977 questions total · 14pages · All types, answers revealed
A company wants to protect data in transit between its on-premises data center and a public cloud environment. Which technology should be used to create a secure encrypted tunnel over the internet?
VPNs (IPsec or SSL VPNs) are designed to create secure tunnels over public networks.
A cloud architect is selecting a deployment model for a workload that has strict data sovereignty requirements; data must remain within the company's on-premises data center. Which cloud deployment model should be chosen?
Private cloud can be deployed on-premises, ensuring data remains within the company's control.
Why this answer
A private cloud deployment model is the correct choice because it provides dedicated infrastructure that is exclusively used by a single organization, ensuring that all data and workloads remain within the company's on-premises data center. This model meets strict data sovereignty requirements by allowing full control over data residency, network boundaries, and physical security, unlike shared or public environments where data may cross jurisdictional lines.
Exam trap
CompTIA often tests the misconception that a hybrid cloud can satisfy data sovereignty by keeping sensitive data on-premises, but the trap is that the hybrid model inherently involves public cloud integration, which may still expose data to off-premises processing or storage, failing the strict 'must remain within the on-premises data center' requirement.
How to eliminate wrong answers
Option B (Community cloud) is wrong because it is shared among several organizations with common concerns (e.g., compliance or security), but data may still be processed or stored across multiple participants' sites, potentially violating strict on-premises data sovereignty. Option C (Hybrid cloud) is wrong because it combines private and public cloud resources, and while it can keep some data on-premises, the public cloud component introduces the risk of data leaving the data center, which conflicts with the requirement that data must remain within the on-premises data center. Option D (Public cloud) is wrong because it uses shared infrastructure owned and operated by a third-party provider, with data stored in off-premises data centers that may be located in different geographic regions, directly violating data sovereignty constraints.
A cloud administrator receives an alert that a virtual machine is unresponsive. The hypervisor shows the VM status as 'running'. Which of the following should the administrator check FIRST to diagnose the issue?
The console shows the OS state; if the OS is hung, it can be diagnosed there.
Why this answer
When a VM is unresponsive but the hypervisor shows its status as 'running', the most direct way to determine if the guest OS has crashed or is stuck in a boot loop is to access the VM's console. This provides a direct view of the OS screen, allowing the administrator to see if the OS is hung, at a login prompt, or displaying an error, which is the first step in isolating the issue before checking network or resource configurations.
Exam trap
CompTIA often tests the distinction between 'VM status' (hypervisor-level) and 'guest OS responsiveness' (OS-level), and the trap here is that candidates assume a 'running' VM is fully operational and immediately check network or resource issues, ignoring the need to verify the OS state via console.
How to eliminate wrong answers
Option B is wrong because security group rules control network traffic at the subnet level; if the VM is unresponsive due to an OS crash, security groups would not affect the VM's ability to respond, and checking them first would be premature without confirming the OS is operational. Option C is wrong because reviewing hypervisor CPU and memory utilization for the VM would help identify resource contention, but the VM is already marked as 'running', meaning the hypervisor is allocating resources; the issue is likely within the guest OS, not resource starvation. Option D is wrong because checking the virtual network interface for disconnection would only be relevant if the VM were unreachable over the network, but the alert states the VM is unresponsive, which could be due to an OS-level hang; network disconnection would not cause the VM to be unresponsive from the hypervisor's perspective.
A cloud architect is planning a disaster recovery (DR) strategy for a mission-critical application. The RTO must be under 1 hour and RPO under 15 minutes. The primary site is in a different region. Which DR pattern meets these requirements?
Pilot light keeps minimal resources running and can scale up quickly to meet RTO/RPO.
Why this answer
The pilot light pattern meets the RTO under 1 hour and RPO under 15 minutes because it keeps a minimal core set of services (e.g., database replicating via asynchronous replication) running in the DR region, allowing rapid scale-up of the full application stack during failover. This pattern balances cost and recovery speed, as the replicated data ensures an RPO of seconds to minutes, and the pre-provisioned core infrastructure enables failover within minutes, satisfying the strict RTO.
Exam trap
CompTIA often tests the misconception that 'pilot light' is only for low-criticality apps, but the trap here is that candidates confuse it with cold standby, failing to recognize that pilot light's pre-provisioned core and continuous replication can meet strict RTO/RPO targets without the cost of full active-active.
How to eliminate wrong answers
Option A is wrong because backup and restore typically involves periodic snapshots (e.g., daily or hourly) that cannot achieve an RPO under 15 minutes, and the restore process often takes hours to days, failing the RTO under 1 hour. Option B is wrong because cold standby has no pre-provisioned resources; provisioning and configuring infrastructure from scratch can take hours, exceeding the 1-hour RTO, and data replication is not continuous, so RPO is often hours or days. Option D is wrong because multi-site active-active requires both regions to handle live traffic simultaneously, which is overkill for a mission-critical application with a 1-hour RTO and 15-minute RPO, and it introduces complexity and cost without additional benefit for these specific recovery targets.
Sequence the steps to troubleshoot a cloud-based application that is not accessible from the internet.
Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Why this order
Start with basic checks: security groups, VM state, connectivity, then move to higher-level components and logs.
An organization is implementing a CI/CD pipeline for a critical application. The team wants to deploy a new version to a small subset of users initially to validate performance and functionality before rolling out to the entire user base. Which deployment strategy best fits this requirement?
Canary deployment routes a small percentage of traffic to the new version, allowing monitoring before full rollout.
Why this answer
Canary deployment releases the new version to a small percentage of users, monitors its performance, and gradually increases traffic if successful.
A company is designing a VPC in AWS. They need to host a web application with a public-facing load balancer, web servers in private subnets, and a database in a separate private subnet. Which network architecture is most secure and aligns with best practices?
This three-tier architecture follows best practices for security and isolation.
Why this answer
A three-tier architecture with a public subnet for the load balancer, private subnets for web servers, and a separate private subnet for the database provides security and isolation.
A KVM host has three VMs. The db-server VM is in a paused state. Which of the following is the most likely cause?
Hypervisors pause VMs when storage errors occur to prevent corruption.
Why this answer
Storage I/O errors on the VM disk can cause the hypervisor to pause the VM to prevent data corruption. CPU overcommitment (Option B) typically leads to performance degradation, not pausing. Insufficient memory (Option C) can cause swapping or OOM, but not directly pausing.
A network interface being down (Option D) would affect connectivity, not cause the VM to enter a paused state.
