Courseiva

CompTIA Cloud+ CV0-004 (CV0-004) — Questions 376–450

977 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 5

Page 6 of 14

Page 7
376
MCQeasy

An organization wants to track cloud costs by project and environment (development, testing, production). Which strategy should be employed for cost attribution?

A.Set up billing alerts for each account
B.Enable detailed billing reports with resource IDs
C.Implement a tagging strategy for resources with Environment and Project tags
D.Use AWS Budgets to set spending limits per project
AnswerC

Tags allow you to filter and group costs in cost reports.

Why this answer

Tagging resources with key-value pairs (e.g., Project, Environment) enables cost allocation reports. Billing alerts and budgets help manage costs but not attribution.

Full explanation →
377
MCQeasy

A company uses AWS and wants to receive alerts when CPU utilization of an EC2 instance exceeds 90% for 10 minutes. Which AWS service should be used to create this alarm?

A.Amazon CloudWatch Alarms
B.AWS CloudTrail
C.AWS Config
D.AWS Trusted Advisor
AnswerA

CloudWatch Alarms monitor metrics and send notifications.

Why this answer

CloudWatch Alarms monitor metrics and trigger actions based on thresholds and duration.

Full explanation →
378
MCQeasy

A cloud engineer needs to ensure that a web application can scale out automatically during traffic spikes. Which design best practice should be implemented?

A.Deploy a larger instance size.
B.Use a single powerful VM with more vCPUs.
C.Manually provision additional VMs during peak times.
D.Configure an auto scaling group with a load balancer.
AnswerD

Auto scaling automatically adjusts capacity.

Why this answer

An auto scaling group combined with a load balancer automatically adds or removes VM instances based on predefined metrics (e.g., CPU utilization, request count), ensuring the web application scales out horizontally during traffic spikes without manual intervention. This aligns with cloud elasticity best practices for handling variable workloads.

Exam trap

CompTIA often tests the distinction between vertical scaling (scaling up) and horizontal scaling (scaling out), where candidates mistakenly choose a larger instance size or a single powerful VM because they think 'more resources' is the solution, ignoring the need for automatic, elastic scaling and fault tolerance.

How to eliminate wrong answers

Option A is wrong because deploying a larger instance size (vertical scaling) has a hard limit based on the maximum available instance type and does not provide true elasticity; it also incurs downtime during resizing and cannot handle sudden spikes beyond the single instance's capacity. Option B is wrong because using a single powerful VM with more vCPUs is also vertical scaling, creating a single point of failure and a scalability ceiling; it cannot distribute traffic across multiple instances. Option C is wrong because manually provisioning additional VMs during peak times is reactive, error-prone, and introduces latency, failing to meet the requirement for automatic scaling during traffic spikes.

Full explanation →
379
MCQeasy

A cloud administrator needs to receive real-time notifications when CPU utilization on a critical web server exceeds 90% for more than 5 minutes. Which cloud monitoring service should be used to create the alert?

A.AWS CloudTrail
B.AWS Config
C.AWS Trusted Advisor
D.AWS CloudWatch Alarms
AnswerD

CloudWatch Alarms monitor metrics and trigger notifications based on threshold breaches.

Why this answer

CloudWatch Alarms (AWS) allow you to monitor metrics and trigger actions when thresholds are breached. Other options are not specific to AWS or not designed for alerting on metrics.

Full explanation →
380
MCQmedium

Refer to the exhibit. A cloud administrator is trying to retrieve a secret from a cloud secrets manager using a script with an access key and secret key. The script returns the error shown. The keys were newly created. What is the most likely cause?

A.The secret is encrypted with a different KMS key.
B.The script is using the wrong region.
C.The secret does not exist.
D.The access key is not activated or has a propagation delay.
AnswerD

Newly created keys can take a few minutes to propagate; until then, they may be considered invalid.

Why this answer

Newly created access keys in IAM can take several minutes to propagate across all regions and services due to eventual consistency. The script returns an authentication error because the access key is not yet activated or fully propagated, even though the keys were just created. This is a common issue when using access keys immediately after creation.

Exam trap

This question tests the concept of eventual consistency and propagation delays for newly created IAM credentials, tricking candidates into thinking the issue is with the secret itself or the region rather than the access key activation status.

How to eliminate wrong answers

Option A is wrong because the error message indicates an authentication failure, not a decryption issue; if the secret were encrypted with a different KMS key, the error would be about access denied or decryption failure, not invalid credentials. Option B is wrong because using the wrong region would typically result in a 'secret not found' or 'endpoint not reachable' error, not an authentication error. Option C is wrong because if the secret did not exist, the error would be 'secret not found' or 'resource not found', not an authentication failure.

