Courseiva

CompTIA Cloud+ CV0-004 (CV0-004) — Questions 826–900

977 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 11

Page 12 of 14

Page 13
826
Multi-Selecteasy

A cloud administrator is deploying a new application in a cloud environment. The application requires high availability and fault tolerance. Which two design principles should the administrator implement? (Select TWO).

Select 2 answers
A.Place a load balancer in front of the application.
B.Use an auto-scaling group across multiple availability zones.
C.Deploy all instances in a single availability zone.
D.Use a single instance to reduce costs.
E.Store all data on a single volume without replication.
AnswersA, B

Correct. Load balancer distributes traffic and detects unhealthy instances, improving availability.

Why this answer

Placing a load balancer in front of the application distributes incoming traffic across multiple healthy instances, ensuring that if one instance fails, traffic is redirected to others, which provides high availability and fault tolerance. Option B is correct because deploying an auto-scaling group across multiple Availability Zones (AZs) ensures that if an entire AZ fails, the application continues running in another AZ, and the auto-scaling group automatically replaces failed instances to maintain capacity.

Exam trap

The trap here is that candidates often think cost-saving strategies (single instance, single volume) are acceptable for high availability, but the exam requires understanding that fault tolerance demands redundancy at every layer—compute, storage, and network—across multiple failure domains.

Full explanation →
827
MCQmedium

A cloud administrator needs to detect unusual spikes in CPU usage across a fleet of EC2 instances. Which AWS service should be used to create an alarm that triggers when CPU utilization exceeds an expected baseline?

A.AWS Config
B.AWS CloudTrail
C.AWS CloudWatch Alarms with anomaly detection
D.AWS Systems Manager
AnswerC

CloudWatch Alarms can use anomaly detection to trigger on deviations from expected baselines.

Why this answer

CloudWatch Alarms can use anomaly detection to automatically detect unusual patterns based on historical data.

Full explanation →
828
MCQmedium

A cloud architect is deploying a web application across multiple availability zones within a single region to achieve high availability. The application requires that if one availability zone fails, traffic should automatically be rerouted to the remaining zones without manual intervention. Which configuration is required?

A.Active-passive with a standby instance in a different region
B.Active-active across availability zones with a load balancer
C.Vertical scaling of instances in a single availability zone
D.Cold standby with daily backups
AnswerB

Active-active across AZs with a load balancer provides automatic failover within the region.

Why this answer

Deploying an active-active configuration across multiple availability zones with a load balancer ensures that traffic is automatically distributed to healthy instances. If one availability zone fails, the load balancer's health checks detect the failure and reroute traffic to the remaining zones without manual intervention, meeting the high availability requirement.

Exam trap

The trap here is that candidates often confuse high availability with disaster recovery, mistakenly choosing a cross-region active-passive setup (Option A) when the question explicitly specifies a single region and automatic rerouting.

How to eliminate wrong answers

Option A is wrong because active-passive with a standby instance in a different region introduces cross-region latency and requires manual or automated failover mechanisms, not automatic rerouting within a single region. Option C is wrong because vertical scaling in a single availability zone does not provide fault tolerance; if that zone fails, all instances become unavailable regardless of size. Option D is wrong because a cold standby with daily backups involves significant recovery time and manual steps to restore service, not automatic traffic rerouting.

Full explanation →
829
Multi-Selectmedium

Which TWO of the following are common vulnerabilities in cloud environments that can lead to unauthorized access? Select two.

Select 2 answers
A.Enabling automatic patching
B.Lack of encryption for data in transit
C.Using multi-factor authentication
D.Properly scoped IAM roles
E.Misconfigured security groups allowing overly permissive inbound rules
AnswersB, E

Unencrypted data can be intercepted.

Why this answer

Options B and E are correct because lack of encryption for data in transit exposes sensitive data to interception, and misconfigured security groups allowing overly permissive inbound rules can grant unauthorized access. Options A, C, and D are security best practices that help prevent vulnerabilities.

Full explanation →
830
MCQeasy

A company is migrating a legacy on-premises application to a public cloud. The application currently uses a single monolithic architecture and relies on a local file system for storage. The cloud architect needs to redesign the application to take advantage of cloud-native features. Which design principle should the architect prioritize to ensure scalability and resilience?

A.Maintain the monolithic architecture and connect via VPN to on-premises storage
B.Use vertical scaling by increasing vCPU and RAM on a single large VM
C.Refactor the application into microservices deployed across multiple instances
D.Deploy the entire application in a single availability zone to reduce latency
AnswerC

Microservices enable independent scaling and fault isolation.

Why this answer

Refactoring the monolithic application into microservices enables independent scaling of components, improves fault isolation, and aligns with cloud-native patterns like containerization and orchestration (e.g., Kubernetes). This approach leverages horizontal scaling across multiple instances, which is essential for achieving elasticity and resilience in a public cloud environment, unlike the legacy single-point-of-failure monolithic design.

Exam trap

The trap here is that candidates often confuse vertical scaling (Option B) as a valid cloud-native approach, but the exam emphasizes horizontal scaling and decoupled architectures as the correct principles for scalability and resilience in cloud design.

How to eliminate wrong answers

Option A is wrong because maintaining the monolithic architecture and connecting via VPN to on-premises storage fails to leverage cloud-native features like managed storage services (e.g., Amazon S3 or Azure Blob Storage), introduces latency and bandwidth bottlenecks, and does not address scalability or resilience. Option B is wrong because vertical scaling (increasing vCPU and RAM on a single large VM) has hard limits (e.g., maximum instance size in AWS or Azure), creates a single point of failure, and does not provide the elasticity or fault tolerance required for cloud-native applications. Option D is wrong because deploying the entire application in a single availability zone increases the risk of downtime due to zone-level failures (e.g., power outages or network issues), contradicts the cloud best practice of multi-AZ deployment for high availability, and does not improve scalability.

Full explanation →
831
MCQeasy

A storage administrator needs to ensure data durability for a critical database. Which approach provides the highest durability?

A.Store data on a single SSD volume.
B.Enable encryption at rest.
C.Use RAID 0 across multiple volumes.
D.Replicate data to a different geographic region.
AnswerD

Geo-replication provides the highest durability by storing copies in separate regions, protecting against region-wide disasters.

Why this answer

Replicating data to a different geographic region provides the highest durability by ensuring that even if an entire data center or region experiences a catastrophic failure (e.g., natural disaster, power outage), a complete copy of the database remains available in another region. This approach leverages asynchronous or synchronous replication to maintain data consistency across geographically separated sites, achieving a Recovery Point Objective (RPO) and Recovery Time Objective (RTO) that single-site solutions cannot match. In cloud environments, this is often implemented using services like AWS Cross-Region Replication or Azure Geo-Redundant Storage, which guarantee 99.9999999999% (12 nines) durability.

Exam trap

The trap here is that candidates confuse data protection mechanisms (like encryption or RAID) with durability, assuming that redundancy within a single site (RAID 0) or security features (encryption) can prevent data loss from a regional disaster, when only geographic replication addresses that risk.

How to eliminate wrong answers

Option A is wrong because storing data on a single SSD volume offers no redundancy; if the drive fails, all data is lost, resulting in zero durability against hardware failure. Option B is wrong because encryption at rest protects data confidentiality (e.g., against unauthorized access if the physical disk is stolen) but does not provide any durability or fault tolerance; it does not prevent data loss from drive failure or site outage. Option C is wrong because RAID 0 stripes data across multiple volumes to improve performance but provides no redundancy; if any one volume fails, the entire array is lost, making it the least durable option.

Full explanation →
832
Multi-Selecthard

A company manages a multi-account AWS environment and wants to deploy consistent infrastructure across several accounts using CloudFormation. The solution must support updates to the infrastructure and detect configuration drift. Which TWO CloudFormation features should be used?

Select 2 answers
A.Change sets
B.StackSets
C.Outputs
D.Nested stacks
E.Drift detection
AnswersB, E

StackSets enable deployments across multiple accounts.

Why this answer

StackSets allow deploying stacks across multiple accounts and regions. Drift detection identifies changes made outside CloudFormation. Change sets preview changes but are not specific to multi-account.

Full explanation →
833
MCQeasy

A cloud customer is deploying a virtual machine (VM) in a public IaaS environment. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

A.Securing the hypervisor
B.Patching the guest operating system
C.Physical security of the data center
D.Network infrastructure integrity
AnswerB

The customer manages the guest OS and its patches.

Why this answer

Under the shared responsibility model, the customer is responsible for securing the operating system, applications, and data within the VM. The cloud provider secures the physical host and hypervisor.

Full explanation →
834
MCQeasy

A company uses a cloud provider's key management service to encrypt data at rest. The security team wants to ensure that encryption keys are automatically rotated every 90 days to meet compliance requirements. Which feature should be enabled?

A.Key import scheduling
B.Key automatic rotation
C.Key revocation
D.Key policy enforcement
AnswerB

This automates key replacement at specified intervals.

Why this answer

Automatic rotation replaces key material periodically without manual intervention, meeting compliance needs.

Full explanation →
835
Drag & Dropmedium

Arrange the steps to deploy a new virtual machine in a public cloud environment (e.g., AWS, Azure, GCP) in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

VM deployment typically starts with specs, then OS, network, launch, and finally public access configuration.

Full explanation →
836
MCQeasy

A company is migrating a legacy application to the cloud. The application requires low-latency access to a shared filesystem that must be accessible from multiple virtual machines simultaneously. Which storage solution should the cloud architect recommend?

A.Cold archive storage
B.Local instance store
C.Block storage
D.Object storage
AnswerC

Block storage can be attached to multiple VMs using a cluster filesystem, providing shared low-latency access.

Why this answer

Block storage (C) is correct because it provides a shared filesystem that can be mounted by multiple virtual machines simultaneously with low-latency access. Services like Amazon EBS with multi-attach or Azure Managed Disks support concurrent read/write operations from multiple instances, meeting the legacy application's requirement for a shared, low-latency filesystem.

Exam trap

The trap here is that candidates confuse object storage's high durability and accessibility with the low-latency, shared filesystem capabilities of block storage, overlooking that object storage lacks the block-level locking and POSIX compliance needed for concurrent VM access.