A company is deploying a containerized application using Kubernetes on a public cloud. The development team has created a Docker image and pushed it to a private container registry. The deployment YAML points to the registry. However, when the deployment is applied, the pods fail to start with an 'ImagePullBackOff' error. The cloud administrator verifies that the registry is reachable from the cluster nodes and that the image exists. What is the most likely reason for the failure?
Without authentication, the private registry denies pull requests.
Why this answer
The most likely reason for the ImagePullBackOff error is that the deployment lacks a Kubernetes secret for registry authentication. Since the image is stored in a private container registry, the kubelet must authenticate with the registry to pull the image. Without a properly configured imagePullSecret in the pod spec, the kubelet cannot obtain credentials, resulting in a failed pull and the ImagePullBackOff status.
Exam trap
CompTIA often tests the distinction between image existence and registry authentication, trapping candidates who assume that because the image is present and the registry is reachable, the pull should succeed without considering the need for explicit credentials.
How to eliminate wrong answers
Option B is wrong because if the cluster nodes were out of disk space, the error would typically be 'Evicted' or 'OutOfDisk', not ImagePullBackOff, and the administrator would see disk pressure events. Option C is wrong because an incorrect image tag would cause a 'ErrImagePull' or 'ImagePullBackOff' error, but the administrator has already verified that the image exists; the issue is authentication, not a missing tag. Option D is wrong because insufficient CPU resources would cause a 'Pending' state with 'Insufficient cpu' events, not an ImagePullBackOff error, which is specific to image retrieval failures.
A company wants to ensure high availability for a stateless web application. Which architecture should be recommended?
This provides HA across zones; if one zone fails, traffic is routed to the other.
Why this answer
Deploying one VM in each of two availability zones with a load balancer ensures high availability by eliminating a single point of failure. If one availability zone fails, the load balancer automatically routes traffic to the healthy VM in the other zone, keeping the stateless web application accessible. This architecture aligns with the principle of fault tolerance for stateless applications, where no session state is lost during failover.
Exam trap
The trap here is that candidates often confuse high availability with redundancy within a single zone, failing to recognize that true high availability requires geographic or zone-level separation to survive infrastructure failures.
How to eliminate wrong answers
Option A is wrong because placing two VMs in the same availability zone still creates a single point of failure at the zone level; if that zone goes down, both VMs become unavailable. Option C is wrong because a single VM with daily backups does not provide high availability — backups only aid recovery after a failure, not automatic failover, and the application will experience downtime. Option D is wrong because a single large VM with auto-recovery still represents a single point of failure; auto-recovery only restarts the VM after a crash, but it does not prevent downtime during the recovery period and cannot protect against zone-level failures.
A company has a requirement to enforce least privilege for its cloud resources. The cloud engineer is configuring IAM policies. Which of the following best describes least privilege?
This is the principle of least privilege.
Why this answer
Least privilege means granting only the permissions required to perform a job function, minimizing potential damage from compromised accounts.
A global company runs a SaaS application in multiple cloud regions. They use DNS-based global load balancing to route users to the nearest region. Recently, users in Asia are experiencing high latency and timeouts. The administrator checks the health of the Asian region's resources and finds everything operational. Latency measurements from a monitoring tool show that traffic from Asian users is being routed to the European region. What should the administrator investigate first?
Misconfiguration in latency-based routing can send traffic to a farther region.
Why this answer
The latency-based routing policy. Since the Asian region's resources are operational but traffic is being routed to Europe, the issue is likely that the latency-based routing policy is misconfigured or not accurately measuring latency from Asian users. This policy uses latency measurements to route users to the closest region; if it's flawed, traffic may be sent to a distant region.
Investigate the latency routing policy first. Option B (DNS TTL) affects caching duration, not routing decisions. Option C (geo-location records) is used for geographic routing, not latency-based routing.
Option D (load balancer in Asia) is operational, so the problem is at the DNS level, not the load balancer.
A company is deploying a new web application in a hybrid cloud environment. The application must be able to scale out automatically during peak usage and scale in during low usage. The deployment must also ensure that the application remains available if a single Availability Zone fails. Which deployment strategy should the architect recommend?
Auto-scaling provides automatic scaling and multi-AZ ensures high availability.
Why this answer
An auto-scaling group spanning multiple Availability Zones ensures both automatic scaling based on demand and high availability. If one Availability Zone fails, the load balancer distributes traffic to healthy instances in the remaining zones, meeting the requirement for continuous availability during a zone failure.
Exam trap
Candidates often mistakenly believe that a load balancer alone ensures high availability. However, without multiple instances across zones and auto-scaling, the application remains vulnerable to a single zone failure.
How to eliminate wrong answers
Option A is wrong because deploying instances in a single Availability Zone creates a single point of failure; if that zone fails, the entire application becomes unavailable, violating the availability requirement. Option C is wrong because manually resizing a single large instance does not provide automatic scaling and still results in a single point of failure; it also lacks the elasticity needed for peak usage. Option D is wrong because a load balancer in front of a single instance does not provide automatic scaling or fault tolerance; if the instance or its Availability Zone fails, the application goes down.
A company wants to migrate a stateful application to the cloud but needs to ensure it can scale horizontally. What architectural change is required?
Externalizing state allows any instance to handle any request, enabling horizontal scaling.
Why this answer
Horizontal scaling requires stateless application design; sessions must be externalized to a shared data store.
A cloud architect is designing a VPC with public and private subnets. Which component is required to allow instances in the private subnet to access the internet for software updates?
NAT gateway allows outbound traffic from private subnets to the internet.
Why this answer
A NAT gateway is required to enable instances in a private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT gateway's Elastic IP address using source network address translation (SNAT). An Internet gateway alone cannot serve private subnets because it requires a route table entry pointing to a public subnet with a public IP address.
How to eliminate wrong answers
Option B is wrong because an Elastic IP is a static public IPv4 address that must be associated with a resource in a public subnet (e.g., an EC2 instance or a NAT gateway) to provide internet access; assigning an Elastic IP directly to a private instance does not enable internet access without a routing path through an Internet gateway or NAT device. Option C is wrong because a VPN connection provides secure connectivity between a VPC and an on-premises network, not direct internet access; it does not route traffic to the public internet unless combined with additional components like a NAT gateway or proxy. Option D is wrong because an Internet gateway allows bidirectional traffic between a VPC and the internet, but it only works for instances with public IP addresses in public subnets; private subnet instances cannot use an Internet gateway directly because they lack a public IP and the route table for the private subnet does not point to the Internet gateway.
A company is adopting a shared responsibility model for a PaaS cloud deployment. Which THREE responsibilities belong to the customer?
