Courseiva

CompTIA Cloud+ CV0-004 (CV0-004) — Questions 76–150

977 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 1

Page 2 of 14

Page 3
76
MCQeasy

A company needs to deploy a web application quickly and reliably. Which approach is best?

A.FTP the application to each server individually
B.Perform a blue-green deployment manually
C.Use a CI/CD pipeline with automated deployment
D.Manually copy the application files to the server
AnswerC

CI/CD automates testing and deployment, improving reliability and speed.

Why this answer

A CI/CD pipeline with automated deployment is the best approach because it integrates code changes, runs tests, and deploys to production in a repeatable, auditable manner. This ensures speed, consistency, and rollback capability, which are critical for reliable web application deployment in a cloud or on-premises environment.

Exam trap

CompTIA Cloud+ emphasizes that while manual or semi-automated methods (like manual blue-green) may seem quick, they lack the repeatability, audit trails, and automated rollback that a full CI/CD pipeline provides. Candidates often overlook that 'quick and reliable' in the exam context specifically requires automation and consistency.

How to eliminate wrong answers

Option A is wrong because FTP is an unencrypted, manual file transfer protocol that lacks automation, version control, and rollback mechanisms, making it slow and error-prone for reliable deployment. Option B is wrong because performing a blue-green deployment manually introduces human error risk, lacks automated health checks, and does not provide the consistency of an automated pipeline. Option D is wrong because manually copying files to the server is error-prone, lacks versioning, and cannot ensure consistent configuration across environments, leading to configuration drift and deployment failures.

Full explanation →
77
MCQmedium

A company is experiencing intermittent network connectivity issues between two cloud subnets. The cloud provider's monitoring shows no packet loss. Which troubleshooting step should be taken first?

A.Review the security group rules for both subnets
B.Replace the virtual routers
C.Increase the bandwidth between subnets
D.Check the physical cabling
AnswerA

Incorrect security group rules can block traffic between subnets intermittently based on timing or state.

Why this answer

Security group rules can cause intermittent connectivity issues by selectively dropping traffic based on stateful inspection, timeouts, or misconfigured rules. Option B is wrong because virtual routers are typically managed by the provider and are unlikely to cause intermittent issues without alerts. Option C is wrong because increasing bandwidth does not address the underlying cause of intermittent drops.

Option D is wrong because physical cabling is not relevant in the cloud.

Full explanation →
78
MCQmedium

An organization is designing a disaster recovery plan with a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 1 hour. Which disaster recovery strategy best meets these requirements while minimizing cost?

A.Cold standby
B.Backup and restore
C.Warm standby
D.Hot standby
AnswerC

Warm standby provides a balance of cost and recovery speed, meeting the stated requirements.

Why this answer

Warm standby maintains a partially running environment that can be fully activated quickly, meeting an RTO of 4 hours and RPO of 1 hour at a lower cost than hot standby.

Full explanation →
79
MCQhard

A cloud operations team notices that a production database is experiencing intermittent slow queries. The database is running on a virtual machine with 4 vCPUs and 16 GB of memory. The slow queries coincide with high CPU usage. Which of the following is the MOST effective long-term solution?

A.Migrate the database to a containerized deployment for better resource utilization.
B.Scale up the database virtual machine to 8 vCPUs and 32 GB of memory.
C.Use a query performance tuning tool to optimize the slow queries.
D.Implement a read replica to offload read traffic.
AnswerB

Increasing resources directly addresses the CPU and memory bottleneck.

Why this answer

Scaling up the virtual machine from 4 vCPUs/16 GB to 8 vCPUs/32 GB directly addresses the root cause of high CPU and memory contention, which is causing the intermittent slow queries. This vertical scaling provides immediate additional compute and memory resources to handle peak query loads, making it the most effective long-term solution for a production database experiencing resource exhaustion.

Exam trap

CompTIA Cloud+ often tests the distinction between scaling up (vertical) and scaling out (horizontal) solutions, and the trap here is that candidates may choose query tuning or read replicas as a 'best practice' without recognizing that the immediate symptom of high CPU usage requires more compute resources, not just query optimization or traffic offloading.

How to eliminate wrong answers

Option A is wrong because migrating to containers does not inherently resolve CPU or memory shortages; it may even introduce overhead from orchestration layers and does not increase the available compute capacity. Option C is wrong because query performance tuning optimizes individual queries but does not address the underlying resource constraint (high CPU usage) that affects all queries during peak loads. Option D is wrong because a read replica offloads read traffic but does not help with slow queries caused by high CPU usage on the primary database, especially if the slow queries are write-heavy or involve complex processing.

Full explanation →
80
MCQeasy

A company wants to receive alerts when their cloud costs exceed a budget threshold. Which cost management feature should they use?

A.Cost anomaly detection alerts
B.Rightsizing recommendations
C.Reserved Instance planning
D.Tagging strategy
AnswerA

Incorrect. Cost anomaly detection alerts focus on unusual spending patterns, not static budget thresholds.

Why this answer

Cost anomaly detection alerts are designed to identify unusual spending patterns using machine learning, not for alerting against a predefined budget threshold. The correct cloud cost management feature for receiving alerts when costs exceed a budget threshold is budget alerts (e.g., AWS Budgets, Azure Budgets), which is not among the listed options. Therefore, none of the provided options is correct.

Full explanation →
81
MCQmedium

A company wants to reduce costs by identifying underutilized EC2 instances and receiving recommendations to downsize them. Which AWS service provides rightsizing recommendations based on historical utilization metrics?

A.AWS Cost Explorer
B.AWS Trusted Advisor
C.AWS Auto Scaling
D.AWS Compute Optimizer
AnswerD

AWS Compute Optimizer analyses historical utilisation metrics—such as CPU, memory, and network throughput—from Amazon CloudWatch to generate rightsizing recommendations for EC2 instances. This directly satisfies the company’s requirement to identify underutilised instances and receive downsizing suggestions, as the service uses machine learning to compare observed usage against instance family specifications and outputs specific instance type changes.

Why this answer

AWS Compute Optimizer analyzes utilization and provides recommendations to optimize instance types.

Full explanation →
82
Multi-Selecthard

A company is deploying a web application on GCP and needs to protect against OWASP Top 10 threats and DDoS attacks. Which THREE services should be combined to provide comprehensive protection?

Select 3 answers
A.Cloud Load Balancing
B.Cloud NAT
C.Cloud CDN
D.Cloud VPN
E.Cloud Armor
AnswersA, C, E

Distributes traffic and integrates with Cloud Armor.

Why this answer

Cloud Load Balancing (A) is correct because it distributes incoming traffic across multiple backend instances, providing inherent DDoS resilience by absorbing and scaling with attack traffic. It also integrates directly with Cloud Armor to enforce OWASP Top 10 web application firewall (WAF) rules, such as SQL injection and XSS protections, at the edge before traffic reaches the application.

Exam trap

The trap here is that candidates often confuse similar network services (like NAT gateways or VPN gateways) as security services for inbound traffic, but they are designed for outbound connectivity and encrypted tunnels, not for application-layer threat detection or DDoS mitigation.

Full explanation →
83
MCQeasy

An administrator is configuring a backup policy for a critical application database. The policy must allow point-in-time recovery up to the last 5 minutes. The database is updated continuously throughout the day. Which of the following backup strategies BEST meets the requirement?

A.Weekly full backups with daily differential backups.
B.Hourly snapshots of the virtual machine.
C.Daily full backups plus transaction log backups every 5 minutes.
D.Daily full backups of the database.
AnswerC

Transaction logs enable recovery to any point within the last 5 minutes.

Why this answer

It combines daily full backups with transaction log backups every 5 minutes, which is the only strategy that supports point-in-time recovery (PITR) to within 5 minutes for a continuously updated database. Transaction log backups capture every committed transaction, allowing restoration to any specific point in time by replaying logs from the last full backup.

Exam trap

The trap here is that candidates often confuse crash-consistent snapshots (Option B) with application-consistent backups, failing to realize that VM snapshots do not capture transaction log details needed for precise point-in-time recovery of a database.

How to eliminate wrong answers

Option A is wrong because weekly full backups with daily differential backups only allow recovery to the state at the time of the last differential backup, not to arbitrary points within the last 5 minutes. Option B is wrong because hourly snapshots of the virtual machine are crash-consistent, not application-consistent, and cannot guarantee point-in-time recovery of the database to within 5 minutes due to the snapshot interval and lack of transaction log granularity. Option D is wrong because daily full backups alone provide no granularity for recovery between backup intervals, making point-in-time recovery to the last 5 minutes impossible.

Full explanation →
84
Multi-Selecteasy

A cloud administrator is troubleshooting an issue where a virtual machine (VM) cannot connect to the internet. Which TWO of the following are valid first steps to diagnose the problem?

Select 2 answers
A.Verify the VM's network interface is attached to the correct subnet.
B.Check the VM's OS firewall settings.
C.Create a new VM.
D.Check the VM's security group rules.
E.Reboot the VM.
AnswersA, D

If the network interface is in a different subnet, routing may fail; this is a fundamental check.

