Unverified placeholder - official domain name not confirmed

A write-heavy table has six secondary indexes added to speed up reports. Insert throughput has dropped sharply. What explains this?

  1. Each index stores a duplicate of the entire row, doubling on-disk storage.
  2. Index statistics are fully recomputed on every insert, blocking the write path.
  3. Indexes reserve memory that would otherwise buffer incoming writes.
  4. Every insert or update must also maintain each index, adding write work per statement. Correct answer.

Explanation

A secondary index is a separate structure the database must keep ordered, so each write becomes the original row change plus one maintenance operation per index. Write cost therefore grows with the number of indexes on the table.

Question 38Unverified placeholder - official domain name not confirmed

One transaction reads a row that a second transaction has modified but not yet committed. The second transaction then rolls back. What anomaly occurred, and which isolation level prevents it?

  1. A non-repeatable read; snapshot isolation prevents it.
  2. A lost update; repeatable read prevents it.
  3. A dirty read; read committed or higher prevents it. Correct answer.
  4. A phantom read; serializable prevents it.

Explanation

Reading uncommitted data that later disappears is a dirty read, and it is the anomaly read committed is specifically defined to eliminate. Stronger levels also prevent it but are not the minimum required.

Question 39Unverified placeholder - official domain name not confirmed

A message broker guarantees at-least-once delivery, and consumers occasionally process the same message twice, creating duplicate records. Which change addresses the root cause?

  1. Have each consumer record processed message IDs and skip ones already handled. Correct answer.
  2. Switch the destination to a fan-out exchange with more partitions.
  3. Move the processing onto a synchronous request path.
  4. Raise the consumer prefetch count so the queue drains faster.

Explanation

Because the delivery guarantee permits redelivery, correctness must come from the consumer: tracking seen identifiers and discarding repeats makes processing effectively once even when delivery is not. Topology and throughput settings do not change the guarantee.

Question 40Unverified placeholder - official domain name not confirmed

A dependency has been failing for several minutes. Every request still waits for the full timeout before failing, exhausting the caller's worker pool. Which pattern limits the damage?

  1. Exponential backoff with jitter applied to each retried request.
  2. A dead-letter queue that captures requests which time out.
  3. A larger connection pool sized to peak concurrency.
  4. A circuit breaker that fails fast while the dependency is unhealthy. Correct answer.

Explanation

A circuit breaker stops issuing calls once the failure rate crosses a threshold, so callers fail immediately instead of holding workers for the timeout duration. It also allows a probe after a cooling period to detect recovery.

Question 41Unverified placeholder - official domain name not confirmed

A team wants a new API version to reach about 2% of live traffic first, with automatic rollback if error rates rise above a threshold. Which release approach fits?

  1. Rolling deployment that updates every instance in a single wave.
  2. Blue-green deployment with an immediate full cutover.
  3. Feature-flagged dark launch whose results are discarded rather than served.
  4. Canary release driven by automated metric-based rollback. Correct answer.

Explanation

A canary sends a small, controlled slice of real traffic to the new version and uses observed metrics to promote or roll back automatically. It is the only option that both limits exposure and reacts to live error rates.

Question 42Unverified placeholder - official domain name not confirmed

A retrieval-augmented assistant reads documents that outside parties can upload. One document contains text ordering the model to ignore its instructions and reveal the system prompt. Which mitigation addresses this risk most directly?

  1. Treat retrieved text as untrusted content and delimit it away from system instructions. Correct answer.
  2. Limit the number of retrieved documents included in each prompt.
  3. Instruct the model to refuse questions about its own configuration or prompt.
  4. Lower the model temperature so the injected instruction is less likely to be obeyed.

Explanation

Indirect prompt injection works because retrieved content shares the same instruction channel as the system prompt. Clearly separating trusted instructions from untrusted data, and telling the model to never follow directives found in data, removes the confusion the attack relies on.

Question 43Unverified placeholder - official domain name not confirmed

Users search a knowledge base with paraphrases that share few keywords with the stored articles, and keyword search returns poor results. Which technique addresses this?

  1. Applying stricter stop-word filtering to the queries.
  2. Shortening the search index refresh interval.
  3. Retrieving by embedding similarity so text with related meaning matches. Correct answer.
  4. Hand-maintaining a synonym list applied by the query parser.

Explanation

Embedding-based retrieval compares meaning rather than surface tokens, so paraphrases and synonyms land near the relevant passages in vector space. This is precisely the gap that lexical keyword matching cannot close.