The customer decides how to classify and encrypt data.
Why this answer
In a PaaS shared responsibility model, the customer is responsible for data classification and encryption of data at rest and in transit. The cloud provider manages the underlying infrastructure, but the customer must classify data according to sensitivity and apply encryption mechanisms, such as using TLS 1.2/1.3 for data in transit and AES-256 for data at rest, as the provider cannot access or classify customer data.
Exam trap
The CV0-004 exam often tests the misconception that the customer manages the runtime environment in PaaS, but the trap here is that PaaS abstracts the runtime, so the provider handles it, while the customer's responsibilities are limited to data, application code, and access control.
Which GCP service provides centralized log management and analysis with the ability to create log-based metrics and alerts?
Cloud Logging provides centralized log storage, querying, and alerting capabilities.
Why this answer
GCP Cloud Logging is the centralized logging service that supports log-based metrics and alerting.
A cloud administrator wants to analyze network traffic to troubleshoot connectivity issues between VMs. Which feature should be enabled?
Correct. Network flow logs capture metadata about IP traffic between resources.
Why this answer
Network flow logs capture IP traffic information for network debugging. They record metadata about network traffic to help troubleshoot connectivity issues.
Exam trap
Candidates may confuse network flow logs with other logging services that capture different types of data, such as API calls or application performance.
A company has deployed a multi-tier application on a public cloud platform. The security team discovers that a Compute Instance is communicating with an external IP address known for malicious activity. The instance is part of an auto scaling group. What is the BEST immediate action to contain the threat while minimizing downtime?
This isolates the specific instance without affecting other instances, and blocking traffic stops the malicious communication.
Why this answer
Isolating the compromised instance by detaching it from the auto scaling group and applying a security group that denies all traffic can quickly contain the threat. Network ACLs are attached to subnets and changing them could affect other instances. Suspending the auto scaling group alone may not stop the current instance.
Updating routing tables is complex and could disrupt legitimate traffic.
A company uses a cloud object storage service to store backup data. The cloud provider charges for storage and retrieval. The operations team wants to minimize costs while ensuring data is available within 24 hours of a restore request. Which storage tier should they use?
Cold storage offers low cost and retrieval within 24 hours.
Why this answer
The cold storage tier offers a retrieval time of 12 hours, which meets the requirement of making data available within 24 hours while minimizing costs compared to hotter tiers. Cold storage is designed for infrequently accessed data with longer retrieval times, providing a cost-effective balance between availability and expense for backup data that does not need immediate access.
Exam trap
The trap here is that candidates may confuse 'cold storage' with 'archive storage' or assume that any tier with a retrieval time under 24 hours is equally cost-effective, overlooking that cold storage specifically balances cost and retrieval time for infrequent access needs.
How to eliminate wrong answers
Option A is wrong because the archive storage tier with a 48-hour retrieval time exceeds the 24-hour availability requirement, making it unsuitable for the stated restore window. Option B is wrong because the hot storage tier, while providing immediate retrieval, incurs higher storage costs that are unnecessary for backup data that does not require real-time access, thus failing to minimize costs. Option D is wrong because the infrequent access tier with a 1-hour retrieval time, though cheaper than hot storage, still costs more than cold storage and provides faster retrieval than needed, leading to higher expenses without operational benefit.
A cloud architect is designing a VPC with multiple tiers. The web servers must be accessible from the internet, but the database servers must not be directly accessible. Which subnet design should the architect implement?
Correct. This keeps databases isolated from direct internet access.
Why this answer
Public subnets for web servers and private subnets for databases, with a load balancer in the public subnet routing to web servers in a private subnet if needed; but typically web servers are in public subnets.
Refer to the exhibit. A cloud engineer is using AzCopy to transfer files to Azure Blob Storage. The copy fails with the above error. Which of the following is the most likely cause?
An expired SAS token causes the server to reject the request with this exact error.
Why this answer
The error explicitly indicates an authentication failure, which is typically due to an expired or invalid SAS token. Option A is wrong because a firewall block would result in a different error (e.g., 403 Forbidden). Option C is wrong because a non-existent container would return a 404 error.
Option D is wrong because insufficient throughput would cause a timeout, not an authentication error.
A company is migrating a legacy application to the cloud using a replatforming strategy. The application uses a proprietary logging framework that writes logs to local disk. The cloud architecture uses ephemeral storage for the application servers. The operations team notices that logs are lost when servers are replaced during auto-scaling events. What is the best solution to ensure logs are preserved?
Ensures logs are stored externally and persist beyond instance lifecycle.
Why this answer
The core issue is that ephemeral storage is lost when instances are terminated or replaced during auto-scaling events. By configuring the logging framework to write to a central log server over the network (e.g., using syslog, HTTP, or a dedicated log aggregation service), logs are persisted independently of the application server's lifecycle. This decouples log storage from compute resources, ensuring logs survive scaling events.
Exam trap
The trap here is that candidates may think increasing storage or optimizing local I/O solves the persistence problem, but the exam tests understanding that ephemeral storage is inherently non-persistent and that logs must be sent off-instance to survive instance replacement.
How to eliminate wrong answers
Option A is wrong because increasing the size of ephemeral storage does not solve the fundamental problem that ephemeral storage is non-persistent and is destroyed when the instance is terminated or replaced. Option B is wrong because memory-only logging would cause logs to be lost even more quickly on instance termination or crash, and it does not address the persistence requirement; it also introduces performance and capacity constraints. Option C is wrong because disabling auto-scaling defeats the purpose of cloud elasticity and scalability, and it does not address the logging persistence issue—logs would still be lost if a server fails or is manually replaced.
A company is moving a 10 TB SQL Server database to Azure SQL Database. They need to migrate with minimal downtime while keeping the source database operational. Which service should they use?
Azure DMS supports online migrations with minimal downtime.
Why this answer
Azure Database Migration Service supports online migrations with minimal downtime using continuous sync (CDC) from SQL Server to Azure SQL Database.
A company is experiencing high latency in their cloud-based database. The database is provisioned with SSD storage. Which THREE factors should the administrator investigate? (Choose three.)
Network congestion or high latency affects database response.
Why this answer
Options A, B, and D are correct because network bandwidth limitations between application and database can cause high latency, unoptimized database queries increase response time, and exceeding IOPS limits leads to throttling and higher latency. Option C is incorrect because the number of database replicas primarily affects read throughput and fault tolerance, not latency directly. Option E is incorrect because region latency is a fixed infrastructure property that typically does not change suddenly, so it is less likely to be the cause of a sudden latency spike.