Why this answer

Verifying the VM's network interface is attached to the correct subnet is a fundamental first step in diagnosing internet connectivity issues. If the VM is on an isolated or mismatched subnet, it cannot route traffic to the internet gateway, regardless of other configurations. This check ensures the VM's virtual NIC is connected to the appropriate virtual network and subnet that has a route to the internet.

Option D is also correct because checking the VM's security group rules is another essential first step. Security groups act as a virtual firewall controlling inbound and outbound traffic at the network interface level. If the security group rules do not allow outbound traffic to the internet (e.g., missing default outbound rule or overly restrictive rules), the VM will be unable to connect to the internet. Checking these rules early can quickly identify misconfigurations that block internet access.

Together, verifying subnet attachment and security group rules are two of the most appropriate initial diagnostic steps, as they address the network-level controls that directly impact connectivity.

Exam trap

The trap here is that candidates often jump to OS-level checks (firewall, reboot) or drastic actions (create new VM) instead of first verifying the foundational network configuration (subnet attachment and security group rules) that directly controls internet access. Note that both subnet and security group checks are valid first steps, and this question tests the ability to prioritize network-level diagnostics.

Full explanation →
85
MCQmedium

A cloud engineer is deploying a web application that requires SSL termination and content-based routing. Which type of load balancer should be used?

A.Gateway Load Balancer
B.Classic Load Balancer
C.Application Load Balancer
D.Network Load Balancer
AnswerC

Correct. ALB supports SSL termination and content-based routing.

Why this answer

An Application Load Balancer (layer 7) can perform SSL termination and route based on content such as URL paths or host headers.

Full explanation →
86
MCQeasy

An organization requires that all cloud resources be tagged with the cost center and environment (e.g., production, development). A compliance checker runs weekly to report untagged resources. The cloud administrator notices that newly created resources are often missing tags. What is the most effective long-term solution?

A.Configure a cloud governance policy that prevents resource creation without required tags.
B.Create a custom dashboard to show untagged resources.
C.Run a script daily to tag any untagged resources.
D.Send an email reminder to all users about tagging policies.
AnswerA

Correct. Enforcing tags at creation time through policy automates compliance.

Why this answer

Enforcing tagging as part of resource creation policy prevents untagged resources from being created, ensuring compliance proactively.

Full explanation →
87
MCQmedium

A cloud architect is designing a web application that must remain available during a full region outage. They plan to deploy identical resources in two separate geographical regions. Which high availability architecture is described?

A.Cold standby
B.Active-passive
C.Active-active
D.Warm standby
AnswerC

Both regions are active, handling traffic and providing full redundancy.

Why this answer

Active-active means both regions handle traffic simultaneously, providing load sharing and failover. This matches deploying identical resources in two regions.

Full explanation →
88
MCQmedium

A financial services firm requires low latency between on-premises resources and its public cloud VPC. They also need a dedicated, consistent network connection that bypasses the internet. Which connectivity option should they use?

A.Direct Connect / ExpressRoute
B.Cloud CDN
C.Internet gateway
D.Site-to-Site VPN
AnswerA

This dedicated private connection meets the low latency and consistency requirements.

Why this answer

Direct Connect (AWS) or ExpressRoute (Azure) provides a dedicated private connection from on-premises to the cloud, offering lower latency and consistency compared to internet-based VPN.

Full explanation →
89
Multi-Selectmedium

Which THREE of the following are best practices for deploying applications in a cloud environment? (Choose three.)

Select 3 answers
A.Use immutable infrastructure patterns.
B.Design for horizontal scaling rather than vertical.
C.Open all ports in security groups to simplify connectivity.
D.Keep unused resources to avoid reprovisioning delays.
E.Implement blue/green deployment to minimize downtime.
AnswersA, B, E

Immutable infrastructure ensures consistency and security.

Why this answer

Immutable infrastructure patterns (A) are a best practice because they ensure that once a server or container is deployed, it is never modified in place. Instead, any change requires building a new instance from a golden image or template, which eliminates configuration drift and makes rollbacks trivial. This approach aligns with cloud-native principles where infrastructure is treated as disposable and version-controlled, reducing the risk of snowflake servers and improving reliability.

Exam trap

CompTIA often tests the misconception that 'keeping unused resources avoids delays' (D) is a valid cost-saving strategy, when in fact cloud environments are designed for rapid provisioning from images or snapshots, making idle resources an unnecessary expense and security risk.

Full explanation →
90
MCQeasy

A company is running a database server on a virtual machine in the cloud. The database team reports that write operations are taking longer than expected. The administrator checks the disk performance metrics and sees that the average disk queue length is consistently above 10. Which action would most likely resolve this issue?

A.Add more RAM to the virtual machine.
B.Upgrade to a higher IOPS tier for the disk.
C.Increase the size of the disk.
D.Enable compression on the database.
AnswerB

Upgrading IOPS tier increases throughput, reducing queue length.

Why this answer

A high disk queue length indicates that I/O requests are waiting, meaning the disk cannot keep up with the workload. Upgrading to a higher IOPS tier provides more throughput, reducing the queue length. Option A is wrong because adding RAM might reduce the number of disk reads due to caching, but write operations still require disk I/O and RAM does not directly increase I/O throughput.

Option C is wrong because increasing disk size does not inherently improve IOPS; it only adds more storage capacity. Option D is wrong because enabling compression reduces the amount of data written, which can lower I/O demand, but it does not directly address the queue length issue caused by insufficient IOPS.

Full explanation →
91
MCQmedium

A company's cloud environment uses a shared responsibility model. The security team notices that a data breach occurred due to misconfigured storage buckets in the public cloud. Which party is primarily responsible for this misconfiguration according to the shared responsibility model?

A.The cloud service provider
B.The cloud auditor
C.A third-party security vendor
D.The customer
AnswerD

The customer is responsible for configuring their storage buckets and managing access permissions.

Why this answer

Under the shared responsibility model, the customer is responsible for configuring their cloud resources securely, including storage bucket permissions. The cloud provider is responsible for the security of the cloud (infrastructure) but not for customer misconfigurations. The third-party vendor and cloud auditor are not directly responsible for the misconfiguration.

Full explanation →
92
MCQmedium

A cloud application is experiencing intermittent high latency. The operations team has enabled distributed tracing using AWS X-Ray but is unable to pinpoint the source. Which additional step should the team take to identify the root cause of the latency?

A.Enable VPC Flow Logs to analyze network traffic patterns.
B.Increase the auto-scaling group size to handle the load.
C.Analyze traces in X-Ray to identify which service segment has the highest duration.
D.Examine application logs on each virtual machine.
AnswerC

Traces show timing of each service call; high duration segments indicate the source of latency.

Why this answer

Distributed tracing (like X-Ray) provides end-to-end visibility of requests. To pinpoint the source of latency, the team should analyze trace data to identify which service or segment is taking the most time. Enabling VPC Flow Logs, application logs, or scaling out would not directly identify the latency source within the application.

Full explanation →
93
MCQmedium

A cloud administrator manages a hybrid cloud environment where on-premises servers connect to a VPC in AWS via a VPN connection. The on-premises network uses IP range 10.0.0.0/16. The VPC uses 172.16.0.0/16. The VPN is established and the tunnel status is UP. However, on-premises hosts cannot ping EC2 instances in the VPC. The administrator logs into an EC2 instance and can ping the on-premises VPN gateway IP. The security groups and network ACLs are configured to allow all traffic. The route tables in the VPC have a route to the on-premises network via the virtual private gateway. The on-premises firewall logs show that packets from the VPC are being dropped. What is the most likely cause?

A.The VPN tunnel is misconfigured and not passing traffic.
B.The on-premises firewall is blocking traffic from the VPC CIDR range.
C.The security group attached to the EC2 instance is blocking inbound ICMP.
D.The VPC route table does not have a route to the on-premises network.
AnswerB

Firewall logs indicate dropping packets from VPC.

Why this answer

The on-premises firewall logs explicitly show that packets from the VPC are being dropped, indicating the firewall is filtering traffic from the VPC CIDR range (172.16.0.0/16). Since the VPN tunnel is UP, the EC2 instance can ping the on-premises VPN gateway IP, and security groups/network ACLs allow all traffic, the only remaining point of failure is the on-premises firewall blocking the return traffic.

Exam trap

The trap here is that candidates assume a UP VPN tunnel guarantees end-to-end connectivity, ignoring that on-premises firewalls often require explicit allow rules for the VPC CIDR, even when the tunnel is established.

How to eliminate wrong answers

Option A is wrong because the VPN tunnel status is UP and the EC2 instance can ping the on-premises VPN gateway IP, proving the tunnel is passing traffic correctly. Option C is wrong because the security group is configured to allow all traffic, and the issue is on the on-premises side as shown by firewall logs. Option D is wrong because the VPC route table already has a route to the on-premises network via the virtual private gateway, as stated in the scenario.

Full explanation →
94
Multi-Selecthard

An organization uses Azure DevOps for CI/CD and needs to deploy serverless functions written in multiple languages. The functions must be triggered by HTTP requests and handle background processing from Azure Blob Storage events. Which THREE Azure services should be used to build this solution?

