Courseiva

CompTIA Cloud+ CV0-004 (CV0-004) — Questions 151–225

977 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 2

Page 3 of 14

Page 4
151
MCQhard

A cloud architect is designing a disaster recovery plan for a critical application with an RTO of 15 minutes and an RPO of 1 minute. The application runs on AWS EC2 instances with data stored on EBS volumes. Which replication strategy best meets these requirements?

A.EBS snapshots replicated to another region every hour
B.Continuous replication using AWS Elastic Disaster Recovery
C.Daily AMI backups stored in a different region
D.Cross-region replication of S3 buckets
AnswerB

Continuous replication provides low RPO (seconds to minutes) and fast RTO.

Why this answer

Continuous replication (e.g., using AWS Elastic Disaster Recovery) provides near-synchronous replication with very low RPO. Snapshot-based replication has higher RPO. Cross-region replication for S3 is for object storage.

Full explanation →
152
MCQhard

A cloud security team is reviewing audit logs and notices that a service account has been used to launch several high-risk API calls that are not part of its normal behavior. Which security control should be implemented to detect such anomalies in real time?

A.Enable API audit logging
B.Implement an anomaly detection service
C.Use a static IAM policy
D.Configure a network ACL
AnswerB

Anomaly detection services analyze logs for unusual patterns.

Why this answer

Anomaly detection tools use machine learning and behavioral analytics to identify unusual API activity in real time, providing early warning of potential security threats.

Full explanation →
153
MCQmedium

An organization uses CloudFormation to manage infrastructure across multiple AWS accounts. The team wants to deploy a common set of resources, such as VPCs and security groups, to all accounts in a consistent manner. Which CloudFormation feature should they use?

A.Change sets
B.Drift detection
C.StackSets
D.Nested stacks
AnswerC

StackSets enable multi-account deployments.

Why this answer

StackSets allow deploying stacks across multiple accounts and regions. Change sets preview changes, drift detection checks for manual changes, and nested stacks organize templates within a single account.

Full explanation →
154
MCQhard

During a security audit, a cloud engineer discovers that a container image used in production has a known critical vulnerability in a base layer. Which practice should be implemented to prevent this in the future?

A.Enable Kubernetes pod security policies
B.Use only official images from Docker Hub
C.Perform container image scanning during CI/CD
D.Implement network segmentation
AnswerC

Scanning identifies vulnerabilities early in the pipeline.

Why this answer

Regular container image scanning in the CI/CD pipeline detects vulnerabilities before deployment.

Full explanation →
155
MCQmedium

A company is migrating its on-premises applications to a public cloud. The security team wants to ensure that the cloud provider is responsible for physical security of data centers, while the company remains responsible for securing guest operating systems. Which concept does this describe?

A.Least privilege principle
B.Zero Trust architecture
C.Shared responsibility model
D.Defense in depth
AnswerC

Correctly describes the division of security responsibilities.

Why this answer

The shared responsibility model delineates security obligations between the cloud provider (physical infrastructure, hypervisor) and the customer (OS, applications, IAM).

Full explanation →
156
MCQmedium

An e-commerce application experiences variable traffic with sudden spikes during flash sales. The application is designed to be stateless. Which scaling approach should the cloud architect implement to handle these spikes efficiently?

A.Vertical scaling on a single large instance
B.Horizontal auto-scaling based on CPU utilization
C.Using a load balancer with active-passive failover
D.Pre-provisioning a fixed cluster of instances
AnswerB

Auto-scaling adds instances during spikes and removes them when demand drops, leveraging stateless design.

Why this answer

Horizontal scaling (adding more instances) combined with auto-scaling based on metrics like CPU utilization can dynamically handle traffic spikes. Stateless design enables seamless addition/removal of instances.

Full explanation →
157
MCQeasy

Which cloud service model provides the customer with the most control over the operating system and applications?

A.IaaS
B.FaaS
C.PaaS
D.SaaS
AnswerA

IaaS provides VMs, storage, networking; customers manage OS and applications.

Why this answer

IaaS provides virtualized computing resources where customers manage OS and above.

Full explanation →
158
MCQeasy

A cloud engineer needs to apply security patches to a group of Linux VMs running in Azure. The engineer wants to automate the patching process and ensure that patches are applied during a predefined maintenance window. Which Azure service should be used?

A.Azure Security Center
B.Azure Policy
C.Azure Backup
D.Azure Update Management
AnswerD

Update Management provides automated patching with maintenance windows.

Why this answer

Azure Update Management (part of Azure Automation) allows automated patching with scheduled maintenance windows.

Full explanation →
159
MCQhard

An organization is migrating a legacy application to the cloud. The application writes logs to a local file system. The cloud architect recommends using a centralized logging service. Which of the following BEST explains why this change is important?

A.To meet regulatory compliance requirements for log retention
B.To reduce storage costs by using object storage for logs
C.Because cloud instances are ephemeral and local logs would be lost if instances terminate
D.To encrypt log data at rest and in transit
AnswerC

Cloud instances can terminate, so logs must be sent off-instance.

Why this answer

Cloud instances are ephemeral; if an instance terminates, logs stored locally are lost. Centralized logging ensures logs persist independently of instance lifecycle. Option A is incorrect because regulatory compliance may be a secondary benefit, but the primary driver here is the ephemeral nature of instances, not compliance.

Option B is incorrect while reducing storage costs might be a benefit, the main reason for centralization is to prevent data loss, not cost savings. Option D is incorrect encryption is a security feature but not the fundamental reason for moving to centralized logging; the key issue is instance ephemerality.

Full explanation →
160
Multi-Selecthard

Which THREE of the following are key considerations when designing a cloud-native application for high availability? (Select exactly three.)

Select 3 answers
A.Use multithreading for all components
B.Use synchronous replication for databases
C.Implement loose coupling between services
D.Use stateless application components
E.Design for horizontal scaling using auto-scaling groups
AnswersC, D, E

Loose coupling (e.g., queues, APIs) isolates failures and improves resilience.

Why this answer

Loose coupling between services, typically achieved via asynchronous messaging or API gateways, ensures that the failure of one service does not cascade to others, which is fundamental for high availability in cloud-native architectures. This design pattern allows individual services to be updated, scaled, or fail independently, maintaining overall system resilience.

Exam trap

CompTIA often tests the misconception that high availability requires synchronous replication or multithreading, when in fact these can introduce tight coupling and single points of failure; the trap is confusing performance optimization with architectural resilience.

Full explanation →
161
MCQmedium

A cloud administrator is troubleshooting a performance issue with a relational database hosted on a cloud provider. The application team reports that queries are taking much longer than usual. The administrator checks the database monitoring dashboard and sees that the queries per second are within normal ranges, but the average query latency has doubled. The database is running on a VM with 4 vCPUs and 16 GB RAM. The storage type is SSD-backed General Purpose (GP2) with provisioned 3000 IOPS. The administrator notices that the Disk I/O Wait metric is consistently above 20%. What should the administrator do to improve query performance?

A.Shrink the database by archiving old data.
B.Increase the provisioned IOPS or upgrade to a higher-performance storage class like Provisioned IOPS SSD.
C.Add more memory to the VM to increase the database cache.
D.Add more vCPUs to the database VM.
AnswerB

Raising IOPS reduces disk queue depth and I/O wait, directly addressing the performance issue.

Why this answer

High I/O Wait indicates that the CPU is spending significant time waiting for disk I/O to complete. Increasing storage IOPS or switching to a higher-performance storage class (e.g., Provisioned IOPS SSD) will reduce I/O latency and improve query performance. Option B directly addresses the bottleneck.

Full explanation →
162
Multi-Selectmedium

A cloud operations team is implementing automated patching for Linux servers using AWS Systems Manager Patch Manager. They need to ensure patches are applied with minimal disruption and have a rollback plan. Which TWO actions should they take? (Select TWO.)

Select 2 answers
A.Create AMI snapshots of instances before patching
B.Configure a maintenance window for the patching operation
C.Enable auto-scaling to replace instances if patching fails
D.Use AWS Config to verify patch compliance after patching
E.Set the patch baseline to automatically approve all patches
AnswersA, B

Snapshots allow restoring the pre-patch state if needed.

Why this answer

Using maintenance windows ensures patches are applied during off-peak hours. Creating AMI snapshots before patching allows rollback if a patch causes issues.

Full explanation →
163
MCQeasy

Which cloud service model provides the customer with the ability to deploy and manage custom applications without managing the underlying operating system or runtime environment?

A.SaaS
B.PaaS
C.IaaS
D.FaaS
AnswerB

PaaS abstracts the OS and runtime, allowing customers to focus on application code.

Why this answer

PaaS provides a managed platform where customers deploy their code while the provider manages the OS, runtime, and infrastructure.