A company is migrating a 50 TB on-premises SQL Server database to Amazon RDS for MySQL with minimal downtime. The schema must be converted from SQL Server to MySQL. Which combination of AWS services should the cloud architect use?
DMS handles migration and replication; SCT converts schema.
Why this answer
AWS DMS can migrate data with minimal downtime using CDC. Schema Conversion Tool (SCT) converts the schema from SQL Server to MySQL. DMS then performs the ongoing replication.
A cloud administrator is configuring an alert for an Azure virtual machine. The alert should trigger when the average CPU percentage exceeds 90% for more than 10 minutes. Which Azure service should be used to create this metric alert?
Azure Monitor Alerts can trigger on metric thresholds and aggregate over time.
Why this answer
Azure Monitor Alerts allow you to create metric alerts based on conditions like CPU percentage thresholds and evaluation periods.
A cloud team is implementing a CI/CD pipeline for a containerized application. They want to automatically build a Docker image, push it to a registry, and deploy it to a Kubernetes cluster. Which TWO tools from the options below are commonly used as part of this pipeline? (Select 2)
Correct. Jenkins can automate build, push, and deploy steps.
Why this answer
Jenkins and GitLab CI are both CI/CD tools that can build Docker images, push to registries, and deploy to Kubernetes. Terraform and CloudFormation are IaC tools, not CI/CD. Docker Compose is for local development.
A small business hosts a web application on a single cloud server. The server has 2 vCPUs and 4 GB RAM. Recently, the application crashes when the number of concurrent users exceeds 50. The administrator checks the system logs and finds out-of-memory (OOM) errors. What is the best course of action to resolve this issue without redesigning the application?
Increasing memory directly resolves OOM errors without application changes.
Why this answer
The best course of action is to increase the server's RAM to 8 GB (Option C). The OOM errors indicate that the current 4 GB RAM is insufficient for 50+ concurrent users. Increasing RAM directly addresses the memory shortage without requiring application changes or redesign.
Option A (load balancer and another server) adds complexity and cost, and may not resolve the memory issue on the single server if the application is not stateless. Option B (code optimization) is a redesign effort that may not be feasible as a quick fix. Option D (enabling swap space) can lead to severe performance degradation because swapping is much slower than RAM, and may still cause crashes under high load.
A company plans to use a public cloud to host a static website with minimal configuration. The website content is stored in an object storage bucket. Users access the site via a custom domain name. Which cloud service should the company use to serve the content with low latency globally?
CDN caches content for low latency.
Why this answer
A CDN caches static content at edge locations worldwide, reducing latency for global users. By configuring the object storage bucket as the origin, the CDN pulls content on cache miss and serves it from the nearest edge node. This meets the requirement of minimal configuration while providing low-latency delivery via a custom domain.
Exam trap
CompTIA often tests the misconception that a load balancer or DNS round-robin alone can provide global low-latency delivery, when in fact they lack caching and edge distribution, which are essential for static content performance.
How to eliminate wrong answers
Option A is wrong because deploying a reverse proxy server in each region requires manual provisioning and maintenance, contradicting the 'minimal configuration' requirement and not leveraging the public cloud's managed services. Option B is wrong because DNS-based round-robin to multiple storage buckets does not cache content; each request still hits the origin bucket, and DNS alone cannot provide low-latency global delivery or handle traffic spikes efficiently. Option C is wrong because a load balancer distributing traffic to multiple object storage endpoints does not cache content; it only distributes requests across buckets, still requiring each request to reach the origin, and adds complexity without reducing latency for geographically distributed users.
An organization uses GCP and wants to implement a tagging strategy to track costs by project and environment. Which GCP feature should be used to assign metadata to resources for cost attribution?
Labels are used to organize resources and enable cost breakdown.
Why this answer
GCP labels are key-value pairs used to organize and track resources for cost allocation.
An organization wants to minimize costs for a batch processing workload that runs nightly for 2 hours and can tolerate interruptions. Which pricing model is most cost-effective?
Spot instances are discounted up to 90% and can be interrupted, ideal for batch jobs that can restart.
Why this answer
Spot instances offer significant discounts but can be terminated; suitable for fault-tolerant, interruptible workloads.
A cloud administrator is troubleshooting a performance issue where a virtual machine running a database is experiencing high latency. The hypervisor shows the VM has been allocated 4 vCPUs and 16 GB of RAM, but the host server has 32 GB of RAM and 16 cores. Which of the following is most likely the cause of the latency?
This is correct because network storage introduces higher latency, which is detrimental to database performance. Even with adequate CPU and RAM, I/O waits can cause significant latency.
Why this answer
The VM has 4 vCPUs on a host with 16 physical cores, so CPU over-provisioning is not the issue. However, the database workload is sensitive to storage latency. If the VM's virtual disks reside on a network share (e.g., NFS, SMB), I/O operations must traverse the network, introducing higher latency compared to local storage.
This is a common cause of performance degradation in database VMs, as they require low-latency disk access. The RAM allocation (16 GB out of 32 GB host) is adequate, and paravirtualized drivers typically improve performance.
Exam trap
CompTIA often tests the concept that network-attached storage can cause high latency for I/O-intensive workloads like databases, even when CPU and memory allocations appear sufficient. Candidates may overlook storage performance and default to CPU or memory issues.
How to eliminate wrong answers
Option B is wrong because network-attached storage can introduce latency, but the question focuses on CPU/RAM allocation and the host has ample resources; storage is not indicated as the bottleneck. Option C is wrong because 16 GB RAM for a database VM is often sufficient, and the host has 32 GB total, so memory starvation is unlikely to cause high latency without other symptoms. Option D is wrong because paravirtualized drivers typically reduce latency by bypassing emulation overhead; they are a best practice for performance, not a cause of high latency.
Which THREE elements are required for a complete key lifecycle management strategy in a cloud environment? (Choose three.)
Keys must be generated securely, often from a hardware security module or using cryptographically sound methods.
Why this answer
Secure key generation is the foundational first step in a key lifecycle management strategy. In a cloud environment, keys must be generated using a FIPS 140-2 validated hardware security module (HSM) or a cloud provider's equivalent (e.g., AWS CloudHSM, Azure Key Vault Premium) to ensure cryptographic strength and prevent exposure of the private key material during creation.
Exam trap
CompTIA often tests the distinction between the mandatory lifecycle phases (generation, rotation, destruction) and supporting security controls (access control, backup) to trap candidates who confuse operational best practices with the required lifecycle stages.