Select 3 answers
A.Azure API Management
B.Azure Logic Apps
C.Azure Blob Storage
D.Azure Functions
E.Azure Application Insights
AnswersA, C, D

API Management can expose HTTP triggers and manage APIs.

Why this answer

Azure Functions is the compute service. API Management provides HTTP triggers with management. Azure Blob Storage can trigger functions via event subscriptions (Event Grid).

Logic Apps is for workflows, not functions. Application Insights is for monitoring.

Full explanation →
95
MCQhard

A company uses AWS Systems Manager Patch Manager to automate patching. They need to ensure that patches are applied during a specific maintenance window with minimal risk of failure. Which additional step should be taken to allow quick recovery if a patch causes issues?

A.Use AWS CloudFormation to re-create the instance
B.Create an AMI snapshot before applying patches
C.Configure a rollback procedure using AWS Systems Manager State Manager
D.Enable termination protection on the instances
AnswerB

An AMI snapshot allows you to revert the instance to its pre-patch state.

Why this answer

Creating an AMI snapshot or instance backup before patching enables rollback if a patch fails. The other options do not directly support rollback.

Full explanation →
96
MCQhard

A company uses a cloud storage service with versioning enabled. An employee accidentally deleted a critical file. The administrator attempts to restore the file from the version history, but the file does not appear in the list of versions. What is the most likely reason?

A.The file was created before versioning was enabled.
B.Versioning was suspended after the file was created.
C.The file was overwritten, not deleted.
D.The file was deleted using a lifecycle policy.
AnswerA

Versioning only retains versions of objects created after it was enabled. Initial uploads before enablement are not versioned.

Why this answer

When versioning is enabled on a cloud storage service (such as Amazon S3), only objects created or modified after the versioning feature is turned on are assigned a version ID. Any objects that existed before versioning was enabled are not tracked in the version history. Therefore, if the file was created prior to enabling versioning, it will not appear in the list of versions, and the administrator cannot restore it via version history.

Exam trap

The trap here is that candidates assume versioning retroactively protects all objects in the bucket, but in reality, versioning only applies to objects created or modified after it is enabled, and objects with a null version ID are not recoverable through version history.

How to eliminate wrong answers

Option B is wrong because suspending versioning does not remove existing version history; it only stops new versions from being created, and the file would still appear in the version list. Option C is wrong because overwriting a file creates a new version, and the previous version remains accessible in the version history; the file would still appear. Option D is wrong because lifecycle policies can delete noncurrent versions, but they operate on objects that already have version IDs; a file created before versioning was enabled would not have a version ID and thus would not be affected by a lifecycle policy.

Full explanation →
97
MCQeasy

Which of the following is a key benefit of using object storage like Amazon S3 over block storage?

A.Unlimited scalability for unstructured data
B.Direct attachment to a single VM
C.Supports file-level locking
D.Lower latency for database workloads
AnswerA

Object storage scales to exabytes and is ideal for unstructured data.

Why this answer

Amazon S3 is designed for unlimited scalability, allowing you to store and retrieve any amount of unstructured data (e.g., images, videos, backups) without provisioning storage in advance. Unlike block storage, which has fixed size limits per volume, S3 automatically scales to accommodate petabytes of data, making it ideal for modern cloud-native applications.

Exam trap

The CV0-004 exam often tests the misconception that object storage is suitable for low-latency transactional workloads, but the trap here is that candidates confuse scalability with performance, forgetting that block storage (e.g., EBS) is optimized for low latency via direct attachment and NVMe protocols, while object storage prioritizes scale and cost over speed.

How to eliminate wrong answers

Option B is wrong because direct attachment to a single VM is a characteristic of block storage (e.g., Amazon EBS), not object storage like S3, which is accessed via HTTP/HTTPS APIs over the network. Option C is wrong because object storage typically does not support file-level locking; it uses eventual consistency or strong consistency for objects, not file locks like NFS or SMB. Option D is wrong because object storage has higher latency compared to block storage (e.g., EBS or local SSD) due to its HTTP-based API and distributed architecture, making it unsuitable for low-latency database workloads.

Full explanation →
98
MCQhard

A cloud engineer needs to ensure that an auto-scaling group does not launch new instances immediately after a scale-in event to allow metrics to stabilize. Which feature should they configure?

A.Health checks
B.Scheduled scaling
C.Lifecycle hooks
D.Cooldown periods
AnswerD

Cooldown periods pause scaling activities after a scaling event.

Why this answer

Cooldown periods prevent premature scaling by allowing metrics to stabilize.

Full explanation →
99
MCQmedium

A cloud administrator receives an alert that a virtual machine (VM) is unresponsive. The VM is hosted on a hypervisor that shows high CPU ready time. Which of the following is the most likely cause?

A.Insufficient memory allocated to the VM
B.Network latency between the VM and storage
C.Disk I/O contention from other VMs
D.Over-provisioning of vCPUs on the hypervisor
AnswerD

Correct; over-provisioned vCPUs cause contention and high ready time.

Why this answer

High CPU ready time indicates that the VM is ready to execute instructions but is waiting for the hypervisor to schedule physical CPU time. This is a classic symptom of over-provisioning vCPUs, where the total number of vCPUs assigned to all VMs exceeds the available physical cores, causing contention at the hypervisor scheduler level.

Exam trap

The trap here is that candidates confuse high CPU ready time with high CPU usage or memory pressure, but ready time is a hypervisor-level scheduling delay, not a guest OS metric, and is directly tied to vCPU over-provisioning.

How to eliminate wrong answers

Option A is wrong because insufficient memory would typically cause swapping or ballooning, not high CPU ready time, which is a CPU scheduling metric. Option B is wrong because network latency between the VM and storage affects storage I/O latency, not CPU scheduling, and would manifest as high disk latency or queue depth. Option C is wrong because disk I/O contention from other VMs would result in high disk queue length or latency, not CPU ready time, which is a measure of CPU starvation.

Full explanation →
100
MCQhard

A cloud administrator is configuring auto-scaling for a batch processing application that uses an SQS queue. The number of jobs varies unpredictably. Which metric is most appropriate for scaling the worker instances?

A.Memory utilization of workers
B.SQS queue depth (ApproximateNumberOfMessages)
C.Network throughput
D.CPU utilization of workers
AnswerB

Queue depth directly indicates workload pending, ideal for scaling workers.

Why this answer

SQS queue depth (approximate number of messages) directly indicates the backlog of work and is a common metric for scaling workers.

Full explanation →
101
MCQhard

A cloud administrator is responsible for ensuring the availability of a critical application that runs on a virtual machine. The administrator needs to implement a solution that can automatically restart the virtual machine if it becomes unresponsive due to an operating system crash. Which of the following should the administrator configure?

A.A snapshot-based backup policy
B.A load balancer with a health probe
C.A VM group configured with automatic recovery
D.A custom script that sends a heartbeat to a monitoring service
AnswerC

Availability sets in cloud platforms can automatically restart VMs that become unhealthy.

Why this answer

Configuring automatic recovery for the VM (or a group of VMs) allows the cloud platform to detect a VM failure and automatically restart it. This is a feature provided by most cloud providers to ensure high availability.

Exam trap

The trap here is that candidates often confuse a load balancer's health probe (which only reroutes traffic) with automatic VM recovery, or they assume a custom heartbeat script alone is sufficient without understanding that it lacks the built-in execution engine to perform the restart.

How to eliminate wrong answers

Option A is wrong because a snapshot-based backup policy is designed for data protection and recovery from corruption or accidental deletion, not for detecting and automatically restarting an unresponsive VM due to an OS crash. Option B is wrong because a load balancer with a health probe distributes traffic and removes unhealthy instances from the pool, but it does not automatically restart the VM; it only reroutes traffic, leaving the VM in a failed state. Option D is wrong because a custom script that sends a heartbeat to a monitoring service can detect unresponsiveness but requires an external automation mechanism (e.g., Azure Automation, Logic Apps) to trigger the restart; it is not a built-in, self-contained solution for automatic VM restart.

Full explanation →
102
MCQeasy

A cloud engineer is writing a Terraform configuration to provision an AWS EC2 instance. They need to pass the AMI ID as a variable to make the configuration reusable. Which Terraform block should be used to define the variable?

A.output
B.provider
C.variable
D.resource
AnswerC

Correct block for input variables.

Why this answer

Variables are defined using the 'variable' block. 'resource' declares resources; 'provider' configures providers; 'output' defines outputs.

Full explanation →
103
MCQmedium

A cloud architect needs to ensure that all data transmitted between an on-premises data center and a cloud VPC is encrypted. Which solution should be implemented?

A.Security group
B.Cloud KMS
C.Direct Connect
D.VPN Gateway
AnswerD

VPN Gateway creates an encrypted tunnel over the internet.

Why this answer

A VPN connection encrypts traffic in transit using IPsec tunnels.

Full explanation →
104
Multi-Selecthard

A cloud team is planning a disaster recovery drill for their application running in a public cloud. They want to validate that the recovery process meets the defined RTO and RPO. Which THREE activities should be included in the DR drill? (Select THREE.)