How to eliminate wrong answers

Option A is wrong because cold archive storage (e.g., Amazon S3 Glacier or Azure Archive Storage) is designed for long-term, infrequently accessed data with retrieval times in minutes to hours, not for low-latency shared filesystem access. Option B is wrong because local instance store provides ephemeral, instance-specific storage that is not persistent and cannot be shared across multiple virtual machines simultaneously. Option D is wrong because object storage (e.g., Amazon S3 or Azure Blob Storage) offers high durability but uses HTTP-based APIs with higher latency and lacks native POSIX filesystem semantics required for a shared filesystem mountable by multiple VMs.

Full explanation →
837
MCQeasy

A cloud administrator is responsible for a multi-tier application hosted in a public cloud. The application consists of a web tier, application tier, and database tier. Recently, users have reported that the application is responding slowly during peak hours. The administrator checks the cloud monitoring dashboard and notices that the web tier instances are running at 90% CPU utilization, but the auto-scaling group has not triggered any scaling events. The scaling policy is set to scale out when average CPU exceeds 80% for 5 minutes. What should the administrator do to resolve this issue?

A.Manually increase the number of web tier instances
B.Increase the CPU threshold to 95% to avoid unnecessary scaling
C.Review the cooldown period settings of the auto-scaling group
D.Check the health check configuration of the load balancer
AnswerC

A long cooldown period can delay scaling even when the threshold is breached.

Why this answer

The cooldown period settings determine how long the auto-scaling group waits before initiating another scaling activity after a previous scaling event. If the cooldown period is too long, new scaling events may be suppressed even when the CPU threshold is exceeded for the required duration. The administrator should review and potentially reduce the cooldown period to allow the auto-scaling group to respond more quickly to high CPU utilization.

Option A is wrong because manual scaling is a temporary workaround and does not address the underlying auto-scaling configuration issue. Option B is wrong because increasing the CPU threshold to 95% would make scaling less sensitive, likely worsening performance during peak hours. Option D is wrong because health check configuration affects load balancer traffic routing, not the triggering of scaling events based on CPU metrics.

Full explanation →
838
Multi-Selecthard

A security engineer is designing a data classification policy for a cloud environment. The policy must identify sensitive data, apply appropriate controls, and monitor access. Which THREE of the following should be included in the policy? (Select THREE.)

Select 3 answers
A.Cloud Access Security Broker (CASB) for all data
B.Encryption at rest for classified data
C.Access logging and monitoring for sensitive data
D.Network security groups to isolate data
E.Data discovery and classification tools
AnswersB, C, E

Protects data in storage.

Why this answer

Data classification includes identifying where data resides, encrypting it, and monitoring access. DLP tools help enforce policies. Security groups are network controls, not data classification.

CASB is for SaaS, but not necessarily part of a classification policy.

Full explanation →
839
MCQmedium

A company is migrating a monolithic application to microservices on a cloud platform. The current application uses a single relational database. The migration plan involves decomposing the application into several services, each with its own database (polyglot persistence). One service handles high-volume time-series data, another handles user profiles, and a third handles transactions. The architect must ensure data consistency across services for user profile updates that affect other services. Which approach should be used to maintain data consistency without tight coupling?

A.Use distributed transactions (e.g., two-phase commit) across all services
B.Rely on eventual consistency with asynchronous messaging
C.Keep a single shared database for all services
D.Implement a saga pattern using choreography or orchestration
AnswerD

The saga pattern coordinates local transactions across services, ensuring consistency without tight coupling.

Why this answer

The saga pattern (option D) is the correct approach because it maintains data consistency across microservices without tight coupling by breaking a distributed transaction into a series of local transactions, each with a compensating action for rollback. In this scenario, user profile updates that affect other services can be coordinated via choreography (each service emits and listens to events) or orchestration (a central coordinator manages the steps), ensuring eventual consistency while preserving service autonomy and polyglot persistence.

Exam trap

CompTIA often tests the distinction between eventual consistency (option B) and the saga pattern (option D), where candidates mistakenly choose eventual consistency because it sounds like a standard microservices pattern, but the question explicitly requires maintaining data consistency across services, which the saga pattern provides through compensating transactions and explicit failure handling.

How to eliminate wrong answers

Option A is wrong because distributed transactions (e.g., two-phase commit) introduce tight coupling, block resources, and violate the autonomy of microservices; they also conflict with polyglot persistence as different databases may not support the same transaction protocol. Option B is wrong because relying solely on eventual consistency with asynchronous messaging does not guarantee data consistency for user profile updates that require coordinated changes across services—without a saga pattern, there is no mechanism to handle failures or rollbacks systematically. Option C is wrong because keeping a single shared database for all services reintroduces the tight coupling and scalability bottlenecks of the monolithic architecture, contradicting the goal of microservices and polyglot persistence.

Full explanation →
840
MCQmedium

A cloud administrator is troubleshooting connectivity to a virtual machine with IP address 10.10.10.10 from another VM on the same subnet. The output of ping and traceroute commands is shown. What is the most likely cause of the connectivity issue?

A.The destination VM's network interface is disabled.
B.The destination VM is powered off.
C.The source VM's routing table does not have a default gateway.
D.The destination VM's security group is blocking ICMP.
AnswerA

If the network interface is disabled, the VM will not respond to ARP requests, causing the gateway to return 'Destination Host Unreachable'.

Why this answer

A disabled network interface on the destination VM would cause the VM to be unreachable from the same subnet, even though the VM itself is powered on. Ping and traceroute would fail with no response, as the NIC is not operational at Layer 2, preventing ARP resolution and frame delivery. This matches the symptom of no connectivity despite being on the same subnet, where routing and security groups are not factors.

Exam trap

The trap here is that candidates often assume a powered-off VM is the cause, but the question specifies the VM is on the same subnet and the output shows no response at all, which points to a Layer 2 issue (disabled NIC) rather than a Layer 3 or higher issue like security groups or routing.

How to eliminate wrong answers

Option B is wrong because if the destination VM were powered off, the hypervisor would not respond to ARP requests, but the question states the VM is on the same subnet and the issue is connectivity from another VM; a powered-off VM would also show no response, but the specific symptom of a disabled NIC is more precise and matches the output of ping/traceroute failing without any ICMP unreachable messages. Option C is wrong because a default gateway is only needed for traffic destined outside the local subnet; since both VMs are on the same subnet, the source VM can communicate directly via ARP and does not require a default gateway. Option D is wrong because a security group blocking ICMP would typically result in no ping reply but the traceroute might show intermediate hops or the destination host responding with ICMP unreachable; however, on the same subnet, a security group would not prevent ARP resolution or Layer 2 communication, and the question's output shows no response at all, which is inconsistent with a security group blocking ICMP (which would still allow ARP and possibly TCP/UDP).

Full explanation →
841
MCQeasy

Which of the following is a benefit of using a Cloud Access Security Broker (CASB) for SaaS applications?

A.It encrypts data at rest in cloud storage.
B.It provides a virtual private network (VPN) for remote access.
C.It replaces the need for a web application firewall.
D.It gives visibility and control over Shadow IT and data protection.
AnswerD

CASBs are designed to discover and control SaaS applications.

Why this answer

CASBs provide visibility into SaaS usage and enforce security policies, such as data loss prevention (DLP) and access control.

Full explanation →
842
MCQeasy

A cloud engineer wants to view a dashboard showing cost breakdown by department. Which tool provides pre-built billing dashboards?

A.AWS CloudWatch
B.AWS Cost Explorer
C.AWS Trusted Advisor
D.AWS Config
AnswerB

Cost Explorer provides cost visualization dashboards.

Why this answer

AWS Cost Explorer provides pre-built dashboards for cost analysis.

Full explanation →
843
Multi-Selectmedium

A company is selecting a cloud deployment model. They require the ability to keep sensitive data on-premises due to regulatory compliance, but want to leverage cloud resources for burst computing capacity. Which THREE characteristics describe this model?

Select 3 answers
A.Uses multiple public cloud providers
B.Resources are exclusively owned by one organization
C.Provides the ability to burst to the cloud for extra capacity
D.Uses a VPN or dedicated connection between on-premises and cloud
E.Data can remain on-premises for compliance
AnswersC, D, E

Cloud bursting is a key use case for hybrid cloud.

Why this answer

Hybrid cloud connects on-premises with public cloud, enabling data residency and bursting.

Full explanation →
844
Multi-Selecthard

A company uses AWS and wants to implement a structured logging format to simplify querying and analysis of application logs. Which three best practices should be followed when implementing structured logging? (Choose THREE.)

Select 3 answers
A.Write logs in plain text to reduce storage costs
B.Include a unique request ID for each transaction
C.Use consistent key names across all services
D.Use JSON format for log entries
E.Embed binary data in log messages for performance
AnswersB, C, D

Request IDs allow tracing of individual transactions across services.

Why this answer

Structured logging typically uses JSON format, includes unique identifiers for tracing, and uses consistent key names for easy querying.

Full explanation →
845
MCQeasy

A company wants to reduce cloud costs by identifying underutilized EC2 instances. Which AWS service provides rightsizing recommendations?

A.AWS Budgets
B.AWS Trusted Advisor
C.AWS Cost Explorer
D.AWS Compute Optimizer
AnswerD

Compute Optimizer uses machine learning to recommend optimal instance types.

Why this answer

AWS Compute Optimizer analyzes utilization and recommends instance type changes to save costs.

Full explanation →
846
Multi-Selectmedium

Which TWO steps should an administrator take to troubleshoot a cloud VM that fails to boot?

Select 2 answers
A.Check the VM's console logs for error messages.
B.Verify the root disk is attached.
C.Check the boot order configuration.
D.Reboot the hypervisor host.
E.Delete and recreate the VM instantly.
AnswersA, C

Console logs show kernel panics or boot issues.

Why this answer

Console logs provide detailed error messages during the boot process, helping identify the root cause of boot failure. Option C is correct because incorrect boot order (e.g., trying to boot from a non-bootable device) can prevent the VM from starting; verifying and adjusting boot order is a standard troubleshooting step. Option B is incorrect because while verifying the root disk is attached is a basic check, it alone does not address other common boot issues (e.g., corrupted OS, incorrect boot configuration).