Full explanation →
164
MCQmedium

A developer is deploying a serverless application using AWS Lambda. They want to reuse common code (e.g., database connection logic) across multiple functions without duplicating it. Which Lambda feature should they use?

A.Lambda versions
B.Lambda aliases
C.Lambda layers
D.Lambda environment variables
AnswerC

Layers are used to centrally manage code and data shared across multiple functions.

Why this answer

Lambda Layers allow you to package and share code across multiple functions, enabling code reuse and reducing deployment package size.

Full explanation →
165
MCQmedium

A cloud engineer needs to deploy a containerized application on Amazon EKS. The application requires a persistent storage volume that can be dynamically provisioned. Which Kubernetes resource should be used to request storage?

A.PersistentVolume
B.PersistentVolumeClaim
C.StorageClass
D.ConfigMap
AnswerB

PVC is a request for storage by a pod.

Why this answer

A PersistentVolumeClaim (PVC) is the correct Kubernetes resource to request storage because it acts as a request for storage by a pod, specifying size, access modes, and optionally a StorageClass. In Amazon EKS, a PVC can trigger dynamic provisioning of an EBS or EFS volume via a StorageClass, decoupling the storage request from the underlying PersistentVolume. This allows the cloud engineer to deploy the containerized application without manually pre-provisioning storage.

Exam trap

The exam often tests the distinction between a PersistentVolume (the actual storage resource) and a PersistentVolumeClaim (the request for storage), leading candidates to mistakenly select PV when the question asks for the resource that 'requests' storage.

How to eliminate wrong answers

Option A is wrong because a PersistentVolume (PV) is a cluster resource representing pre-provisioned storage, not a request for storage; it is the backend volume that a PVC binds to. Option C is wrong because a StorageClass defines the storage type and provisioner (e.g., 'ebs.csi.aws.com') but does not itself request storage; it is referenced by a PVC to enable dynamic provisioning. Option D is wrong because a ConfigMap is used to inject configuration data (key-value pairs) into pods, not for persistent storage requests.

Full explanation →
166
MCQeasy

Which cloud service model provides the customer with the highest level of control over the operating system and middleware?

A.PaaS
B.FaaS
C.IaaS
D.SaaS
AnswerC

IaaS provides control over the OS, storage, and deployed applications.

Why this answer

IaaS provides virtualized computing resources where the customer manages the OS, middleware, and applications, offering the highest control among the three main service models.

Full explanation →
167
MCQmedium

A developer deployed a new version of a cloud function, but the function is returning 500 errors. The previous version worked fine. What is the most likely cause?

A.The function is using an outdated runtime.
B.The new code contains a runtime error.
C.The function's memory allocation is too low.
D.The function's timeout is set too short.
AnswerB

A bug in the new code is the most common cause of 500 errors after deployment.

Why this answer

The most likely cause of 500 errors after deploying a new version of a cloud function is a runtime error in the new code. A 500 Internal Server Error indicates that the function's code executed but threw an unhandled exception or logic error, which did not exist in the previous working version. Since the environment (runtime, memory, timeout) remained unchanged, the introduction of faulty code is the primary suspect.

Exam trap

CompTIA often tests the distinction between code-level errors (500) and resource/configuration errors (memory, timeout, runtime), tempting candidates to blame environment settings when the actual cause is a bug introduced in the new code.

How to eliminate wrong answers

Option A is wrong because an outdated runtime would cause deployment failures or compatibility warnings, not a sudden 500 error after a code change; the runtime version is typically fixed during deployment. Option C is wrong because memory allocation being too low would manifest as out-of-memory (OOM) errors or timeouts, not a generic 500 error, and the previous version worked with the same allocation. Option D is wrong because a timeout set too short would produce a 504 Gateway Timeout or a specific timeout error, not a 500 Internal Server Error, and the previous version succeeded with the same timeout value.

Full explanation →
168
MCQeasy

A company has a cloud-based application that uses a relational database. The database team performs daily backups to an on-premises storage system using a VPN connection. Recently, backups have been failing with timeout errors. The network team confirms the VPN is up and stable. Which of the following is the MOST likely cause?

A.The database service is not responding
B.The VPN bandwidth is insufficient for the backup data volume
C.The VPN tunnel is not properly configured
D.The on-premises firewall is blocking the backup port
AnswerB

Large backups can exceed VPN capacity, leading to timeouts.

Why this answer

The VPN connection is confirmed stable, so tunnel configuration and firewall issues are unlikely. Backup timeout errors with large data volumes typically indicate insufficient bandwidth, causing the transfer to exceed the timeout threshold. The database service itself is responding (backups are attempted), ruling out service unavailability.

Exam trap

The trap here is that candidates assume a stable VPN means the link has sufficient capacity, but CompTIA often tests the distinction between connectivity (layer 3) and throughput (layer 4/performance), where a stable tunnel can still be too slow for large data transfers.

How to eliminate wrong answers

Option A is wrong because if the database service were not responding, backups would fail immediately with a connection error, not a timeout after data transfer begins. Option C is wrong because the network team confirmed the VPN is up and stable, meaning the tunnel is properly configured and operational. Option D is wrong because a firewall block would cause a consistent failure (e.g., connection refused), not intermittent timeouts, and the VPN tunnel encrypts traffic, making port-specific blocking less likely.

Full explanation →
169
MCQmedium

A cloud architect is designing a multi-tier application that must meet a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 hour. Which disaster recovery strategy is MOST cost-effective while meeting these requirements?

A.Backup and restore from object storage
B.Warm standby with database replication
C.Pilot light with database replication
D.Active-active across two regions
AnswerB

Meets RTO and RPO cost-effectively.

Why this answer

Warm standby with database replication is the most cost-effective strategy that meets an RTO of 15 minutes and an RPO of 1 hour. It maintains a scaled-down but fully functional copy of the production environment in another region, with synchronous or asynchronous database replication ensuring data loss is within the 1-hour RPO. Failover can be automated to achieve the 15-minute RTO without the expense of running full production capacity in the standby region.

Exam trap

CompTIA often tests the distinction between pilot light and warm standby, where candidates mistakenly believe pilot light can achieve a 15-minute RTO because it has database replication, but they overlook the time needed to provision and configure compute resources, which pushes the RTO beyond the requirement.

How to eliminate wrong answers

Option A is wrong because backup and restore from object storage typically has an RTO of hours or days due to the time required to download and restore large volumes of data, and the RPO depends on backup frequency, which often exceeds 1 hour. Option C is wrong because pilot light with database replication can meet the RPO but usually has an RTO longer than 15 minutes, as it requires provisioning compute resources and scaling up the environment before failover. Option D is wrong because active-active across two regions is over-engineered and costly for these requirements, as it runs full production capacity in both regions simultaneously, which is unnecessary when an RTO of 15 minutes and RPO of 1 hour can be met with a warm standby.

Full explanation →
170
MCQmedium

Refer to the exhibit. The auto scaling group is fluctuating between 2 and 3 instances every few minutes. What is the most likely cause?

A.The instances are taking too long to become healthy.
B.The launch configuration has incorrect user data.
C.The load balancer is not properly distributing traffic.
D.The scaling policies are based on metrics that are too sensitive.
AnswerD

Oscillation occurs when metrics trigger both scale-out and scale-in frequently.

Why this answer

The auto scaling group fluctuating between 2 and 3 instances every few minutes indicates a scaling policy that is too sensitive, likely based on a metric such as CPU utilization or request count per target that oscillates rapidly. When the metric crosses the scale-out threshold, a new instance launches, causing the metric to drop below the scale-in threshold, which then terminates an instance, creating a cycle. This is a classic symptom of thrashing due to overly aggressive or poorly configured scaling policies.

Exam trap

CompTIA often tests the concept of scaling thrashing, and the trap here is that candidates may incorrectly attribute the oscillation to load balancer misconfiguration or instance health delays, rather than recognizing it as a direct symptom of overly sensitive scaling policies with insufficient cooldown or threshold margins.

How to eliminate wrong answers

Option A is wrong because instances taking too long to become healthy would cause the auto scaling group to launch additional instances while waiting, but it would not cause rapid fluctuation between 2 and 3 instances; instead, it would lead to a sustained higher count or failed health checks. Option B is wrong because incorrect user data in the launch configuration would cause instances to fail to initialize properly, leading to unhealthy instances and potential replacement, but not the specific 2-to-3 oscillation pattern. Option C is wrong because the load balancer not properly distributing traffic would cause uneven load but would not directly cause the auto scaling group to scale in and out every few minutes; the scaling policies are based on aggregated metrics, not load balancer distribution issues.

Full explanation →
171
MCQmedium

A healthcare organization uses a cloud-based virtual private cloud (VPC) to host a web application that processes protected health information (PHI). The application consists of a public-facing load balancer, a web server tier in a public subnet, and a database tier in a private subnet. The database runs on a managed relational database service with encryption at rest enabled using a cloud provider-managed key. The security auditor requires that the database encryption key must be controlled by the organization and rotated every 90 days. Additionally, the database must only be accessible from the web server tier. The database is currently accessible from the entire VPC CIDR block. What should the cloud administrator do to meet these requirements?