Select 3 answers
A.Review cost optimization recommendations for the DR environment.
B.Measure the time taken to restore services from backups.
C.Run chaos engineering experiments to introduce random failures.
D.Perform a failover to the DR site and verify application functionality.
E.Check the timestamp of the most recent backup or replica to ensure data is within RPO.
AnswersB, D, E

This tests whether RTO is met.

Why this answer

Key DR drill activities include verifying the recovery time, checking data freshness to validate RPO, and conducting failover testing to ensure the process works. Chaos engineering is for resilience testing but not specifically for RTO/RPO validation.

Full explanation →
105
MCQmedium

A cloud administrator is configuring automated scaling for a web application. The scaling policy should add two instances when CPU utilization exceeds 80% for five minutes. Which type of scaling policy should they implement?

A.Scheduled scaling
B.Dynamic scaling
C.Target tracking scaling
D.Step scaling
AnswerD

Step scaling adds or removes instances based on breach magnitude.

Why this answer

Step scaling allows adding a specific number of instances based on a metric threshold breach.

Full explanation →
106
MCQmedium

A cloud engineer is deploying a containerized application using Kubernetes. The application consists of a frontend, a backend API, and a database. The engineer needs to ensure that the backend API can be reached by the frontend but not from outside the cluster. Which Kubernetes resource should the engineer use to expose the backend API?

A.NodePort service
B.ClusterIP service
C.Ingress resource
D.LoadBalancer service
AnswerB

ClusterIP provides internal-only access.

Why this answer

A ClusterIP service exposes the backend API on a cluster-internal IP address, making it reachable only from within the Kubernetes cluster. This meets the requirement that the frontend can communicate with the backend API, but external traffic is blocked. ClusterIP is the default service type and is ideal for internal service-to-service communication.

Exam trap

The trap here is that candidates often confuse Ingress as a method to expose services internally, but Ingress is specifically designed for external HTTP/HTTPS traffic and does not restrict access to cluster-internal communication.

How to eliminate wrong answers

Option A is wrong because a NodePort service exposes the backend API on a static port on each node's IP address, allowing external traffic to reach the service from outside the cluster, which violates the requirement. Option C is wrong because an Ingress resource is not a service type; it provides HTTP/HTTPS routing to services from outside the cluster and typically requires an Ingress controller, thus exposing the backend externally. Option D is wrong because a LoadBalancer service provisions an external load balancer (e.g., from a cloud provider) with a public IP, making the backend API accessible from outside the cluster, which contradicts the requirement.

Full explanation →
107
Multi-Selectmedium

A security engineer is implementing DDoS protection for a public-facing web application hosted in AWS. Which TWO services should be used together to provide comprehensive DDoS mitigation? (Choose two.)

Select 2 answers
A.AWS WAF
B.AWS Shield Advanced
C.Amazon Route 53
D.AWS Shield Standard
E.Amazon GuardDuty
AnswersA, B

WAF can block malicious HTTP requests at the application layer.

Why this answer

AWS Shield Advanced provides enhanced DDoS protection for EC2, ELB, CloudFront, etc. AWS WAF can be used to mitigate application-layer attacks like HTTP flood. Shield Standard is free but less comprehensive.

Route 53 is DNS and does not directly mitigate DDoS. GuardDuty is threat detection.

Full explanation →
108
MCQmedium

A company operates a hybrid cloud environment with on-premises servers and a public cloud provider. They use AWS for compute and storage. Their application requires low-latency access to on-premises databases. They set up a Direct Connect link between their data center and AWS. Recently, users report slow application performance. Cloud engineers notice increased latency on the Direct Connect link. The on-premises network team confirms no issues with their internal network. The application uses jumbo frames on the on-premises side for optimized performance. The virtual interface on the AWS side is configured with a default MTU of 1500. Which of the following is the MOST likely cause of the increased latency?

A.The MTU on the virtual interface is set to 1500, causing fragmentation and reassembly delays.
B.The on-premises router has not configured BGP graceful restart for the Direct Connect session.
C.The cloud provider's routing table has not propagated the latest on-premises prefixes, causing traffic to take a suboptimal path.
D.The Direct Connect link bandwidth is oversubscribed, causing packet loss and retransmission delays.
AnswerA

The MTU mismatch forces fragmentation, increasing latency.

Why this answer

The application uses jumbo frames on-premises, but the AWS virtual interface defaults to an MTU of 1500. When packets larger than 1500 bytes traverse the Direct Connect link, they must be fragmented at the on-premises router and reassembled at the AWS side. This fragmentation and reassembly process introduces significant processing overhead and latency, which explains the reported slow performance.

Exam trap

The trap here is that candidates often overlook the MTU mismatch and instead focus on routing or bandwidth issues, not realizing that fragmentation and reassembly directly cause increased latency without necessarily causing packet loss.

How to eliminate wrong answers

Option B is wrong because BGP graceful restart is a feature that helps maintain routing stability during a control plane restart; it does not affect latency caused by MTU mismatch. Option C is wrong because if the cloud provider's routing table had not propagated the latest on-premises prefixes, traffic would likely be dropped or take a completely different path, not simply experience increased latency on the existing Direct Connect link. Option D is wrong because oversubscription would manifest as packet loss and retransmissions, not as the consistent increased latency described; the engineers specifically noted increased latency, not packet loss.

Full explanation →
109
MCQmedium

A company uses a cloud provider's container orchestration service (e.g., EKS, AKS, GKE) to run a set of microservices. The current cluster uses three worker nodes, each of size m5.large (2 vCPU, 8 GB RAM). The operations team notices that CPU utilization on the worker nodes averages 80% during peak hours, and some pods are being evicted due to resource pressure. The team wants to ensure that the cluster can handle a 50% increase in traffic without performance degradation. Which action should the cloud architect take?

A.Configure horizontal pod autoscaling to scale out pods automatically
B.Create a new node pool using a larger instance type, such as m5.xlarge, and migrate the pods
C.Implement cluster autoscaler to add more nodes of the same type during peak
D.Reduce the CPU and memory requests in the pod specifications to allow more pods per node
AnswerB

Larger instances provide more resources per node, addressing the CPU pressure and accommodating traffic increase.

Why this answer

The current nodes are already at 80% CPU utilization during peak hours, and a 50% traffic increase would push them to 120% utilization, causing severe performance degradation and pod evictions. Scaling to a larger instance type (m5.xlarge with 4 vCPU, 16 GB RAM) doubles the available resources per node, providing sufficient headroom to absorb the traffic spike without requiring additional nodes or architectural changes. This directly addresses the resource pressure by increasing the capacity per node, which is more efficient than scaling out horizontally when the existing node type is already saturated.

Exam trap

The trap here is that candidates often assume horizontal scaling (adding more nodes or pods) is always the answer, but when the existing node type is already saturated, vertical scaling (larger instance type) is required to provide the necessary per-node capacity to handle the increased load without performance degradation.

How to eliminate wrong answers

Option A is wrong because horizontal pod autoscaling (HPA) scales the number of pod replicas, but the underlying nodes are already at 80% CPU utilization; adding more pods would only worsen resource contention and evictions, as the nodes lack spare capacity. Option C is wrong because cluster autoscaler adds more nodes of the same type (m5.large), but each node only has 2 vCPU and 8 GB RAM; with 80% utilization already, adding more nodes would still result in each node being heavily loaded, and the 50% traffic increase would require many additional nodes, leading to inefficient resource usage and potential cost overruns. Option D is wrong because reducing CPU and memory requests allows more pods to be scheduled per node, but this does not increase actual node capacity; it only lowers the guaranteed resources, risking resource starvation and OOM kills when traffic spikes, as pods may exceed their reduced requests.

Full explanation →
110
MCQeasy

A developer wants to deploy an application using Azure Bicep. What is a key benefit of using Bicep over ARM templates?

A.Bicep has simpler, more readable syntax than ARM JSON
B.Bicep can be used to manage any cloud provider
C.Bicep eliminates the need for resource providers
D.Bicep supports imperative scripting
AnswerA

Correct. Bicep reduces complexity with a concise syntax.

Why this answer

Bicep is a domain-specific language that simplifies authoring ARM templates by providing a cleaner syntax, modularization, and code reuse. It compiles to ARM JSON templates.

Full explanation →
111
MCQmedium

A company is adopting a canary deployment strategy for a microservice running on Kubernetes. They want to initially route 5% of traffic to the new version and monitor for errors before increasing. Which Kubernetes resource is best suited to implement this traffic splitting?

A.ConfigMap
B.Ingress resource
C.Service with multiple Deployments and replica scaling
D.HorizontalPodAutoscaler
AnswerC

Correct. By running two Deployments (stable and canary) and scaling replicas, the Service distributes traffic proportionally based on pod counts.

Why this answer

Service meshes like Istio provide traffic routing capabilities, but in native Kubernetes, a Service can be used with multiple Deployments, but traffic splitting is not native. However, using a Service with label selectors that match both versions and manually adjusting replica counts is a common approach, but more advanced canary deployments use tools like Flagger or Istio. Among the options, a Service with a canary Deployment and adjusting replicas is most straightforward.