Option D is incorrect because rebooting the hypervisor host affects multiple VMs and is not a targeted troubleshooting step for a single VM failing to boot. Option E is incorrect because deleting and recreating the VM is a drastic measure that results in data loss and should only be considered after all other troubleshooting steps have failed.

Full explanation →
847
MCQmedium

A company runs a stateful application that maintains session data in memory on the server. The application experiences performance issues during traffic spikes. Which design change would best improve scalability?

A.Increase the memory of each server (vertical scaling)
B.Implement sticky sessions on the load balancer
C.Move session state to a shared cache or database (stateless design)
D.Use a CDN to cache static content
AnswerC

Correct. Stateless design enables horizontal scaling.

Why this answer

Making the application stateless by moving session state to an external store (e.g., Redis or database) allows any instance to handle any request, enabling horizontal scaling.

Full explanation →
848
MCQeasy

A cloud engineer is writing a Terraform configuration to deploy an AWS EC2 instance. Which file extension is typically used for Terraform configuration files written in HCL?

A..yaml
B..tf
C..json
D..hcl
AnswerB

.tf is the correct extension for Terraform HCL files.

Why this answer

Terraform uses the .tf extension for HCL configuration files.

Full explanation →
849
MCQhard

A company uses a public cloud provider and has a requirement that all data must be encrypted in transit and at rest. The architect notices that the cloud provider's load balancer terminates TLS and forwards traffic to backend instances over HTTP. Which design change should the architect make?

A.Implement a web application firewall (WAF) on the backend
B.Enable TLS termination at the backend instances only
C.Use a VPN tunnel between the load balancer and backend
D.Configure end-to-end encryption using HTTPS between load balancer and backend
AnswerD

This ensures traffic is encrypted all the way from client to backend instance.

Why this answer

The requirement mandates encryption in transit for all data paths. By configuring end-to-end HTTPS between the load balancer and backend instances, the architect ensures that traffic is encrypted from the client to the backend, even after the load balancer terminates the initial TLS connection. This prevents plaintext HTTP traffic from flowing over the internal network, satisfying the encryption-at-rest and in-transit compliance needs.

Exam trap

The trap here is that candidates often assume TLS termination at the load balancer is sufficient for encryption in transit, overlooking that the requirement applies to the entire data path, including the segment between the load balancer and backend instances.

How to eliminate wrong answers

Option A is wrong because implementing a WAF on the backend does not encrypt traffic; it only inspects and filters HTTP requests, leaving the data in transit over HTTP unencrypted. Option B is wrong because enabling TLS termination only at the backend instances would still leave the path from the load balancer to the backend unencrypted if the load balancer forwards via HTTP, and it also defeats the purpose of offloading TLS at the load balancer. Option C is wrong because a VPN tunnel between the load balancer and backend would encrypt the traffic at the network layer, but the load balancer would still terminate TLS and forward plaintext HTTP into the tunnel, meaning the data is decrypted before entering the tunnel and thus not encrypted end-to-end at the application layer.

Full explanation →
850
MCQhard

A company is deploying a multi-tier application in a cloud environment. The application must comply with PCI DSS, which requires encryption of data at rest and in transit. The database tier must be isolated from direct internet access, while the web tier must be accessible from the internet. Which of the following deployment architectures best meets these requirements?

A.Place all tiers in the same subnet and use security groups to restrict traffic.
B.Use a single instance for web and database, and place it behind a load balancer.
C.Use a VPN connection from the web tier to the database tier and disable encryption.
D.Deploy web tier in a public subnet, database tier in a private subnet, and use SSL/TLS for encryption.
AnswerD

Public subnet for web, private for database, and encryption satisfies PCI DSS.

Why this answer

It separates the web tier into a public subnet for internet accessibility and the database tier into a private subnet for isolation, meeting PCI DSS requirements. SSL/TLS encryption ensures data in transit is protected, and encryption at rest can be applied to the database storage. This architecture aligns with cloud best practices for multi-tier applications requiring compliance.

Exam trap

CompTIA often tests the misconception that security groups alone provide sufficient isolation, but network segmentation via separate subnets is required for PCI DSS compliance, and encryption must be explicitly enabled for both data at rest and in transit.

How to eliminate wrong answers

Option A is wrong because placing all tiers in the same subnet with only security groups does not provide network-level isolation for the database tier, violating PCI DSS requirements for data at rest and in transit encryption and exposing the database to potential direct internet access if misconfigured. Option B is wrong because using a single instance for both web and database tiers eliminates isolation, creating a single point of failure and violating PCI DSS segmentation requirements; it also fails to encrypt data in transit between tiers. Option C is wrong because a VPN connection from the web tier to the database tier does not inherently provide encryption for data in transit unless SSL/TLS or IPsec is explicitly configured, and disabling encryption violates PCI DSS; additionally, the web tier in a public subnet still requires encryption for all data in transit.

Full explanation →
851
MCQeasy

A cloud engineer needs to apply security patches to a fleet of Windows servers without manual intervention. Which service can automate this process?

A.AWS Config
B.AWS CloudFormation
C.AWS Trusted Advisor
D.AWS Systems Manager Patch Manager
AnswerD

Patch Manager automates patching.

Why this answer

AWS Systems Manager Patch Manager automates the patching of managed instances.

Full explanation →
852
Multi-Selecthard

A company uses a hybrid cloud model with an on-premises data center connected to a public cloud via a VPN. Users report intermittent connectivity issues to cloud applications. Which THREE components should the administrator check to isolate the problem? (Choose three.)

Select 3 answers
A.Rebooting the cloud instances
B.VPN tunnel status and configuration
C.Security group rules in the cloud VPC
D.Route tables in the cloud VPC and on-premises
E.DNS resolution configuration
AnswersB, C, D

VPN tunnel issues are a common cause of connectivity problems.

Why this answer

The VPN tunnel is the direct connectivity link between the on-premises data center and the public cloud. Intermittent connectivity issues often stem from tunnel flapping, misconfigured IPsec parameters (such as mismatched pre-shared keys, IKE versions, or lifetime settings), or routing issues within the tunnel. Checking the VPN tunnel status and configuration helps identify whether the tunnel is up, stable, and correctly passing traffic.

Exam trap

The trap here is that candidates often focus on application-level fixes (like rebooting instances) or DNS, when the real issue is a network-layer problem involving the VPN tunnel, routing, and security group rules that affect the path between on-premises and cloud resources.

Full explanation →
853
Multi-Selectmedium

Which TWO of the following are key components of a disaster recovery plan in the cloud? (Select TWO.)

Select 2 answers
A.Network performance monitoring
B.Billing alerts
C.Recovery point objective (RPO)
D.Load balancing
E.Cross-region replication
AnswersC, E

RPO determines how much data loss is acceptable during a disaster.

Why this answer

Recovery point objective (RPO) is a core metric in disaster recovery planning that defines the maximum acceptable amount of data loss measured in time. It directly determines the required frequency of backups or replication, making it essential for designing a cloud DR strategy that meets business continuity requirements.

Exam trap

Many candidates mistakenly think load balancing is part of disaster recovery, but load balancing is for high availability within a single region, not for cross-region DR. Recovery point objective (RPO) and cross-region replication are key DR components.

Full explanation →
854
MCQhard

A company uses Terraform to manage infrastructure as code. After running terraform apply, the state file is stored locally. The team wants to enable collaboration by storing state remotely with locking to prevent concurrent modifications. Which backend should be configured?

A.Consul
B.HTTP
C.S3 with DynamoDB locking
D.local
AnswerC

S3 backend with DynamoDB table for locking is a standard approach for team collaboration.

Why this answer

S3 provides a scalable, durable remote backend for Terraform state, and DynamoDB locking prevents concurrent modifications by acquiring a lock via a DynamoDB table before state operations. This combination is the standard AWS-native solution for team collaboration, as it supports state versioning, encryption, and consistent locking via DynamoDB's conditional writes.

Exam trap

The trap here is that candidates may choose Consul or HTTP thinking they support locking, but CompTIA Cloud+ tests the specific requirement for a fully managed, AWS-native solution with built-in locking, which only S3 with DynamoDB provides among the options.

How to eliminate wrong answers

Option A is wrong because Consul is a valid remote backend but is not the recommended choice for AWS environments; it requires running a Consul cluster and does not natively integrate with AWS services like S3 for state storage. Option B is wrong because the HTTP backend is a generic REST-based backend that does not support state locking natively; it requires a custom server implementation to handle locking, making it unsuitable for simple collaboration. Option D is wrong because the local backend stores state on the local filesystem, which prevents any form of remote collaboration and lacks locking mechanisms entirely.

Full explanation →
855
MCQhard

A company is migrating a legacy database that relies on a specific hardware security module (HSM) that cannot be moved to the cloud. The application must continue to function with minimal redevelopment. Which migration strategy is most appropriate?

A.Refactor
B.Replace
C.Rehost
D.Rebuild
AnswerB

Replace uses a cloud-native database service, eliminating the HSM dependency.

Why this answer

(Replace) because the legacy database depends on a specific hardware security module (HSM) that cannot be migrated to the cloud. Replacing the database with a cloud-native equivalent (e.g., Amazon RDS or Azure SQL Database) that supports a cloud-based HSM (like AWS CloudHSM or Azure Key Vault Managed HSM) allows the application to continue functioning with minimal redevelopment, as the replacement typically maintains SQL compatibility and standard interfaces.

Exam trap

The trap here is that candidates often confuse 'Replace' with 'Rebuild' or 'Refactor,' assuming that any change to the database engine requires significant code changes, but the exam tests the understanding that a cloud-native database replacement can be a drop-in substitute with minimal application impact when the HSM dependency is offloaded to a cloud service.

How to eliminate wrong answers

Option A (Refactor) is wrong because refactoring involves modifying the application code to adapt to cloud-native services, which contradicts the requirement for minimal redevelopment and still requires addressing the HSM dependency. Option C (Rehost) is wrong because rehosting (lift-and-shift) would move the legacy database and its HSM dependency to the cloud as-is, but the HSM cannot be moved, making this strategy infeasible. Option D (Rebuild) is wrong because rebuilding the application from scratch involves significant redevelopment effort and cost, which violates the 'minimal redevelopment' constraint.

