Knowledge + Practice

CompTIA Cloud+ CV0-004 (CV0-004) — Questions 226–300

977 questions total · 14pages · All types, answers revealed

Take a mock exam Exam hub

Page 4 of 14

226

MCQeasy

A cloud engineer needs to deploy a stateless application across multiple availability zones. The application must scale horizontally based on CPU utilization. Which of the following is the BEST configuration?

A.Deploy a single large instance and increase its size as needed

B.Create an auto-scaling group spanning multiple zones with a load balancer

C.Use a managed container service and manually add containers

D.Deploy instances in one zone using spot instances to reduce cost

AnswerB

This provides automated horizontal scaling and fault tolerance.

Why this answer

An auto-scaling group spanning multiple availability zones ensures high availability and fault tolerance by distributing instances across zones, while the load balancer distributes traffic and the scaling policy adjusts capacity based on CPU utilization. This configuration meets the requirements for a stateless, horizontally scalable application without manual intervention.

Exam trap

A common trap is choosing vertical scaling (Option A) because it seems simpler, but it does not meet the requirement for multi-AZ distribution and automated horizontal scaling.

How to eliminate wrong answers

Option A is wrong because scaling vertically (increasing instance size) does not provide horizontal scalability or multi-AZ resilience, and it introduces a single point of failure. Option C is wrong because manually adding containers lacks automation and does not leverage auto-scaling based on CPU utilization, making it inefficient for dynamic workloads. Option D is wrong because deploying instances in a single zone with spot instances does not ensure multi-AZ fault tolerance, and spot instances can be terminated at any time, risking application availability.

Full explanation →

227

MCQhard

Refer to the exhibit. A cloud security engineer is reviewing an S3 bucket policy that controls access to the 'example-bucket' bucket. The 'AdminRole' IAM role attempts to upload an object to the bucket using the AWS CLI without specifying the '--server-side-encryption' parameter. The object transfer uses HTTPS. What will be the outcome?

A.The upload succeeds but the object is stored without server-side encryption.

B.The upload succeeds because the request uses HTTPS and the role is allowed.

C.The upload fails because the condition in the Allow statement is not satisfied.

D.The upload fails because the Deny statement blocks all requests that are not using HTTPS.

AnswerC

The Allow requires the encryption header to equal AES256, which is not provided.

Why this answer

The S3 bucket policy includes an Allow statement with a condition that requires `s3:x-amz-server-side-encryption` to be `AES256`. Since the `AdminRole` IAM role did not specify the `--server-side-encryption` parameter, the condition is not satisfied, and the Allow statement does not grant permission. Without a matching Allow, the default implicit deny applies, causing the upload to fail.

Exam trap

CompTIA often tests the nuance that a condition in an Allow statement can cause a request to fail even when the principal and action are permitted, because the condition must be satisfied for the Allow to grant access.

How to eliminate wrong answers

Option A is wrong because the condition in the Allow statement explicitly requires server-side encryption with AES256; without it, the request is not allowed, so the upload does not succeed. Option B is wrong because HTTPS alone does not satisfy the condition for server-side encryption; the policy requires both the role to be allowed and the encryption header to be present. Option D is wrong because the Deny statement blocks requests not using HTTPS, but the request does use HTTPS, so the Deny does not apply; the failure is due to the Allow condition not being met.

Full explanation →

228

MCQhard

A security analyst is investigating a potential data exfiltration from a cloud environment. The analyst finds that an instance IAM role was assumed by a compromised user, and the role has permissions to read from a sensitive database. What is the BEST way to prevent this type of attack in the future?

A.Enforce MFA for all users and require MFA when assuming the role.

B.Add a resource-based policy to the database to deny access from the role.

C.Rotate the IAM role's access keys every 30 days.

D.Remove the IAM role and use a service account instead.

AnswerA

MFA adds a second factor, making it much harder for attackers to use stolen credentials.

Why this answer

The best because enforcing MFA for all users and requiring MFA when assuming roles ensures that even if a user's credentials are compromised, the attacker cannot assume the IAM role without also having access to the user's MFA device. This directly addresses the scenario. Option B is not the best because adding a resource-based policy to deny access from the role would break legitimate access and does not prevent the compromised user from assuming the role.

Option C is not the best because rotating the role's access keys every 30 days does not prevent an attacker from using the role's temporary credentials if they have already assumed the role; also, IAM roles do not have access keys; they issue temporary credentials. Option D is not the best because removing the IAM role and using a service account would not solve the underlying issue and could introduce other security risks.

Full explanation →

229

Multi-Selectmedium

A cloud architect is designing network security for a VPC. The architect needs to implement both stateful and stateless firewalls. Which TWO of the following correctly describe these firewall types?

Select 2 answers

A.Network ACLs are stateful; they track connection state and allow return traffic automatically.

B.Security groups are stateful; they automatically allow return traffic for allowed inbound connections.

C.Security groups support allow rules only; deny rules are not supported.

D.Network ACLs support allow and deny rules, and rules are evaluated in order of priority.

E.Both security groups and network ACLs can be used to allow or deny traffic based on source IP and port.

AnswersB, D

Correct. Security groups are stateful and automatically allow return traffic for established connections.

Why this answer

Security groups are stateful firewalls that automatically allow return traffic for allowed inbound connections. Network ACLs are stateless firewalls that support both allow and deny rules evaluated in priority order. Option C, while true, describes a property of security groups (allow rules only) but is not a direct description of the firewall type (stateful vs. stateless) as asked by the question.

Therefore, only options B and D are correct.

Full explanation →

230

MCQhard

A cloud administrator is managing a fleet of virtual machines that run a batch processing job. The job is memory-intensive and runs once a day. The administrator wants to optimize cost without affecting performance. Which of the following is the BEST approach?

A.Purchase dedicated hosts to ensure resource isolation

B.Use a mix of reserved instances for the minimum required capacity and spot instances to handle the daily workload

C.Manually shut down instances when the job completes

D.Use only on-demand instances to avoid commitment

AnswerB

Reserved instances provide discount; spot instances offer cheap compute for tolerant jobs.

Why this answer

It combines reserved instances for the baseline capacity needed daily, ensuring cost savings through a 1- or 3-year commitment, with spot instances for the memory-intensive batch workload. Spot instances can handle the peak demand at a significantly lower cost (often 60-90% discount) without affecting performance, as the batch job is fault-tolerant and can be interrupted. This hybrid approach optimizes cost while maintaining the required performance for the daily job.

Exam trap

Cloud+ exam often tests the misconception that manual shutdown (Option C) is a valid cost optimization strategy, but the trap is that it ignores automation and the significant savings from using spot instances for fault-tolerant workloads.

How to eliminate wrong answers

Option A is wrong because purchasing dedicated hosts provides physical isolation but incurs higher costs (per-host billing) and does not offer the cost optimization needed for a batch job that runs once a day; it is typically used for licensing or compliance requirements, not cost savings. Option C is wrong because manually shutting down instances when the job completes is inefficient and error-prone, and it does not leverage automated scaling or pricing models like spot instances, leading to potential waste if instances are left running or if shutdown is delayed. Option D is wrong because using only on-demand instances avoids commitment but results in the highest per-hour cost, which is not optimal for a predictable, recurring daily workload that could benefit from reserved or spot pricing.

Full explanation →

231

MCQeasy

Refer to the exhibit. An application running on an EC2 instance is failing to connect to an RDS database. What is the most likely issue?

A.The database instance is in a different VPC

B.The security group for the RDS instance does not allow inbound traffic from the EC2 instance

C.The database instance is stopped

D.The application is using the wrong database port

AnswerB

A security group denying inbound traffic causes a TCP reset, resulting in connection refused.

Why this answer

A 'connection refused' error typically indicates that the database is reachable but the port is blocked, likely by a security group. Option A is wrong if the database is in a different VPC, the error would be timeout or no route. Option C is wrong because a stopped database would result in a 'no route to host' or timeout.

Option D is wrong because port 3306 is standard for MySQL and the error is not about wrong port.

Full explanation →

232

Multi-Selectmedium

A company is using a PaaS offering to host a web application. Which THREE management responsibilities are retained by the customer? (Select THREE.)

Select 3 answers

A.Runtime environment

B.Application code

C.Operating system patches

D.Data and its security

E.Access and identity management

AnswersB, D, E

The customer develops and manages the application code.

Why this answer

In PaaS, the customer manages the application code, data, and access configuration. The provider manages the runtime, OS, and infrastructure.

Full explanation →

233

MCQmedium

A cloud administrator notices that an AWS IAM user has more permissions than necessary. Which principle should be applied to correct this?

A.Separation of duties

B.Defense in depth

C.Zero trust

D.Least privilege

AnswerD

Least privilege ensures users have minimal necessary permissions.

Why this answer

Least privilege means granting only the permissions required to perform a job function.

Full explanation →

234

Multi-Selecthard

A cloud architect is evaluating a multi-cloud strategy to improve resilience. Which THREE factors should be considered when designing multi-cloud architecture? (Select THREE.)

Select 3 answers

A.Increased vendor lock-in

B.Data transfer costs between clouds

C.Ability to manage all clouds with a single API

D.Application portability and interoperability

E.Consistent security and compliance policies across clouds

AnswersB, D, E

Egress charges can be significant.

Why this answer

Data transfer costs, consistent security policies, and application portability are key considerations. Vendor lock-in is reduced, not increased. Single API management is not typical for multi-cloud.

Full explanation →

235

Multi-Selectmedium

Which TWO of the following are best practices for securing an API gateway in a cloud environment?

Select 2 answers

A.Implement rate limiting to control the number of requests per client.

B.Expose the API endpoints without authentication for ease of integration.

C.Return detailed error messages including stack traces to help developers.

D.Use API keys or OAuth for authentication and authorization.

E.Disable HTTPS to reduce latency.

AnswersA, D

Rate limiting protects against abuse and DoS attacks.