Full explanation →
112
MCQhard

A cloud architect is designing a VPC for a three-tier web application. The web servers must be accessible from the internet, the application servers should only be reachable from the web tier, and the database servers should not have any public IP addresses and should be isolated. Which subnet design meets these requirements?

A.Web tier in public subnet, app tier in private subnet, database tier in a separate private subnet with no internet gateway
B.Web tier in public subnet, app and database tiers in the same private subnet
C.All servers in private subnets with a NAT gateway for inbound traffic
D.All servers in the same public subnet with security groups
AnswerA

This design isolates tiers appropriately: web is public, app is private, database is isolated.

Why this answer

A typical three-tier architecture uses public subnets for web servers (with internet gateway), private subnets for application servers (with NAT for outbound if needed), and isolated database subnets with no internet access. Security groups/NACLs enforce traffic rules.

Full explanation →
113
Multi-Selectmedium

Which THREE of the following are common causes of cloud resource provisioning failures?

Select 3 answers
A.Insufficient service quotas.
B.Policy restrictions (e.g., organization policies).
C.Exceeded resource limits (e.g., vCPU, memory).
D.Disk encryption settings.
E.Incorrect resource tagging.
AnswersA, B, C

Service quotas limit the number of resources that can be created.

Why this answer

Cloud providers enforce service quotas (e.g., AWS Service Quotas, Azure subscription limits, GCP project quotas) that cap the number of resources you can provision per region or account. When a provisioning request exceeds these quotas, the API call fails with an explicit error (e.g., AWS 'LimitExceeded' or Azure 'QuotaExceeded'). This is a common failure mode, especially in automated scaling or CI/CD pipelines.

Exam trap

CompTIA often tests the distinction between hard failures (quotas, policies, limits) and soft failures (tagging, encryption), where candidates mistakenly think metadata or encryption misconfigurations prevent provisioning when they actually only cause post-deployment issues.

Full explanation →
114
MCQmedium

A DevOps team is deploying containerized applications on Kubernetes. They want to ensure containers do not run with root privileges and that host filesystem access is restricted. Which Kubernetes feature should they use?

A.Service accounts
B.ConfigMaps
C.Network policies
D.Pod Security Standards
AnswerD

PSS enforces security contexts on pods.

Why this answer

Pod Security Standards (PSS) define security levels (privileged, baseline, restricted) to enforce security policies on pods, such as disallowing root access and restricting host filesystem access.

Full explanation →
115
Multi-Selecthard

Which TWO of the following are valid methods for migrating on-premises virtual machines to a public cloud? (Choose two.)

Select 2 answers
A.Reinstall the OS and applications on new cloud instances.
B.Use a backup and restore method creating cloud instance from backup.
C.Export the VM as an OVF and import to cloud.
D.Use a physical server migration tool that converts to cloud image.
E.Use a hybrid cloud extension that replicates VMs live.
AnswersB, C

Backup software can create a cloud instance from a backup of the on-premises VM.

Why this answer

Correct methods for migrating on-premises VMs to public cloud include: (B) using backup and restore, where you create a cloud instance from a backup, and (C) exporting the VM as OVF and importing to the cloud. Reinstalling OS and apps (A) is a redeployment, not migration. Physical-to-virtual conversion (D) applies to physical servers, not VMs.

Live replication (E) is for disaster recovery, not a one-time migration method.

Full explanation →
116
MCQhard

A cloud instance fails to initialize. The cloud-init log shows the error above. Which of the following is the most likely cause?

A.The filesystem on /dev/xvdb1 is not formatted with a recognized filesystem.
B.The disk is not attached to the instance at all.
C.The partition table on /dev/xvdb1 is corrupted.
D.The launch template specifies a block device mapping that is not attached to the instance.
AnswerD

The device /dev/xvdb1 is present in the mapping but not attached, causing mount failure.

Why this answer

The error 'No such device' indicates that the device specified in the block device mapping does not exist on the instance. Option D is correct because the launch template likely references a block device mapping for a device that is not actually attached (e.g., an ephemeral disk or misconfigured EBS volume). Option A is incorrect because an unformatted filesystem would produce a different error (e.g., 'mount: unknown filesystem type').

Option B is incorrect because if the disk were not attached at all, the device path would not appear in the system, but the error references a specific device path that is missing. Option C is incorrect because a corrupted partition table would yield errors like 'invalid partition table', not 'No such device'.

Full explanation →
117
Multi-Selecthard

A company experienced a security breach where an attacker gained access to an S3 bucket containing sensitive data. The investigation reveals that the bucket policy allowed public access. Which THREE measures should be implemented to prevent future occurrences?

Select 3 answers
A.Implement bucket policies that require requests to include specific IP address conditions.
B.Enable default encryption for all S3 buckets.
C.Enable S3 versioning to safeguard against accidental modifications.
D.Enable S3 Block Public Access at the account level.
E.Enable multi-factor authentication (MFA) for all IAM users.
AnswersA, C, D

Restricts access to trusted IPs.

Why this answer

Implementing bucket policies that require requests to include specific IP address conditions restricts access to the S3 bucket to only those requests originating from trusted IP ranges. This is a form of network-level access control that, when combined with other measures, helps prevent unauthorized public access by ensuring that even if the bucket policy is misconfigured, only traffic from approved networks can reach the bucket.

Exam trap

CompTIA often tests the distinction between access control measures (like IP restrictions and Block Public Access) and data protection features (like encryption and versioning), leading candidates to select encryption or MFA as solutions for a public access breach.

Full explanation →
118
MCQmedium

A cloud architect is designing a security group for a web server in AWS. The server must receive HTTPS traffic from the internet. What is the most secure inbound rule?

A.Allow HTTPS from the VPC CIDR only
B.Allow HTTPS from 10.0.0.0/8
C.Allow all traffic from 0.0.0.0/0
D.Allow HTTPS from 0.0.0.0/0
AnswerD

This allows all inbound HTTPS traffic, which is standard for public web servers.

Why this answer

Security groups are stateful; specifying source IP range 0.0.0.0/0 for HTTPS is typical for public web servers.

Full explanation →
119
MCQhard

A company uses Azure AD for identity federation with an on-premises Active Directory. They want to enable single sign-on (SSO) for cloud applications using an open standard. Which protocol should they use?

A.OAuth 2.0
B.SAML 2.0
C.LDAP
D.Kerberos
AnswerB

SAML is widely used for SSO federation.

Why this answer

SAML (Security Assertion Markup Language) and OIDC (OpenID Connect) are open standards for federation. SAML is commonly used for SSO with Azure AD. OAuth is for authorization, not authentication.

LDAP is a directory protocol. Kerberos is for on-premises.

Full explanation →
120
Multi-Selecteasy

Which TWO characteristics are essential for a cloud service to be considered as a true Infrastructure as a Service (IaaS) offering?

Select 2 answers
A.Customer has control over the guest operating system
B.Provider automatically applies OS security patches
C.Customer manages the underlying hypervisor
D.Provider performs automated backups of all customer data
E.On-demand self-service provisioning of virtual machines
AnswersA, E

IaaS gives customers control over the OS and applications.

Why this answer

In IaaS, the customer retains control over the guest operating system, including its configuration, security, and installed applications. The provider manages the underlying physical infrastructure and hypervisor, but the customer is responsible for the OS layer, which is a defining characteristic of IaaS versus PaaS or SaaS. Option E is also correct because on-demand self-service provisioning is a fundamental characteristic of cloud computing as defined by NIST, and it is essential for IaaS offerings, allowing customers to provision virtual machines and other resources automatically without human interaction with the provider.

Exam trap

CompTIA often tests the misconception that IaaS includes provider-managed OS patching or backups, confusing it with PaaS or managed services, but the core distinction is customer control over the guest OS and on-demand self-service provisioning.

Full explanation →
121
MCQmedium

A cloud administrator is configuring a new virtual private cloud (VPC) and needs to ensure that traffic between web servers and database servers is restricted to only the necessary ports. Which security approach should the administrator implement?

A.Enable VPC flow logs to detect and block malicious traffic.
B.Configure a security group with inbound rules for the web tier and outbound rules for the database tier.
C.Create an IAM policy to restrict access between subnets.
D.Implement network ACLs with rules that allow only database-specific ports (e.g., 3306) from web to database and block all other traffic.
AnswerB

Correct. Configuring security groups with inbound rules on the database tier to allow only the necessary database port from the web tier's security group, and outbound rules on the web tier, effectively restricts traffic to required ports.

Why this answer

Security groups are stateful firewalls that operate at the instance level. By configuring a security group for the database tier with an inbound rule that allows traffic only from the web tier's security group on the necessary database port (e.g., 3306 for MySQL), and a corresponding outbound rule on the web tier's security group, the administrator can restrict traffic to only the required ports. Network ACLs are stateless and require explicit rules for return traffic, making them more complex and error-prone.

IAM policies manage permissions, not traffic. Flow logs only monitor traffic, they do not block it.