A.Export the database, disable encryption, and import into a new database with a customer-managed key.
B.Enable encryption with a provider-managed key and restrict database access using a network ACL.
C.Re-encrypt the database using a customer-managed key in the cloud provider's key management service, and update the database security group to only allow traffic from the web server security group.
D.Encrypt the web server's storage with a customer-managed key and keep the database encryption as is.
AnswerC

Customer-managed keys allow rotation, and security groups restrict access to the web tier only.

Why this answer

It addresses both requirements: re-encrypting the database with a customer-managed key in the cloud provider's KMS allows the organization to control and rotate the key every 90 days, and updating the database security group to only allow traffic from the web server security group restricts access to only the web server tier. Option A is incorrect because exporting and re-importing the database is unnecessary and disabling encryption is not recommended; re-encrypting in place is the proper approach. Option B is incorrect because provider-managed keys do not give the organization control or the ability to rotate the key as required.

Option D is incorrect because encrypting the web server's storage does not address database encryption or access control requirements.

Full explanation →
172
MCQhard

A company recently migrated its database to a cloud-managed database service. After the migration, the application team reports that some queries are returning stale data. The database is configured with read replicas. What is the most likely reason for the stale data?

A.The database parameter group is misconfigured.
B.The application is reading from a read replica that has replication lag.
C.The network latency between the application and database is high.
D.The database’s backup and restore process has corrupted the data.
AnswerB

Correct. Replication lag causes replicas to return older data; application should direct write-after-read to primary.

Why this answer

The most likely reason for stale data is that the application is reading from a read replica that has not yet applied all changes from the primary database. In cloud-managed database services like Amazon RDS or Azure SQL, read replicas use asynchronous replication, which introduces replication lag. If the application directs read queries to a replica that is behind, it will return data that is not current.

Exam trap

CompTIA Cloud+ often tests the concept of asynchronous replication lag in read replicas, and the trap here is that candidates may confuse stale data with network latency or misconfiguration, overlooking the fundamental behavior of read replicas returning data that is not yet fully synchronized.

How to eliminate wrong answers

Option A is wrong because a misconfigured database parameter group affects settings like memory, timeouts, or character sets, but it does not cause stale data from read replicas. Option C is wrong because high network latency would slow query response times but would not cause the database to return outdated data; the data itself would still be current. Option D is wrong because backup and restore processes are separate from live read replicas and would not cause stale data in ongoing operations; corruption would typically cause errors or missing data, not stale data.

Full explanation →
173
MCQhard

A company has deployed a containerized application on a Kubernetes cluster. The security team wants to ensure that containers cannot run as the root user and that the container's root filesystem is read-only. Which Kubernetes security mechanism should be used?

A.Pod Security Standards
B.Network policies
C.Seccomp profiles
D.Resource quotas
AnswerA

PSS includes the restricted profile that enforces these requirements.

Why this answer

Pod Security Standards (PSS) provide predefined security profiles (privileged, baseline, restricted) that enforce policies like running as non-root and read-only root filesystem.

Full explanation →
174
MCQeasy

A cloud administrator notices that a virtual machine (VM) is running slowly. The hypervisor shows high CPU ready time for that VM. Which of the following is the most likely cause?

A.High disk I/O latency on the datastore
B.Insufficient memory allocated to the VM
C.Overcommitted physical CPU resources on the host
D.Misconfigured virtual switch
AnswerC

Overcommitted CPU means the VM competes for physical cores, causing high ready time.

Why this answer

High CPU ready time indicates that the VM is ready to execute instructions but is waiting for the physical CPU to become available. This is a classic symptom of CPU overcommitment, where the host has more virtual CPUs (vCPUs) assigned to VMs than physical cores, causing contention. Option C correctly identifies this as the most likely cause.

Exam trap

CompTIA often tests the distinction between CPU ready time and other performance metrics, trapping candidates who confuse high CPU ready time with memory pressure or storage latency.

How to eliminate wrong answers

Option A is wrong because high disk I/O latency would manifest as high disk queue depth or high kernel latency, not as CPU ready time. Option B is wrong because insufficient memory would cause ballooning or swapping, not CPU ready time. Option D is wrong because a misconfigured virtual switch would cause network connectivity issues or packet loss, not CPU scheduling delays.

Full explanation →
175
MCQeasy

An architect is designing a cloud application that must handle unpredictable spikes in traffic. The application should automatically add resources during peak demand and remove them when demand decreases to minimize costs. Which scaling strategy should be used?

A.Scheduled scaling based on historical patterns
B.Vertical scaling of existing instances
C.Manual scaling by operations team
D.Horizontal auto-scaling based on CPU utilization
AnswerD

Automatically adds/removes instances as needed.

Why this answer

Horizontal auto-scaling based on CPU utilization is the correct strategy because it dynamically adds or removes instances in response to real-time demand, ensuring the application can handle unpredictable traffic spikes while minimizing costs. This approach aligns with cloud elasticity principles, where resources scale out (add instances) during high CPU load and scale in (remove instances) when load decreases, without manual intervention.

Exam trap

The trap here is that candidates often confuse vertical scaling (scaling up) with horizontal scaling (scaling out), assuming resizing existing instances is more cost-effective, but vertical scaling has hard limits and cannot match the elasticity required for unpredictable spikes.

How to eliminate wrong answers

Option A is wrong because scheduled scaling relies on predefined historical patterns, which cannot adapt to unpredictable spikes that deviate from those patterns. Option B is wrong because vertical scaling (resizing existing instances) has hardware limits and often requires downtime, making it unsuitable for handling sudden, unpredictable demand changes. Option C is wrong because manual scaling by the operations team introduces latency and human error, failing to provide the automatic, real-time response needed for unpredictable traffic.

Full explanation →
176
MCQmedium

A cloud administrator notices that an IAM role in a public cloud environment has permissions to perform all actions on all resources. The principle of least privilege should be applied. What is the best first step to reduce the security risk?

A.Delete the role and create a new one with minimal permissions immediately.
B.Create a new role with fewer permissions and ask users to switch roles.
C.Review the role's attached policies and identify unused or unnecessary permissions.
D.Modify the role's trust policy to restrict which users can assume it.
AnswerC

This allows targeted removal of excessive permissions while maintaining functionality.

Why this answer

The best first step is to review the role's attached policies and identify unused or unnecessary permissions (Option C). This aligns with the principle of least privilege by allowing the administrator to understand which permissions are actually needed before making changes, minimizing the risk of disrupting legitimate access. Deleting the role immediately (Option A) could cause service disruptions.

Creating a new role and asking users to switch (Option B) is time-consuming and may not address the root issue. Modifying the trust policy (Option D) restricts who can assume the role but does not reduce the permissions granted.

Full explanation →
177
MCQeasy

A cloud administrator needs to set up a centralized logging solution to collect logs from multiple projects. Which cloud service should be used?

A.Monitoring service
B.Logging service
C.Serverless function service
D.Audit logs service
AnswerB

Cloud Logging ingests and stores logs from various sources.

Why this answer

A centralized logging service is designed to aggregate and store logs from various sources, such as multiple projects or services, enabling administrators to search, monitor, and analyze log data in one place. The other options serve different purposes: monitoring focuses on metrics and alerts, serverless functions process events but do not natively centralize logs, and audit logs are a subset of logging typically focused on compliance and user activity.

Full explanation →
178
MCQhard

Your organization operates a three-tier web application hosted on a public cloud platform. The application tier consists of an auto-scaling group of virtual machines running a custom web service. The database tier is a managed MySQL service. Recently, users have reported slow response times during business hours, especially when the application performs write operations. Reviewing the monitoring dashboards shows that the CPU utilization on the application instances averages 80% and the database connection pool is consistently maxed out at 200 connections. The auto-scaling group is configured to add instances when CPU exceeds 70% for 5 minutes, but scaling events are not triggering as expected. The application team has confirmed that there are no code changes in the last week. You check the CloudWatch alarms and see no metric alarms for CPU. What is the MOST likely reason the auto-scaling group is not scaling out?

A.The auto-scaling group has reached the maximum instance count
B.The CPU metric alarm that triggers the scaling policy has been deleted or never configured
C.The auto-scaling group has a default cooldown period that is too long
D.The application instances are not responding to health checks
AnswerB

Auto-scaling policies require a metric alarm to trigger; missing alarm means no scaling.

Why this answer

The auto-scaling group relies on a metric alarm (e.g., CPU utilization) to trigger the scaling policy. Without any CloudWatch alarm for CPU, the scaling policy has no trigger, so scaling out never occurs. Option A is incorrect because the group may not have reached its maximum count; the issue is the lack of a trigger.