Which TWO of the following are best practices for managing cloud costs? (Select TWO.)
Tags help identify cost centers and optimize spend.
Why this answer
A is correct because resource tagging enables granular cost allocation and chargeback by attaching metadata (e.g., environment, project, cost center) to cloud resources. This allows you to filter and group costs in billing reports, making it easier to identify spending patterns and optimize budgets. Without tagging, costs are aggregated, obscuring which teams or workloads drive expenses.
Exam trap
Cloud+ often tests the misconception that manual actions (like stopping VMs by hand) are a best practice, when in fact automation and right-sizing are the recommended approaches for consistent cost management.
Which TWO of the following are advantages of using a configuration management tool (e.g., Ansible, Chef, Puppet) in cloud deployments? (Choose two.)
Idempotency ensures repeated runs converge to the same state.
Why this answer
Configuration management tools like Ansible, Chef, and Puppet enforce idempotency, meaning that applying the same configuration multiple times results in the same desired state without unintended side effects. This is achieved by checking the current state of the system before making changes, ensuring that resources are only modified when necessary. Idempotency is critical for reliable, repeatable infrastructure changes in cloud deployments.
Exam trap
The trap here is that candidates confuse configuration management tools with broader cloud management or monitoring services, mistakenly attributing capabilities like auto-scaling or real-time monitoring to tools that are strictly focused on state-based configuration and idempotent provisioning.
A company has a hybrid cloud environment where on-premises servers communicate with cloud resources via a VPN connection. The network team notices intermittent connectivity issues and packet loss. The VPN tunnel is established, but performance is degraded. Which step should the team take first to diagnose the issue?
Identifies network path issues.
Why this answer
B is correct because traceroute and ping are the foundational diagnostic tools to measure latency and packet loss across a VPN tunnel. Intermittent connectivity and packet loss often stem from path issues, MTU mismatches, or routing problems that these tools can isolate. Since the tunnel is established, the first step is to quantify the performance degradation before making configuration changes.
How to eliminate wrong answers
Option A is wrong because restarting the VPN tunnel is a disruptive action that should only be taken after gathering diagnostic data; it may temporarily mask the issue without identifying the root cause. Option C is wrong because increasing the MTU size could worsen fragmentation or cause packet drops if the underlying path has a lower MTU; the correct first step is to test with ping to determine the optimal MTU. Option D is wrong because checking CPU utilization of the on-premises VPN appliance is a secondary step; while high CPU could cause performance issues, it is not the first diagnostic step when the tunnel is established and the primary symptom is packet loss.
A cloud administrator is troubleshooting a network connectivity issue between two subnets. They suspect a security group or NACL is blocking traffic. Which tool should they use to analyze the traffic flow?
Flow logs record allowed/denied traffic for analysis.
Why this answer
VPC Flow Logs capture network traffic metadata, helping identify dropped packets.
A cloud architect is designing a container security strategy. Which TWO of the following should be implemented to secure containers? (Choose two.)
Runtime security detects threats during container execution.
Why this answer
Image scanning detects vulnerabilities in container images, and runtime security monitors containers for anomalous behavior. Network ACLs are not container-specific. Using the latest base image reduces vulnerabilities.
Disabling security controls is wrong.
Determines if IaaS (full control) or PaaS (less control) is needed.
Why this answer
The level of control over the operating system and runtime environment is a defining factor when choosing between IaaS, PaaS, and SaaS. IaaS provides full control over the OS and runtime, PaaS abstracts the OS and runtime but allows control over application deployment, and SaaS offers no control over the underlying infrastructure. This directly impacts migration decisions, especially for legacy applications that require specific OS configurations or custom runtime dependencies.
Exam trap
CompTIA often tests the misconception that security compliance or scalability are primary factors for service model selection, when in fact they are operational requirements that apply across all models, while control over the OS and runtime is the key differentiator.
A cloud administrator is configuring an auto-scaling group for a web application. The application experiences predictable traffic spikes every weekday at 9 AM. Which scaling policy is most appropriate?
Scheduled scaling handles predictable patterns by scaling in advance.
Why this answer
Scheduled scaling allows you to increase capacity at specific times. Target tracking and step scaling are reactive. Cooldown periods are settings within policies.
A developer is deploying a serverless function that processes images uploaded to an S3 bucket. The function should be triggered automatically whenever a new object is created in the bucket. Which event source should be configured to invoke the Lambda function?
Lambda can be configured to trigger on S3 events such as s3:ObjectCreated:*.
Why this answer
S3 can send events to Lambda when objects are created, enabling automatic processing without polling.
A company needs to migrate 50 TB of data from an on-premises file server to a cloud storage service. The network bandwidth is limited and the migration must be completed within one week. Which cloud service is specifically designed for offline data transfer of large datasets?
Correct: This service uses physical devices for offline transfer, ideal for large datasets with bandwidth constraints.
Why this answer
Offline data transfer via physical device is specifically designed for offline data transfer of large datasets, such as 50 TB, when network bandwidth is limited. It provides physical storage devices that are shipped to the customer, loaded with data, and returned to the cloud provider for ingestion into the cloud storage service, bypassing network constraints entirely. This makes it the ideal choice for completing a 50 TB migration within one week over a limited bandwidth connection.
Exam trap
The trap here is that candidates often confuse online data transfer services with offline transfer solutions, overlooking that the physical device service is the only option designed for moving large data when bandwidth is insufficient.
How to eliminate wrong answers
Option A is wrong because AWS DataSync is an online data transfer service that requires network connectivity and is not designed for offline transfer; it would be impractical for 50 TB over limited bandwidth within one week. Option C is wrong because Amazon S3 Batch Operations is used for managing bulk actions on existing S3 objects (e.g., copying, tagging) and does not handle initial data ingestion from on-premises sources. Option D is wrong because S3 Transfer Acceleration is a network optimization feature that speeds up uploads over the internet but still relies on available bandwidth and cannot overcome severe bandwidth limitations for large datasets.
A company is migrating a legacy application to the cloud. The application has a stateful design and requires low-latency access to a shared file system. The application must scale horizontally to handle increased load. Which THREE of the following architectural changes should be recommended to enable horizontal scaling?
Statelessness enables any instance to handle any request, facilitating horizontal scaling.
Why this answer
Horizontal scaling requires that any instance can handle any request without depending on local state. By refactoring the application to be stateless, session data is externalized, allowing new instances to be added or removed without affecting ongoing transactions. This eliminates the coupling between a client and a specific server, which is essential for elastic scaling in cloud environments.