Exam trap

Candidates often confuse security groups with network ACLs. Security groups are stateful and operate at the instance level, while NACLs are stateless and operate at the subnet level. For restricting traffic between specific instances (like web and database servers), security groups are the more appropriate and granular control.

Full explanation →
122
MCQmedium

A company deploys a stateless web application across two AWS Availability Zones behind a load balancer. This design primarily improves which characteristic?

A.Cost efficiency
B.High availability
C.Scalability
D.Security
AnswerB

Availability Zones provide fault isolation, and load balancing distributes traffic, ensuring high availability.

Why this answer

Deploying across multiple AZs with a load balancer increases availability by eliminating single points of failure.

Full explanation →
123
MCQmedium

A cloud operations team is configuring auto-scaling for a web application. They want to add two instances when CPU utilization exceeds 80% for five minutes, and remove one instance when CPU drops below 30% for five minutes. Which type of scaling policy should they use?

A.Simple scaling
B.Scheduled scaling
C.Target tracking scaling
D.Step scaling
AnswerD

Step scaling policies allow adding/removing specific instance counts based on metric thresholds.

Why this answer

Step scaling allows adding or removing a specific number of instances based on the size of the alarm breach.

Full explanation →
124
MCQmedium

A cloud operations team is implementing a tagging strategy for cost attribution. They need to track costs by environment (dev, test, prod), project, and team. Which approach should they use?

A.Use resource groups to organize resources by environment
B.Apply tags such as Environment, Project, and Team to all resources
C.Use resource naming conventions to encode environment and project
D.Create separate cloud accounts for each environment
AnswerB

Tags allow flexible cost allocation and reporting across cloud providers.

Why this answer

Tags are key-value pairs that can be applied to resources. Using a consistent set of tags for all resources enables cost breakdown by those dimensions. Resource groups are Azure-specific and not universal.

Naming conventions are less reliable. Separate accounts add overhead.

Full explanation →
125
MCQhard

A cloud architect is designing a DDoS protection strategy for a web application hosted on AWS. The application uses an Application Load Balancer (ALB). Which service provides automatic, always-on DDoS protection at no additional cost?

A.AWS WAF
B.AWS Network Firewall
C.AWS Shield Standard
D.AWS Shield Advanced
AnswerC

Shield Standard is included automatically and protects against common DDoS attacks.

Why this answer

AWS Shield Standard provides automatic protection against common DDoS attacks for all AWS customers at no additional cost.

Full explanation →
126
MCQeasy

A company is migrating a web application to the cloud. The application requires low latency and high availability across multiple geographic regions. Which cloud deployment model BEST meets these requirements?

A.Public cloud
B.Private cloud
C.Hybrid cloud
D.Community cloud
AnswerA

Public cloud providers have multiple regions worldwide, enabling low latency and HA.

Why this answer

The public cloud model is the best fit because it offers globally distributed infrastructure (e.g., AWS Regions, Azure Availability Zones) that enables low-latency access and high availability through multi-region deployment. Public cloud providers natively support global load balancing (e.g., AWS Global Accelerator, Azure Traffic Manager) and auto-scaling across regions, meeting the application's requirements without the capital expense of building private infrastructure.

Exam trap

CompTIA often tests the misconception that hybrid cloud is always the best choice for multi-region deployments, but the trap here is that hybrid cloud adds unnecessary complexity and cost when the application can be fully served by the public cloud's native global infrastructure.

How to eliminate wrong answers

Option B (Private cloud) is wrong because it is typically deployed in a single on-premises or colocation facility, making it difficult to achieve low latency and high availability across multiple geographic regions without significant investment in private WAN links and redundant data centers. Option C (Hybrid cloud) is wrong because while it can span multiple locations, its primary purpose is to integrate on-premises and cloud resources, not to natively provide the global distribution and managed multi-region services needed for this use case. Option D (Community cloud) is wrong because it is designed for a specific group of organizations with shared compliance or regulatory concerns, not for optimizing global latency and availability for a single web application.

Full explanation →
127
MCQeasy

A company wants to migrate its on-premises workloads to the cloud but must keep sensitive customer data on-premises due to regulatory compliance. Which cloud deployment model should they use?

A.Public cloud
B.Hybrid cloud
C.Multi-cloud
D.Private cloud
AnswerB

Hybrid cloud allows keeping sensitive data on-premises while using public cloud for other workloads.

Why this answer

A hybrid cloud connects on-premises infrastructure to public cloud services, allowing sensitive data to remain on-premises while leveraging the public cloud for other workloads.

Full explanation →
128
MCQeasy

A cloud administrator needs to transfer 50 TB of data from an on-premises NAS to Amazon S3. The office has limited bandwidth (50 Mbps). Which service is most suitable for this offline transfer?

A.AWS VPN
B.AWS DataSync
C.AWS Snowball
D.S3 Transfer Acceleration
AnswerC

Snowball is a physical device for offline transfer, suitable for large data volumes over limited bandwidth.

Why this answer

AWS Snowball is designed for large offline data transfers where network bandwidth is limited. Physical devices are shipped to transfer data.

Full explanation →
129
MCQhard

A company uses a multi-account AWS organization with separate accounts for development, testing, and production. A developer in the development account needs to access an S3 bucket in the production account to retrieve log files for troubleshooting. The developer has an IAM user in the development account with full S3 permissions, and the production account's S3 bucket policy includes a statement that grants access to the root user of the development account. However, when the developer attempts to access the bucket using AWS CLI with their IAM user credentials, they receive an 'Access Denied' error. The security team has verified that there are no explicit deny policies in either account, and that the bucket policy is correctly configured. The administrator has confirmed that the developer's IAM user has permissions to perform S3 operations. Which of the following is the MOST likely cause of the access failure?

A.The developer's IAM user needs to be added to an IAM group in the production account.
B.The production account must have an IAM role with a trust policy that allows the development account to assume it.
C.A VPC peering connection must be established between the two accounts.
D.The developer should use the root user credentials of the development account to access the bucket.
AnswerB

An IAM role with a trust policy enables the developer to assume the role and access the bucket.

Why this answer

Cross-account S3 access typically requires the developer to assume an IAM role in the production account with a trust policy allowing the development account. The bucket policy granting access to the root user of the development account does not automatically grant access to IAM users in that account; the users must assume the role to get temporary credentials. Adding the user to a group in the target account is not possible across accounts.

Using root credentials is insecure. VPC peering addresses network connectivity, not IAM permissions.

Full explanation →
130
Multi-Selectmedium

Which TWO metrics should be monitored to determine if a cloud database is experiencing a memory bottleneck?

Select 2 answers
A.Network bytes sent
B.Swap usage
C.Average disk queue length
D.Disk latency
E.Page faults per second
AnswersB, E

High swap usage indicates memory pressure.

Why this answer

Swap usage (B) is a direct indicator of memory pressure; when the operating system moves memory pages to disk, it signals that the database cannot fit its working set in RAM, causing severe performance degradation. Page faults per second (E) measures how often the database must retrieve memory pages from disk; a sustained high rate indicates the buffer pool is too small for the workload, confirming a memory bottleneck.

Exam trap

CompTIA often tests the distinction between memory-specific metrics (swap usage, page faults) and storage-related metrics (disk queue length, latency), trapping candidates who confuse high disk activity with memory pressure.

Full explanation →
131
Multi-Selecthard

A company uses AWS and wants to implement structured logging for their applications to improve queryability. Which THREE practices should they follow? (Select THREE.)

Select 3 answers
A.Send all logs to a single S3 bucket without partitioning
B.Include timestamp, severity, and request ID in each log entry
C.Use a consistent schema across all services
D.Write logs in JSON format
E.Encrypt log files at rest using AWS KMS
AnswersB, C, D

These fields enable filtering and correlation.

Why this answer

Structured logging uses JSON format, includes key fields, and uses consistent schemas.

Full explanation →
132
MCQmedium

A company uses GitLab CI for its CI/CD pipeline. The pipeline includes a 'deploy' job that runs only when a tag is pushed. Which GitLab CI keyword should be used to control job execution based on tags?

A.stage
B.except
C.only
D.needs
AnswerC

'only: tags' restricts job to tags.

Why this answer

The 'only' keyword (or 'rules') in GitLab CI specifies conditions for job execution. 'only: tags' ensures the job runs only for tags.

Full explanation →
133
MCQeasy

A company is designing a disaster recovery plan for a critical database that requires a recovery point objective (RPO) of 1 minute and a recovery time objective (RTO) of 15 minutes. The database runs on a cloud virtual machine. Which backup strategy should the administrator implement to meet these requirements?

A.Take daily snapshots and store them in the same region.
B.Perform weekly backups to tape and store offsite.
C.Use cross-region snapshot replication with hourly snapshots.
D.Implement continuous replication to a standby instance in a different region.
AnswerD

Continuous replication provides near-zero RPO and fast failover for low RTO.

Why this answer

Continuous replication to a standby instance in a different region can achieve RPO of 1 minute (near-zero data loss) and RTO of 15 minutes by failing over quickly, whereas snapshot-based replication would have higher RPO.