Full explanation →
856
MCQhard

A cloud engineer is designing a VPC in AWS for a three-tier web application. The web servers must be accessible from the internet, the application servers should only be accessible from the web servers, and the database servers should only be accessible from the application servers. What is the most secure VPC design?

A.Public subnet for web and application servers, private subnet for database servers
B.Single public subnet with all servers placed in it, using security groups to restrict traffic
C.Public subnet for web servers, private subnet for application servers, and a separate private subnet for database servers, with proper security group rules
D.Use a single private subnet and a NAT gateway for internet access
AnswerC

This design isolates each tier and limits exposure, following best practices.

Why this answer

A three-tier VPC design uses public subnets for web servers (with an internet gateway) and private subnets for application and database servers, with security group rules restricting traffic between tiers.

Full explanation →
857
MCQhard

A systems administrator is troubleshooting a network connectivity issue between two peered VPCs in different regions. The VPC peering connection is established and the route tables are configured. However, instances cannot communicate. What should be checked NEXT?

A.The route propagation of the peering connection
B.The network ACLs at the subnet level
C.The security group rules on the instances
D.The MTU settings on the instances
AnswerC

Security groups are stateful firewalls that can block inter-VPC traffic if not explicitly allowed.

Why this answer

Since the VPC peering connection is established and route tables are configured, the next likely cause is that security group rules on the instances are blocking traffic. Security groups act as virtual firewalls at the instance level, and by default they deny all inbound traffic; explicit rules must allow traffic from the peered VPC's CIDR or security group. This is a common oversight when peering VPCs across regions, as security groups do not automatically permit cross-peering traffic.

Exam trap

The trap here is that candidates often focus on network ACLs or route propagation first, forgetting that security groups are the most granular and commonly misconfigured firewall layer that can silently block traffic even when routes and ACLs are correct.

How to eliminate wrong answers

Option A is wrong because route propagation is not a feature of VPC peering connections; route propagation applies to VPN connections and Direct Connect virtual interfaces, not to VPC peering. Option B is wrong because network ACLs at the subnet level are stateless and must be checked, but the question states route tables are configured, and the more immediate next step is to verify instance-level security groups, which are stateful and often misconfigured. Option D is wrong because MTU settings on instances are unlikely to cause a complete lack of connectivity; MTU mismatches typically cause packet fragmentation issues or performance degradation, not a total failure to communicate.

Full explanation →
858
MCQmedium

An organization uses a cloud-based backup service to back up its critical database every night. The backup job has been failing for the past three days with an error message indicating 'insufficient storage space in the backup repository.' The administrator checks the backup repository and finds that it is 80% full. The database is 2 TB in size, and the backup policy retains 7 daily backups. The administrator estimates that each full backup is approximately 500 GB after deduplication. The company's RPO requirement is 24 hours. What should the administrator do to resolve the backup failure without violating the RPO?

A.Delete the oldest full backup that is more than 7 days old.
B.Increase the backup retention period to 14 days to keep more backups.
C.Enable incremental backups instead of full backups to reduce size.
D.Reduce the deduplication ratio to lower storage usage.
AnswerA

This frees space while still keeping the required 7 days of backups, satisfying the RPO.

Why this answer

The backup repository is running out of space. Deleting older backups (beyond the current retention window) frees up space immediately, allowing the next backup to succeed and meet the 24-hour RPO. The retention policy is 7 days, so deleting backups older than 7 days or adjusting retention is appropriate.

Full explanation →
859
Multi-Selecthard

A cloud architect is designing a deployment for a multi-tier application that must meet compliance requirements for data residency. The application consists of a web tier, application tier, and database tier. Which TWO deployment strategies should the architect consider to ensure data remains in a specific geographic region while maintaining high availability?

Select 2 answers
A.Set up a VPN to a neighboring region
B.Deploy across multiple availability zones in the same region
C.Deploy in a single availability zone
D.Use regional load balancers
E.Deploy across multiple regions
AnswersB, D

Keeps data in region and provides HA.

Why this answer

Deploying across multiple Availability Zones (AZs) within the same region ensures that application components remain within the geographic boundary required for data residency, while providing high availability through fault isolation. If one AZ fails, traffic is automatically routed to healthy instances in other AZs, maintaining uptime without leaving the region.

Exam trap

CompTIA often tests the distinction between 'high availability' and 'disaster recovery' — candidates mistakenly choose multi-region deployment for high availability, but that violates data residency, while the correct answer uses multiple AZs within a single region to satisfy both constraints.

Full explanation →
860
MCQhard

A cloud engineer is troubleshooting a storage performance issue. The storage is backed by a SAN with a mix of SSD and HDD drives. Which of the following metrics would BEST indicate that the storage subsystem is the bottleneck?

A.Low memory usage on the hypervisor
B.High network utilization on storage network links
C.High disk queue depth and latency
D.High CPU utilization on all application servers
AnswerC

Queue depth over 2-3 per disk with high latency indicates storage bottleneck.

Why this answer

High disk queue depth and latency directly indicate that I/O requests are waiting, which is a classic sign of a storage bottleneck. Low memory usage (A) does not indicate a storage issue. High network utilization (B) could be caused by storage traffic but does not confirm the storage subsystem is the bottleneck; it could be normal.

High CPU utilization (D) points to compute, not storage.

Full explanation →
861
MCQmedium

Refer to the exhibit. An IAM policy is attached to a group that includes engineers. An engineer attempts to start a stopped EC2 instance that has tags {Environment: development, Project: alpha}. What will happen?

A.The engineer can start the instance because the policy allows ec2:StartInstances.
B.The engineer cannot start the instance because the Deny on ec2:TerminateInstances also blocks StartInstances.
C.The engineer can start the instance because the Deny does not apply to start actions.
D.The engineer cannot start the instance because the Allow condition is not met.
AnswerA

Correct. The Allow condition is met (instance has required tags), so the engineer can start the instance.

Why this answer

The IAM policy includes an Allow statement for ec2:StartInstances with a condition requiring the instance to have tags {Environment: development, Project: alpha}. The instance in question has exactly those tags, so the condition is met. The Allow applies, granting permission to start the instance.

The Deny statement only affects ec2:TerminateInstances and does not block StartInstances. Since there is no other Deny applicable to StartInstances, the engineer is allowed to start the instance. Therefore, option A is correct.

Exam trap

The key trap is that candidates may focus on the Deny for TerminateInstances and incorrectly think it blocks StartInstances, or they may misread the condition in the Allow. The correct reasoning is that the Allow condition is satisfied, so the action is permitted.

How to eliminate wrong answers

Option A is wrong because the Allow statement for ec2:StartInstances has a condition that the instance must have tags {Environment: development, Project: alpha}, but the instance only has {Environment: development}, so the condition is not met and the Allow does not grant permission. Option B is wrong because the Deny on ec2:TerminateInstances only blocks termination actions, not start actions; AWS IAM Deny statements are action-specific and do not implicitly block other actions. Option C is wrong because while the Deny does not apply to start actions, the Allow condition is not satisfied, so the engineer lacks permission to start the instance.

Full explanation →
862
MCQhard

A cloud orchestration template fails to deploy resources with the error 'Resource limit exceeded'. The administrator has enough quota for all services. What is the most likely cause?

A.The template has a syntax error in the JSON.
B.A specific resource type has reached its service limit.
C.The custom image used is corrupted.
D.The IAM role used does not have permission to create resources.
AnswerB

Service limits are per-resource and can be lower than account quota.

Why this answer

Certain resource types have service-specific limits that are separate from the overall account quota. Even if the administrator has enough total quota, a specific resource type (e.g., virtual machines, storage accounts) may have reached its maximum allowed count. Option A is incorrect because a syntax error would cause a different error, such as parsing failure.

Option C is incorrect because a corrupted image would typically result in image-related errors. Option D is incorrect because permission issues would generate an access denied error, not 'Resource limit exceeded'.

Full explanation →
863
MCQmedium

A cloud administrator is deploying a new application that requires low latency between two virtual machines. The VMs are in the same cloud region but in different availability zones. The administrator notices higher latency than expected. Which of the following is the most effective way to reduce latency?

A.Assign larger instance types to both VMs.
B.Move both VMs to the same availability zone.
C.Use a VPN connection between the VMs.
D.Place both VMs in the same placement group.
AnswerB

Same zone reduces physical distance and latency.

Why this answer

Moving both VMs to the same availability zone reduces the physical network distance and eliminates the latency introduced by inter-zone routing. In cloud providers, availability zones are distinct data centers with separate power and networking, so traffic between zones traverses additional switches and fiber, adding microseconds to milliseconds of latency. Placing VMs in the same zone keeps traffic within a single data center fabric, minimizing hop count and propagation delay.

Exam trap

CompTIA often tests the misconception that placement groups (like cluster placement groups) can reduce latency across availability zones, but in reality, placement groups only work within a single availability zone and do not override zone boundaries.

How to eliminate wrong answers

Option A is wrong because assigning larger instance types increases CPU, memory, or network bandwidth but does not reduce the physical distance or network hops between VMs in different availability zones; latency is a function of propagation delay, not compute capacity. Option C is wrong because a VPN connection adds encapsulation overhead (e.g., IPsec ESP headers) and often routes traffic through a VPN gateway or internet, increasing latency rather than reducing it. Option D is wrong because a placement group (e.g., cluster placement group) ensures VMs are in the same rack or cluster but does not override the zone boundary; if VMs are in different availability zones, a placement group cannot be applied across zones, and even if it could, it would not reduce inter-zone latency.

Full explanation →
864
MCQhard

A DevOps team deploys a containerized application to a Kubernetes cluster. They need to ensure that containers cannot run with privileged access. Which Kubernetes security mechanism should be applied?

A.Pod Security Standards
B.Network policies
C.ConfigMaps
D.Service accounts
AnswerA

These enforce security contexts including privilege settings.

Why this answer

Pod Security Standards define policies like 'restricted' that prevent privileged containers.