Exam trap
The CV0-004 exam often tests the misconception that sticky sessions (session affinity) are a valid solution for scaling stateful applications, but in reality they create a hard dependency on a specific server, which directly contradicts the principles of horizontal scaling and fault tolerance.
A cloud engineer is tasked with securing network traffic in a VPC. Which TWO of the following are stateful security mechanisms? (Choose two.)
DDoS protection services are stateful, monitoring traffic patterns and maintaining state to identify anomalies.
Why this answer
Security groups are stateful, automatically allowing return traffic. DDoS protection services are stateful as they track and analyze traffic flows to detect anomalies. Network ACLs are stateless.
WAF is typically stateless, processing each request independently. Route tables are stateless, simply directing traffic without tracking connections.
A company stores sensitive customer data in an S3 bucket and must encrypt the data at rest using a key managed by the company (not AWS). Which encryption option should the company use?
SSE-C uses customer-provided keys; the customer manages the keys outside of AWS.
Why this answer
SSE-C allows customers to provide their own encryption keys; AWS performs encryption/decryption but does not store the keys.
A company wants to reduce cloud costs for a stateless batch processing workload that runs nightly for about 3 hours. The workload can tolerate interruptions. Which pricing model is most cost-effective?
Correct. Spot instances offer the lowest cost and are ideal for fault-tolerant, stateless workloads like this nightly batch process.
Why this answer
Spot instances are the most cost-effective because they offer deep discounts (up to 90%) for interruptible workloads. The workload is stateless, runs for only 3 hours nightly, and can tolerate interruptions, making it an ideal fit for spot instances. Reserved instances require a long-term commitment and provide capacity for steady-state usage, resulting in paying for 24/7 capacity for a workload that only needs 3 hours daily.
A cloud administrator wants to ensure that patches are applied to cloud workloads with minimal risk. Which TWO practices should the administrator follow? (Choose two.)
Automation ensures timely, consistent patching and reduces human error.
Why this answer
Automating patch deployment using orchestration tools ensures consistent, repeatable, and scheduled patching across cloud workloads, reducing human error and manual overhead. Option E is correct because testing patches in a staging environment first validates compatibility and identifies regressions before production deployment, which is a critical risk mitigation practice in cloud operations.
Exam trap
A common misconception is that manual control is safer than automation, but in cloud operations, automation with orchestration tools reduces risk by ensuring consistency and audit trails, while manual patching introduces human error and scalability issues.
A cloud application is intermittently slow. Based on the exhibit, which of the following is the most likely cause?
Blocking the port prevents TCP handshake, causing a timeout. This matches the error logs.
Why this answer
The intermittent slowness points to a network security group blocking port 3306, which is used by MySQL/MariaDB. When the NSG intermittently drops packets to this port, the application experiences timeouts and retries, causing sporadic slowdowns. This is a common issue in cloud environments where security rules are misconfigured or applied at the wrong priority level.
Exam trap
CompTIA often tests the distinction between intermittent failures (caused by network filtering or transient connectivity issues) versus persistent failures (caused by overload or misconfiguration), leading candidates to incorrectly choose database overload or DNS errors.
How to eliminate wrong answers
Option B is wrong because a database server overload would cause consistent slowness or errors, not intermittent issues, and the exhibit likely shows no CPU/memory spikes. Option C is wrong because an incorrect DNS record would cause a complete failure to resolve the endpoint, not intermittent slowness, and DNS caching would mask transient changes. Option D is wrong because insufficient application memory would manifest as out-of-memory errors or crashes, not intermittent slowness, and would be visible in application metrics.
An organization runs a batch processing job that runs for 2 hours every night. The job can tolerate interruptions and can resume from the last checkpoint. Which cloud purchasing option minimizes cost?
Spot instances are cheap and suitable for tolerant workloads.
Why this answer
Spot instances (preemptible VMs) offer significant discounts and are suitable for fault-tolerant, interruptible workloads. Reserved instances are for steady-state usage. On-demand is more expensive.
Dedicated hosts are for regulatory compliance or licensing.
A cloud engineer is writing a Terraform configuration to deploy an AWS EC2 instance. The engineer wants to pass the AMI ID and instance type into the configuration at runtime without hardcoding them. Which Terraform feature should be used?
Variables allow you to define inputs that can be provided at runtime via command line, environment variables, or variable files.
Why this answer
Variables in Terraform allow you to define parameters that can be supplied at runtime, making configurations reusable and flexible.
A cloud administrator notices that a virtual machine has been running for 180 days without a reboot. The administrator needs to install critical security patches that require a reboot. Which of the following actions should the administrator take FIRST?
Creating a snapshot before patching provides a rollback point in case of failure.
Why this answer
Before applying patches that require a reboot, the administrator should first check for existing snapshots and create a new snapshot. This ensures a rollback point is available in case the patching process fails or causes instability. Snapshots capture the virtual machine's state, including disk and memory, allowing the administrator to revert to the pre-patch state without data loss.
Exam trap
The trap here is that candidates may assume applying patches offline (Option C) is the safest first step, but the exam tests the principle of 'first, do no harm' by ensuring a recoverable state exists before making changes to a long-running VM.
How to eliminate wrong answers
Option A is wrong because pausing a virtual machine only suspends its execution, not its disk state, and does not provide a recovery point; patches cannot be applied while the VM is paused, and a reboot is still required. Option C is wrong because shutting down the VM and applying patches offline is a valid method but should not be the first action; the administrator must first ensure a backup or snapshot exists to recover from potential patch failures. Option D is wrong because migrating the VM to a different host does not address the need to install patches; it only moves the running VM and does not create a recovery point or apply the security updates.
A cloud administrator is troubleshooting a performance issue in a virtualized environment. Which THREE of the following metrics should the administrator analyze to identify potential resource contention? (Select THREE.)
High CPU ready time means the VM is waiting for CPU cycles due to contention.
Why this answer
CPU ready time measures the time a virtual machine is ready to execute instructions but is waiting for the hypervisor to schedule physical CPU resources. High ready time directly indicates CPU contention, as the VM is being starved of CPU cycles by other VMs on the same host.
Exam trap
The trap here is that candidates often select network latency or swap file usage as signs of resource contention, but these metrics are not direct indicators of hypervisor-level contention for CPU, memory, or storage in a virtualized environment.
A developer wants to deploy a containerized application on a Kubernetes cluster using a package manager that simplifies deployment and management. Which tool should be used?
Helm is the standard Kubernetes package manager.
Why this answer
Helm is the package manager for Kubernetes. It uses charts to define, install, and upgrade complex Kubernetes applications.