Option C is incorrect because the cooldown period only delays scaling after a scaling activity has been triggered, but no scaling event is occurring. Option D is incorrect because health checks affect instance replacement, not scaling based on load.

Full explanation →
179
MCQhard

A cloud administrator is designing an auto-scaling policy for a web application that experiences predictable traffic spikes during business hours. The administrator wants to ensure that the application scales out before the start of business hours to avoid performance degradation. Which scaling policy type should be used?

A.Manual scaling
B.Dynamic scaling
C.Scheduled scaling
D.Predictive scaling
AnswerC

Scheduled scaling allows you to define scaling actions at specific times, making it ideal for predictable traffic spikes before business hours.

Why this answer

Scheduled scaling allows scaling actions at specific times (e.g., before business hours).

Full explanation →
180
MCQhard

A company runs a critical application on a single VM in a public cloud. The VM uses a 500 GB managed disk. The company takes daily snapshots of the disk for backup. The operations team notices that the snapshot creation time has increased from 5 minutes to over an hour over the past month. The VM's disk usage has remained stable at around 200 GB. The VM runs a database that writes logs to a separate data disk (100 GB) which is not snapshotted. Which of the following is the MOST likely cause of the increasing snapshot time?

A.The VM's used disk space has increased significantly, requiring larger snapshots.
B.High write activity (churn) on the OS disk causing more data to be captured in each snapshot.
C.The data disk is consuming space on the OS disk due to log file growth.
D.The backup software is compressing snapshots, causing CPU overhead and longer times.
AnswerB

Snapshots capture blocks changed since last snapshot; high churn increases the volume of changed blocks.

Why this answer

The snapshot creation time has increased because of high write activity (churn) on the OS disk. Azure and other cloud platforms use a block-level incremental snapshot mechanism; when a disk has high churn, many blocks change between snapshots, forcing the snapshot process to read and store a large number of changed blocks even if the total used space remains stable. Since the VM runs a database that writes logs to a separate data disk (not snapshotted), the OS disk still experiences frequent writes from the database's log flushing or other system operations, causing the snapshot to capture many changed blocks and thus take longer.

Exam trap

The trap here is that candidates assume snapshot time correlates only with total used disk space, ignoring that write churn (block-level changes) is the primary driver of incremental snapshot duration in cloud environments.

How to eliminate wrong answers

Option A is wrong because the VM's used disk space has remained stable at around 200 GB, so the snapshot size is not increasing due to used space growth. Option C is wrong because the data disk is a separate 100 GB disk that is not snapshotted, and log file growth on that disk does not consume space on the OS disk or affect the OS disk's snapshot. Option D is wrong because the question does not mention any backup software performing compression; the snapshots are taken natively by the cloud provider's snapshot service, which does not apply CPU-intensive compression that would increase snapshot time.

Full explanation →
181
MCQmedium

During a cloud migration, a database server is moved from on-premises to a cloud-managed database service. After migration, the application team reports that some queries are running slower than before. The database CPU utilization is low. What is the most likely cause?

A.The network latency between the application and the database has increased
B.The database is not indexed properly
C.The database connection pooling is misconfigured
D.The cloud database instance type has insufficient memory
AnswerA

Higher latency increases query response time without affecting CPU.

Why this answer

Increased network latency between the application and the cloud database can slow query response times without raising CPU utilization. Option B is wrong: improper indexing forces full table scans, which typically increase CPU usage. Option C is wrong: misconfigured connection pooling usually leads to connection errors or timeouts, not consistently slow queries with low CPU.

Option D is wrong: insufficient memory causes swapping and high disk I/O, which would increase CPU usage.

Full explanation →
182
MCQhard

A company uses a cloud provider's identity federation to allow employees to sign in using their corporate Active Directory credentials. After a merger, employees from the acquired company need access. What must be modified to enable federated access for the new users without disrupting existing access?

A.Create a separate federation agreement for the new domain.
B.Manually create cloud IAM users for each employee.
C.Create a new identity provider in the cloud.
D.Update the trust policy to include the new Active Directory domain.
AnswerD

This seamlessly adds the new domain to the existing federation setup.

Why this answer

Updating the trust policy to include the new Active Directory domain allows federation from both the original and acquired domains under the same identity provider, enabling access for new users without disrupting existing access. Options A, B, and C are incorrect because they would either require separate management, create unnecessary overhead, or disrupt the existing federation setup.

Full explanation →
183
MCQhard

A security administrator is deploying a web application firewall (WAF) to protect a public-facing web application. The application experiences a high volume of traffic from a specific geographic region that is not part of the target customer base. Which WAF feature would best reduce the attack surface without impacting legitimate users?

A.IP whitelisting
B.Rate limiting
C.OWASP rule set
D.Geo-blocking
AnswerD

Geo-blocking blocks or allows traffic based on geographic location.

Why this answer

Geo-blocking allows the administrator to block traffic from specific regions, reducing the attack surface by eliminating traffic from non-target areas.

Full explanation →
184
MCQmedium

A company has a three-tier application in a cloud VPC: web servers in a public subnet, application servers in a private subnet, and database servers in a private subnet. The web servers can connect to the application servers, but the application servers cannot connect to the database servers. The security groups are configured as follows: - Web SG: inbound HTTP from 0.0.0.0/0, outbound all - App SG: inbound HTTP from Web SG, outbound all - DB SG: inbound MySQL from App SG, outbound all What is the most likely cause of the connectivity issue?

A.The database security group is missing an inbound rule for MySQL.
B.The application security group is missing an outbound rule for MySQL.
C.The network access control list (NACL) on the database subnet is blocking inbound traffic from the application subnet.
D.The web security group is blocking traffic to the database.
AnswerC

NACLs are stateless, so they must have explicit rules for traffic. A missing rule can block connectivity.

Why this answer

Security groups are stateful and allow return traffic automatically, so outbound rules are not the issue. The inbound rule on DB SG allows MySQL from App SG, so A is not the issue. B is not needed because outbound is all.

D is irrelevant because web SG does not affect traffic between app and DB. The issue likely is a network ACL (NACL) on the database subnet, which is stateless and needs explicit inbound and outbound rules; if it blocks inbound MySQL from the app subnet, the connection fails.

Full explanation →
185
MCQmedium

An Azure administrator needs to deploy a cloud-native application using Azure DevOps. The team wants to define the entire Azure infrastructure as code using a declarative language that is concise and integrated with Azure. Which tool should the administrator use?

A.Terraform
B.Bicep
C.Ansible
D.ARM templates (JSON)
AnswerB

Bicep is a declarative language for Azure that transpiles to ARM templates, offering a cleaner syntax.

Why this answer

Bicep is a domain-specific language for deploying Azure resources that provides a simpler syntax than ARM templates while being fully integrated with Azure.

Full explanation →
186
Multi-Selectmedium

A company is considering a multi-cloud deployment to avoid vendor lock-in. Which TWO factors should they consider? (Select TWO.)

Select 2 answers
A.Unified management tools support
B.Consistent security policies across clouds
C.Data egress costs between clouds
D.Performance differences between providers
E.Software licensing compatibility
AnswersB, C

Ensuring consistent security across different cloud providers is essential to avoid gaps.

Why this answer

Consistent security policies across clouds ensure a unified security posture, which is critical for compliance and risk management in a multi-cloud environment. Without consistent policies, vulnerabilities can arise from misconfigurations or gaps in coverage between providers. Option C is correct because data egress costs between clouds can be significant, as each cloud provider charges for data leaving their network, and these costs must be factored into the total cost of ownership to avoid budget overruns.

Exam trap

The trap here is that candidates often confuse operational benefits (like unified management or performance tuning) with strategic lock-in avoidance, leading them to select options A or D instead of focusing on cost and security consistency as the key differentiators.

Full explanation →
187
Multi-Selectmedium

A cloud operations team is preparing for a disaster recovery drill for a multi-tier application. Which TWO activities are essential for verifying the effectiveness of the DR plan? (Select TWO.)

Select 2 answers
A.Verify the RTO and RPO are achieved
B.Review the incident response plan
C.Update the asset inventory
D.Perform a failover test to the DR site
E.Conduct a security audit
AnswersA, D

Testing RTO/RPO confirms the recovery meets business continuity targets.

Why this answer

Failover testing validates that the DR site takes over correctly, and RTO/RPO verification ensures the recovery meets business requirements. Updating documentation is important but not a verification activity.

Full explanation →
188
MCQhard

A company is deploying a microservices architecture that must scale dynamically based on traffic. Which technology should be used?

A.Manually add more virtual machines during peak hours
B.Deploy a monolithic application on a single large instance
C.Kubernetes with Horizontal Pod Autoscaler
D.Use a single large instance with a load balancer
AnswerC

Kubernetes automates container orchestration and HPA scales pods based on demand.