Full explanation →
865
Multi-Selecteasy

Which TWO of the following are best practices for managing cloud storage in a multi-account environment? (Choose two.)

Select 2 answers
A.Implement bucket policies to restrict cross-account access.
B.Use separate encryption keys for each account.
C.Enable logging and monitoring of all storage operations.
D.Use a single storage bucket/container for all accounts to simplify management.
E.Allow full public access to ensure availability.
AnswersA, C

Bucket policies allow fine-grained access control between accounts.

Why this answer

Options A and C are correct. Implementing bucket policies to restrict cross-account access (A) ensures that storage resources are isolated and secure in a multi-account environment. Enabling logging and monitoring of all storage operations (C) provides audit trails and helps detect unauthorized access.

Option B is incorrect because using separate encryption keys per account is a good security practice but not a top requirement specifically for storage management; access control and monitoring are more critical. Option D is wrong because a single storage bucket for all accounts compromises isolation and increases risk. Option E is incorrect because full public access is insecure and violates the principle of least privilege.

Full explanation →
866
MCQhard

A cloud administrator is troubleshooting a connectivity issue between two virtual networks in different cloud regions. The networks are connected via a VPN gateway. The administrator can ping resources in one network but not the other. Which of the following should the administrator check FIRST?

A.Confirm the local network gateways have the correct NIC IP addresses
B.Verify the VPN tunnel status on both gateways
C.Check network security groups for blocking ICMP
D.Review the route tables on both sides for the remote network prefix
AnswerD

Missing routes cause traffic to be dropped, leading to unidirectional connectivity.

Why this answer

The correct first step is to review the route tables on both sides for the remote network prefix. Since the administrator can ping resources in one direction but not the other, the issue is likely asymmetric routing or a missing route for the return traffic. Route tables control how traffic is forwarded between virtual networks, and a missing or incorrect route for the remote network prefix would prevent bidirectional communication, even if the VPN tunnel is up.

Exam trap

The trap is that candidates assume a one-way ping means the VPN tunnel is down or ICMP is blocked, but the real issue is often a missing or misconfigured route on the side that cannot receive replies.

How to eliminate wrong answers

Option A is wrong because local network gateways use public IP addresses, not NIC IP addresses, and NIC IPs are irrelevant for VPN gateway configuration. Option B is wrong because verifying VPN tunnel status is a later step; the tunnel could be up and still have routing issues, as evidenced by one-way ping success. Option C is wrong because ICMP being blocked would prevent pings in both directions, not just one; the symptom of one-way ping suggests a routing problem, not a firewall rule.

Full explanation →
867
MCQhard

A cloud operations team is investigating a security breach where an unauthorized user accessed a storage bucket containing sensitive data. The logs show that the access occurred using valid access keys from an IP address outside the company's network. The administrator checks the IAM policies and finds that the keys belong to a service account that has read access to the bucket. Which of the following actions would be MOST effective in preventing a recurrence?

A.Remove the bucket and restore from backup to a new bucket.
B.Delete the service account and create a new one with the same permissions.
C.Change the bucket policy to deny access from outside the company's IP range.
D.Rotate the compromised keys and implement multi-factor authentication on the account.
AnswerD

Key rotation invalidates stolen keys, and MFA adds protection.

Why this answer

Rotating the compromised keys immediately invalidates the stolen credentials, while implementing multi-factor authentication (MFA) on the service account adds an additional layer of security. Even though service accounts typically don't support interactive MFA, using IAM conditions to require MFA for API calls or using workload identity federation can enforce MFA-like controls. This directly addresses the root cause—compromised static keys—and prevents reuse of the stolen access keys.

Exam trap

The trap here is that candidates often choose Option C (IP-based policy) because they think it blocks external access, but they overlook that service accounts are not bound to a specific IP and can be used from any location, making IP restrictions ineffective for key-based access.

How to eliminate wrong answers

Option A is wrong because removing the bucket and restoring from backup does not address the compromised keys; the attacker could still use the same keys to access the restored bucket. Option B is wrong because deleting the service account and creating a new one with the same permissions does not prevent recurrence—the new account would still have read access to the bucket, and the attacker could compromise the new keys in the same way. Option C is wrong because changing the bucket policy to deny access from outside the company's IP range is not effective for service accounts; service accounts are not tied to a specific IP address and can be used from anywhere, so this policy would not block the attacker if they use the same keys from a different external IP.

Full explanation →
868
MCQhard

An organization uses a private cloud and wants to implement multifactor authentication (MFA) for administrative access to the hypervisor. However, due to legacy system constraints, the hypervisor does not support MFA directly. What is the BEST alternative to achieve MFA for administrative logins?

A.Configure SSH key-based authentication for all hypervisor logins.
B.Implement a certificate-based authentication scheme for the hypervisor.
C.Set up a VPN that requires MFA and allow only VPN traffic to reach the hypervisor.
D.Deploy a jump host (bastion host) with MFA, and restrict hypervisor access to only that host.
AnswerD

This layers MFA at the entry point, and the hypervisor access is limited to a secured intermediary.

Why this answer

A jump host (bastion host) can be placed in a separate network segment that requires MFA for access. Administrators log into the jump host first and then connect to the hypervisor from it. Direct SSH keys still rely on single-factor authentication.

A VPN without MFA is insufficient. Using a certificate alone is also single factor.

Full explanation →
869
MCQhard

A financial services company has a disaster recovery (DR) plan for its cloud infrastructure that includes a secondary region 500 miles away. The plan uses synchronous replication for the primary database. During a scheduled DR test, the administrator triggers a failover to the secondary region. The application comes up, but the database is missing the last three minutes of transactions. The RPO requirement is 5 seconds. The administrator finds that the network latency between regions is 40 milliseconds. What is the most likely cause of the data loss, and what should the administrator do?

A.Switch to asynchronous replication and accept a longer RPO, or choose a DR region with lower network latency.
B.Reduce the RPO requirement to 30 seconds.
C.Enable compression on the replication link to reduce data transfer time.
D.Increase the instance size in the secondary region to handle more transactions.
AnswerA

Synchronous replication over long distances with high latency is prone to timeouts; asynchronous replication or a closer region is needed.

Why this answer

Synchronous replication requires the primary database to wait for acknowledgment from the secondary before committing a transaction. With 40ms network latency, this introduces significant delays, causing timeouts and dropped transactions, resulting in data loss exceeding the 5-second RPO. To meet the RPO, the administrator should either switch to asynchronous replication (which does not wait for acknowledgment, reducing latency impact but requiring a higher RPO) or choose a DR region with lower latency to support synchronous replication.

Option A correctly identifies these solutions.

Full explanation →
870
Multi-Selecthard

A cloud engineer is optimizing costs for a data analytics workload that runs periodically. The workload processes large datasets stored in Amazon S3 and runs on EC2 instances. Which THREE strategies should the engineer consider to reduce costs? (Select THREE.)

Select 3 answers
A.Implement S3 Lifecycle policies to transition older data to S3 Glacier
B.Provision large instances to reduce processing time
C.Choose the correct instance type based on resource requirements
D.Use Spot Instances for the compute nodes
E.Use on-demand instances exclusively
AnswersA, C, D

Lifecycle policies reduce storage costs by moving data to cheaper tiers.

Why this answer

Using spot instances reduces compute cost for interruptible workloads. S3 lifecycle policies move old data to cheaper storage classes. Selecting the correct instance type (rightsizing) avoids overprovisioning.

Full explanation →
871
MCQmedium

A company is migrating 100 TB of data from an on-premises NAS to Amazon S3. The network bandwidth is limited to 100 Mbps, and the transfer must complete within 30 days. Which service should the company use to meet the deadline?

A.AWS DataSync
B.Amazon S3 Transfer Acceleration
C.AWS Snowball
D.AWS Direct Connect
AnswerC

Snowball physically ships data, bypassing network limits.

Why this answer

At 100 Mbps, transferring 100 TB would take about 100 days over the network. AWS Snowball is a physical device for offline transfer, much faster. DataSync and S3 Transfer Acceleration still rely on network bandwidth.

Full explanation →
872
MCQhard

A company is migrating its on-premises e-commerce application to a public cloud. The application consists of a stateless web tier, a stateful application tier that stores session data in memory, and a relational database. The migration must ensure high availability, scalability, and minimal downtime during cutover. The cloud provider offers load balancers, auto-scaling groups, managed database services, and caching services. The current on-premises architecture uses a single web server, a single application server, and a single database server. The application tier stores session data in local memory, which is lost if the server fails. The team needs to redesign the architecture to be cloud-native. Which of the following is the BEST course of action?

A.Deploy the web tier behind a load balancer with auto-scaling. Keep the application tier as a single instance with session replication to a secondary instance. Use a managed database with a read replica.
B.Deploy the web tier behind a load balancer with auto-scaling. Move session state from the application tier to a distributed caching service. Deploy the application tier behind a separate load balancer with auto-scaling. Migrate the database to a managed Multi-AZ deployment.
C.Use a load balancer for the web tier with auto-scaling. Deploy the application tier as a single large instance with sticky sessions. Migrate the database to a larger single-instance managed database.
D.Deploy both web and application tiers behind a load balancer with auto-scaling. Use sticky sessions to maintain session state. Migrate the database to a managed Multi-AZ deployment.
AnswerB

This design is fully cloud-native: the web and application tiers are stateless and auto-scaled, session state is stored externally in a highly available cache, and the database is managed with Multi-AZ for high availability.

Why this answer

It addresses the key requirements: high availability, scalability, and minimal downtime. By moving session state from local memory to a distributed caching service (e.g., Amazon ElastiCache or Azure Cache for Redis), the application tier becomes stateless and can be auto-scaled behind its own load balancer. The managed Multi-AZ database provides automatic failover and high availability, while the web tier behind a load balancer with auto-scaling ensures scalability and fault tolerance.

This design eliminates single points of failure and allows zero-downtime cutover by scaling out before decommissioning on-premises resources.

Exam trap

CompTIA often tests the misconception that sticky sessions or session replication are sufficient for high availability in a cloud environment, but the correct approach is to externalize session state to a distributed cache to achieve true statelessness and scalability.