Why this answer

Rate limiting is a fundamental security control for API gateways. It mitigates abuse and denial-of-service (DoS) attacks by restricting the number of requests a client can make within a specified time window, typically enforced via token bucket or leaky bucket algorithms. This ensures fair resource usage and protects backend services from being overwhelmed.

Exam trap

CompTIA often tests the misconception that 'detailed error messages help developers debug faster'—but in a cloud environment, exposing stack traces is a critical security flaw, not a best practice.

Full explanation →

236

Multi-Selectmedium

A cloud architect is designing a secrets management solution for a microservices application. The solution must avoid hardcoding secrets in code and support automatic rotation. Which THREE of the following are best practices? (Select THREE.)

Select 3 answers

A.Use a dedicated secrets management service like AWS Secrets Manager.

B.Inject secrets into containers at runtime via volume mounts.

C.Use long-lived static keys for simplicity.

D.Enable automatic rotation of secrets.

E.Store secrets in environment variables for ease of access.

AnswersA, B, D

Centralized vault for secrets.

Why this answer

Best practices include using a dedicated vault, injecting secrets at runtime, and enabling rotation. Storing secrets in environment variables is not recommended. Using IAM roles avoids storing credentials.

Full explanation →

237

MCQhard

A cloud architect must design a deployment for a containerized microservices application. The requirements include automated scaling based on CPU utilization, rolling updates with zero downtime, and service discovery. Which orchestration feature should be used?

A.Docker Compose with a reverse proxy

B.Kubernetes with Horizontal Pod Autoscaler

C.Ansible playbooks with Docker modules

D.AWS ECS with Fargate

AnswerB

Kubernetes natively supports autoscaling, rolling updates, and service discovery.

Why this answer

Kubernetes with Horizontal Pod Autoscaler (HPA) is the correct choice because HPA automatically scales the number of pod replicas based on observed CPU utilization (or custom metrics), meeting the automated scaling requirement. Kubernetes also supports rolling updates with zero downtime via its Deployment controller, which gradually replaces old pods with new ones while maintaining service availability. Additionally, Kubernetes provides built-in service discovery through DNS (CoreDNS) and Services, allowing microservices to find each other by name without external dependencies.

Exam trap

The trap here is that candidates may confuse a container runtime or provisioning tool (like Docker Compose or Ansible) with a full orchestration platform, or assume that a managed service like ECS is an orchestration feature rather than a cloud implementation, missing that Kubernetes is the specific feature set that directly satisfies all three requirements.

How to eliminate wrong answers

Option A is wrong because Docker Compose with a reverse proxy lacks native automated scaling based on CPU utilization; it requires manual intervention or external tools to adjust replica counts, and it does not provide built-in rolling updates with zero downtime or integrated service discovery beyond a static reverse proxy configuration. Option C is wrong because Ansible playbooks with Docker modules are configuration management and provisioning tools, not an orchestration platform; they cannot natively perform automated scaling based on CPU metrics, manage rolling updates with zero downtime, or provide service discovery without additional components like Consul or etcd. Option D is wrong because AWS ECS with Fargate is a managed container service that supports scaling and service discovery, but it is a cloud-specific solution, not an orchestration feature; the question asks for an orchestration feature, and Kubernetes is the platform-agnostic, industry-standard orchestrator that directly provides HPA, rolling updates, and DNS-based service discovery.

Full explanation →

238

MCQhard

A company is implementing a cloud governance strategy. They need to ensure that all resources are tagged with cost center and environment, and any untagged resources are automatically remediated. Which of the following best practices should be applied?

A.Implement role-based access control to restrict resource creation

B.Set up budget alerts to notify when costs exceed thresholds

C.Create a manual audit process to check tags weekly

D.Use policy-as-code to enforce tagging and automatically apply tags to untagged resources

AnswerD

Correct; policy-as-code can enforce and auto-remediate tagging.

Why this answer

Policy-as-code (e.g., Azure Policy, AWS Config Rules, or Open Policy Agent) allows you to define tagging requirements declaratively and automatically remediate non-compliant resources. This approach enforces governance in real-time without manual intervention, ensuring all resources are tagged with cost center and environment as specified.

Exam trap

The trap here is that candidates often confuse manual audit processes (Option C) with automated governance, failing to recognize that policy-as-code provides the required automatic remediation in real-time.

How to eliminate wrong answers

Option A is wrong because role-based access control (RBAC) restricts who can create resources but does not automatically tag or remediate untagged resources. Option B is wrong because budget alerts notify when costs exceed thresholds but do not enforce tagging or remediate untagged resources. Option C is wrong because a manual audit process is reactive, time-consuming, and does not provide automatic remediation, which is required by the question.

Full explanation →

239

MCQmedium

A cloud engineer wants to be notified when the average CPU utilization of an auto-scaling group exceeds 80% for 5 minutes. Which alerting mechanism should be used?

A.AWS Systems Manager OpsCenter

B.AWS Config rule

C.AWS Trusted Advisor

D.AWS CloudWatch Alarm

AnswerD

Alarms evaluate metric thresholds and trigger notifications.

Why this answer

CloudWatch Alarms can monitor metrics and trigger actions when a threshold is breached for a specified period.

Full explanation →

240

MCQhard

After reviewing the Terraform plan, a cloud administrator notices that the instance will be created with a public IP address. However, the company policy requires that all instances in this subnet remain private. What should the administrator do to meet the policy before applying the plan?

A.Add a shell command in user_data to remove the public IP after boot.

B.Use a different AMI that does not require public access.

C.Change the 'associate_public_ip_address' argument to 'false' in the resource block.

D.Modify the subnet_id to point to a private subnet with no internet gateway.

AnswerC

Correct: This explicitly disables public IP assignment.

Why this answer

Setting 'associate_public_ip_address' to false in the Terraform resource block explicitly prevents the instance from receiving a public IP address, directly adhering to the policy. Option A is wrong: using user_data to remove the public IP after boot is unreliable, creates a temporary exposure, and violates the principle of declarative infrastructure. Option B is wrong: the AMI choice does not control public IP assignment; that is determined by subnet settings and resource arguments.

Option D is wrong: changing to a private subnet might work if it disables auto-assign public IP, but it is unnecessary and could have other implications; the direct fix is to set the argument to false.

Full explanation →

241

MCQhard

A user attempted to copy an encrypted snapshot to a different region and received the above error. What is the most likely cause?

A.The snapshot size exceeds the regional limit.

B.The user does not have permission to create snapshots in the destination region.

C.The snapshot was created in a different region using a regional encryption key that is not present in the destination region.

D.The encryption key used to encrypt the snapshot has been deleted.

AnswerC

Regional keys cannot be used across regions by default.

Why this answer

The error occurs when copying an encrypted snapshot to a different region because the snapshot was encrypted using a regional encryption key that exists only in the source region. The destination region does not have access to that key, causing the copy to fail. Option C correctly identifies this scenario.

Full explanation →

242

MCQmedium

A company is deploying a new version of a microservice on Amazon EKS. The deployment must ensure that new pods are created and become healthy before old pods are terminated. The current deployment uses a ReplicaSet. Which Kubernetes resource and strategy should be used?

A.ReplicaSet with RollingUpdate strategy

B.DaemonSet with RollingUpdate

C.Deployment with RollingUpdate strategy

D.StatefulSet with OnDelete strategy

AnswerC

Deployment provides rolling updates ensuring new pods are healthy before old ones are removed.

Why this answer

A Deployment manages ReplicaSets and supports a RollingUpdate strategy that creates new pods and waits for them to become ready before terminating old ones.

Full explanation →

243

MCQeasy

A cloud architect is designing a monitoring solution for a web application. Which service should they use to collect and visualize metrics such as CPU utilization and network throughput?

A.AWS CloudTrail

B.AWS CloudWatch

C.AWS Config

D.AWS Trusted Advisor

AnswerB

CloudWatch provides metrics collection and dashboards.

Why this answer

AWS CloudWatch is the service for collecting and visualizing metrics on AWS.

Full explanation →

244

MCQmedium

A company wants to implement a disaster recovery strategy with an RTO of 15 minutes and an RPO of 1 hour for a critical application running on AWS. Which approach would best meet these requirements?

A.Continuous replication to a warm standby environment with automated failover

B.Backup to AWS S3 and restore using AWS CloudFormation

C.Cross-region replication with a read replica and manual promotion

D.Daily snapshots of EBS volumes to another region

AnswerA

Continuous replication achieves RPO of seconds to minutes, and automated failover achieves RTO of minutes.

Why this answer

Continuous replication to a standby environment with automatic failover provides the lowest RTO and RPO, meeting the requirements.

Full explanation →

245

MCQmedium

Refer to the exhibit. After deploying a new version of the application, users report that some requests fail intermittently. The administrator checks the load balancer configuration and health checks, and both servers are marked as healthy. Which of the following is the MOST likely cause of the intermittent failures?

A.The health check interval is too short, marking servers down incorrectly.

B.The backend servers are not configured to accept traffic on port 80.

C.The health check path '/health' is no longer valid after the application update.

D.The load balancer is configured for round-robin, which is causing session persistence issues.

AnswerD

Correct. Round-robin without session affinity causes requests from the same user to land on different servers, leading to loss of session state and intermittent failures after an update.

Why this answer

Round-robin load balancing distributes requests across all healthy servers without session affinity. After an application update, if the application relies on session state stored locally on a server (e.g., in-memory session data), subsequent requests from the same user may be routed to a different backend that does not have the session data, causing intermittent failures. This explains why both servers appear healthy in health checks but users experience occasional request failures.

Option A is incorrect because a short health check interval would cause servers to be marked down momentarily, but they are consistently marked healthy in this scenario.

Option B is incorrect because if backend servers were not configured to accept traffic on port 80, all requests would fail persistently, not intermittently.