Full explanation →
381
MCQmedium

The exhibit shows the health check status for targets in an application load balancer's target group. The target group has a health check on port 80. An administrator notices that one target is unhealthy on port 80 but healthy on port 443. What is the most likely cause?

A.The web server on the target is not listening on port 443.
B.The security group for the target is blocking port 80 from the load balancer.
C.The load balancer is in a different VPC.
D.The health check path is incorrect.
AnswerB

A security group blocking port 80 would cause the health check on port 80 to fail, while port 443 remains healthy.

Why this answer

The target is healthy on port 443 but unhealthy on port 80, indicating that port 80 is not reachable from the load balancer. The most likely cause is that the security group for the target is blocking inbound traffic on port 80 from the load balancer. Option A is incorrect because the target is healthy on 443, so the web server is listening on that port, but it could still be listening on 80; the issue is connectivity.

Option C is incorrect because if the load balancer were in a different VPC, it wouldn't be able to communicate with any targets at all. Option D is incorrect because the health check path applies to both port 80 and 443 health checks if configured separately, but since only port 80 is failing and the path is the same, the path is not the issue.

Full explanation →
382
MCQmedium

Refer to the exhibit. An administrator created this policy and attached it to a user. When the user attempts to terminate an instance from an IP address outside the 10.0.0.0/8 range, what will happen?

A.The user will be denied because the action is not allowed.
B.The effect will be evaluated as Deny.
C.The user will be denied because the condition fails.
D.The user will be allowed to terminate instances.
AnswerC

Without a matching Allow, the default Deny takes effect.

Why this answer

The policy includes a condition that restricts the allowed source IP addresses to the 10.0.0.0/8 range. When the user attempts to terminate an instance from an IP address outside this range, the condition fails, and the default implicit deny in IAM (or equivalent policy engine) denies the action. The explicit Allow effect is only applied when the condition is met, so a failed condition results in denial.

Exam trap

The trap here is that candidates often confuse a failed condition with an explicit Deny effect, not realizing that an Allow with an unmet condition results in an implicit deny, not a Deny effect in the policy.

How to eliminate wrong answers

Option A is wrong because the policy does not explicitly deny the action; it uses an Allow effect with a condition, so the denial is implicit due to the condition failure, not because the action is explicitly disallowed. Option B is wrong because the effect in the policy is Allow, not Deny; the evaluation results in an implicit deny when the condition is not satisfied, but the effect itself is not Deny. Option D is wrong because the condition restricts the source IP to 10.0.0.0/8, so an IP outside that range causes the condition to fail, preventing the Allow from taking effect and resulting in denial.

Full explanation →
383
Matchingmedium

Match each cost management concept to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Prepaid compute for discounted rate

Cheap compute with possible termination

Adjust resources based on demand

Label resources for cost allocation

Upfront purchase vs operational expense

Why these pairings

TCO is lifecycle cost, Pay-as-you-go is usage-based billing, Reserved Instances offer discounts for prepayment, and Cost Allocation tracks departmental spending. Common confusions include mixing TCO with Pay-as-you-go and Pay-as-you-go with Reserved Instances.

Full explanation →
384
MCQmedium

A company uses AWS for its production environment. The company has deployed a web application behind an Application Load Balancer (ALB) with a target group containing two EC2 instances in different Availability Zones. The application is stateless and stores session data in an external Redis cluster. Recently, users report that they are occasionally logged out during a session. The load balancer health checks pass for both instances. The application logs show no errors. Which of the following is the most likely cause of the issue?

A.The Redis cluster is not configured for replication.
B.The instances are using different AMI versions.
C.The target group is configured with slow start.
D.Sticky sessions are not enabled on the ALB.
AnswerA

Without replication, a failure in the Redis node can cause session data loss, resulting in intermittent logouts.

Why this answer

The application is stateless and stores session data in an external Redis cluster. If the Redis cluster lacks replication, a failure of the primary node will cause all session data to be lost, logging users out. The ALB health checks pass and application logs show no errors because the EC2 instances themselves are healthy; the issue lies entirely in the Redis layer's lack of high availability.

Exam trap

The trap here is that candidates often assume sticky sessions are required for session persistence, but the question explicitly states the application is stateless and uses an external Redis cluster, making the Redis architecture the real culprit.

How to eliminate wrong answers

Option B is wrong because different AMI versions would cause inconsistent application behavior or deployment failures, not intermittent session loss when health checks pass. Option C is wrong because slow start gradually increases traffic to new targets, which affects load distribution but does not cause session data loss or logouts. Option D is wrong because sticky sessions (session affinity) are unnecessary for a stateless application that stores session data externally in Redis; enabling them would not prevent data loss from a non-replicated Redis cluster.