How to eliminate wrong answers

Option A is wrong because it keeps the application tier as a single instance with session replication to a secondary instance, which still has a single point of failure during failover and does not provide true horizontal scalability; session replication introduces latency and complexity without the elasticity of auto-scaling. Option C is wrong because deploying the application tier as a single large instance with sticky sessions creates a single point of failure and does not allow auto-scaling, violating high availability and scalability requirements; sticky sessions also couple clients to specific instances, preventing seamless failover. Option D is wrong because using sticky sessions for both web and application tiers ties session state to specific instances, preventing true statelessness and auto-scaling; if an instance fails, its sticky sessions are lost, causing data loss and downtime.

Full explanation →
873
MCQmedium

A cloud administrator manages a web application that uses an auto scaling group (ASG) with a minimum of 2 and maximum of 10 instances. The CPU utilization for the ASG averages 40%. However, during peak hours, users experience intermittent timeouts. The administrator reviews the scaling policy, which is set to scale out when CPU exceeds 70% for 5 minutes. What is the most likely cause of the timeouts?

A.The maximum number of instances is too low.
B.The health checks are marking healthy instances as unhealthy.
C.The CPU threshold is too low, causing premature scaling.
D.The scale-out cooldown period is too long, delaying the addition of new instances.
AnswerD

A long cooldown delays scaling during rapid spikes, leading to timeouts.

Why this answer

During peak hours, CPU utilization may spike quickly, but the scaling policy requires CPU to exceed 70% for 5 minutes before triggering a scale-out. If the scale-out cooldown period is too long, additional instances are delayed, causing the existing instances to become overloaded and leading to timeouts. Option A is incorrect because the maximum of 10 instances is likely sufficient; the problem is the speed of scaling.

Option B is incorrect because health check failures would cause instance replacement, not timeouts from overload. Option C is incorrect because a 70% threshold is not too low; a lower threshold would cause premature scaling, not timeouts.

Full explanation →
874
MCQmedium

Refer to the exhibit. An administrator is unable to SSH into a cloud server with IP 10.0.1.10 from a remote location (outside the 10.0.0.0/16 network). What is the most likely cause?

A.The firewall rule order is incorrect
B.The firewall is dropping all packets on port 22
C.The SSH host key has changed
D.The SSH service is not running
AnswerA

The drop rule appears before the allow rule, so external traffic is dropped before reaching the allow rule.

Why this answer

Firewall rules are evaluated in order; the first rule (rule #1) drops all SSH traffic from any source, and the second rule (rule #2) permits SSH traffic only from the internal network (10.0.0.0/16). Since the remote location is outside this network, the packet matches the first rule and is dropped before reaching the second rule. Option B is incorrect because the firewall is not dropping all packets on port 22; it only drops those from external sources due to the rule order.

Option C is incorrect because a host key change would cause a different SSH warning, not a connection timeout. Option D is incorrect because if the SSH service were not running, the error would be 'connection refused' rather than a timeout.

Full explanation →
875
MCQmedium

A cloud engineer is deploying a serverless application using AWS Lambda. The application processes files uploaded to an S3 bucket. To minimize cold start latency, which deployment configuration should the engineer use?

A.Set the function timeout to the minimum value.
B.Increase the memory allocation and enable provisioned concurrency.
C.Place the Lambda function in a VPC without any NAT gateway.
D.Configure the function to run in a specific Availability Zone.
AnswerB

More memory means faster initialization; provisioned concurrency eliminates cold starts.

Why this answer

Provisioned concurrency pre-warms a specified number of Lambda execution environments, eliminating cold starts for those instances. Increasing memory allocation also proportionally increases CPU and network throughput, which can reduce initialization time. Together, these configurations directly address cold start latency for a serverless application processing S3 uploads.

Exam trap

CompTIA often tests the misconception that reducing timeout or placing Lambda in a VPC improves performance, when in fact these actions either have no effect or increase latency due to network overhead.

How to eliminate wrong answers

Option A is wrong because setting the function timeout to the minimum value (e.g., 1 second) does not reduce cold start latency; it only limits execution duration, potentially causing timeouts for file processing. Option C is wrong because placing the Lambda function in a VPC without a NAT gateway prevents internet access but does not reduce cold start latency; in fact, VPC-enabled Lambda functions often experience increased cold start times due to ENI (Elastic Network Interface) creation overhead. Option D is wrong because Lambda functions are inherently stateless and run across multiple Availability Zones automatically; specifying a single Availability Zone is not a supported configuration and does not affect cold start latency.

Full explanation →
876
MCQhard

A cloud administrator is migrating a legacy application to a public cloud IaaS environment. The application requires a static IP address for licensing. Which of the following should the administrator configure to meet this requirement?

A.NAT gateway
B.Virtual IP address
C.Reserved public IP
D.Elastic IP
AnswerC

Reserved public IP provides a static, persistent address for licensing.

Why this answer

A reserved public IP (also known as a static public IP) ensures the legacy application always has the same public IP address for licensing purposes. In IaaS environments like Azure, this is called a 'reserved IP' or 'static public IP', which persists even after the VM is stopped or deallocated, meeting the licensing requirement.

Exam trap

The trap here is that candidates may confuse 'Elastic IP' (an AWS-specific term) with a generic static IP, or think a NAT gateway or virtual IP can provide a persistent public IP for inbound licensing, when in fact only a reserved/static public IP meets the requirement.

How to eliminate wrong answers

Option A is wrong because a NAT gateway translates private IPs to a public IP for outbound traffic but does not provide a static public IP for inbound licensing checks. Option B is wrong because a virtual IP address is typically used for load balancing or high availability within a private network, not for providing a static public IP for external licensing. Option D is wrong because 'Elastic IP' is an AWS-specific term for a static public IP; while it meets the requirement, it is not a generic term used across all public clouds, and the question does not specify AWS, making 'Reserved public IP' the more universally correct answer.

Full explanation →
877
MCQeasy

An organization wants to reduce cloud costs by identifying underutilized EC2 instances. Which AWS service provides rightsizing recommendations?

A.AWS Budgets
B.AWS Compute Optimizer
C.AWS Trusted Advisor
D.AWS Cost Explorer
AnswerB

Compute Optimizer uses machine learning to recommend optimal instance types.

Why this answer

AWS Compute Optimizer analyzes resource utilization and provides recommendations to optimize AWS resources. AWS Cost Explorer shows spending but not specific rightsizing recommendations.

Full explanation →
878
MCQhard

A cloud architect is designing a multi-tier application in a public cloud that must comply with PCI DSS. The web tier must be accessible from the internet, but the application tier should not have any public IP addresses. Which architecture meets these requirements?

A.Assign public IP addresses to both tiers and use security group rules to restrict traffic.
B.Deploy both tiers in private subnets and use a VPC peering connection to the corporate data center.
C.Use a site-to-site VPN between the cloud VPC and an on-premises network for all traffic.
D.Place the web tier in a public subnet behind an internet-facing load balancer, and the app tier in a private subnet with a NAT gateway for outbound traffic.
AnswerD

This provides internet access to the web tier while keeping the app tier isolated from direct internet.

Why this answer

It places the web tier in a public subnet with an internet-facing load balancer, allowing internet access, and the app tier in a private subnet with no public IP, meeting the requirement. The NAT gateway enables outbound traffic for the app tier (e.g., for updates) without exposing it inbound. Option A is wrong because it assigns public IPs to both tiers, which violates the requirement that the app tier should not have public IPs.

Option B is wrong because deploying both in private subnets would prevent internet access to the web tier, and VPC peering to a data center does not address internet access. Option C is wrong because a site-to-site VPN would route all traffic through on-premises, which is unnecessary and doesn't provide direct internet access to the web tier as required.

Full explanation →
879
MCQmedium

A company uses a hybrid cloud model and experiences intermittent connectivity issues between the on-premises network and the public cloud VPC. The administrator has verified that the VPN connection is established. Which of the following should the administrator check next?

A.Firewall rules for outbound traffic.
B.Public IP address of the VPN gateway.
C.Routing tables on both sides.
D.DNS resolution of cloud endpoints.
AnswerC

Incorrect routes can lead to intermittent packet loss or misrouting.

Why this answer

Since the VPN connection is established (tunnel is up), the issue is likely with traffic routing rather than basic connectivity. Routing tables on both the on-premises router and the cloud VPC must have correct routes pointing to the VPN gateway and the remote subnets; a missing or misconfigured route (e.g., a missing static route or incorrect VPC route table entry) will cause intermittent connectivity even when the VPN tunnel itself is active.

Exam trap

The trap here is that candidates assume an established VPN tunnel guarantees end-to-end connectivity, but CompTIA often tests that routing misconfigurations (e.g., missing static routes or incorrect VPC route propagation) are the most common cause of intermittent connectivity when the tunnel is up.

How to eliminate wrong answers

Option A is wrong because firewall rules for outbound traffic are typically checked after routing; if the VPN tunnel is up, outbound firewall rules are not the primary cause of intermittent connectivity between two specific networks. Option B is wrong because the public IP address of the VPN gateway is already verified as part of the established VPN connection; changing it would break the tunnel, not cause intermittent issues. Option D is wrong because DNS resolution of cloud endpoints affects name resolution, not the underlying network path; if the VPN is up and routes are correct, DNS issues would manifest as name resolution failures, not intermittent connectivity.

Full explanation →
880
MCQhard

A company is deploying a critical financial application on a private cloud. The compliance team requires that all data at rest be encrypted with a key managed by the company's hardware security module (HSM). The cloud architect must select a storage solution that supports customer-managed keys and integrates with the existing HSM. Which storage option should the architect choose?

A.Object storage with server-side encryption using a cloud provider key
B.Instance store volumes on the compute nodes
C.Encrypted volumes on a software-defined storage (SDS) cluster
D.Network-attached storage (NAS) appliance with built-in encryption
AnswerC

SDS volumes can use customer-managed keys and integrate with HSMs.

Why this answer

A software-defined storage (SDS) cluster can be configured to use customer-managed encryption keys that integrate directly with the company's existing hardware security module (HSM) via standard interfaces like PKCS#11 or KMIP. This allows the company to maintain full control over key management and meet the compliance requirement for data-at-rest encryption with HSM-managed keys.