Option C is incorrect because an invalid health check path would cause persistent health check failures, not intermittent ones, and servers would be marked unhealthy, which contradicts the given information that both servers are healthy.

Exam trap

In Cloud+, note that session persistence (sticky sessions) is crucial for stateful applications when using round-robin load balancing. Even with all servers healthy, intermittent failures can occur if session state is not shared across backends.

How to eliminate wrong answers

Option A is wrong because a health check interval that is too short would cause servers to be marked down more frequently, not intermittently, and the exhibit explicitly states both servers are marked as healthy. Option B is wrong because if backend servers were not configured to accept traffic on port 80, all requests would fail consistently, not intermittently, and the load balancer would mark them as unhealthy. Option D is wrong because round-robin alone does not cause session persistence issues; session persistence is a separate configuration (e.g., sticky sessions via cookies or source IP), and the question does not indicate any session-related requirement.

Full explanation →

246

MCQeasy

A cloud engineer needs to deploy a serverless function that runs when a new object is uploaded to an S3 bucket. Which AWS service event trigger should be configured?

A.API Gateway

B.EventBridge

C.S3

D.SQS

AnswerC

S3 can invoke Lambda directly on object creation events.

Why this answer

Amazon S3 can directly invoke AWS Lambda when a new object is uploaded by configuring an S3 event notification on the bucket. This native integration allows the S3 service to trigger the function without any intermediary service, making option C the correct choice for a serverless function triggered by an S3 upload event.

Exam trap

Candidates often confuse direct service integrations (S3 → Lambda) with event bus patterns (EventBridge), where they may overcomplicate by choosing EventBridge when the native S3 trigger is simpler and sufficient.

How to eliminate wrong answers

Option A is wrong because API Gateway is a service for creating RESTful or WebSocket APIs to front-end applications or services, not for directly triggering functions from S3 events; it would require an additional integration layer. Option B is wrong because EventBridge is a serverless event bus for routing events between AWS services and custom applications, but S3 can send events directly to Lambda without needing EventBridge as an intermediary. Option D is wrong because SQS is a message queue service that decouples components, not a direct trigger for Lambda from S3; while S3 can send events to SQS, the queue would then need to be polled by a consumer, adding latency and complexity.

Full explanation →

247

Multi-Selecteasy

A cloud engineer receives alerts that a storage volume is reaching capacity. Which three immediate actions should the engineer consider? (Choose three.)

Select 3 answers

A.Attach additional volumes

B.Create a snapshot before making changes

C.Enable compression on the volume

D.Delete unnecessary files

E.Increase the size of the storage volume

AnswersA, D, E

Adding new volumes expands total storage instantly.

Why this answer

Correct options are A, D, and E. Option A is correct because attaching additional volumes increases total capacity immediately. Option D is correct because deleting unnecessary files frees up space quickly.

Option E is correct because increasing the size of the storage volume provides more space without data migration. Option B is incorrect because creating a snapshot is a precautionary backup step, not an immediate remedy for capacity issues. Option C is incorrect because enabling compression may not affect existing data and is not an immediate solution.

Full explanation →

248

Multi-Selecteasy

A cloud administrator is configuring a new virtual private cloud (VPC) with a public subnet for a web application. The administrator must ensure that the web application can receive HTTPS traffic from the internet but cannot be directly accessed via SSH. Which TWO security controls should the administrator implement? (Choose two.)

Select 2 answers

A.Attach an internet gateway (IGW) to the VPC and enable auto-assign public IP on the subnet.

B.Configure a network ACL on the subnet to allow inbound TCP ports 80 and 443 from 0.0.0.0/0 and deny inbound TCP port 22.

C.Place the web server in a private subnet and use a NAT gateway for outbound traffic.

D.Configure a security group that allows inbound TCP port 443 from 0.0.0.0/0 and denies inbound TCP port 22.

E.Deploy a web application firewall (WAF) in front of the web server.

AnswersB, D

Network ACLs are stateless and provide subnet-level filtering; allowing HTTP/HTTPS and denying SSH adds defense.

Why this answer

A network ACL (NACL) is a stateless firewall that operates at the subnet level, allowing you to explicitly deny inbound TCP port 22 (SSH) while allowing TCP ports 80 and 443 (HTTP/HTTPS) from 0.0.0.0/0. Option D is correct because a security group (SG) is a stateful firewall at the instance level; by default, SGs deny all inbound traffic, so you must explicitly allow TCP port 443 from 0.0.0.0/0, and since SSH (port 22) is not allowed, it is implicitly denied. Together, these provide defense-in-depth: the NACL blocks SSH at the subnet boundary, and the SG ensures only HTTPS is permitted to the web server.

Exam trap

CompTIA often tests the distinction between stateless (NACL) and stateful (security group) firewalls, and the trap here is that candidates may think a security group alone is sufficient to deny SSH, forgetting that a permissive NACL could allow SSH traffic to reach the subnet, or they may incorrectly assume a WAF can block SSH at the network layer.

Full explanation →

249

MCQhard

A DevOps engineer runs a rollout status command for a Kubernetes deployment and receives the error shown. The deployment specification includes a rolling update strategy with maxSurge=25% and maxUnavailable=25%. What is the most likely cause of the failure?

A.The cluster does not have enough CPU resources to schedule new pods

B.The new pod template contains an invalid container image tag

C.The maxSurge and maxUnavailable settings are too restrictive

D.The old ReplicaSet is still running and preventing the new one from scaling up

AnswerB

Invalid image causes pods to fail readiness, leading to rollout timeout.

Why this answer

The error message from the rollout status command indicates that the new ReplicaSet is unable to create pods, which typically occurs when the pod template in the deployment specification references an invalid container image tag. Kubernetes attempts to pull the image, fails, and marks the pods as ImagePullBackOff or ErrImagePull, preventing the rollout from progressing. The rolling update strategy with maxSurge=25% and maxUnavailable=25% is not the cause, as these settings control the rate of pod replacement, not the validity of the image reference.

Exam trap

CompTIA often tests the distinction between resource constraints (which cause Pending pods) and image-related errors (which cause ImagePullBackOff), tempting candidates to choose CPU or memory issues when the error message points to a pod template problem.

How to eliminate wrong answers

Option A is wrong because insufficient CPU resources would cause pods to remain in a Pending state due to resource constraints, not produce an error related to image pulling or invalid container configuration. Option C is wrong because maxSurge=25% and maxUnavailable=25% are standard, permissive settings that allow the rollout to proceed; they are not too restrictive and would not cause a rollout failure unless the cluster has zero capacity. Option D is wrong because the old ReplicaSet is expected to remain running during a rolling update until the new ReplicaSet becomes healthy; its presence does not prevent the new ReplicaSet from scaling up, as the rolling update strategy explicitly allows both ReplicaSets to coexist within the surge and unavailable limits.

Full explanation →

250

MCQhard

A cloud administrator is troubleshooting connectivity to a web server running on a Linux VM. The web server is configured to listen on ports 80 (HTTP) and 443 (HTTPS). The administrator runs the iptables command shown in the exhibit. Based on the output, what is the MOST likely reason that external users cannot access the web server on port 443?

A.The web server is not configured to listen on port 443, so iptables rules are irrelevant.

B.The iptables default policy is ACCEPT, but the rule for port 443 explicitly drops traffic from external sources.

C.The rule for port 80 is placed before the rule for port 443, causing all HTTPS traffic to be evaluated as HTTP and dropped.

D.The iptables rule for port 443 only allows traffic from the 10.0.0.0/8 subnet, which does not include external IP addresses.

AnswerD

The rule for HTTPS only accepts from the private subnet, so external traffic is dropped by the default DROP policy.

Why this answer

The iptables rule for port 443 specifies a source IP range of 10.0.0.0/8, which is a private RFC 1918 address space. External users have public IP addresses that do not fall within this subnet, so their HTTPS traffic is implicitly dropped by the rule's match condition. The default policy being ACCEPT does not override the explicit rule that only permits traffic from the 10.0.0.0/8 subnet.

Exam trap

The trap here is that candidates assume a default ACCEPT policy means all traffic is allowed, overlooking that an explicit rule with a restrictive source match will only permit traffic from that source, effectively denying all others by not matching.

How to eliminate wrong answers

Option A is wrong because the question states the web server is configured to listen on port 443, so the issue is not a misconfigured web server. Option B is wrong because the iptables output does not show an explicit DROP rule for port 443; instead, it shows an ACCEPT rule restricted to a specific source subnet, which implicitly drops all other traffic. Option C is wrong because iptables processes rules sequentially, but the rule for port 80 (HTTP) does not affect HTTPS traffic on port 443; each rule is evaluated independently based on protocol and port match.

Full explanation →

251

MCQmedium

A cloud administrator is designing a backup strategy for a critical database that must achieve a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 30 minutes. The database has a high write throughput. Which of the following backup methods BEST meets these requirements?

A.Synchronous log shipping to a standby database.

B.Full daily backups with transaction log backups every hour.

C.Snapshot replication to a secondary datastore every 10 minutes.

D.Incremental backups every 10 minutes.

AnswerC

Snapshots provide point-in-time copies that can be restored quickly, meeting RPO and RTO.

Why this answer

Snapshot replication to a secondary datastore every 10 minutes meets the RPO of 15 minutes because snapshots can be taken at intervals shorter than the RPO (e.g., every 10 minutes), and the RTO of 30 minutes is achievable if the secondary datastore is ready to be promoted quickly. For a high-write-throughput database, snapshot replication minimizes performance impact compared to synchronous log shipping, which can throttle writes due to network latency.

Exam trap

The trap here is that candidates often choose synchronous log shipping (Option A) thinking it provides the best RPO, but they overlook the severe write-throughput penalty and the fact that RTO can be longer due to failover complexity, while snapshot replication offers a better balance for high-write environments.