Why this answer

Kubernetes with Horizontal Pod Autoscaler (HPA) automatically scales the number of pods based on metrics like CPU utilization or custom metrics, enabling dynamic scaling in a microservices architecture. Option A is incorrect because manually adding VMs is not dynamic and requires human intervention. Option B is incorrect because a monolithic application on a single instance cannot scale dynamically and lacks microservices benefits.

Option D is incorrect because a single large instance with a load balancer still has a fixed capacity and cannot scale out automatically.

Full explanation →
189
MCQmedium

During a CI/CD pipeline for a web application, the team wants to reduce risk by deploying a new version to a small percentage of users initially, monitoring for errors, and automatically rolling back if issues are detected. Which deployment strategy should they implement?

A.Blue/green deployment
B.Rolling deployment
C.In-place deployment
D.Canary deployment
AnswerD

Routes a small percentage of traffic to new version and monitors.

Why this answer

Canary deployment releases to a subset of users and includes monitoring and automatic rollback. Blue/green uses two full environments and switch traffic; rolling updates gradually replace instances; in-place updates replace instances without traffic shifting.

Full explanation →
190
MCQmedium

A cloud administrator receives an alert that a virtual machine's disk usage is at 95%. The VM hosts a database. Which of the following troubleshooting steps should the administrator take FIRST?

A.Expand the virtual disk by resizing the volume in the cloud console
B.Reboot the virtual machine to free up temporary files
C.Query the database for active connections to determine if there are long-running transactions
D.Check the disk to identify which files are consuming space
AnswerD

First step to understand the cause of high disk usage.

Why this answer

When a VM's disk usage reaches 95%, the first step is to identify what is consuming the space. Checking the disk to identify which files are consuming space (Option D) allows the administrator to determine whether the issue is caused by database logs, temporary files, or other data, and to plan an appropriate remediation without unnecessary risk or downtime.

Exam trap

The trap here is that candidates may assume high disk usage is always caused by temporary files or transactions, leading them to reboot or query the database first, rather than performing a simple disk space analysis to identify the actual culprit.

How to eliminate wrong answers

Option A is wrong because expanding the virtual disk without first identifying the cause of high usage may lead to uncontrolled growth and does not address the root cause; it also risks exceeding storage quotas or costs. Option B is wrong because rebooting the VM to free temporary files is a disruptive action that may not resolve the issue if the space is consumed by database logs or persistent data, and it could cause unnecessary downtime for a production database. Option C is wrong because querying for long-running transactions addresses performance issues, not disk space consumption; high disk usage is typically caused by data files, logs, or temporary files, not by active connections.

Full explanation →
191
Multi-Selecthard

A cloud engineer is configuring auto-scaling for a web application that experiences variable traffic. The application runs on virtual machines and uses a message queue for incoming requests. The scaling policy must ensure that the average CPU utilization stays around 60% and that the queue depth does not exceed 100 messages. Which THREE metrics should the engineer use for the scaling policies? (Choose three.)

Select 3 answers
A.Network throughput (bytes in/out)
B.CPU utilization
C.SQS queue depth (message count)
D.Memory utilization
E.Custom application metrics (e.g., request latency)
AnswersB, C, E

CPU utilization is used for target tracking to maintain 60%.

Why this answer

The required metrics are CPU utilization, SQS queue depth (message queue length), and custom application metrics can be used for additional application-specific scaling. Memory and network throughput are not specified as requirements.

Full explanation →
192
MCQhard

An organization uses Terraform to manage multi-cloud infrastructure across AWS and Azure. The state file must be stored securely with locking to prevent concurrent modifications. Which backend configuration should the team use?

A.GitHub repository with Terraform Cloud agent
B.Azure DevOps pipeline variable group
C.AWS S3 bucket with DynamoDB table for locking
D.Local file system with .terraform.lock.hcl
AnswerC

S3 stores state; DynamoDB provides state locking, preventing concurrent operations.

Why this answer

Terraform supports remote backends like AWS S3 with DynamoDB for state locking, which provides both state storage and locking. Azure Blob Storage can also be used with blob lease locking.

Full explanation →
193
MCQhard

An organization is migrating a MySQL database to Amazon Aurora with minimal downtime. The migration must capture ongoing changes from the source database and apply them to the target during the cutover. Which AWS Database Migration Service (DMS) feature should be used?

A.Validation
B.Change data capture (CDC)
C.Full load only
D.Schema conversion
AnswerB

CDC enables continuous replication of changes, allowing minimal downtime migration.

Why this answer

AWS DMS supports ongoing replication using change data capture (CDC), which continuously replicates changes from the source to the target with minimal downtime.

Full explanation →
194
MCQeasy

A cloud administrator notices that a virtual machine (VM) hosting a web application is consistently running at 95% CPU utilization during business hours. End users complain that the application is slow. The application is stateless and can scale horizontally. The VM is part of an auto-scaling group configured with a target tracking scaling policy based on average CPU utilization. The administrator checks CloudWatch metrics and sees that the CPU utilization has been above the target of 70% for the last two hours, but no new instances have been launched. What should the administrator do FIRST to resolve the issue?

A.Verify that the CloudWatch agent is sending CPU metrics and that the metric names match the scaling policy configuration.
B.Manually increase the desired capacity of the auto-scaling group.
C.Reduce the target tracking value to 50% so scaling happens sooner.
D.Replace the instance with a larger instance type that has more vCPUs.
AnswerA

If metrics are missing or misconfigured, auto-scaling cannot trigger. This is the most direct diagnostic step.

Why this answer

The auto-scaling policy is configured to scale based on average CPU utilization, but it has not triggered despite sustained high CPU. Since the application is stateless and can scale horizontally, the issue is likely that the scaling policy is not receiving the correct metrics. The first step should be to verify that the CloudWatch agent is properly sending CPU metrics and that the metric names and dimensions match the scaling policy configuration.

Without accurate metrics, auto-scaling cannot make scaling decisions. Option A is correct because it addresses the root cause—missing or mismatched metrics. Options B, C, and D are premature actions that do not diagnose the underlying issue; manually scaling, changing thresholds, or resizing the instance may temporarily help but do not fix the core problem.

Full explanation →
195
MCQmedium

A company uses a hybrid cloud model with on-premises servers and a public cloud. The IT team wants to ensure that critical data is backed up daily and retained for 30 days. The backup solution must be cost-effective. Which of the following backup strategies BEST meets these requirements?

A.Full backup daily to cloud storage with a 30-day lifecycle policy.
B.Full backup daily to tape, retained for 30 days.
C.Differential backup daily to cloud storage, with full backup every 30 days.
D.Incremental backup daily to cloud storage, with weekly full backup.
AnswerD

Incremental backups are small and cost-effective; weekly full provides baseline; retention can be set to 30 days.

Why this answer

It combines daily incremental backups to cloud storage with a weekly full backup, minimizing daily data transfer and storage costs while ensuring a full recovery point within the week. The 30-day retention is achieved by retaining the weekly full backup and all incremental backups for 30 days, which is cost-effective compared to daily full backups. This strategy aligns with the 3-2-1 backup rule and leverages cloud storage's pay-as-you-go model.

Exam trap

A common misconception is that differential backups are more efficient than incremental backups, but in this scenario, daily differentials grow over the 30-day period, making them less cost-effective than daily incrementals with a weekly full backup.

How to eliminate wrong answers

Option A is wrong because performing a full backup daily to cloud storage would incur high storage and bandwidth costs, making it less cost-effective than needed, and the 30-day lifecycle policy would delete backups after 30 days but still waste resources on daily full copies. Option B is wrong because tape backups are slow to access, require manual handling, and are not cost-effective for daily backups in a hybrid cloud scenario, as they lack the scalability and automation of cloud storage. Option C is wrong because a differential backup daily with a full backup every 30 days means each differential grows in size until the next full backup, leading to larger daily transfers and higher storage costs, and recovery would require the last full backup plus the latest differential, which is less efficient than incremental backups.

Full explanation →
196
MCQmedium

An organization is using CloudFormation to manage AWS infrastructure. They need to detect if any manual changes have been made to resources outside of CloudFormation. Which CloudFormation feature should they use?

A.Change sets
B.Drift detection
C.Stack sets
D.Resource signals
AnswerB

Correct. Drift detection identifies resources that have drifted from the template definition.

Why this answer

CloudFormation drift detection compares the current state of resources with the expected state defined in the stack template. It identifies resources that have been modified manually, known as drift.

Full explanation →
197
MCQhard

A cloud administrator receives an alert that a virtual machine has unexpectedly shut down. The administrator checks the hypervisor logs and finds an entry "Out of memory: killed process" in the VM's OS logs. Which of the following is the most likely cause?