Full explanation →
385
MCQhard

A cloud administrator sees the output above when troubleshooting a virtual machine that is unresponsive. The VM is critical and must be restored quickly. What should the administrator do first?

A.Resume the VM using the virsh resume command.
B.Restart the libvirtd service on the host.
C.Increase the memory allocation for the host to free resources.
D.Migrate the VM to another host in the cluster.
AnswerA

This directly addresses the paused state and will restore the VM to a running state.

Why this answer

The output from `virsh list --all` shows the VM is in a 'paused' state, which means it is still resident in memory but not executing. The fastest way to restore a paused VM is to resume it with `virsh resume <vm-name>`, which immediately continues CPU execution without requiring a reboot or migration. This directly addresses the unresponsive behavior while preserving the VM's current memory state.

Exam trap

The trap here is that candidates assume a paused VM requires a full restart or host-level intervention, but the CV0-004 exam expects you to recognize that `virsh resume` is the immediate, low-risk recovery action for a paused domain.

How to eliminate wrong answers

Option B is wrong because restarting the libvirtd service would disrupt all VMs on the host and is unnecessary when only a single VM is paused; the issue is at the VM level, not the hypervisor daemon. Option C is wrong because increasing host memory allocation does not affect a paused VM—pausing is triggered by storage I/O errors, disk full conditions, or host memory overcommitment, not by insufficient host memory. Option D is wrong because migrating a paused VM requires resuming it first or using `virsh migrate --live` which cannot work on a paused domain; migration adds unnecessary complexity and downtime when a simple resume command will restore service immediately.

Full explanation →
386
MCQmedium

A financial services company requires a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 5 minutes for its critical database. Which high availability architecture should they implement?

A.Active-passive with synchronous replication
B.Warm standby
C.Active-active with asynchronous replication
D.Cold standby
AnswerA

Synchronous replication ensures RPO; failover is fast, meeting RTO.

Why this answer

Active-passive with synchronous replication provides fast failover and minimal data loss, meeting the RTO of 15 minutes and RPO of 5 minutes. Hot standby can fail over quickly, but synchronous replication ensures the RPO.

Full explanation →
387
MCQhard

A cloud administrator is troubleshooting an issue where users from the 192.0.2.0/24 network cannot access objects in an S3 bucket. The bucket policy is shown in the exhibit. What is the most likely cause of the issue?

A.The condition uses an incorrect IP address format.
B.The policy does not grant the s3:ListBucket action.
C.The policy is missing a required statement ID.
D.The resource ARN does not include the bucket itself.
AnswerB

Without ListBucket, users cannot list objects, only get them if they know the exact key.

Why this answer

The bucket policy grants s3:GetObject but not s3:ListBucket. Without s3:ListBucket, users cannot list the objects in the bucket, so they cannot discover the object keys needed to access objects. Even if they know the exact object key, the missing ListBucket action prevents the initial listing operation, which is required for many S3 access patterns.

Exam trap

CompTIA often tests the distinction between object-level actions (s3:GetObject) and bucket-level actions (s3:ListBucket), trapping candidates who assume that granting read access automatically includes listing permissions.

How to eliminate wrong answers

Option A is wrong because the IP address format '192.0.2.0/24' is a valid CIDR notation and is correctly used in the condition block. Option C is wrong because a Statement ID (Sid) is optional in S3 bucket policies; its absence does not cause access failures. Option D is wrong because the resource ARN 'arn:aws:s3:::example-bucket/*' correctly specifies all objects in the bucket, and the bucket itself is not required for object-level operations like s3:GetObject.

Full explanation →
388
MCQmedium

A company is planning to migrate to AWS and wants to achieve the lowest possible compute costs for a steady-state workload that will run 24/7. Which purchasing option should be recommended?

A.Spot Instances
B.Reserved Instances
C.On-Demand Instances
D.Dedicated Hosts
AnswerB

Reserved Instances provide a discount for a 1- or 3-year term, ideal for steady-state.

Why this answer

Reserved Instances offer a significant discount over On-Demand for consistent usage. Spot Instances are cheaper but can be interrupted. Savings Plans are also cost-effective, but Reserved Instances are a traditional choice for steady-state.

Full explanation →
389
MCQeasy

A cloud administrator notices that a virtual machine is running but cannot be reached over the network. The administrator verifies that the VM is configured with the correct IP address and subnet mask. Which of the following is the MOST likely cause of this issue?