Full explanation →
134
MCQeasy

A user reports that they cannot connect to a RDS database instance from their application. The security group for the RDS instance allows inbound traffic on port 3306 from the application server's security group. What should the administrator check NEXT?

A.IAM policy attached to the RDS instance
B.Network ACL rules for the RDS subnet
C.Route table entries for the RDS subnet
D.Outbound security group rules on the RDS instance
AnswerB

Network ACLs act as a firewall at subnet level and can block inbound traffic.

Why this answer

The RDS security group already allows inbound traffic from the application server's security group, so the issue likely lies elsewhere. Network ACLs (NACLs) are stateless and apply to the subnet level; they must allow both inbound and outbound traffic in both directions for the connection. Checking NACL rules is the next step.

Option A is incorrect because IAM policies control access permissions, not network connectivity. Option C is incorrect because route tables primarily govern traffic between subnets and to the internet; within the same VPC, routes are typically not the cause of this issue. Option D is incorrect because outbound rules on the RDS instance affect traffic leaving the RDS, not incoming connections.

Full explanation →
135
MCQeasy

A company wants to migrate its on-premises virtualized workloads to the cloud while maintaining control over the operating system and middleware. Which cloud service model should they choose?

A.SaaS
B.FaaS
C.PaaS
D.IaaS
AnswerD

IaaS gives the customer control over VMs, OS, and middleware.

Why this answer

IaaS provides virtual machines, storage, and networking, allowing the customer to manage the OS and above. PaaS abstracts the OS, SaaS delivers complete applications, and FaaS is for functions.

Full explanation →
136
Multi-Selectmedium

A company is evaluating storage options for different use cases. Which TWO storage types are most suitable for hosting a relational database in the cloud? (Select TWO.)

Select 2 answers
A.File storage
B.Cache storage
C.Archive storage
D.Object storage
E.Block storage
AnswersA, E

File storage is suitable for hosting relational databases, especially when shared access is needed, but it has higher latency than block storage.

Why this answer

Block storage (e.g., AWS EBS, Azure Disk) is the primary choice for hosting relational databases due to low latency and direct block-level access. File storage (e.g., AWS EFS, Azure Files) can also host relational databases, especially in shared storage scenarios, though with higher latency and lower performance. Therefore, both block storage and file storage are suitable for hosting relational databases.

Cache, archive, and object storage are not designed for active database hosting.

Exam trap

A common mistake is thinking that only block storage can host relational databases. While block storage is optimal, file storage (NFS-based) can also be used, but it is often overlooked. Candidates should recognize both as viable options for database hosting.

Full explanation →
137
Multi-Selecthard

A cloud administrator is troubleshooting a network connectivity issue between two VPCs connected via a VPC peering connection. The administrator has verified that the route tables are correct and that the security groups allow traffic. However, instances in VPC A cannot ping instances in VPC B. Which TWO of the following could be causing the issue? (Choose TWO.)

Select 2 answers
A.Network ACLs in VPC B are blocking inbound ICMP
B.Security groups in VPC A are blocking inbound ICMP
C.Host-based firewall on the target instance is blocking ping
D.VPC peering connection does not support ICMP
E.Route tables are misconfigured
AnswersA, C

Network ACLs are stateless; they must explicitly allow both inbound and outbound ICMP.

Why this answer

Network ACLs are stateless and must allow both inbound and outbound traffic; if they block inbound ICMP, ping fails, making A correct. Host-based firewall rules within the OS of the target instance can also block ICMP, making C correct. B is wrong because security groups in VPC A control inbound traffic to instances in VPC A, not to instances in VPC B.

D is wrong because VPC peering supports ICMP. E is wrong because the administrator verified route tables are correct.

Full explanation →
138
MCQeasy

A cloud architect is designing a solution to ensure that data at rest in an object storage bucket is encrypted. The company requires that the encryption keys are managed by an on-premises hardware security module (HSM) to maintain control. Which encryption approach should the architect choose?

A.Server-side encryption with cloud-managed keys (SSE).
B.Client-side encryption using a local library.
C.Disable encryption at rest to rely on network encryption.
D.Server-side encryption with customer-provided keys (SSE-C).
AnswerB

Client-side encryption allows the customer to encrypt data with keys stored on-premises before transmission, maintaining full control.

Why this answer

Client-side encryption allows the customer to encrypt data before sending it to the cloud, using keys managed on-premises. Server-side encryption with cloud-managed keys would have the cloud provider control the keys, negating the requirement. SSE-C allows the customer to provide their own encryption keys, but the keys must be sent to the cloud each time, which may not satisfy the on-premises management requirement.

Client-side encryption ensures data is encrypted before leaving the on-premises environment.

Full explanation →
139
MCQmedium

A cloud architect is designing a multi-tier web application that must handle sudden traffic spikes. The application layer is stateless, and the database layer is read-heavy with occasional writes. Which design best meets the requirement for elasticity and cost efficiency?

A.Use auto-scaling for the application tier and read replicas for the database
B.Implement auto-scaling for the database tier and use a larger application instance
C.Use a load balancer to distribute traffic to multiple database instances
D.Deploy large application and database instances to handle peak load
AnswerA

Auto-scaling handles stateless compute elasticity, read replicas scale database reads cost-effectively.

Why this answer

Auto-scaling the stateless application tier dynamically adds or removes instances based on CPU or request metrics, directly handling traffic spikes without over-provisioning. For the read-heavy database tier, read replicas offload SELECT queries from the primary database, improving read throughput and cost efficiency by scaling horizontally only when needed, while the primary handles occasional writes.

Exam trap

CompTIA often tests the misconception that auto-scaling applies equally to all tiers, but the trap here is that databases are stateful and require careful replication strategies (like read replicas) rather than simple instance scaling, and candidates may confuse load balancers with database replication mechanisms.

How to eliminate wrong answers

Option B is wrong because auto-scaling a database tier is complex and rarely used; databases are stateful and scaling them horizontally requires sharding or replication, not simple instance count changes, and using a larger application instance alone fails to handle spikes cost-effectively as it leads to over-provisioning. Option C is wrong because a load balancer distributing traffic to multiple database instances assumes all instances can handle writes, which breaks consistency unless a distributed database with consensus (e.g., Raft) is used; for a traditional RDBMS, this would cause split-brain or stale reads. Option D is wrong because deploying large instances to handle peak load is the opposite of elasticity—it wastes resources during low traffic and does not scale down, increasing costs without dynamic adjustment.

Full explanation →
140
Drag & Dropmedium

Order the steps to configure a load balancer to distribute traffic across multiple web servers.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First create the target group, define health checks, then the load balancer, listeners, and finally associate the target group.

Full explanation →
141
Multi-Selectmedium

A company is designing a hybrid cloud architecture connecting their on-premises data center to AWS. Which TWO options provide dedicated, private network connectivity? (Select TWO.)

Select 2 answers
A.Internet gateway
B.VPC peering
C.NAT gateway
D.Site-to-Site VPN
E.AWS Direct Connect
AnswersD, E

VPN creates a private encrypted tunnel over the internet.

Why this answer

AWS Direct Connect provides dedicated private connection, and VPN over the internet can also be private if encrypted, but it's not dedicated. Site-to-Site VPN is a valid private connectivity option. Internet gateway is public, VPC peering is between VPCs, not on-premises.

Full explanation →
142
MCQhard

A cloud administrator deploys a new application that writes logs to a block storage volume attached to a virtual machine. The application's performance degrades after a few hours. Monitoring shows that the volume's read latency is low, but write latency spikes periodically. The administrator discovers that the volume type is standard HDD. What should the administrator do to improve write performance without changing the application?

A.Migrate to a volume type with provisioned IOPS (SSD).
B.Increase the volume size to gain higher baseline IOPS.
C.Move the logs to an object storage service.
D.Enable write caching on the volume.
AnswerA

Provisioned IOPS SSD provides consistent high IOPS, eliminating write spikes.

Why this answer

Standard HDD volumes have low maximum IOPS and burst performance that is quickly exhausted under sustained writes, leading to write latency spikes. Migrating to a volume type with provisioned IOPS, such as SSD, provides consistent and higher write performance without requiring application changes. Option B is incorrect because increasing the volume size does increase baseline IOPS for HDD volumes, but the improvement is marginal and still relies on burst credits, which will be depleted again.

Option C is incorrect because moving logs to object storage changes the storage paradigm and would require application modifications to use different APIs. Option D is incorrect because write caching on a data volume is not recommended as it can lead to data loss in the event of a power failure, and caching is typically for read performance.

Full explanation →
143
MCQeasy

A company is migrating its on-premises workload to a public cloud. The security team wants to ensure that all data transmitted between the on-premises network and the cloud VPC is encrypted in transit and that the connection uses dedicated bandwidth. Which of the following should the security team implement?

A.Attach an internet gateway to the VPC and use public IP addresses.
B.Use a NAT gateway to translate private IPs to public IPs.
C.Configure a site-to-site VPN between the on-premises network and the cloud VPC.
D.Set up a direct connection between the on-premises router and the cloud VPC.
AnswerD

A dedicated connection (direct connection) provides a private, dedicated physical link between on-premises and the cloud VPC, meeting the bandwidth requirement. Encryption can be applied separately, making it the correct choice.