A.The hypervisor memory overcommitment is too high.
B.The VM has a memory leak in its application.
C.The VM's memory balloon driver is not installed.
D.The VM's swap space is insufficient.
AnswerB

A memory leak causes the VM's memory to be exhausted, triggering the OOM killer.

Why this answer

The log entry 'Out of memory: killed process' indicates that the Linux kernel's Out-Of-Memory (OOM) killer terminated a process to free memory. This is typically triggered when the system runs out of available memory, often due to a memory leak in an application consuming memory over time without releasing it. While hypervisor-level issues can cause VM instability, the specific OOM killer message points to a guest OS-level memory exhaustion problem, making a memory leak the most likely cause.

Exam trap

CompTIA Cloud+ often tests the distinction between guest OS-level memory exhaustion (e.g., memory leak) and hypervisor-level memory management (e.g., overcommitment or ballooning), leading candidates to incorrectly attribute the OOM killer message to hypervisor issues rather than the application inside the VM.

How to eliminate wrong answers

Option A is wrong because hypervisor memory overcommitment can cause the hypervisor to reclaim memory from VMs (e.g., via ballooning or swapping), but it does not directly cause the guest OS's OOM killer to fire; the guest OS would see its memory shrink but not necessarily run out unless the balloon driver forces it. Option C is wrong because the memory balloon driver not being installed would prevent the hypervisor from reclaiming unused memory from the VM, potentially leading to wasted resources, but it does not cause the guest OS to run out of memory and trigger the OOM killer; in fact, without ballooning, the VM retains all its allocated memory. Option D is wrong because insufficient swap space can lead to the OOM killer if memory is exhausted and no swap is available, but the OOM killer message itself does not indicate a swap insufficiency; it indicates that the system ran out of both physical RAM and swap, and the root cause is often a memory leak consuming all available memory, not just a lack of swap.

Full explanation →
198
MCQhard

A cloud engineer runs the commands shown in the exhibit. Based on the output, which security issue is present?

A.The bastion host is not used for SSH access.
B.The web servers are not running.
C.The firewall rule allows SSH access from any source IP.
D.There are too many firewall rules allowing SSH.
AnswerC

The sourceRanges is 0.0.0.0/0, meaning all IPs can SSH into the instances.

Why this answer

The firewall rule 'allow-ssh' allows SSH (tcp:22) from all source IP addresses (0.0.0.0/0), which is a security risk. Option A is incorrect because the bastion host is not shown to be unused for SSH access; the issue is the firewall rule, not the use of the bastion host. Option B is incorrect because the output shows the web servers are running (status RUNNING).

Option D is incorrect because the concern is not the number of rules but that the single rule allows SSH from any IP.

Full explanation →
199
MCQeasy

A cloud architect is designing a deployment pipeline using GitHub Actions. They want to automatically run tests on every push to the main branch. Which GitHub Actions component defines the automation workflow?

A.Job
B.Step
C.Action
D.Workflow
AnswerD

A workflow is the top-level automation unit.

Why this answer

A workflow is a configurable automated process defined in YAML in the .github/workflows directory.

Full explanation →
200
MCQmedium

A company is deploying a cloud-based application that requires consistent, low-latency access to shared database files. Which storage option should be used for the database files?

A.Block storage volumes attached to the database server
B.Network file system (NFS) mount
C.Object storage (e.g., Amazon S3)
D.Ephemeral instance storage
AnswerA

Block storage offers high performance and low latency for random I/O, making it ideal for databases.

Why this answer

Block storage volumes (e.g., Amazon EBS or Azure Managed Disks) provide consistent, low-latency I/O performance because they are directly attached to the database server via a high-speed network and support protocols like NVMe or SCSI. This allows the database to perform synchronous writes and reads with minimal jitter, which is critical for transactional workloads that require ACID compliance. Unlike shared file systems or object storage, block storage offers the raw disk-level access that database engines (e.g., MySQL, PostgreSQL, SQL Server) expect for their data and log files.

Exam trap

CompTIA often tests the misconception that NFS is suitable for database workloads because it provides shared access, but the trap is that NFS lacks the low-latency, synchronous write guarantees required for transactional databases, and candidates overlook the performance penalties of network file locking and cache coherency protocols.

How to eliminate wrong answers

Option B is wrong because NFS mounts introduce network latency and protocol overhead (e.g., lock management, stateless operations) that can cause performance degradation and consistency issues for database workloads, especially under concurrent write operations. Option C is wrong because object storage (e.g., Amazon S3) uses a RESTful API with eventual consistency models and higher latency, making it unsuitable for low-latency database file access that requires immediate read-after-write consistency. Option D is wrong because ephemeral instance storage is temporary and data is lost when the instance is stopped or terminated, which violates the requirement for persistent, shared database files.

Full explanation →
201
Multi-Selectmedium

A cloud architect is designing a CI/CD pipeline for a critical application that requires zero-downtime deployments. The architect wants to gradually shift traffic to the new version while monitoring for errors and automatically rolling back if issues are detected. Which TWO deployment strategies should the architect consider? (Select TWO.)

Select 2 answers
A.Blue/green deployment
B.Rolling deployment
C.Immutable deployment
D.A/B testing deployment
E.Canary deployment
AnswersA, E

Blue/green switches traffic and can rollback quickly.

Why this answer

Canary and blue/green both support gradual traffic shift and rollback. Rolling updates are gradual but may not have automatic rollback based on monitoring. A/B testing is not a deployment strategy.

Immutable deployments replace instances but not gradual.

Full explanation →
202
MCQeasy

A cloud administrator is troubleshooting a connectivity issue between two virtual machines in the same VPC but different subnets. Both VMs have security groups that allow all traffic from the VPC CIDR. What should the administrator check first?

A.The VPC flow logs.
B.The network ACLs for both subnets.
C.The route tables for both subnets.
D.The DHCP option set.
AnswerB

NACLs are stateless and may be blocking traffic even if security groups allow it.

Why this answer

Network ACLs are stateless and evaluate traffic entering and leaving a subnet. Even if security groups allow all traffic from the VPC CIDR, a default or custom NACL rule might implicitly deny traffic between subnets. Since the VMs are in different subnets, the NACL for each subnet must be checked first to ensure inbound and outbound rules permit the traffic.

Exam trap

The trap here is that candidates assume security groups alone control all traffic, forgetting that NACLs are stateless and must be configured for both inbound and outbound directions on each subnet involved.

How to eliminate wrong answers

Option A is wrong because VPC flow logs capture metadata about accepted and rejected traffic but are a diagnostic tool, not the first check for a connectivity issue caused by a missing allow rule. Option C is wrong because route tables control the path traffic takes between subnets, but if the route exists (e.g., local route), the issue is more likely a firewall rule. Option D is wrong because DHCP option sets only provide configuration parameters like DNS servers and domain names, not traffic filtering or routing.

Full explanation →
203
MCQhard

A DevOps engineer is configuring a Kubernetes deployment for a microservices application. The application requires that new pods receive traffic only after a health check endpoint returns HTTP 200. Which Kubernetes feature should be configured on the pods?

A.Startup probe
B.Liveness probe
C.Resource limits
D.Readiness probe
AnswerD

Readiness probes indicate when a pod is ready to serve traffic; Kubernetes only sends traffic to pods with a successful readiness probe.

Why this answer

Readiness probes determine whether a pod is ready to receive traffic; only when the probe succeeds is the pod added to service endpoints.

Full explanation →
204
MCQmedium

A cloud security analyst finds the above JSON policy attached to an S3 bucket containing confidential customer data. What change must be made to comply with the principle of least privilege?

A.Restrict the Principal to a specific AWS account or user.
B.Change the Effect to 'Deny'.
C.Change the Action to 's3:PutObject'.
D.Remove the Resource field.
AnswerA

This limits access to only authorized identities.

Why this answer

The JSON policy attached to the S3 bucket includes a wildcard Principal ("Principal": "*"), which allows anonymous access to anyone. To comply with the principle of least privilege, access must be restricted to only authorized entities. Option A correctly identifies this by requiring the Principal to be set to a specific AWS account or user, ensuring only authenticated and authorized principals can access the bucket.

Full explanation →
205
Multi-Selectmedium

Which TWO actions should a cloud administrator take to protect against data exfiltration from a cloud storage bucket? (Choose two.)

Select 2 answers
A.Implement server-side encryption with SSE-S3.
B.Enable object versioning on the bucket.
C.Configure bucket access logs for monitoring.
D.Block all public access by configuring bucket policies and ACLs.
E.Enable MFA delete on the bucket.
AnswersA, D

Encryption protects data at rest; even if exfiltrated, the data is unreadable without the key.

Why this answer

Enabling object versioning allows recovery if data is deleted or overwritten but does not prevent exfiltration. Requiring MFA for delete operations prevents unauthorized deletion but not reading. Restricting public access and encrypting data at rest are effective controls against exfiltration.

Audit logging is detective, not preventive.