A.Cloud provider firewall blocking all traffic
B.Incorrect DNS server settings
C.Missing port forwarding rule
D.Misconfigured default gateway
AnswerD

Without a correct gateway, traffic cannot exit the subnet.

Why this answer

A misconfigured default gateway is the most likely cause when the IP address and subnet mask are correct but the VM cannot be reached over the network. The default gateway is responsible for routing traffic from the VM to other networks. If it is incorrect, the VM can communicate within its own subnet but not beyond, leading to unreachability.

Option A (firewall blocking traffic) is less likely because the administrator verified correct IP configuration, and a firewall issue would typically affect specific ports or protocols, not all connectivity. Option B (incorrect DNS) affects name resolution but not basic IP connectivity. Option C (missing port forwarding) is used for inbound NAT mappings and is not relevant to general network reachability.

Full explanation →
390
MCQhard

During a disaster recovery test, a cloud administrator finds that the replicated VMs in the secondary site fail to start because they are assigned to a resource pool that does not exist in the secondary site. Which of the following should the administrator have done to prevent this issue?

A.Map the resource pools between primary and secondary sites.
B.Use storage snapshot replication instead.
C.Ensure the secondary site has identical hardware.
D.Configure the replication job to use a different datastore.
AnswerA

Resource pool mappings allow VMs to start on appropriate clusters or hosts in the DR site.

Why this answer

The issue stems from the replicated VMs being assigned to a resource pool that doesn't exist on the secondary site. By mapping resource pools between primary and secondary sites during replication setup, the administrator ensures that the destination resource pool is created or mapped correctly, allowing the VMs to start without dependency errors. This is a common prerequisite in vSphere Replication or similar disaster recovery tools where resource pool configurations must be mirrored to avoid startup failures.

Exam trap

The trap here is that candidates often assume the issue is storage-related or hardware-related, overlooking the fact that logical constructs like resource pools must be explicitly mapped in a disaster recovery configuration, even when using replication technologies.

How to eliminate wrong answers

Option B is wrong because storage snapshot replication replicates the storage-level data but does not address the mapping of virtual infrastructure objects like resource pools; the VMs would still fail to start if the target resource pool is missing. Option C is wrong because identical hardware is not required for resource pool existence; resource pools are logical constructs within a vCenter or hypervisor, not tied to physical hardware specifics. Option D is wrong because configuring the replication job to use a different datastore only changes the storage location, not the resource pool assignment; the VMs would still reference a non-existent resource pool on the secondary site.

Full explanation →
391
MCQeasy

A startup wants to run code in response to events without provisioning or managing servers. Which cloud service model should they use?

A.PaaS
B.IaaS
C.FaaS
D.SaaS
AnswerC

Correct. FaaS executes code in a serverless environment.

Why this answer

FaaS (serverless) runs code in response to events, and the provider manages the infrastructure.

Full explanation →
392
Multi-Selecthard

A cloud engineer is troubleshooting a performance issue with a web application that uses a cloud load balancer and multiple backend instances. Users report intermittent slow responses. The engineer reviews metrics and finds that CPU utilization on backend instances stays below 50% but network throughput is near the instance limit. Which THREE actions should the engineer take to improve performance?

Select 3 answers
A.Change the load balancing algorithm to least connections.
B.Distribute instances across multiple availability zones.
C.Upgrade to an instance type with higher network bandwidth.
D.Increase the number of backend instances.
E.Enable connection draining on the load balancer.
AnswersB, C, E

Multi-zone deployment can improve resilience and distribute load across network paths.

Why this answer

Distributing instances across multiple availability zones (AZs) improves fault tolerance and can reduce network congestion by spreading traffic across physically separate infrastructure. In this scenario, network throughput is near the instance limit, so adding instances in different AZs allows the load balancer to distribute traffic more evenly, preventing any single instance from being overwhelmed. This also leverages the load balancer's cross-zone load balancing capability, which can improve overall throughput and reduce latency for users.

Exam trap

CompTIA often tests the misconception that increasing the number of instances always solves performance issues, when in reality the bottleneck may be the network bandwidth per instance, requiring a larger instance type or distribution across AZs to utilize aggregate bandwidth.

Full explanation →
393
MCQmedium

A cloud team wants to automatically scale an application based on the number of pending messages in a message queue. Which scaling policy type should be used?

A.Dynamic scaling (metric-based)
B.Scheduled scaling
C.Manual scaling
D.Static scaling
AnswerA

Dynamic scaling (metric-based) adjusts capacity based on a real-time metric like queue depth, making it ideal for scaling on pending messages.