A company uses AWS and wants to verify that its disaster recovery plan meets the defined RTO and RPO objectives. Which type of testing should be performed to simulate a real failover scenario without impacting production?
Full-scale DR drill involves executing the failover plan to validate RTO/RPO without impacting production (using a sandbox or isolated environment).
Why this answer
A full-scale DR drill involves actually failing over to the DR environment to validate RTO/RPO without affecting production if isolated.
A company needs to back up a critical database with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 2 hours. Which disaster recovery strategy should be implemented?
Continuous replication (e.g., MySQL cross-region replica) can achieve RPO of seconds/minutes and RTO within hours.
Why this answer
Continuous replication (such as using database replication) can achieve a very low RPO like 15 minutes.
A company uses a multi-cloud strategy with workloads in AWS and Azure. The cloud team wants a centralized log management solution to correlate security events across both platforms. Which approach is most suitable?
A third-party SIEM can ingest logs from multiple cloud providers for centralized analysis.
Why this answer
Azure Log Analytics, AWS CloudWatch Logs, and GCP Cloud Logging each work only within their own cloud. A third-party SIEM like Splunk can aggregate logs from multiple clouds.
Which TWO of the following are best practices for securing a cloud object storage bucket?
Versioning allows recovery from accidental deletion or ransomware.
Why this answer
Options A and D are correct. Enabling versioning helps protect against accidental deletion or overwrite, and bucket policies can restrict access to specific principals. Option B is wrong because public access is generally not recommended.
Option C is wrong because lifecycle policies are for management, not security. Option E is wrong because encryption is important but does not enforce access control.
Which TWO are best practices for designing a multi-tenant SaaS application on a public cloud?
Provides network isolation.
Why this answer
Using separate virtual networks or VPCs for each tenant provides strong network isolation, preventing cross-tenant traffic and reducing the blast radius of a security breach. This aligns with the shared responsibility model in public cloud SaaS design, where the provider ensures infrastructure-level separation.
Exam trap
The trap here is that candidates often confuse 'dedicated resources' with 'best practice' for multi-tenancy, but the exam expects you to recognize that shared infrastructure with proper isolation (e.g., row-level security, separate VPCs) is more scalable and cost-effective than dedicated per-tenant resources.
A company is designing a cloud architecture that must meet a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 1 hour for a critical database. The database is 500 GB and runs on a virtual machine. Which backup strategy should be used?
Meets both RTO and RPO.
Why this answer
Daily snapshots provide a baseline recovery point, and hourly transaction log backups ensure that the RPO of 1 hour is met by limiting data loss to at most one hour of transactions. Combined with the ability to restore from the latest snapshot and apply transaction logs, this strategy can achieve an RTO of 4 hours for a 500 GB database, assuming adequate infrastructure and restore automation.
Exam trap
The trap here is that candidates confuse high-availability replication (Option C) with a backup strategy, failing to recognize that replication does not protect against logical corruption or allow granular point-in-time recovery to meet RPO requirements.
How to eliminate wrong answers
Option B is wrong because weekly full backups with daily differentials can only restore to the last differential, which may be up to 24 hours old, failing the 1-hour RPO. Option C is wrong because continuous database replication to a standby instance is a high-availability solution, not a backup strategy; it does not provide point-in-time recovery to meet the RPO of 1 hour if logical corruption occurs. Option D is wrong because block-level incremental backups every 4 hours would allow up to 4 hours of data loss, exceeding the 1-hour RPO requirement.
A cloud operations team wants to analyze application performance and identify slow database queries. They need a distributed tracing solution. Which service should they use?
X-Ray traces requests and helps pinpoint performance issues like slow queries.
Why this answer
AWS X-Ray provides distributed tracing to trace requests through applications and identify performance bottlenecks.
An organization wants to migrate its on-premises virtual machines to the cloud with minimal changes. Which deployment model is most appropriate?
Lift-and-shift moves VMs without modifications, using infrastructure as a service.
Why this answer
The lift-and-shift (rehost) model migrates on-premises virtual machines to IaaS with minimal changes, preserving the OS, applications, and configurations. This approach avoids refactoring or re-architecting, making it the most appropriate for minimizing modifications during cloud migration.
How to eliminate wrong answers
Option A is wrong because re-platforming to PaaS requires modifying the application to use platform-managed services (e.g., replacing a database with a cloud-native DB), which introduces changes beyond minimal. Option B is wrong because refactoring into SaaS involves rewriting the application as a multi-tenant service, which is a fundamental architectural change and not minimal. Option D is wrong because re-architecting as containerized applications requires packaging the VM workloads into containers, altering the deployment model and often requiring orchestration (e.g., Kubernetes), which is not minimal.
A company wants to implement a disaster recovery plan with minimal data loss and fast recovery. Which TWO strategies best achieve an RPO of minutes and RTO of hours?
Pilot light can be scaled up for recovery within hours.
Why this answer
Cross-region replication and pilot light can achieve low RPO and moderate RTO.
A team is using Kubernetes for container orchestration. They want to ensure that a new deployment does not cause downtime by gradually updating pods with a rolling update strategy. Which parameter in a Deployment manifest controls the number of pods that can be unavailable during the update?
Correct. This parameter controls the maximum number of pods that can be unavailable during the update.
Why this answer
The `spec.strategy.rollingUpdate.maxUnavailable` parameter in a Kubernetes Deployment manifest specifies the maximum number of pods that can be unavailable during a rolling update. This ensures that a controlled number of pods are taken down at a time, preventing downtime by maintaining a minimum number of available pods throughout the update process.
Exam trap
The trap here is that candidates often confuse `maxSurge` (which controls extra pods created above the desired count) with `maxUnavailable` (which controls pods that can be taken down), leading them to select option C instead of D.
How to eliminate wrong answers
Option A is wrong because `spec.minReadySeconds` controls how long a newly created pod must be ready before it is considered available, not the number of pods that can be unavailable during an update. Option B is wrong because `spec.replicas` defines the desired number of pod replicas, not the availability constraints during a rolling update. Option C is wrong because `spec.strategy.rollingUpdate.maxSurge` controls the maximum number of pods that can be created above the desired replica count during an update, not the number that can be unavailable.
A cloud engineer is required to set up cost allocation tags. Which THREE standard tag categories are commonly used for cost attribution? (Choose THREE)
Project tags attribute costs to specific projects.
Why this answer
Environment, project, and team are common tag categories for cost allocation.
A cloud administrator is designing a backup strategy for a virtual machine running a critical application. The application stores data on a separate data disk. Which TWO of the following practices should the administrator include to ensure a reliable backup?