How to eliminate wrong answers

Option A is wrong because synchronous log shipping requires the standby to acknowledge every transaction before the primary commits, which introduces latency that can severely degrade write throughput on a high-write database, and it does not inherently guarantee an RTO of 30 minutes if the standby needs manual failover steps. Option B is wrong because transaction log backups every hour result in a maximum data loss of up to 60 minutes, which exceeds the 15-minute RPO requirement. Option D is wrong because incremental backups every 10 minutes still require applying a full backup plus all incremental chains to restore, which typically takes longer than 30 minutes for a large database, failing the RTO.

Full explanation →

252

MCQeasy

A cloud administrator notices that a load balancer is marking all instances as unhealthy. The health check is configured to check a specific URL path. Which of the following is the MOST likely cause?

A.The health check path does not exist on the instances.

B.The auto scaling group's minimum size is too low.

C.The security group for the instances blocks traffic from the load balancer.

D.The instances are under high CPU load.

AnswerA

If the path is missing, the load balancer receives non-200 responses.

Why this answer

The health check is configured to check a specific URL path. If that path does not exist on the instances (e.g., returns a 404 or 403 status), the load balancer will consider the instances unhealthy. This is the most direct cause because the health check relies on a successful HTTP response (typically 200 OK) from that exact path.

Exam trap

CompTIA often tests the distinction between connectivity issues (security groups, network ACLs) and application-level health check failures, leading candidates to incorrectly choose security group misconfiguration when the real issue is a missing or misconfigured health check endpoint.

How to eliminate wrong answers

Option B is wrong because the auto scaling group's minimum size affects the number of instances running, not the health check status of individual instances; a low minimum size could cause scaling issues but does not cause all instances to be marked unhealthy. Option C is wrong because if the security group blocked traffic from the load balancer, the instances would be unreachable entirely (e.g., connection timeout), not just fail a specific URL path health check. Option D is wrong because high CPU load might degrade performance but does not inherently cause the health check to fail unless the application crashes or the web server stops responding; the load balancer's health check is a simple HTTP request that typically succeeds even under moderate load.

Full explanation →

253

MCQmedium

A cloud administrator is debugging a failed CloudFormation stack creation. The exhibit shows the stack events. What is the most likely cause of the failure?

A.The instance type is not supported in the region.

B.The stack name already exists.

C.The AMI ID is incorrect.

D.The referenced security group does not exist in the chosen VPC.

AnswerD

The error explicitly mentions invalid groupId.

Why this answer

The stack creation fails with a 'CREATE_FAILED' status on the security group resource, and the error message indicates that the security group does not exist in the specified VPC. This is a common issue when a CloudFormation template references a security group by ID or name that is not present in the target VPC, causing the resource creation to fail. The stack events show the security group resource as the point of failure, confirming that the referenced security group is missing.

Exam trap

CompTIA often tests the ability to read CloudFormation stack events and correlate the failing resource with the specific error message, rather than assuming a generic failure like an incorrect AMI or instance type.

How to eliminate wrong answers

Option A is wrong because an unsupported instance type would cause a failure on the EC2 instance resource, not on a security group resource, and the error would typically mention 'instance type' or 'not supported'. Option B is wrong because a stack name that already exists would cause a stack creation to fail immediately with a 'Stack with id [name] already exists' error, not a failure on a specific resource like a security group. Option C is wrong because an incorrect AMI ID would cause a failure on the EC2 instance resource with an error like 'AMI [ami-id] does not exist' or 'AMI not found', not on a security group resource.

Full explanation →

254

MCQhard

Refer to the exhibit. A developer is trying to upload an object to S3 bucket 'example-bucket' using the IAM policy shown. The upload fails with an AccessDenied error. Which of the following is the MOST likely reason?

A.The IAM policy requires server-side encryption with AES256, but the upload request did not specify that header.

B.The bucket policy has a deny that overrides this IAM policy.

C.The developer's user is not in the same account as the bucket.

D.The IAM policy does not grant the s3:ListBucket permission.

AnswerB

The bucket policy denies PutObject unless encryption is aws:kms, which conflicts with the IAM policy's AES256 requirement, resulting in a deny.

Why this answer

The IAM policy grants the s3:PutObject action, but an explicit deny in the bucket policy overrides any allow from an IAM policy. Since AWS evaluates all policies (identity-based and resource-based) and an explicit deny always takes precedence, the upload fails with AccessDenied even though the IAM policy appears sufficient.

Exam trap

CompTIA Cloud+ often tests the concept that an explicit deny in a resource-based policy (like an S3 bucket policy) overrides any allow from an identity-based policy (like an IAM policy), leading candidates to incorrectly focus on missing permissions or encryption headers instead of the deny override.

How to eliminate wrong answers

Option A is wrong because the IAM policy does not require server-side encryption; it only allows the s3:PutObject action without any condition for encryption headers, so the absence of AES256 in the request would not cause an AccessDenied unless a bucket policy or condition explicitly enforced it. Option C is wrong because IAM policies can grant access to resources in another account as long as the bucket policy also allows cross-account access; the question does not indicate a cross-account scenario, and the error is AccessDenied, not a permissions boundary issue. Option D is wrong because s3:ListBucket is not required for uploading an object; the s3:PutObject permission alone is sufficient to perform the upload, and the error is not related to listing objects.

Full explanation →

255

MCQmedium

A cloud architect is designing a disaster recovery plan for a cloud-based application. The primary site is in a cloud region, and the recovery site is in a different geographic region. The application uses a relational database with synchronous replication. The recovery time objective (RTO) is 1 hour, and the recovery point objective (RPO) is 15 minutes. Which replication strategy BEST meets these objectives?

A.Perform daily backups of the database and restore at the recovery site

B.Use storage-level asynchronous replication between regions

C.Use a script to copy database logs every hour to the recovery site

D.Configure synchronous database replication with automated failover

AnswerD

Synchronous replication provides near-zero RPO and fast failover.

Why this answer

Synchronous database replication with automated failover ensures that every write transaction is committed to both the primary and recovery site databases before acknowledging success, guaranteeing zero data loss (RPO=0) and near-instantaneous failover within seconds to minutes, which comfortably meets the RTO of 1 hour and RPO of 15 minutes. This strategy directly satisfies the strict RPO requirement by maintaining a fully synchronized, hot standby replica that can be promoted immediately upon failure.

Exam trap

CompTIA often tests the misconception that asynchronous replication (Option B) can meet a low RPO like 15 minutes, but the trap is that asynchronous replication inherently risks data loss equal to the replication lag, which can spike unpredictably under load or network congestion, making it unsuitable for strict RPO requirements.

How to eliminate wrong answers

Option A is wrong because daily backups provide an RPO of up to 24 hours, far exceeding the 15-minute requirement, and restoration from backup typically takes hours, violating the 1-hour RTO. Option B is wrong because storage-level asynchronous replication introduces a replication lag that can result in data loss exceeding the 15-minute RPO, as transactions may be committed at the primary but not yet replicated to the recovery site. Option C is wrong because copying database logs every hour provides an RPO of up to 60 minutes, which does not meet the 15-minute RPO, and log replay for recovery can be time-consuming, risking the RTO.

Full explanation →

256

MCQmedium

An organization wants to automate patching of their EC2 instances running Windows Server. They need to schedule patching during a maintenance window and ensure minimal downtime. Which AWS service should they use?

A.AWS OpsWorks

B.Amazon Inspector

C.AWS CloudFormation

D.AWS Systems Manager Patch Manager

AnswerD

Patch Manager automates OS patching and integrates with maintenance windows.

Why this answer

AWS Systems Manager Patch Manager automates patching and can be scheduled via maintenance windows.

Full explanation →

257

Multi-Selectmedium

A cloud operations team wants to implement automated patching for their fleet of virtual machines. They need to minimize disruption during business hours and ensure that critical security patches are applied within 48 hours of release. The team also requires a rollback plan in case a patch causes issues. Which THREE actions should the team take? (Choose three.)

Select 3 answers

A.Define maintenance windows that occur during off-peak hours.

B.Document rollback procedures to revert patches if necessary.

C.Disable automatic updates to maintain control over patch deployment.

D.Enable automated patching using a tool such as AWS Systems Manager Patch Manager.

E.Apply all patches immediately upon release regardless of maintenance windows.

AnswersA, B, D

Maintenance windows minimize disruption by scheduling patching during low-usage periods.

Why this answer

Automated patching requires defining maintenance windows to avoid disruption, enabling automated patching tools like AWS Systems Manager Patch Manager, and having a rollback procedure in place. Testing patches in a staging environment first is wise but not a direct action for the described requirements.

Full explanation →

258

MCQhard

During a scheduled DR drill, the cloud team fails over a critical application to the secondary region. After the drill, the application is failed back. The application's RTO was 2 hours, but the actual failover took 2.5 hours. Which action should be taken to improve future failover times?

A.Increase the frequency of DR drills

B.Increase the bandwidth between regions for data replication

C.Automate the failover process using infrastructure as code and runbooks

D.Reduce the RTO to 1 hour to force faster execution

AnswerC

Automation reduces manual intervention and speeds up failover.

Why this answer

Failing the RTO indicates the process is not meeting the target. Automating the failover process with scripts or runbooks reduces manual steps and time. Rehearsing the process more often also helps but automation directly reduces time.

Full explanation →

259

MCQhard

Refer to the exhibit. An application in a cloud environment logs multiple database connection errors. The database is a managed MySQL instance in the same VPC. The timeouts and connection refused errors occur intermittently. Which of the following is the most likely cause?

A.The database is hitting its maximum connections limit.

B.The database instance is out of storage.

C.The security group for the database is not allowing inbound traffic from the application.

D.The database's DNS resolves to multiple IP addresses.

AnswerA

Correct. When max connections are reached, new connections are refused, and timeouts occur when waiting for a slot.

Why this answer

Intermittent connection refused and timeouts indicate that the database is reaching its maximum connections limit, causing new connections to be refused or timeout.