Exam trap

The trap here is that candidates often confuse 'built-in encryption' on a NAS appliance with the ability to integrate with an external HSM, but NAS appliances typically lack native KMIP or PKCS#11 support for HSM-backed key management, making SDS the only option that explicitly supports such integration.

How to eliminate wrong answers

Option A is wrong because object storage with server-side encryption using a cloud provider key means the cloud provider manages the encryption key, not the company's HSM, failing the customer-managed key requirement. Option B is wrong because instance store volumes are ephemeral and do not persist data beyond the instance lifecycle, making them unsuitable for a critical financial application that requires durable, encrypted storage with HSM integration. Option D is wrong because a NAS appliance with built-in encryption typically uses its own internal key management or a simple passphrase, and does not natively integrate with an external HSM for key management without additional complex configuration, which is not a standard feature.

Full explanation →
881
MCQeasy

A cloud administrator is tasked with ensuring that a cloud database is backed up daily. The backup must be stored off-site for disaster recovery. Which of the following is the most cost-effective solution?

A.Schedule a backup to an object storage bucket in a different region.
B.Perform a full backup to tape and store off-site.
C.Perform incremental backups to a local network share.
D.Use snapshot replication to a different region.
AnswerA

Object storage is cheap, durable, and off-site.

Why this answer

Scheduling a backup to an object storage bucket in a different region leverages cloud-native, pay-per-use storage (e.g., Amazon S3, Azure Blob, or Google Cloud Storage) with geo-redundancy. This eliminates the need for physical media or manual intervention, and cross-region replication provides off-site disaster recovery at minimal cost compared to tape or dedicated replication services.

Exam trap

Many candidates mistakenly believe that snapshot replication is the cheapest DR method, but in reality, scheduled object storage backups are more cost-effective for daily off-site retention because snapshots replicate entire block-level changes and incur higher storage and transfer costs.

How to eliminate wrong answers

Option B is wrong because tape backups require physical media handling, manual transport, and ongoing hardware/operational costs, making them significantly more expensive and slower to restore than cloud object storage. Option C is wrong because storing backups on a local network share does not provide off-site disaster recovery; a local failure or site-wide disaster would destroy both the database and its backup. Option D is wrong because snapshot replication to a different region typically incurs higher egress and storage costs than simple scheduled backups to object storage, and snapshots are often tied to the source region's lifecycle, making them less cost-effective for daily off-site backups.

Full explanation →
882
Multi-Selectmedium

A company is designing a hybrid cloud architecture. They need to ensure high availability for a critical application. Which TWO of the following are best practices for achieving high availability in a hybrid cloud environment?

Select 2 answers
A.Rely solely on on-premises infrastructure with cloud as a backup
B.Implement an active-active architecture across on-premises and cloud
C.Use a single load balancer to route all traffic
D.Use multiple availability zones within a cloud region
E.Deploy the application in a single availability zone to reduce complexity
AnswersB, D

Active-active provides redundancy and load distribution.

Why this answer

Using multiple availability zones within a region protects against data center failure. An active-active architecture ensures both on-premises and cloud are handling traffic, providing redundancy. Deploying in a single zone creates a single point of failure.

Using only on-premises does not leverage cloud for HA. A single load balancer is a SPOF.

Full explanation →
883
MCQhard

A company uses AWS and Azure to run identical workloads for redundancy. They want to simplify management by using a single set of tools across both clouds. Which architectural approach should they consider?

A.Use each provider's native management tools
B.Single cloud migration to one provider
C.Multi-cloud using a cloud-agnostic orchestration tool
D.Hybrid cloud using VPN between AWS and Azure
AnswerC

Tools like Kubernetes or Terraform provide a consistent management layer.

Why this answer

Multi-cloud with a cloud-agnostic abstraction layer (e.g., using Terraform or Kubernetes) allows managing resources across providers with a unified toolset.

Full explanation →
884
MCQhard

An organization wants to receive notifications in a Slack channel when a new VM instance is created. Which combination of cloud services should be used?

A.Monitoring alert policy with Slack notification channel
B.Scheduler and event-driven function
C.Pub/sub messaging service and container service
D.Logging service log-based metric and event-driven function with webhook
AnswerD

A log entry for VM creation can trigger a Cloud Function via a log-based metric, which then posts to Slack.

Why this answer

A logging service can trigger an event-driven function via a log-based metric when a VM is created, and the function sends a message to Slack via webhook.

Full explanation →
885
MCQhard

An organization's hybrid cloud environment uses a VPN connection between on-premises and the cloud. Intermittent connectivity drops are reported during peak hours. The VPN logs show rekeying failures. Which configuration is most likely the cause?

A.The VPN tunnel is using a pre-shared key that has expired
B.The IPSec dead peer detection interval is set too high
C.The VPN gateway throughput is exceeded
D.The on-premises firewall is blocking IKE packets
AnswerB

A high DPD interval delays detection of unresponsive peers, causing rekeying failures during high traffic.

Why this answer

A dead peer detection (DPD) interval set too high delays detection of lost peers, causing rekeying failures under load. Option A is wrong because pre-shared keys don't expire. Option C is wrong because throughput exceeded would show packet loss or high latency, not rekeying failures.

Option D is wrong because blocking IKE packets would prevent the VPN from establishing at all.

Full explanation →
886
MCQmedium

A cloud administrator is writing an Ansible playbook to provision cloud resources. The administrator wants to ensure that the playbook can run without requiring any agent software on the target machines. Which Ansible feature enables this agentless operation?

A.Ansible inventory files that list hosts
B.Ansible modules that run on the control node
C.SSH-based connection to managed nodes
D.Pull mode from a central repository
AnswerC

SSH is agentless.

Why this answer

Ansible connects via SSH (or WinRM) by default, no agent needed. Pull mode requires an agent, modules are code units, and inventory lists hosts.

Full explanation →
887
MCQmedium

A DevOps team uses Jenkins for CI/CD. They want to automatically deploy containerized applications to a Kubernetes cluster. Which Jenkins feature or plugin can integrate with Kubernetes to manage deployments?

A.Jenkins Declarative Pipeline
B.Jenkins Blue Ocean
C.Jenkins Multibranch Pipeline
D.Kubernetes plugin
AnswerD

The Kubernetes plugin enables Jenkins to dynamically create agents in Kubernetes and deploy workloads.

Why this answer

The Kubernetes plugin for Jenkins allows Jenkins agents to be dynamically provisioned as pods within a Kubernetes cluster, enabling automated deployment of containerized applications. It integrates directly with the Kubernetes API to manage deployments, services, and other resources, making it the correct choice for this scenario.

Exam trap

The CompTIA Cloud+ exam often tests the distinction between Jenkins features that define pipeline logic (like Declarative Pipeline) and plugins that provide external integrations (like the Kubernetes plugin), leading candidates to confuse syntax with integration capabilities.

How to eliminate wrong answers

Option A is wrong because Jenkins Declarative Pipeline is a syntax for defining CI/CD pipelines, not a plugin that integrates with Kubernetes for deployment management. Option B is wrong because Jenkins Blue Ocean is a user interface redesign for Jenkins, providing a modern UI but no native Kubernetes integration or deployment capabilities. Option C is wrong because Jenkins Multibranch Pipeline is a feature that automatically creates pipelines for multiple branches in a repository, but it does not provide Kubernetes-specific deployment integration.

Full explanation →
888
MCQmedium

A company is using AWS and wants to minimize egress costs for data transferred out to the internet. Which strategy would be most effective?

A.Use a VPN to encrypt traffic
B.Migrate to a different region with lower egress prices
C.Use a larger instance type to reduce data transfer
D.Implement a CDN to cache content at edge locations
AnswerD

CDN reduces egress by serving cached content from edge locations.

Why this answer

Using a CDN caches content at edge locations, reducing the amount of data transferred directly from the origin to users, thus lowering egress costs.

Full explanation →
889
MCQeasy

A company is migrating its on-premises application to the cloud and needs to ensure high availability. The application requires a stateless web tier and a stateful database tier. Which design approach BEST meets these requirements?

A.Deploy one large web server and one large database server.
B.Deploy web servers behind a load balancer and use a managed database with multi-AZ replication.
C.Use round-robin DNS for web servers and a read replica for the database.
D.Use auto-scaling for web servers and a single database instance.
AnswerB

Provides redundancy for both tiers.

Why this answer

Deploying web servers behind a load balancer provides horizontal scaling and fault tolerance for the stateless web tier, while using a managed database with multi-AZ replication ensures automatic failover and data durability for the stateful database tier. This combination meets high availability requirements by eliminating single points of failure and providing redundancy across Availability Zones.

Exam trap

CompTIA often tests the misconception that round-robin DNS or a single read replica provides high availability, but candidates must recognize that DNS-based load balancing lacks health checking and automatic failover, and a read replica cannot handle write failures, making multi-AZ replication essential for database high availability.

How to eliminate wrong answers

Option A is wrong because deploying one large web server and one large database server creates a single point of failure; if either server fails, the entire application becomes unavailable, violating high availability. Option C is wrong because round-robin DNS does not provide health checking or automatic failover; if a web server goes down, DNS will still direct traffic to it, causing service disruption, and a read replica for the database does not support automatic failover for writes, leaving the database tier without high availability. Option D is wrong because auto-scaling for web servers addresses scaling but not high availability if all instances are in a single Availability Zone, and a single database instance is a single point of failure; without multi-AZ replication, database failure causes complete downtime.

Full explanation →
890
MCQeasy

Which cloud deployment model involves connecting an on-premises data center to a public cloud provider using a VPN or dedicated connection?

A.Private cloud
B.Multi-cloud
C.Hybrid cloud
D.Public cloud
AnswerC

Hybrid cloud connects on-premises and public cloud resources.

Why this answer

A hybrid cloud combines on-premises infrastructure with public cloud resources, typically connected via VPN or dedicated circuits like AWS Direct Connect or Azure ExpressRoute.