Including both system state and data disk allows full restore of the VM.
Why this answer
Backing up both the system state and the data disk ensures the entire virtual machine can be restored, including operating system settings and application data. Option D is correct because guest-level backups with application-aware processing ensure that the application data is consistent and can be recovered properly, minimizing data loss. Option B is incorrect because encryption enhances security but does not directly affect backup reliability.
Option C is incorrect because file-level backups for the data disk only may miss system state and lack application consistency. Option E is incorrect because hypervisor-level snapshots are typically crash-consistent and do not guarantee application consistency, making them less reliable for critical applications.
A cloud administrator is troubleshooting an application that is experiencing intermittent timeouts. The application runs on a cloud VM and connects to a cloud database. The administrator sees no errors in the application logs but notices high network latency during peak hours. Which of the following is the MOST likely cause?
Low IOPS leads to queueing and increased latency under load.
Why this answer
Insufficient provisioned IOPS can cause queue buildup and increased latency during peak loads, leading to intermittent timeouts. Option B is incorrect because schema issues would typically cause query errors or failures, not just latency. Option C is incorrect because a missing route would cause complete connectivity failure, not intermittent timeouts.
Option D is incorrect because SSL misconfiguration would cause handshake failures and errors, not just latency.
A company is implementing a secrets management solution. The security team wants to ensure that secrets are protected and rotated regularly. Which THREE of the following are best practices for secrets management?
Auditing helps identify and respond to potential breaches.
Why this answer
Best practices include using a dedicated vault, rotating secrets, avoiding hard-coded secrets, and auditing access.
Refer to the exhibit. What is the effect of this bucket policy?
The effect is Allow, principal is *, action is GetObject, and condition restricts by source IP.
Why this answer
The policy allows s3:GetObject to any principal (*) but only if the request originates from the IP range 203.0.113.0/24. This is a common way to restrict access to a specific network. It does not deny other IPs explicitly; it just doesn't allow them.
It does not require authentication; the principal is *.
A cloud engineer is deploying a new application that requires high availability. The solution must include automated failover and load balancing. Which TWO of the following should the engineer implement?
Auto scaling provides automated replacement and multi-AZ distribution.
Why this answer
Deploying an auto scaling group with a minimum of two instances across two availability zones ensures that if one instance or zone fails, the other can continue serving traffic, providing high availability. This setup also supports automated failover by replacing unhealthy instances automatically, and it works with a load balancer to distribute traffic. The combination of multi-AZ placement and auto scaling is a foundational pattern for fault-tolerant architectures in cloud environments.
Exam trap
The trap here is that candidates often confuse data backup or database replication (options B and C) with application-level high availability and load balancing, failing to recognize that automated failover and load balancing require multiple active compute instances and a traffic distributor, not just data redundancy.
A company uses AWS and needs to enforce that all S3 buckets are encrypted at rest with customer-managed keys stored in AWS KMS. Which IAM policy condition would ensure this?
This condition allows requiring a specific KMS key ARN for encryption.
Why this answer
The 'aws:RequestTag' condition (or similar) can enforce that resources are created with specific tags, but to enforce encryption key usage, the condition 's3:x-amz-server-side-encryption-aws-kms-key-id' is used.
A cloud architect reviews the above IAM policy attached to a user. What is the effect of this policy on the user's ability to stop or terminate instances?
Allow is scoped to production-tagged, and Deny explicitly blocks termination.
Why this answer
The policy uses a Condition block with StringNotEquals to explicitly deny ec2:StopInstances and ec2:TerminateInstances when the resource tag 'environment' is not equal to 'production'. Since the Deny effect overrides any Allow, the user can only stop instances tagged with 'environment=production' and cannot terminate any instances because the TerminateInstances action is also denied for non-production tags and there is no Allow for termination.
Exam trap
CompTIA often tests the nuance that a Deny with a condition does not implicitly allow the action for matching resources—you must have an explicit Allow statement for the action to be permitted, and here termination is never allowed.
How to eliminate wrong answers
Option A is wrong because the policy denies stopping instances that are not tagged as production, so the user cannot stop any instance. Option C is wrong because the policy denies terminating instances regardless of tags (the Deny applies to all instances where the tag is not production, and there is no Allow for termination), so the user cannot terminate any instances. Option D is wrong because the policy explicitly denies both stop and terminate actions for non-production-tagged instances, and termination is never allowed.
A cloud architect is designing a monitoring strategy to detect anomalies in application latency. Which TWO services can be used for anomaly detection?
CloudWatch has built-in anomaly detection for metrics.
Why this answer
CloudWatch anomaly detection and Azure Monitor smart detection can detect anomalies in metrics.
A cloud architect is designing a highly available web application. Which THREE of the following components should be configured in at least two availability zones? (Choose THREE.)
Instances should be deployed across AZs to handle requests if one AZ fails.
Why this answer
To achieve high availability across AZs, the load balancer, application servers, and database should be multi-AZ. Auto-scaling groups can launch instances across AZs, but they are not a component themselves; they are a management service. The DNS service is globally redundant by nature, not usually limited to AZs.
A cloud administrator is reviewing cost reports and notices that a development environment is incurring high costs due to idle compute resources. The environment is used only during business hours on weekdays. Which of the following actions would MOST effectively reduce costs?
This stops instances when not in use, significantly reducing costs without impacting availability during business hours.
Why this answer
An auto-scaling schedule allows you to define time-based rules to automatically scale in (terminate) instances during off-hours and scale out (launch) them during business hours. This directly addresses the idle compute waste by ensuring resources are only running when needed, which is the most effective cost reduction strategy for a predictable usage pattern like weekdays 9-to-5.
Exam trap
CompTIA often tests the distinction between reducing per-unit cost (e.g., smaller instances, spot, different region) versus reducing total runtime cost, and the trap here is that candidates choose a cost-reduction method that still leaves resources running 24/7 instead of aligning compute with actual usage patterns.
How to eliminate wrong answers
Option B is wrong because moving to a different region may reduce per-hour costs but does not eliminate the idle time waste; instances would still run 24/7, just at a lower rate. Option C is wrong because downsizing instance types reduces per-instance cost but still leaves instances running idle during off-hours, failing to address the core issue of unnecessary runtime. Option D is wrong because spot instances can be interrupted at any time and are not suitable for a development environment that requires consistent availability during business hours; they also do not automatically stop during off-hours.
Practice CV0-004 by domain
Target a specific domain to shore up weak areas.
See all domains with question counts →