Full explanation →

260

MCQeasy

A company wants to migrate its on-premises workload to the cloud and needs to maintain full control over the operating system, middleware, and applications. Which cloud service model should the company choose?

A.PaaS

B.FaaS

C.SaaS

D.IaaS

AnswerD

IaaS provides virtual machines where the customer manages OS and above.

Why this answer

IaaS provides virtualized computing resources (VMs, storage, networking) where the customer manages the OS and above, making it the right choice for full control.

Full explanation →

261

MCQhard

A company is deploying a multi-tier application with web servers and a database. Which architecture ensures high availability?

A.Deploy web servers in an auto-scaling group across two AZs and database in a multi-AZ configuration

B.Deploy a single large web server and a single database instance

C.Deploy web servers in an auto-scaling group in one AZ and database in single instance

D.Deploy web servers and database in a single availability zone

AnswerA

This provides redundancy for both web and database tiers.

Why this answer

Deploying web servers in an auto-scaling group across two Availability Zones (AZs) ensures that if one AZ fails, the other continues serving traffic, while a multi-AZ database configuration (e.g., Amazon RDS Multi-AZ) automatically synchronously replicates data to a standby instance in a different AZ, enabling automatic failover. This combination eliminates single points of failure at both the web and database tiers, meeting high availability requirements.

Exam trap

The trap here is that candidates often assume auto-scaling alone guarantees high availability, but without distributing instances across multiple AZs, a single AZ failure still causes downtime.

How to eliminate wrong answers

Option B is wrong because a single large web server and a single database instance create a single point of failure; if either component or its underlying hardware fails, the entire application becomes unavailable. Option C is wrong because deploying web servers in an auto-scaling group within a single AZ still leaves the web tier vulnerable to an AZ-level outage, and a single database instance lacks failover capability. Option D is wrong because placing both web servers and the database in a single AZ means any failure affecting that AZ (e.g., power loss, network partition) will bring down the entire application, violating high availability principles.

Full explanation →

262

MCQhard

A company deploys a multi-tier application in a public cloud. The web tier uses an auto scaling group across multiple availability zones. The database tier runs on a single large VM. The application experiences intermittent slowdowns during peak load. Which of the following is the BEST long-term solution?

A.Migrate the database to a managed database service with read replicas

B.Add a load balancer in front of the database tier

C.Upgrade the database VM to a larger instance type

D.Increase the number of web servers in the auto scaling group

AnswerA

Managed service provides scaling and high availability.

Why this answer

The database tier is a single point of failure and a performance bottleneck during peak load. Migrating to a managed database service with read replicas offloads read-heavy traffic, improves scalability, and provides automatic failover, addressing both performance and availability issues. This is a long-term solution that aligns with cloud best practices for multi-tier applications.

Exam trap

The trap here is that candidates often assume scaling the web tier (Option D) or vertically scaling the database (Option C) is sufficient, but CompTIA tests the understanding that the database tier is the bottleneck and requires a horizontally scalable, managed solution for long-term reliability and performance.

How to eliminate wrong answers

Option B is wrong because adding a load balancer in front of the database tier does not solve the underlying performance bottleneck; databases typically use connection pooling or direct connections, and a load balancer adds latency without addressing read scalability or write contention. Option C is wrong because upgrading the database VM to a larger instance type is a vertical scaling approach that has a hard limit and does not provide high availability or fault tolerance; it also incurs downtime during resizing and does not handle read-heavy workloads efficiently. Option D is wrong because increasing the number of web servers in the auto scaling group only addresses the web tier's capacity, not the database tier's inability to handle increased read/write requests, so the database remains the bottleneck.

Full explanation →

263

Multi-Selectmedium

A cloud administrator is configuring network ACLs (NACLs) for a VPC subnet. The subnet hosts a web server that must accept HTTP (port 80) and HTTPS (port 443) from the internet, and the server needs to respond to clients. Which TWO rules are required?

Select 2 answers

A.Inbound rule: allow all ICMP from 0.0.0.0/0

B.Outbound rule: allow TCP port 80 and 443 to 0.0.0.0/0

C.Inbound rule: allow TCP ports 1024-65535 from 0.0.0.0/0

D.Outbound rule: allow TCP ports 1024-65535 to 0.0.0.0/0

E.Inbound rule: allow TCP port 80 and 443 from 0.0.0.0/0

AnswersD, E

Allows return traffic on ephemeral ports.

Why this answer

NACLs are stateless, so both inbound and outbound rules must be explicitly allowed. Inbound allows HTTP/HTTPS, outbound allows ephemeral ports for return traffic.

Full explanation →

264

MCQhard

A company wants to reduce cloud storage costs for data that is accessed frequently for 30 days, then rarely accessed for 90 days, and then must be retained for 7 years for compliance. Which storage lifecycle policy should be implemented?

A.Standard storage for 30 days, then delete

B.Standard storage for 30 days, then infrequent access for 90 days, then archive

C.Archive immediately for 7 years

D.Infrequent access immediately for 120 days, then archive

AnswerB

Correct. This aligns with access patterns and compliance.

Why this answer

A lifecycle policy that transitions from standard storage to infrequent access after 30 days, and then to archive after 120 days (30+90) meets the access patterns and compliance requirements.

Full explanation →

265

MCQmedium

A company uses GCP and wants to implement alerting based on anomaly detection for their Compute Engine instances. Which GCP service should they use?

A.Cloud Logging

B.Cloud Functions

C.Cloud Audit Logs

D.Cloud Monitoring

AnswerD

Cloud Monitoring provides alerting policies with anomaly detection capabilities.

Why this answer

GCP's Cloud Monitoring (formerly Stackdriver) includes alerting policies that support anomaly detection. Cloud Logging is for logs. Cloud Audit Logs for auditing.

Cloud Functions can be triggered but not directly for anomaly detection.

Full explanation →

266

MCQmedium

A company wants to ensure that logs from their application are easily searchable and structured for analysis. Which logging format should be recommended?

A.JSON format

B.CSV format

C.Binary format

D.Plain text format

AnswerA

JSON is a standard structured format that integrates well with log analysis tools.

Why this answer

Structured logging in JSON format allows for efficient querying and parsing.

Full explanation →

267

MCQmedium

A company is migrating a legacy monolithic application to the cloud. The application currently runs on a single server with 16 vCPUs and 64 GB RAM. The cloud architect recommends redesigning the application to be stateless and horizontally scalable. What is the primary benefit of this approach?

A.Lower storage costs

B.Simpler licensing costs

C.Improved fault tolerance and elasticity

D.Reduced network latency

AnswerC

Stateless horizontal scaling improves fault tolerance (failure of one instance does not affect others) and allows elastic scaling.

Why this answer

Horizontal scaling allows adding more instances to handle increased load, improving availability and elasticity compared to vertical scaling of a monolithic server.

Full explanation →

268

MCQmedium

A cloud engineer is deploying a containerized application on Kubernetes. The security team requires that containers run with reduced privileges and that certain capabilities are dropped. Which Kubernetes feature should be used to enforce these requirements?

A.Pod Security Standards

B.Network policies

C.ConfigMap

D.Horizontal Pod Autoscaler

AnswerA

Pod Security Standards enforce security context constraints.

Why this answer

Pod Security Standards (or Pod Security Policies) define security contexts and can restrict container capabilities.

Full explanation →

269

MCQmedium

A cloud administrator needs to centralize logs from multiple cloud provider accounts and on-premises servers for security analysis. Which approach should be used?

A.Create a serverless function that copies logs from each account to a central storage bucket in a management account

B.Enable virtual network flow logs in each account and store them locally

C.Use configuration compliance rules to aggregate logs into a single account

D.Configure each account's API activity logging to deliver logs to a central storage bucket, and use a log collection agent on on-premises servers to send logs to a central log service

AnswerD

This centralizes logs from multiple sources in one place.

Why this answer

Centralized logging can be achieved by sending logs from multiple sources to a central storage and using a central log service for querying. API activity logging captures API calls from cloud provider accounts, and on-premises logs can be sent via a log collection agent to a central log service.

Full explanation →

270

MCQhard

A company uses a cloud-based load balancer to distribute traffic to a fleet of web servers. Users report intermittent timeouts. The administrator reviews the load balancer logs and notices that one backend server has a significantly higher error rate than the others. Which of the following is the BEST course of action?

A.Immediately add two more backend servers to distribute the load.

B.Drain connections to the unhealthy server and troubleshoot its configuration.

C.Enable sticky sessions on the load balancer to maintain user sessions.

D.Increase the health check interval for all servers to reduce false positives.

AnswerB

Draining prevents further impact while allowing investigation of the root cause.

Why this answer

Draining connections from the unhealthy server allows the load balancer to stop sending new traffic to it while existing sessions complete, preventing further timeouts. Troubleshooting the server's configuration addresses the root cause of the high error rate, such as misconfigured web server software, resource exhaustion, or application bugs. This approach follows the principle of isolating and resolving the faulty component rather than masking the issue with workarounds.

Exam trap

CompTIA often tests the misconception that adding more servers or increasing health check intervals will solve performance issues, but the trap here is that the problem is a specific faulty backend server, not a capacity or health check sensitivity issue, so the correct action is to isolate and troubleshoot that server.

How to eliminate wrong answers

Option A is wrong because adding more backend servers does not fix the underlying problem with the unhealthy server; it only distributes load away from it temporarily, and the faulty server will continue to serve errors to any traffic it receives. Option C is wrong because enabling sticky sessions (session persistence) would lock users to the unhealthy server, worsening the timeouts for those users and increasing error rates. Option D is wrong because increasing the health check interval makes the load balancer less responsive to failures, allowing the unhealthy server to remain in the pool longer and serve more errors before being marked down.

Full explanation →

271

Multi-Selecthard

A cloud administrator is reviewing the security posture of a cloud deployment. The company has a policy of least privilege and must ensure that only authorized services can access storage buckets. Which THREE mechanisms should the administrator configure to enforce this policy? (Choose three.)