Full explanation →
891
MCQeasy

A cloud engineer is designing a deployment strategy for a web application that requires zero downtime. The engineer has set up two identical production environments, one active and one idle. After deploying the new version to the idle environment, the engineer switches the DNS record to point to the idle environment. This deployment method is known as:

A.Blue/green deployment
B.Rolling deployment
C.A/B testing deployment
D.Canary deployment
AnswerA

Blue/green uses two environments and a switch.

Why this answer

Blue/green deployment involves two environments (blue = current, green = new) and switching traffic via DNS or load balancer. Canary and rolling deploy gradually, while A/B testing is for feature comparison.

Full explanation →
892
MCQmedium

A cloud engineer is writing an Ansible playbook to provision virtual machines in Azure. The playbook includes a task that uses the 'azure_rm_virtualmachine' module. Which of the following best describes Ansible's architecture in this scenario?

A.Ansible uses agents installed on target VMs to execute modules.
B.Ansible is a managed service in Azure that runs playbooks automatically.
C.Ansible requires Python to be installed only on the control node.
D.Ansible is agentless and uses SSH or WinRM to connect to target machines.
AnswerD

Correct. Ansible connects to targets without installing agents.

Why this answer

Ansible is agentless and connects via SSH or WinRM. It is not agent-based; it does not require Python on the control node only; it is not a managed service.

Full explanation →
893
Multi-Selectmedium

A cloud architect is designing a Kubernetes deployment for a stateless web application. The application must be highly available and automatically recover from failures. Which THREE components are required to achieve this? (Select 3)

Select 3 answers
A.ConfigMap
B.Deployment resource
C.Service resource
D.StatefulSet
E.Readiness probe
AnswersB, C, E

Correct. Deployment manages replica sets and ensures desired state.

Why this answer

A Deployment manages replicas and supports rolling updates. A Service provides stable networking to the pods. Readiness probes ensure only healthy pods receive traffic.

ConfigMaps and StatefulSets are not required for stateless HA.

Full explanation →
894
MCQmedium

A company uses a configuration management tool to enforce desired state on cloud servers. During an audit, it is discovered that some servers have deviated from the baseline configuration. The administrator runs a report and finds that the configuration management agent was not running on those servers. Which of the following is the BEST solution to ensure continuous compliance?

A.Reinstall the configuration management agent on all servers.
B.Remove the drifit servers from the environment and rebuild them.
C.Manually update the configuration on the deviated servers.
D.Implement a periodic compliance scan and auto-remediation job.
AnswerD

Automated scans and remediation enforce continuous compliance.

Why this answer

It automates the detection and correction of configuration drift without manual intervention. By implementing a periodic compliance scan (e.g., using AWS Config rules or Azure Policy) coupled with an auto-remediation action (e.g., a Lambda function or runbook), the system can restart the configuration management agent or reapply the desired state automatically, ensuring continuous compliance even if the agent stops temporarily.

Exam trap

The trap here is that candidates focus on fixing the immediate deviation (options A, B, or C) rather than implementing a proactive, automated process to detect and correct future agent failures, which is the core of continuous compliance in cloud operations.

How to eliminate wrong answers

Option A is wrong because reinstalling the agent does not address the root cause of why the agent stopped running; it only provides a temporary fix without ensuring the agent remains active. Option B is wrong because removing and rebuilding servers is an extreme, disruptive approach that does not scale and does not prevent future agent failures. Option C is wrong because manual updates are error-prone, do not scale across multiple servers, and do not provide a mechanism to detect or correct future deviations automatically.

Full explanation →
895
MCQeasy

Which of the following is a benefit of using a Web Application Firewall (WAF)?

A.Filtering malicious HTTP/HTTPS traffic to a web application
B.Encrypting data at rest in a database
C.Protecting against DDoS attacks at the network layer
D.Managing user identities and access
AnswerA

WAFs analyze HTTP/HTTPS requests and block malicious ones.

Why this answer

WAFs protect web applications from common attacks like SQL injection, cross-site scripting, and other OWASP Top 10 threats by filtering and monitoring HTTP/HTTPS traffic.

Full explanation →
896
MCQhard

A company uses a public cloud IaaS model to host a database. They want to ensure the database remains available if an entire availability zone fails. Which configuration would provide the highest availability with automatic failover?

A.Use a single database instance with automated snapshots to a different region
B.Deploy the database in a single availability zone with multiple EC2 instances
C.Use a read replica in a different region with asynchronous replication
D.Deploy the database with a stand-by replica in a different availability zone using synchronous replication
AnswerD

Synchronous replication and automatic failover protect against zone failure.

Why this answer

Deploying a database with a stand-by replica in a different availability zone using synchronous replication ensures that all committed transactions are written to both the primary and the stand-by before acknowledging the client. This provides automatic failover with zero data loss (RPO=0) and high availability, as the stand-by replica can immediately take over if the entire availability zone fails.

Exam trap

The CV0-004 exam often tests the distinction between high availability (automatic failover within the same region) and disaster recovery (manual or automated recovery to a different region), and the trap here is that candidates confuse a read replica or cross-region snapshot with a true high-availability solution that provides automatic failover and zero data loss.

How to eliminate wrong answers

Option A is wrong because automated snapshots to a different region provide point-in-time recovery but do not enable automatic failover; the database would still be unavailable until a manual restore is performed, resulting in significant downtime. Option B is wrong because deploying multiple EC2 instances in a single availability zone does not protect against an availability zone failure; if the entire zone fails, all instances become unavailable simultaneously. Option C is wrong because a read replica in a different region with asynchronous replication is designed for read scaling and disaster recovery, not for automatic failover with high availability; asynchronous replication introduces replication lag, which can cause data loss (RPO > 0) and failover is not automatic.

Full explanation →
897
MCQhard

A DevOps team is implementing a canary deployment for a microservice running on Amazon ECS. They want to gradually shift 10% of traffic to the new version and automatically roll back if error rates exceed 1% in 5 minutes. Which combination of services should they use?

A.AWS CloudFormation and SSM
B.AWS Lambda and Step Functions
C.AWS CodeDeploy with CloudWatch alarms
D.AWS Elastic Beanstalk and Route 53
AnswerC

CodeDeploy supports canary deployments and integrates with CloudWatch alarms for automatic rollback.

Why this answer

AWS CodeDeploy natively supports canary deployments for Amazon ECS, allowing you to specify a traffic shift percentage (e.g., 10%) and integrate with CloudWatch alarms to automatically trigger a rollback when error rates exceed a defined threshold (e.g., 1% over 5 minutes). This combination directly fulfills the gradual traffic shifting and automated rollback requirements without custom scripting.

Exam trap

A common mistake is assuming that any orchestration service (like Step Functions) is equivalent to a native deployment service, but the key is that CodeDeploy provides built-in traffic shifting and alarm-based rollback without custom code, which is exactly the requirement in the question.

How to eliminate wrong answers

Option A is wrong because AWS CloudFormation and SSM are infrastructure provisioning and management tools; they do not provide built-in traffic shifting or automated rollback based on error rate thresholds for ECS deployments. Option B is wrong because AWS Lambda and Step Functions can orchestrate custom deployment logic but require significant custom code to implement traffic shifting and alarm-based rollback, whereas CodeDeploy offers this natively. Option D is wrong because AWS Elastic Beanstalk is a PaaS service that does not support canary deployments for ECS microservices, and Route 53 is a DNS service that cannot shift traffic at the application load balancer level for ECS tasks.

Full explanation →
898
MCQeasy

A cloud engineer is managing infrastructure as code using Terraform. Which command should be run to preview changes before applying them to the cloud environment?

A.terraform apply
B.terraform destroy
C.terraform plan
D.terraform init
AnswerC

Correct. It shows the execution plan without making any changes.

Why this answer

The terraform plan command creates an execution plan, showing what actions Terraform will take to change the infrastructure. It is used as a dry run before applying changes.

Full explanation →
899
MCQhard

A company uses a cloud provider's IAM service to manage access. An administrator creates a new IAM role for an application running on an EC2 instance to access an S3 bucket. The application is unable to read objects from the bucket, even though the role has an attached policy that allows s3:GetObject on the bucket. The administrator verifies that the instance is correctly associated with the role. What is the most likely cause?

A.The S3 bucket policy denies access to the role.
B.The role's trust policy does not allow the EC2 service to assume the role.
C.The role's permissions policy has a condition key that restricts access to a specific IP range.
D.The instance's security group is blocking outbound traffic to S3.
AnswerC

A condition like ipAddress could limit access to allowed IPs, and the instance's IP may not be included.

Why this answer

The role's permissions policy is an IAM policy attached to the role that defines what actions the role can perform. If this policy includes a condition key such as `ipAddress` or `SourceIp`, it can restrict access to requests coming from specific IP addresses. If the EC2 instance's public IP address is not within the allowed range, the `s3:GetObject` call will be denied, even though the permission is granted.

Option A is incorrect because the stem does not mention any bucket policy, and the question asks for the most likely cause; a bucket policy denying access would be less common than a condition on the role's policy. Option B is incorrect because if the trust policy did not allow EC2 to assume the role, the instance would not receive temporary credentials at all, and the administrator would likely see errors during association. Option D is incorrect because security groups by default allow all outbound traffic, and S3 access uses HTTPS over the internet or VPC endpoints, so outbound blocking is unlikely unless explicitly configured.

Full explanation →
900
MCQmedium

A DevOps team is deploying a containerized application to Google Kubernetes Engine (GKE). The team wants to automate the deployment of the application along with its dependencies, such as ConfigMaps and Services, using a single package. Which tool should the team use?

A.Helm charts
B.kubectl apply with multiple manifest files
C.Kustomize overlays
D.Docker Compose
AnswerA

Helm packages Kubernetes resources as charts.

Why this answer

Helm charts package Kubernetes resources into a single deployable unit. Docker Compose is for local development, not production. kubectl apply can apply manifests but not as a package manager. Kustomize overlays but not package management.

Full explanation →
Page 11

Page 12 of 14

Page 13

All pages

1234567891011121314

Practice CV0-004 by domain

Target a specific domain to shore up weak areas.

Cloud Architecture and DesignDeploymentSecurityOperations and SupportTroubleshooting
See all domains with question counts →