Why this answer

A dedicated connection (e.g., AWS Direct Connect or Azure ExpressRoute) provides a private physical link with dedicated bandwidth between on-premises and the cloud VPC. While encryption is not inherent, it can be added using IPsec over the direct connection or by using encrypted protocols on top. This combination satisfies both requirements: dedicated bandwidth and encryption in transit.

Option C (site-to-site VPN) encrypts traffic but uses shared internet bandwidth, failing the dedicated bandwidth requirement. Therefore, D is the best answer.

Exam trap

The trap is that candidates often focus on the encryption requirement and choose the VPN (Option C), overlooking that the question explicitly requires dedicated bandwidth. A direct connection (Option D) provides dedicated bandwidth and can be combined with encryption, while the VPN cannot guarantee bandwidth.

How to eliminate wrong answers

Option A is wrong because an internet gateway with public IPs exposes the VPC directly to the internet, does not encrypt traffic, and uses shared public bandwidth, not dedicated. Option B is wrong because a NAT gateway only translates private IPs to public IPs for outbound traffic, does not encrypt data in transit, and does not provide dedicated bandwidth. Option D is wrong because a direct connection (e.g., AWS Direct Connect) provides dedicated bandwidth but does not inherently encrypt data in transit; encryption must be added separately (e.g., IPsec over Direct Connect).

Full explanation →
144
MCQhard

A multinational corporation runs a critical application on a private cloud hosted in their data center. The application uses virtual machines (VMs) that are attached to a storage area network (SAN) for block storage. The company is migrating the application to a public cloud IaaS model to reduce on-premises costs. The security team mandates that all data at rest in the cloud must be encrypted using customer-managed keys, and the cloud provider must not have access to the keys. The application requires low-latency block storage for a database. The storage must be replicated within the same region for availability. The cloud architect needs to choose a storage solution that meets these security and performance requirements. The cloud provider offers: (A) Object storage with server-side encryption using provider-managed keys. (B) Ephemeral instance storage with encryption at rest using provider-managed keys. (C) Persistent block storage volumes with encryption using customer-managed keys stored in the provider's key management service (KMS) integrated with hardware security modules (HSM). (D) Network file system (NFS) shares encrypted with customer-managed keys managed on-premises. Which option should the architect choose?

A.Object storage with server-side encryption using provider-managed keys.
B.Ephemeral instance storage with encryption at rest using provider-managed keys.
C.Persistent block storage volumes with encryption using customer-managed keys stored in the provider's KMS/HSM
D.Network file system (NFS) shares encrypted with customer-managed keys managed on-premises.
AnswerC

Persistent block storage volumes with encryption using customer-managed keys stored in the provider's KMS/HSM. This is correct because it provides low-latency block storage, meets the customer-managed key mandate, and ensures the provider cannot access the keys.

Why this answer

It provides persistent block storage volumes, which are required for low-latency database workloads. The encryption uses customer-managed keys stored in the provider's key management service (KMS) integrated with hardware security modules (HSM), ensuring the provider cannot access the keys. This meets the security mandate.

Option A is wrong because object storage is not suitable for low-latency block storage, and it uses provider-managed keys. Option B is wrong because ephemeral instance storage is not persistent and replication is not guaranteed; also it uses provider-managed keys. Option D is wrong because NFS is file storage, not block, and managing keys on-premises introduces latency and complexity, which contradicts the low-latency requirement.

Full explanation →
145
MCQmedium

A security engineer is reviewing IAM policies and notices a policy that allows all actions on all resources for a user. Which principle of security is being violated?

A.Least privilege
B.Separation of duties
C.Need to know
D.Defense in depth
AnswerA

A policy with full access violates least privilege by granting excessive permissions.

Why this answer

The principle of least privilege states that users should be granted only the permissions necessary to perform their job functions.

Full explanation →
146
Matchingmedium

Match each compute service to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Emulated computer running an OS

Lightweight, isolated application environment

Event-driven code without server management

Physical server dedicated to a single tenant

Why these pairings

Correct matches: Virtual Machines provide virtualized hardware; Containers package code and dependencies; Serverless Functions run code on demand; Bare Metal offers dedicated hardware. Common confusions include mixing containers with VMs and serverless with bare metal.

Full explanation →
147
Multi-Selecteasy

A cloud architect is designing identity and access management (IAM) for a multi-cloud environment. The architect wants to enforce least privilege and support federation with an on-premises Active Directory. Which TWO of the following should be implemented? (Select TWO).

Select 2 answers
A.Storing shared credentials in application code
B.Assigning full administrator roles to all users
C.Disabling multi-factor authentication (MFA)
D.Using service accounts for application authentication
E.Federation using SAML
AnswersD, E

Service accounts provide dedicated identities with minimal permissions for apps.

Why this answer

Federation with SAML allows SSO from on-prem AD, and service accounts provide non-human identities for applications, both supporting least privilege by granting only necessary permissions.

Full explanation →
148
Multi-Selectmedium

A cloud administrator is troubleshooting a performance issue in a virtualized environment. Which TWO metrics should the administrator monitor to identify CPU contention? (Choose two.)

Select 2 answers
A.CPU usage percentage
B.CPU ready time
C.CPU co-stop time
D.CPU frequency
E.CPU load average
AnswersB, C

High ready time indicates the VM is waiting for CPU cycles due to contention.

Why this answer

CPU ready time (B) measures the time a virtual CPU is ready to run but is waiting for the physical CPU to become available, directly indicating contention for CPU resources. CPU co-stop time (C) occurs when a virtual machine with multiple vCPUs has one vCPU ready to run but is forced to wait because its sibling vCPUs are not scheduled simultaneously, which is a specific form of CPU contention in SMP configurations.

Exam trap

The trap here is that candidates often confuse CPU usage percentage with CPU contention, but usage measures consumption while ready time and co-stop time directly measure waiting caused by resource competition.

Full explanation →
149
MCQmedium

A company wants to deploy a Kubernetes application across multiple AWS accounts using a single set of manifests. The team needs to manage the deployment centrally while allowing each account to have its own configuration values (e.g., environment-specific variables). Which approach should the team use?

A.Use Terraform workspaces with Kubernetes provider
B.Use Helm charts with per-environment values files
C.Use CloudFormation StackSets with Kubernetes resources
D.Create separate manifests for each account
AnswerB

Helm allows centralized chart management with values overrides per environment.

Why this answer

Helm charts package Kubernetes manifests and support parameterization via values files, allowing centralized deployment with per-environment overrides.

Full explanation →
150
MCQhard

A company runs a critical e-commerce application on a cloud platform. The architecture includes a load balancer in front of an auto scaling group of compute instances across two availability zones. The instances are in a private subnet and use a NAT gateway for outbound internet access. The application stores session data in a managed Redis cache cluster. During a flash sale, users report that the site is extremely slow and some requests time out. Monitoring shows the load balancer's latency metric is high, and the number of healthy hosts fluctuates. The CPU utilization on the compute instances averages 60% and memory averages 70%. The Redis cluster's CPU utilization is 90%, and its memory usage is 95%. The NAT gateway's metrics show high BytesOutToSource but no errors. Which of the following is the most likely cause of the performance issue?

A.The NAT gateway is throttling traffic due to bandwidth limits
B.The managed Redis cache cluster is overloaded and becoming a bottleneck for session lookups
C.The auto scaling group is not scaling quickly enough due to cooldown periods
D.The load balancer's idle timeout setting is too low, causing premature connection drops
AnswerB

The Redis cluster's high CPU and memory utilization directly impact session operations, causing latency and timeouts.

Why this answer

The managed Redis cache cluster is the most likely bottleneck because its CPU utilization is at 90% and memory usage at 95%, indicating it is near capacity. Since the application stores session data in Redis, high latency and timeouts during a flash sale are consistent with an overloaded session store that cannot keep up with request volume, causing the load balancer to experience increased latency and healthy host fluctuations as sessions fail to be retrieved or written.

Exam trap

The trap here is that candidates may focus on the NAT gateway or auto scaling group because they are common bottlenecks, but the key clue is the Redis cluster's high CPU and memory metrics, which directly correlate with session store performance issues in a stateful application.

How to eliminate wrong answers

Option A is wrong because the NAT Gateway shows high BytesOutToSource but no errors, and NAT Gateway bandwidth limits are typically high (up to 10 Gbps per AZ) and would cause packet drops or errors if throttled, not just high latency. Option C is wrong because the Auto Scaling group's cooldown periods could delay scaling, but the EC2 instances are only at 60% CPU and 70% memory, which are not saturated, so scaling is not the primary issue. Option D is wrong because the ALB's idle timeout setting (default 60 seconds) controls how long the ALB keeps a connection open without data; premature connection drops would manifest as immediate disconnects, not high latency and timeouts.

Full explanation →
Page 1

Page 2 of 14

Page 3

All pages

1234567891011121314

Practice CV0-004 by domain

Target a specific domain to shore up weak areas.

Cloud Architecture and DesignDeploymentSecurityOperations and SupportTroubleshooting
See all domains with question counts →