Select 3 answers

A.Network ACLs that block unauthorized IP ranges

B.Bucket policies that restrict access to specific cloud services

C.Organizational policies that restrict permissions at the account level

D.IAM roles that grant permissions to services requiring access

E.Security groups that allow traffic from authorized services

AnswersB, C, D

Bucket policies define who can access the bucket and under what conditions.

Why this answer

Bucket policies can explicitly grant or deny access to specific cloud services (e.g., logging or auditing services) using the principal element with a service principal. This aligns with the least privilege policy by ensuring only authorized services can access the storage buckets, without relying on network-level controls. Option C is correct because organizational policies enforce rules across accounts, restricting permissions at the account level to ensure only authorized services have access.

Option D is correct because IAM roles can be used to grant granular permissions to services that require access, following the principle of least privilege.

Exam trap

The trap here is that candidates often confuse network-level controls (ACLs and security groups) with identity-based controls, assuming they can restrict service access to storage buckets, but these mechanisms cannot enforce service identity and are not applicable to cloud storage services.

Full explanation →

272

MCQmedium

A cloud engineer is configuring an auto-scaling group and wants to add instances based on a sustained increase in CPU utilization above 80% for 5 minutes. Which scaling policy type should be used?

A.Target tracking scaling policy

B.Step scaling policy

C.Simple scaling policy

D.Scheduled scaling policy

AnswerB

Step scaling policies allow you to define specific adjustments based on the magnitude of the metric breach.

Why this answer

Step scaling policies allow you to define steps that respond to metric breaches with specific actions, such as adding a certain number of instances when CPU exceeds 80% for a specified period.

Full explanation →

273

MCQmedium

A DevOps team is setting up a CI/CD pipeline using GitHub Actions. They want the pipeline to automatically deploy a containerized application to a Kubernetes cluster only when changes are pushed to the main branch. Which GitHub Actions component should they use to trigger the deployment?

A.A cron job that checks the repository every hour

B.A GitHub webhook configured in the repository settings

C.A pull request review requirement

D.A workflow with an on.push trigger for the main branch

AnswerD

Correct. The on.push event triggers the workflow on push to specified branches.

Why this answer

GitHub Actions workflows are defined in YAML and can include an 'on' trigger specifying events such as push to a branch. This allows automation of the deployment when code is pushed to main.

Full explanation →

274

MCQmedium

A company is experiencing increased traffic to its web application. They want to handle the load by adding more web server instances behind a load balancer. This approach is known as:

A.Stateless design

B.Horizontal scaling

C.Auto-scaling

D.Vertical scaling

AnswerB

Horizontal scaling adds more instances to handle increased load.

Why this answer

Horizontal scaling (scaling out) adds more instances to distribute the load, as opposed to vertical scaling which adds resources to a single instance.

Full explanation →

275

MCQeasy

A company wants to deploy a cloud application that requires predictable performance and dedicated resources for a critical database. Which cloud service model is MOST appropriate?

A.Infrastructure as a Service (IaaS)

B.Function as a Service (FaaS)

C.Software as a Service (SaaS)

D.Platform as a Service (PaaS)

AnswerA

IaaS allows provisioning of dedicated compute and storage for the database.

Why this answer

Infrastructure as a Service (IaaS) provides virtualized computing resources, such as dedicated virtual machines, storage, and networking, that can be configured to meet the predictable performance and dedicated resource requirements of a critical database. With IaaS, the company can provision a dedicated server instance with guaranteed CPU, memory, and I/O, avoiding the resource contention common in shared platforms. This model offers full control over the operating system, database software, and security settings, which is essential for a critical database workload.

Exam trap

The trap here is that candidates often choose PaaS (Option D) thinking it provides dedicated resources for databases (e.g., Azure SQL Database or Amazon RDS), but these services run on shared infrastructure with resource governance rather than true dedicated hardware, which can lead to performance variability under load.

How to eliminate wrong answers

Option B (FaaS) is wrong because Function as a Service is designed for event-driven, stateless, short-lived functions that run in a shared environment with no dedicated resources, making it unsuitable for a persistent, resource-intensive database. Option C (SaaS) is wrong because Software as a Service delivers pre-built applications managed entirely by the provider, offering no control over underlying infrastructure or dedicated resource allocation for a custom database. Option D (PaaS) is wrong because while PaaS abstracts infrastructure management, it typically runs on shared multi-tenant platforms with resource limits and less granular control over dedicated resources, which can lead to performance unpredictability for a critical database.

Full explanation →

276

MCQmedium

A security team needs to enforce multi-factor authentication (MFA) for all users accessing the cloud management console. Which IAM feature should be configured?

A.IAM role

B.Condition in IAM policy requiring MFA

C.Resource-based policy

D.Password policy

AnswerB

A condition like 'aws:MultiFactorAuthPresent' can enforce MFA.

Why this answer

A condition in an identity policy can require the presence of multi-factor authentication, enforcing MFA for access to the cloud management console. This is a standard mechanism to mandate MFA at the policy level, ensuring users must authenticate with a second factor before accessing the console.

Exam trap

A common misconception is that password policies can enforce MFA, but password policies only control password attributes, not the second authentication factor required by MFA.

How to eliminate wrong answers

Option A is wrong because an IAM role is used to delegate permissions to entities (like EC2 instances or federated users) and does not inherently enforce MFA; it can be assumed without MFA unless a condition is added. Option C is wrong because a resource-based policy (e.g., an S3 bucket policy) controls access to specific resources, not the cloud management console itself, and cannot enforce MFA for console login. Option D is wrong because a password policy only governs password complexity and rotation rules, not multi-factor authentication; MFA enforcement requires a separate IAM policy condition.

Full explanation →

277

MCQhard

A company's cloud environment uses Azure Active Directory for identity management. They want to allow employees to sign in using their existing on-premises Active Directory credentials without synchronizing passwords to the cloud. Which federation protocol should they use?

A.LDAP

B.Kerberos

C.OAuth 2.0

D.SAML 2.0

AnswerD

SAML 2.0 is commonly used for federated identity with Azure AD, enabling single sign-on without password sync.

Why this answer

Federation allows identity federation without password synchronization. AD FS can be configured to use SAML 2.0 or OIDC to authenticate against on-premises AD and issue tokens to access cloud resources.

Full explanation →

278

MCQmedium

A cloud administrator needs to ensure that a set of AWS EC2 instances can only be accessed via SSH from the corporate office IP range 203.0.113.0/24. Which configuration should the administrator implement?

A.Create a security group with an inbound rule allowing TCP port 22 from 203.0.113.0/24

B.Deploy a VPN and require all SSH traffic to go through it

C.Configure a network ACL with an inbound allow rule for TCP port 22 from 203.0.113.0/24

D.Use AWS WAF to block SSH traffic except from 203.0.113.0/24

AnswerA

Security groups are stateful and can restrict inbound SSH to the specific IP range.

Why this answer

A security group acts as a stateful virtual firewall for EC2 instances. By specifying the source IP range 203.0.113.0/24 on the inbound SSH rule, only traffic from that range is allowed. Security groups are stateful, so return traffic is automatically permitted.

Full explanation →

279

MCQmedium

A cloud administrator needs to deploy a web application in a public cloud. The application must automatically scale out based on CPU utilization and scale in during low demand. Which of the following is the BEST approach?

A.Configure an auto scaling group with a scaling policy based on average CPU utilization

B.Use a script to increase the instance size when CPU exceeds 80%

C.Implement scheduled scaling to add instances during business hours

D.Create a load balancer and manually add instances during peak hours

AnswerA

Auto scaling with CPU metric provides automated horizontal scaling.

Why this answer

An auto scaling group with a scaling policy based on average CPU utilization is the best approach because it dynamically adjusts the number of instances in response to real-time demand. This method uses CloudWatch metrics to trigger scale-out when CPU exceeds a threshold (e.g., 70%) and scale-in when it drops, ensuring the application remains responsive while minimizing cost during low usage.

Exam trap

CompTIA often tests the distinction between horizontal scaling (adding/removing instances) and vertical scaling (resizing instances), where candidates mistakenly choose vertical scaling (Option B) because it seems simpler, but it does not provide the elasticity required for cloud-native applications.

How to eliminate wrong answers

Option B is wrong because increasing the instance size (vertical scaling) does not provide the horizontal scaling required for distributed load handling and can cause downtime during resizing; it also does not automatically scale in. Option C is wrong because scheduled scaling assumes predictable traffic patterns and cannot adapt to unexpected spikes or lulls in CPU utilization, which is the specified trigger. Option D is wrong because manually adding instances during peak hours is not automated and defeats the purpose of elastic scaling, leading to potential delays and human error.

Full explanation →

280

MCQmedium

A cloud administrator is configuring an auto-scaling group for a stateless application. The scaling policy should add 2 instances when the average CPU utilization exceeds 80% for 5 minutes, and remove 1 instance when CPU drops below 40% for 5 minutes. Which type of scaling policy should be used?

A.Simple scaling policy

B.Scheduled scaling policy

C.Step scaling policy

D.Target tracking scaling policy

AnswerC

Step scaling can define different adjustments for different metric ranges.

Why this answer

Step scaling allows specifying different scaling adjustments based on the size of the alarm breach. It can add a specific number of instances for a high CPU breach and remove a specific number for a low CPU breach.

Full explanation →

281

Multi-Selectmedium

Which TWO of the following are common causes of performance degradation in a cloud-based application?

Select 2 answers

A.Over-provisioned virtual machines

B.Resource contention from other tenants on the same hypervisor (noisy neighbor)

C.Load balancer distributing traffic evenly

D.Insufficient IOPS on the storage volume

E.Insufficient bandwidth to the cloud provider

AnswersB, D

Noisy neighbor is a classic cloud performance issue.