Question 44Unverified placeholder - official domain name not confirmed

A fraud classifier flags roughly 0.5% of transactions. A model that predicts 'not fraud' for every transaction reports 99.5% accuracy. Which evaluation approach better reflects real performance?

  1. Precision and recall, or F1, computed for the fraud class. Correct answer.
  2. The number of input features used by the model.
  3. Overall accuracy plus training loss.
  4. Mean squared error measured on the test set.

Explanation

With severe class imbalance, accuracy is dominated by the majority class, so a trivial predictor scores highly. Precision and recall focus on the minority class and expose how many frauds are caught and how many alerts are false.

Question 45Unverified placeholder - official domain name not confirmed

A customer asks for their personal data to be deleted. Copies exist in the primary database, a nightly backup set, and an analytics warehouse. Which practice best satisfies the request?

  1. Remove the customer's login credentials and mark the account inactive.
  2. Delete the rows from the primary database and confirm the request is complete.
  3. Wait for the backup retention window to expire before taking any action.
  4. Propagate the deletion to derived stores and let backups expire on a documented schedule. Correct answer.

Explanation

Erasure obligations cover every system that holds the data, including warehouses and derived datasets, not just the system of record. Where immutable backups cannot be edited, a documented retention period after which they expire is the accepted approach.

Question 46Unverified placeholder - official domain name not confirmed

A network partition splits a replicated store into two halves. The team decides each half will keep accepting writes and conflicts will be merged later. Which trade-off have they made?

  1. They guaranteed linearizable reads during the partition.
  2. They eliminated the need for partition tolerance.
  3. They chose availability over strong consistency. Correct answer.
  4. They chose strong consistency over availability.

Explanation

When a partition occurs, a system that keeps serving writes on both sides is prioritizing availability and accepting that the two sides can temporarily disagree. Strong consistency would require refusing or blocking writes that cannot be coordinated.

Question 47Unverified placeholder - official domain name not confirmed

A team normalizes a dataset using the mean and standard deviation computed over all rows, then splits it into training and test sets. Test scores look excellent, but production performance is poor. What is the cause?

  1. The labels were shuffled before the train-test split.
  2. The test set is too small to produce a meaningful score.
  3. Statistics from the test set leaked into preprocessing, inflating the scores. Correct answer.
  4. The model has too few parameters and is underfitting the data.

Explanation

Fitting any transformation on the full dataset lets information about the evaluation rows influence the model's inputs, so the test set is no longer unseen. The correct order is to fit preprocessing on the training split only and apply those parameters to validation and test data.

Question 48Unverified placeholder - official domain name not confirmed

A retrieval system indexes documents in 50-token chunks. Answers miss context that spans sentences, and the retrieved fragments look relevant but lack the needed detail. Which change is most likely to improve answer quality?

  1. Raise the model temperature so it produces broader answers.
  2. Raise the number of chunks retrieved per query from three to thirty.
  3. Index only document titles and short summaries instead of full text.
  4. Use larger, overlapping chunks so related sentences stay together. Correct answer.

Explanation

Retrieval quality is bounded by what each chunk contains; tiny chunks cut the reasoning an answer depends on. Larger chunks with overlap preserve cross-sentence context while overlap prevents facts from being split at boundaries.

Question 49Unverified placeholder - official domain name not confirmed

A customer-facing assistant must never mention a competitor's pricing or promise refunds outside policy. Which control most reliably enforces these limits?

  1. Reviewing a random sample of transcripts after conversations complete.
  2. Adding the policy to the system prompt and relying on the model to follow it.
  3. Validating each response against deterministic rules before returning it. Correct answer.
  4. Fine-tuning the model on examples of compliant responses.

Explanation

Probabilistic generation cannot guarantee a constraint, so enforceable limits belong in code that inspects the output and blocks or rewrites violations. Prompt instructions and fine-tuning shift behaviour statistically, which is insufficient for a hard requirement.

Question 50Unverified placeholder - official domain name not confirmed

A mobile app holds long-lived refresh tokens. If a token is stolen, an attacker could keep minting access tokens indefinitely. Which measure best detects and limits this?

  1. Shorten the access token lifetime so each token expires within five minutes of issue.
  2. Rotate the refresh token on each use and detect reuse of consumed tokens. Correct answer.
  3. Require the user to sign in again with a password every 24 hours.
  4. Persist refresh tokens in the device's local file storage so they survive app restarts.

Explanation

Rotation makes every refresh token single-use, so a stolen token becomes invalid once the legitimate client refreshes. If an already-consumed token is presented, that signals theft and the whole token family can be revoked.