Full explanation →
206
MCQmedium

Refer to the exhibit. A cloud engineer is reviewing logs from an EC2 instance. Which of the following is the MOST likely root cause of the application failure?

A.The application experienced a segmentation fault due to a code bug
B.The instance ran out of memory because the application had a memory leak
C.The instance was stopped by the cloud provider due to a license violation
D.The disk space reached 100% capacity, preventing the application from writing logs
AnswerD

The sequence shows disk warnings before application failures.

Why this answer

When disk space reaches 100% capacity, the operating system cannot write new data to the filesystem. Since the application relies on writing logs (and potentially other data) to disk, it will fail when it cannot perform these write operations. This is a common root cause in cloud environments where log rotation is not configured or monitoring thresholds are not set.

Exam trap

CompTIA often tests the distinction between memory-related failures (segfaults, OOM) and disk-related failures, where candidates mistakenly attribute a log-write failure to a memory issue instead of checking disk space.

How to eliminate wrong answers

Option A is wrong because a segmentation fault is a memory access violation caused by a code bug, which would generate a core dump and specific error messages in logs, not a gradual failure due to disk space exhaustion. Option B is wrong because running out of memory due to a memory leak would manifest as the kernel OOM killer terminating processes or the application crashing with out-of-memory errors, not as a failure to write logs. Option C is wrong because cloud providers like AWS do not stop instances for license violations; they may disable the instance or revoke access, but the instance itself would not be stopped by the provider for this reason.

Full explanation →
207
MCQmedium

An administrator notices that a cloud-hosted database is experiencing high latency during peak usage. The CPU and memory utilization on the DB server are below 50%, but disk IOPS are consistently at the provisioned limit. What should the administrator check first?

A.Check network bandwidth between the DB and application servers.
B.Add additional storage volumes and stripe data.
C.Check if the storage volume has an IOPS cap.
D.Increase the number of vCPUs on the DB server.
AnswerC

Saturating the IOPS limit causes queuing and high latency.

Why this answer

The symptoms (high latency, low CPU/memory utilization, but disk IOPS at provisioned limit) indicate the storage volume's IOPS cap is being hit, causing queueing and latency. Option A is incorrect because network bandwidth is not indicated as the bottleneck; CPU and memory are low, and latency is tied to disk. Option B is incorrect because adding storage volumes would not directly address the IOPS cap; it might spread load but does not increase the per-volume IOPS limit.

Option D is incorrect because increasing vCPUs would not resolve an IOPS limitation; the CPU is not saturated.

Full explanation →
208
MCQhard

A cloud administrator is troubleshooting a database failover issue. The database is a managed service with a primary and standby replica in different availability zones. The application uses a read-write endpoint. During a recent maintenance event, the primary database failed over automatically, but the application experienced a 10-minute outage. The administrator checks the failover logs and sees that it completed within 2 minutes. What is the most likely cause of the extended outage?

A.The application's database connection pool does not retry DNS resolution
B.The application was not configured to use multiple availability zones
C.The standby replica was not in sync
D.The failover triggered a change in the endpoint DNS record
AnswerA

Stale connections continue to point to the old primary IP, causing failures until the pool refreshes.

Why this answer

If the application's connection pool caches the IP address of the primary database, it will not automatically re-resolve the DNS after failover, causing prolonged outages. Option B is wrong because multi-AZ configuration is about the database, not the application's endpoint configuration. Option C is wrong because if the standby was out of sync, failover would not complete cleanly.

Option D is wrong because the DNS change is usually fast but the application may not re-query DNS.

Full explanation →
209
MCQmedium

A cloud administrator notices that a virtual machine is running out of memory and causing performance issues. The VM is part of a production web application. Which of the following actions should the administrator take FIRST to resolve the issue without impacting availability?

A.Stop the VM and increase its memory allocation, then restart it.
B.Add a swap file to the VM's virtual disk.
C.Take a snapshot of the VM and then increase memory allocation.
D.Perform a live migration of the VM to a host with more memory.
AnswerB

Adding a swap file provides virtual memory without downtime, relieving memory pressure.

Why this answer

Adding a swap file to the VM's virtual disk provides virtual memory, which can be allocated while the VM is running and does not require downtime. This is the first action to relieve memory pressure without impacting availability. Live migration (D) does not increase the VM's memory allocation, so it does not resolve the issue.

Stopping the VM (A) causes downtime. Taking a snapshot (C) adds overhead and increasing memory may still require a restart.

Exam trap

Candidates often think live migration resolves memory pressure, but it only changes the host, not the VM's memory allocation. The correct first step is to add virtual memory via a swap file, which can be done without downtime.

How to eliminate wrong answers

Option A is wrong because stopping the VM to increase memory allocation causes downtime, which violates the requirement to not impact availability. Option B is wrong because adding a swap file to the VM's virtual disk only shifts memory pressure to disk I/O, degrading performance further, and does not resolve the underlying physical memory shortage. Option C is wrong because taking a snapshot before increasing memory is unnecessary for a memory change and does not prevent the need to stop the VM (unless using hot-add memory, which is not implied), and snapshots can cause performance overhead and storage issues.

Full explanation →
210
MCQeasy

A cloud architect needs to choose a compute service for a batch processing job that runs once a day and takes about 30 minutes. The job is CPU-intensive and can tolerate interruptions. Which compute option is the most cost-effective?

A.Reserved instances
B.Spot (preemptible) instances
C.Dedicated hosts
D.On-demand instances
AnswerB

Spot instances provide the lowest cost for fault-tolerant, short-lived workloads.

Why this answer

(Spot/preemptible instances) is the most cost-effective for this interruptible batch job. Reserved instances (A) require a long-term commitment, on-demand instances (D) are more expensive, and dedicated hosts (C) are costly and unnecessary.

Full explanation →
211
Multi-Selecteasy

A cloud engineer is writing Ansible playbooks to automate the configuration of cloud resources. Which TWO statements about Ansible are true?

Select 2 answers
A.Ansible requires an agent installed on each managed node.
B.Ansible uses a declarative language like HCL.
C.Ansible uses YAML for playbook syntax.
D.Ansible modules are used to interact with cloud providers.
E.Ansible is a CI/CD pipeline tool.
AnswersC, D

Playbooks are written in YAML.

Why this answer

Ansible is agentless (uses SSH/WinRM) and uses YAML for playbooks. It requires Python on control node, not agents on target hosts. It is not primarily for orchestration of CI/CD pipelines.

Full explanation →
212
MCQeasy

A cloud architect needs to centrally manage logs from multiple AWS accounts. Which service should be used to aggregate logs into a single view?

A.AWS CloudWatch Logs
B.AWS CloudTrail
C.AWS Config
D.AWS X-Ray
AnswerA

CloudWatch Logs aggregates logs from multiple sources.

Why this answer

AWS CloudWatch Logs can aggregate log data from multiple accounts into a single log group for centralized monitoring.

Full explanation →
213
MCQmedium

A cloud architect is creating a Terraform configuration to deploy resources in AWS. The architect needs to store the state file in a remote backend that supports state locking and encryption at rest. Which backend should the architect configure?

A.Local file system with Terraform Cloud
B.S3 with DynamoDB for state locking
C.Azure Blob Storage with a lease blob for locking
D.Google Cloud Storage with object versioning
AnswerB

S3 backend with DynamoDB provides remote state and locking.

Why this answer

S3 with DynamoDB for locking is a recommended backend for Terraform state in AWS. Azure Blob Storage is for Azure, GCS for GCP, and local backend does not support remote state or locking.

Full explanation →
214
MCQmedium

A company's compliance team must provide evidence that their cloud environment meets PCI DSS requirements. Which AWS service can aggregate security findings and automate compliance checks?

A.AWS Config
B.AWS Security Hub
C.Amazon Inspector
D.AWS CloudTrail
AnswerB

Security Hub centralizes security findings and compliance checks.

Why this answer

AWS Security Hub provides a comprehensive view of security alerts and compliance status across AWS accounts, including automated checks against standards like PCI DSS.

Full explanation →
215
MCQmedium

A company migrated to a hybrid cloud and users report slow access to files stored in the cloud. The on-premises network is 100 Mbps. What troubleshooting step should be taken?

A.Enable compression on the cloud storage gateway
B.Check VPN bandwidth and latency
C.Increase cloud storage performance tier
D.Move files to on-premises storage
AnswerB

VPN bandwidth and latency directly affect file transfer speeds.

Why this answer

Slow file access over a hybrid connection is often due to limited VPN bandwidth or high latency. Option A is wrong because increasing storage performance tier may not address network bottlenecks. Option C is wrong because moving files back defeats the hybrid cloud purpose.

Option D is wrong because compression may help but isn't the first step to diagnose the issue.