Why this answer

Resource contention, commonly known as the 'noisy neighbor' effect, occurs when multiple virtual machines (VMs) on the same hypervisor compete for shared physical resources such as CPU caches, memory bandwidth, and disk I/O. This contention can cause unpredictable performance degradation in a cloud-based application, as one tenant's heavy workload starves others of resources. Cloud providers often mitigate this using CPU pinning, I/O throttling, or dedicated instances, but without such controls, noisy neighbors remain a common cause of performance issues.

Exam trap

CompTIA often tests the misconception that over-provisioning (Option A) causes performance degradation, but in cloud environments, over-provisioning leads to cost inefficiency, not performance loss, while under-provisioning is the actual performance risk.

Full explanation →

282

MCQhard

A company uses Azure DevOps to deploy a critical application. They need to implement a deployment strategy that ensures zero downtime by directing all traffic to the new environment after validation, while keeping the old environment as a fallback. Which deployment strategy should be configured in the Azure Pipelines release pipeline?

A.Canary deployment

B.In-place deployment

C.Blue/green deployment

D.Rolling deployment

AnswerC

Switches traffic from blue to green after validation, keeping blue as fallback.

Why this answer

Blue/green deployment is the correct strategy because it maintains two identical environments (blue and green) and switches the router or load balancer to direct all traffic to the new (green) environment only after validation is complete. The old (blue) environment remains untouched and can serve as an immediate fallback if issues arise, ensuring zero downtime during the cutover.

Exam trap

CompTIA often tests the distinction between canary and blue/green by emphasizing 'gradual traffic shift' versus 'instant full cutover with fallback,' leading candidates to confuse canary's incremental rollout with the zero-downtime fallback requirement.

How to eliminate wrong answers

Option A is wrong because canary deployment gradually shifts a small percentage of traffic to the new version before full rollout, which does not guarantee zero downtime for all users during the initial validation phase and does not keep the old environment as a full fallback. Option B is wrong because in-place deployment updates the existing environment directly, causing downtime during the update process and no fallback environment is preserved. Option D is wrong because rolling deployment replaces instances incrementally, which can cause temporary capacity reduction or version mismatch during the update, and it does not maintain a complete fallback environment.

Full explanation →

283

Multi-Selecthard

A cloud team uses Azure Bicep for deploying resources. They need to create a modular deployment that includes a virtual network and a subnet. Which THREE best practices should they follow when authoring Bicep files? (Choose three.)

Select 3 answers

A.Use hard-coded resource names to ensure consistency.

B.Use modules to encapsulate and reuse resource definitions.

C.Use symbolic names for resources to reference them elsewhere in the file.

D.Use parameters for configurable values like address prefixes.

E.Define all resources in a single file for simplicity.

AnswersB, C, D

Modules promote modularity.

Why this answer

Using parameters for configurable values, using modules for reuse, and using symbolic names for resource references are best practices.

Full explanation →

284

MCQeasy

A cloud application returns HTTP 503 errors during high traffic. The application runs on VMs behind a load balancer. Which action is most likely to resolve the issue?

A.Restart the web server service on one VM.

B.Change the DNS TTL to a lower value.

C.Increase the health check interval on the load balancer.

D.Add additional VMs to the backend pool.

AnswerD

Scaling out increases capacity to handle traffic.

Why this answer

Adding VMs increases the overall capacity to handle high traffic, directly addressing the 503 errors caused by overload. Option A is incorrect because restarting only one VM does not increase capacity; it might briefly disrupt service. Option B is incorrect because lowering the DNS TTL affects how clients resolve the domain, not the backend capacity.

Option C is incorrect because increasing the health check interval only delays detection of unhealthy VMs, which does not prevent overload.

Full explanation →

285

MCQeasy

A small business uses a public cloud IaaS to host a single Windows virtual machine (VM) running a line-of-business application. The VM has a public IP address and is in a network security group that allows RDP (port 3389) from the internet (0.0.0.0/0). The administrator frequently connects from home and various client sites. The administrator is concerned about brute force attacks on the RDP service. The business does not have a VPN server. What is the best way to secure the RDP access without changing the public IP address or blocking all external access?

A.Remove the public IP address and use a bastion service like Azure Bastion or AWS Systems Manager Session Manager to access the VM via RDP over HTTPS.

B.Change the RDP port to a non-standard port (e.g., 3390).

C.Enable multi-factor authentication (MFA) on the local Windows user accounts.

D.Disable password authentication and require smart card certificates for RDP.

AnswerA

This eliminates direct public exposure of RDP and provides secure, audited access.

Why this answer

The best because using Azure Bastion or AWS Systems Manager Session Manager eliminates public RDP exposure entirely. Instead of opening port 3389 to the internet, the administrator connects through a bastion service that authenticates and tunnels RDP over HTTPS. This prevents brute force attacks since no direct RDP port is exposed.

Option B (changing port) is security through obscurity and does not stop automated scans. Option C (MFA on local accounts) is not practical without domain join and still leaves the port open. Option D (smart card certificates) still exposes the port to potential attacks on the certificate authentication process.

Full explanation →

286

Multi-Selecteasy

Which TWO of the following are best practices when configuring a cloud-based virtual private cloud (VPC) for a multi-tier application?

Select 2 answers

A.Place each application tier in a separate subnet.

B.Disable VPC flow logs to reduce costs.

C.Use the default security group for all instances.

D.Place all instances in the same subnet for simplicity.

E.Restrict SSH access to management IP addresses using security groups.

AnswersA, E

Separate subnets allow for network segmentation and security controls.

Why this answer

Placing each application tier (e.g., web, application, database) in a separate subnet allows you to apply distinct network access control lists (NACLs) and security groups per tier. This segmentation enforces the principle of least privilege, ensuring that only the web tier can communicate with the application tier on specific ports, and only the application tier can reach the database tier. It also isolates failures and simplifies troubleshooting by containing traffic within defined network boundaries.

Exam trap

CompTIA often tests the misconception that simplicity (placing all instances in one subnet) is a best practice, when in fact proper segmentation is critical for security and compliance in multi-tier architectures.

Full explanation →

287

MCQmedium

An automated snapshot of a cloud VM is failing with the error 'Quota exceeded for resource snapshots'. What is the most likely cause?

A.The snapshot is being created during a backup window.

B.The maximum number of snapshots allowed has been reached.

C.The snapshot retention policy is set too high.

D.The VM's disk is too full to create a snapshot.

AnswerB

Quota exceeded means the limit on number of snapshots is hit.

Why this answer

The error 'Quota exceeded for resource snapshots' indicates that the number of snapshots has reached the maximum allowed by the cloud provider. Therefore, Option B is correct. Option A is incorrect because backup windows do not affect snapshot quotas.

Option C is incorrect because a high retention policy may cause more snapshots to be retained, but the immediate error is about exceeding the quota, not the policy setting itself. Option D is incorrect because disk space is unrelated to the snapshot count limit.

Full explanation →

288

MCQmedium

A cloud engineer needs to implement a solution to automatically scale an application based on the number of messages in an SQS queue. The goal is to keep the queue length short. Which Auto Scaling policy type should the engineer use?

A.Step scaling

B.Simple scaling

C.Scheduled scaling

D.Target tracking scaling

AnswerD

Target tracking keeps the metric near a target value (e.g., 100 messages).

Why this answer

Target tracking scaling maintains a target metric value (e.g., queue length), adjusting capacity automatically.

Full explanation →

289

MCQeasy

A company hosts its critical applications on a cloud provider's virtual machines within a virtual private cloud. The security team receives an alert from the intrusion detection system indicating that one of the VMs is exhibiting signs of a ransomware infection. The administrator connects to the VM via a bastion host and observes that several important files have been encrypted and a ransom note has been left. The incident response plan is still being developed, but the administrator knows the immediate priority is to contain the threat and prevent it from spreading to other VMs and storage resources. The company has daily backups stored in a separate cloud storage service that is not directly accessible from the production network. Which of the following actions should the administrator take FIRST to contain the incident and minimize further damage?

A.Restore the VM from the most recent backup.

B.Notify law enforcement about the ransomware attack.

C.Run a full antivirus scan on the infected VM.

D.Immediately disconnect the network interface of the infected VM.

AnswerD

This isolates the VM, preventing lateral movement and further encryption.

Why this answer

Isolating the infected VM by disconnecting its network interface stops the ransomware from communicating with command-and-control servers and prevents lateral movement. Restoring from backup without verification may reintroduce the infection. Notifying law enforcement is important but not the first step.

Running antivirus on the active VM could trigger further encryption or be ineffective.

Full explanation →

290

MCQmedium

A cloud architect is designing a highly available web application. The application must remain available even if an entire AWS Availability Zone fails. The architect decides to deploy identical application instances in two separate Availability Zones and distribute traffic equally. Which architecture is being implemented?

A.Fault tolerance

B.Warm standby

C.Active-active

D.Active-passive

AnswerC

Both instances are active and traffic is distributed equally.

Why this answer

Active-active architecture distributes traffic across all instances; if one zone fails, the other continues serving traffic.

Full explanation →

291

MCQmedium

A healthcare organization must store patient imaging data that is accessed infrequently but must be retained for 7 years. They need the lowest-cost storage option while ensuring data can be retrieved within 12 hours if needed. Which storage class should they use?

A.Object storage standard tier

B.Archive storage (Glacier / Azure Archive)

C.Block storage with snapshots

D.File storage (EFS / Azure Files)

AnswerB

Archive storage is cheapest for long-term retention with retrieval times up to 12 hours.

Why this answer

Archive storage like Amazon S3 Glacier Deep Archive or Azure Archive is the lowest cost for long-term retention, with retrieval times ranging from minutes to 12 hours.

Full explanation →

292

MCQhard

A company uses AWS and wants to analyze cost trends and identify the top services contributing to monthly spending. Which AWS tool provides a pre-built dashboard for this purpose?

A.AWS Trusted Advisor

B.AWS Cost Explorer

C.AWS Compute Optimizer

D.AWS Budgets

AnswerB

Cost Explorer offers customizable dashboards and reports for cost analysis.

Why this answer

AWS Cost Explorer provides pre-built reports and dashboards for cost trend analysis.

Full explanation →

293

MCQmedium

Refer to the exhibit. A cloud administrator is troubleshooting why an EC2 instance in subnet-12345678 cannot be reached from the internet. The instance has a public IP and the security group allows all inbound traffic. Based on the exhibit, what is the most likely cause?

A.The security group is not applied.

B.The route table is missing a default route to the internet gateway.

C.The instance is stopped.

D.The network ACL is misconfigured and blocking all inbound traffic.

AnswerD

The network ACL has a deny rule for all inbound traffic, which overrides the security group's allow.

Why this answer

The exhibit shows that the network ACL (NACL) associated with subnet-12345678 has an inbound rule that denies all traffic (rule number 100 with DENY for 0.0.0.0/0). Since NACLs are stateless and evaluated in order, this explicit deny overrides any allow rules, blocking all inbound internet traffic to the EC2 instance regardless of the security group settings or the instance having a public IP.

Exam trap

A common trap is that candidates assume a permissive security group is sufficient, overlooking the NACL's explicit deny rule that blocks all traffic at the subnet boundary.

How to eliminate wrong answers

Option A is wrong because the security group is applied to the instance (as stated in the question, it allows all inbound traffic), and the issue is at the subnet level, not the instance level. Option B is wrong because the route table likely has a default route to the internet gateway (otherwise the instance would not have a public IP reachable from the internet), and the problem is explicitly with the NACL blocking traffic. Option C is wrong because the instance is running (implied by the troubleshooting scenario), and a stopped instance would not have a public IP assigned or respond to traffic, but the question states the instance has a public IP and the security group allows all traffic, indicating it is running.

Full explanation →

294

MCQmedium

A company is deploying a new web application in a hybrid cloud environment. The application must be highly available and able to handle traffic spikes. The cloud team decides to use an auto-scaling group across multiple availability zones with a load balancer. Which additional step should the team take to ensure session persistence during scaling events?

A.Implement a stateless application design

B.Increase the instance size to handle more sessions

C.Configure the load balancer to use a round-robin algorithm

D.Enable sticky sessions on the load balancer

AnswerD

Sticky sessions maintain session affinity during scaling.

Why this answer

Sticky sessions (also known as session affinity) ensure that all requests from a user during a session are directed to the same backend instance. In an auto-scaling group, instances are added or removed dynamically; without sticky sessions, a load balancer using a default algorithm could route a user to a different instance after a scale-out event, losing the in-memory session state. Enabling sticky sessions on the load balancer preserves session persistence across scaling events by binding the user's session to a specific instance for its duration.

Exam trap

The trap here is that candidates often confuse high availability with session persistence, assuming that distributing traffic evenly (round-robin) or scaling instances is sufficient, but they overlook that stateful applications require session affinity to maintain user context during dynamic scaling events.

How to eliminate wrong answers

Option A is wrong because implementing a stateless application design would eliminate the need for session persistence entirely, but the question asks how to ensure session persistence during scaling events, implying the application is stateful and requires sticky sessions. Option B is wrong because increasing the instance size does not solve session persistence; it only increases the capacity of individual instances, but during scaling events, new instances are added and traffic can still be routed to instances that do not hold the user's session. Option C is wrong because configuring the load balancer to use a round-robin algorithm distributes traffic evenly but does not guarantee that a user's subsequent requests go to the same instance, which breaks session persistence during scaling events.

Full explanation →

295

MCQhard

A financial services company must store sensitive customer data in the cloud. The compliance team requires that data at rest be encrypted using customer-managed keys (CMK), and that the keys are rotated every 90 days. Additionally, the cloud provider must not have access to the keys. Which key management solution should the company choose?

A.Store the encryption keys in the cloud provider's parameter store with rotation policy

B.Use the cloud provider's default server-side encryption with a managed key

C.Use a dedicated HSM (hardware security module) with automated key rotation

D.Implement client-side encryption using a third-party key management service

AnswerC

Dedicated HSM ensures exclusive customer control and supports rotation.

Why this answer

A dedicated HSM provides a tamper-resistant hardware appliance where the customer exclusively controls the encryption keys, ensuring the cloud provider has no access. Automated key rotation policies can be configured on the HSM to meet the 90-day rotation requirement, satisfying both the CMK and provider non-access mandates.

Exam trap

The trap here is that candidates often confuse a cloud provider's managed HSM service (e.g., AWS KMS with custom key store) with a dedicated HSM, but the former still allows the provider logical access to the key management plane, whereas a dedicated HSM enforces physical and logical isolation.

How to eliminate wrong answers

Option A is wrong because the cloud provider's parameter store is a software-based service that typically stores keys in a shared infrastructure, and the provider retains administrative access to the underlying key material, violating the requirement that the provider must not have access to the keys. Option B is wrong because the cloud provider's default server-side encryption with a managed key means the provider generates and controls the key, which fails the customer-managed key (CMK) requirement and the provider non-access mandate. Option D is wrong because client-side encryption using a third-party KMS does not inherently prevent the cloud provider from accessing the keys if the third-party service operates within the provider's environment or shares infrastructure, and it may not offer the same hardware-level isolation and automated rotation guarantees as a dedicated HSM.

Full explanation →

296

Multi-Selecthard

A cloud administrator is troubleshooting an application that fails to connect to a database. The application and database are in the same VPC. Which THREE steps should the administrator take to diagnose the issue?

Select 3 answers

A.Check the routing table for a route to the internet.

B.Test connectivity to the database using a telnet or netcat command from the application server.

C.Verify that the security group associated with the database instance allows inbound traffic from the application's security group on the database port.

D.Check the DNS resolution of the database endpoint in the application's subnet.

E.Verify that the network ACL for the database subnet allows inbound traffic on the database port.

AnswersB, C, E

Direct connectivity test isolates the issue.

Why this answer

Telnet or netcat can test basic TCP connectivity to the database port, confirming whether the database is reachable from the application server at the network layer. This step isolates whether the issue is a network connectivity problem versus an authentication or configuration issue within the database itself.

Exam trap

CompTIA often tests the distinction between stateful security groups and stateless network ACLs, and candidates mistakenly assume that allowing inbound traffic in the security group alone is sufficient, forgetting that network ACLs must also permit the traffic.

Full explanation →

297

Multi-Selectmedium

An organization is using Azure and wants to implement a patch management strategy with minimal disruption. Which TWO actions should they take? (Select TWO.)

Select 2 answers

A.Implement rollback procedures

B.Define maintenance windows for patching

C.Use only manual patching

D.Patch all servers simultaneously

E.Disable automatic updates on all VMs

AnswersA, B

Rollback procedures allow reverting patches if they cause problems.

Why this answer

Maintenance windows schedule updates during low activity, and rollback procedures enable recovery if issues occur.

Full explanation →

298

MCQmedium

A DevOps team uses Ansible to automate cloud resource provisioning. Which of the following best describes Ansible's architecture?

A.It uses a declarative language similar to Terraform.

B.It uses a master-server architecture with a central controller.

C.It requires an agent installed on each managed node.

D.It is agentless and uses SSH or WinRM to execute tasks.

AnswerD

Correct. Ansible uses SSH (Linux) or WinRM (Windows) without agents.

Why this answer

Ansible is agentless and uses SSH or WinRM to connect to managed nodes, executing YAML playbooks.

Full explanation →

299

MCQmedium

A company wants to migrate a legacy application to the cloud. The application has a monolithic design and requires low-latency access to on-premises databases. The company needs to keep sensitive data on-premises due to regulatory compliance. Which cloud deployment model is most suitable?

A.Public cloud

B.Hybrid cloud

C.Multi-cloud

D.Private cloud

AnswerB

Hybrid cloud allows workloads in public cloud with connectivity to on-premises resources, meeting latency and compliance needs.

Why this answer

Hybrid cloud connects on-premises infrastructure with public cloud, allowing the legacy app to run in the cloud while maintaining low-latency access to on-premises databases and keeping sensitive data on-premises. Public cloud alone would not allow data residency. Private cloud is on-premises only, missing cloud benefits.

Multi-cloud involves multiple public clouds, which does not address the on-premises requirement.

Full explanation →

300

MCQmedium

A deployment fails with a message about missing dependencies. What should the administrator check first?

A.Change the instance type to one with more memory

B.Review the deployment logs to identify missing packages

C.Reinstall the operating system

D.Restart the server and retry the deployment

AnswerB

Logs provide details on what dependencies are missing.

Why this answer

When a deployment fails with a 'missing dependencies' message, the first step is to review the deployment logs. Logs will contain specific error messages indicating which packages or libraries are absent, allowing the administrator to install them directly. This aligns with standard troubleshooting methodology: identify the root cause from logs before taking corrective action.

Exam trap

The trap here is that candidates may assume a generic 'fix' like restarting or resizing the instance will resolve the issue, when the specific error message about missing dependencies demands log inspection to identify and install the exact missing packages.

How to eliminate wrong answers

Option A is wrong because changing the instance type to one with more memory addresses resource constraints (e.g., out-of-memory errors), not missing dependencies, which are package or library absences. Option C is wrong because reinstalling the operating system is an extreme, time-consuming measure that would likely resolve the dependency issue only if the OS image already includes the required packages, but it bypasses the need to identify the specific missing dependencies from logs. Option D is wrong because restarting the server and retrying the deployment does not install missing packages; it merely re-executes the same failing process without addressing the root cause.

Full explanation →

Page 4 of 14

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14

Practice CV0-004 by domain

Target a specific domain to shore up weak areas.

Cloud Architecture and Design Deployment Security Operations and Support Troubleshooting

See all domains with question counts →