Full explanation →
216
MCQeasy

A cloud engineer is troubleshooting a performance issue in a virtualized environment. A critical application is running slowly, and the engineer suspects resource contention. The host server has 32 vCPUs and 256 GB of RAM, running four VMs. Which tool should the engineer use to determine if CPU ready time is causing the performance degradation?

A.Run the 'top' command inside the affected VM
B.Deploy a network analyzer to capture traffic between VMs
C.Check the performance monitor in the guest operating system
D.Use the hypervisor's monitoring console to view CPU ready time
AnswerD

Hypervisor consoles provide CPU ready metrics indicating contention.

Why this answer

CPU ready time is a hypervisor-level metric that measures the time a VM is ready to execute but must wait for a physical CPU core to become available. Since the engineer suspects resource contention among VMs on the same host, the hypervisor's monitoring console is the only tool that can expose this metric directly. Guest OS tools like 'top' or Performance Monitor cannot see CPU ready time because it occurs at the virtualization layer, not inside the VM.

Exam trap

The trap here is that candidates assume guest OS tools like 'top' or Performance Monitor can detect all CPU-related bottlenecks, but they cannot see hypervisor-level metrics like CPU ready time, which requires the hypervisor's own monitoring console.

How to eliminate wrong answers

Option A is wrong because the 'top' command inside the affected VM shows guest-level CPU utilization, not hypervisor-level CPU ready time, which is invisible to the guest OS. Option B is wrong because a network analyzer captures traffic between VMs and is used for network latency or packet loss issues, not CPU scheduling contention. Option C is wrong because the guest OS performance monitor reports CPU usage from the guest's perspective, but CPU ready time is a hypervisor metric that the guest cannot measure or report.

Full explanation →
217
MCQmedium

An organization is subject to PCI DSS compliance and must ensure that all data transmitted between its cloud application and users is encrypted. Which encryption method should be enforced?

A.AES-256
B.TLS 1.2 or higher
C.SHA-256
D.IPsec VPN
AnswerB

TLS 1.2+ provides secure encryption in transit and is required by PCI DSS.

Why this answer

TLS (Transport Layer Security) is the standard protocol for encrypting data in transit over networks, such as between a web browser and a server. PCI DSS requires strong encryption for cardholder data in transit.

Full explanation →
218
Multi-Selecthard

A company wants to ensure fault tolerance for a critical application by deploying across multiple availability zones. Which THREE design decisions contribute to fault tolerance? (Select THREE.)

Select 3 answers
A.Using a single database instance without replication
B.Placing a load balancer in front of the instances to distribute traffic
C.Deploying application instances in at least two availability zones
D.Implementing duplicate components (N+1 redundancy) in each tier
E.Using a single large instance in one AZ
AnswersB, C, D

Load balancers distribute traffic and can route away from failed instances.

Why this answer

Deploying across multiple AZs, using load balancers to distribute traffic, and having redundant components in each AZ contribute to fault tolerance. Single instance and same AZ do not provide fault tolerance.

Full explanation →
219
MCQeasy

A cloud customer needs to ensure that data stored in an object storage bucket is encrypted at rest. The customer wants to manage the encryption keys themselves. Which encryption option should they choose?

A.Server-side encryption with provider-managed keys
B.Server-side encryption with customer-provided keys
C.Server-side encryption with key management service
D.Client-side encryption
AnswerB

SSE-C allows the customer to provide their own encryption keys, which AWS uses and then discards.

Why this answer

Server-side encryption with customer-provided keys allows the customer to manage their own encryption keys while the cloud provider handles the encryption and decryption process. The customer provides the encryption key as part of the upload request, and the provider uses it to encrypt the object at rest, then discards the key after the operation. This meets the requirement of managing the keys themselves while ensuring data is encrypted at rest on the server side.

Exam trap

CompTIA Cloud+ often tests the distinction between server-side and client-side encryption, where candidates mistakenly choose client-side encryption because they think 'managing keys' means encrypting on the client, but the question explicitly requires encryption at rest in object storage, which is server-side.

How to eliminate wrong answers

Option A (SSE-S3) is wrong because AWS manages the encryption keys entirely, not the customer. Option C (SSE-KMS) is wrong because while it allows customer control over key policies and rotation, the keys themselves are managed by AWS KMS, not directly by the customer. Option D (Client-side encryption) is wrong because the customer encrypts data before sending it to S3, meaning encryption happens on the client side, not at rest on the server, and the customer manages the keys entirely, but this does not meet the 'encrypted at rest in S3' requirement as the encryption is performed client-side.

Full explanation →
220
Multi-Selectmedium

An organization is moving 100 TB of archival data from on-premises to Google Cloud Storage. The network bandwidth is limited to 10 Mbps, and the migration must complete within two weeks. Which THREE methods should the team consider?

Select 3 answers
A.Google Cloud Storage Transfer Service for on-premises data
B.Direct peering with Google Cloud
C.Google Cloud Data Transfer Appliance
D.Partner edge appliance (e.g., from compatible partner)
E.Google Cloud Storage Transfer Service for inter-cloud transfer
AnswersB, C, D

Direct peering establishes a dedicated connection that can be provisioned at higher bandwidth, allowing the transfer to complete within the two-week deadline.

Why this answer

(Google Cloud Data Transfer Appliance) is correct for offline transfer of large datasets when bandwidth is insufficient. Option D (Partner edge appliance) similarly allows offline transfer using a compatible partner device. Option B (Direct peering with Google Cloud) is correct because it establishes a dedicated network connection that can provide higher bandwidth than the existing limited link, enabling faster data transfer.

With only 10 Mbps, transferring 100 TB would take over two years; a dedicated connection can be provisioned at higher speeds (e.g., 1 Gbps) to meet the two-week deadline. Options A and E are not viable because they rely on the existing limited network bandwidth and would not complete within the timeframe.

Exam trap

Candidates often assume that cloud transfer services or network optimizations can overcome severe bandwidth limitations, but for extremely large datasets, physical appliances or dedicated high-bandwidth connections are necessary.

Full explanation →
221
MCQhard

A company hosts a web application on AWS and wants to improve latency for global users. Which service should they use to cache static content at edge locations?

A.Application Load Balancer
B.AWS CloudFront
C.AWS Global Accelerator
D.Amazon Route 53
AnswerB

CloudFront is a CDN that caches at edge locations.

Why this answer

A CDN (like CloudFront) caches content at edge locations to reduce latency for users worldwide.

Full explanation →
222
MCQhard

A cloud architect is designing a multi-region application on AWS. The application has a critical database that must tolerate the failure of an entire AWS region. Which strategy provides the lowest RTO while ensuring data consistency?

A.Active-passive with synchronous replication
B.Active-active with asynchronous replication
C.Active-passive with asynchronous replication
D.Multi-cloud active-active with eventual consistency
AnswerA

Synchronous replication ensures data consistency; passive standby can be promoted quickly, minimizing RTO.

Why this answer

Active-passive with synchronous replication provides the lowest RTO for regional failure because the standby region has up-to-date data and can be promoted quickly, though synchronous replication may impact performance. Active-active requires conflict resolution. Asynchronous replication has higher RPO.

Multi-cloud adds complexity and latency.

Full explanation →
223
MCQeasy

A cloud engineer is troubleshooting performance issues in a virtualized environment. Which of the following tools would BEST help identify CPU contention on a hypervisor?

A.iperf
B.esxtop
C.ping
D.nslookup
AnswerB

Shows CPU metrics like ready time and co-stop.

Why this answer

'esxtop' (on VMware) provides real-time performance data including CPU ready time, which directly indicates CPU contention. Option A is incorrect because 'iperf' measures network throughput. Option C is incorrect because 'ping' tests basic connectivity.

Option D is incorrect because 'nslookup' is for DNS resolution.

Full explanation →
224
Matchingmedium

Match each networking concept to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Isolated private network in the cloud

Logical subdivision of a VPC

Enables private instances to access internet

Secure tunnel over public internet

Distributed network for content delivery

Why these pairings

Correct matches: VPC (isolated network), VPN (secure tunnel). Common confusions involve swapping Subnet and CDN, or Load Balancer and CDN. Understanding each component's role in cloud networking is key.

Full explanation →
225
MCQmedium

An organization needs to store database credentials and API keys securely in the cloud, with automatic rotation every 90 days. Which service should be used?

A.AWS CloudHSM
B.AWS Key Management Service (KMS)
C.AWS Systems Manager Parameter Store
D.AWS Secrets Manager
AnswerD

Secrets Manager stores secrets and supports automatic rotation.

Why this answer

AWS Secrets Manager manages secrets lifecycle, including automatic rotation.

Full explanation →
Page 2

Page 3 of 14

Page 4

All pages

1234567891011121314

Practice CV0-004 by domain

Target a specific domain to shore up weak areas.

Cloud Architecture and DesignDeploymentSecurityOperations and SupportTroubleshooting
See all domains with question counts →