Why this answer

Dynamic scaling (metric-based) adjusts the number of instances to keep a specific metric, such as queue depth, at a target value. This is the appropriate policy for scaling based on real-time queue depth.

Full explanation →
394
MCQeasy

A cloud engineer notices that a virtual machine (VM) in a public cloud environment is consistently running at 90% CPU during business hours. The VM hosts a customer-facing web application. Which of the following is the BEST initial troubleshooting step?

A.Migrate the VM to a different availability zone.
B.Review the VM's performance metrics and application logs.
C.Reboot the VM to reset resource usage.
D.Scale up the VM to a larger instance size.
AnswerB

Reviewing metrics and logs is the standard first step in troubleshooting.

Why this answer

The initial step in troubleshooting high CPU usage is to gather diagnostic data. Reviewing the VM's performance metrics (e.g., CPU utilization, memory, disk I/O) and application logs helps identify whether the issue is caused by a legitimate workload spike, a memory leak, or a misconfiguration. This aligns with the 'identify before act' principle in cloud operations, ensuring the engineer understands the root cause before making changes.

Exam trap

The trap here is that candidates often jump to a 'fix' like scaling up or rebooting, but the CompTIA Cloud+ exam tests the foundational troubleshooting methodology of 'gather data first' to avoid unnecessary changes and ensure the solution is targeted and cost-effective.

How to eliminate wrong answers

Option A is wrong because migrating the VM to a different availability zone does not address high CPU usage; it only changes the physical location, which may introduce latency or availability issues without resolving the performance bottleneck. Option C is wrong because rebooting the VM is a disruptive action that only temporarily resets resource usage; it does not diagnose or fix the underlying cause, and it can lead to application downtime for a customer-facing web app. Option D is wrong because scaling up to a larger instance size is a reactive measure that may mask the problem without investigation; it increases costs and could be unnecessary if the issue is due to a software bug or misconfiguration.

Full explanation →
395
MCQmedium

A security engineer is reviewing a cloud storage bucket policy. Which of the following best describes the security issue present in the exhibit?

A.The bucket policy correctly limits access to read-only operations, which is secure by default.
B.The bucket policy should be modified to allow write access for full functionality.
C.The bucket policy should include an IP address restriction to limit access to corporate IPs.
D.The bucket policy allows public read access to all objects, creating a data exposure risk.
AnswerD

Correct. The policy grants read access to any anonymous user, which is insecure.

Why this answer

The bucket policy grants read access to any anonymous user (Principal: "*"), which is a common misconfiguration that can lead to data exposure. The correct action is to remove the wildcard principal or restrict it to authenticated users.

Full explanation →
396
MCQhard

An organization is migrating a 50 TB on-premises Oracle database to Amazon RDS for MySQL with minimal downtime. They plan to use AWS DMS with ongoing replication. Which additional step is necessary to reduce downtime during the final cutover?

A.Use AWS Schema Conversion Tool (AWS SCT) to convert the schema
B.Enable change data capture (CDC) on the source database
C.Increase the allocated storage on the target RDS instance
D.Use AWS Snowball to transfer the initial data load
AnswerB

Correct. CDC allows DMS to capture ongoing changes, enabling near-zero downtime during cutover.

Why this answer

To minimize downtime, after the full load, CDC replication keeps the target in sync. During final cutover, stopping application writes and applying remaining CDC changes completes the migration with very little downtime.

Full explanation →
397
MCQhard

A company uses a hybrid cloud environment with workloads in AWS and on-premises. They want to use a single monitoring dashboard to view metrics from both environments. Which solution should they implement?

A.Deploy a third-party monitoring tool in AWS and replicate all logs to it
B.Set up a VPN connection and use VPC Flow Logs for on-premises traffic
C.Install the CloudWatch agent on on-premises servers and send metrics to CloudWatch, then create a CloudWatch dashboard
D.Use AWS CloudTrail to log on-premises activity
AnswerC

This allows unified monitoring from a single dashboard.

Why this answer

Amazon CloudWatch can collect metrics from on-premises servers using the CloudWatch agent, and from AWS services natively. A single CloudWatch dashboard can then display all metrics.

Full explanation →
398
Multi-Selectmedium

A cloud architect is designing a deployment pipeline for a multi-tier application. The team wants to automate testing and deployment while ensuring that only healthy code reaches production. Which TWO practices should they implement?

Select 2 answers
A.Infrastructure as Code
B.Immutable infrastructure
C.Blue/green deployment
D.Canary releases
E.Manual approval gates
AnswersC, D

Blue/green enables automated switchover after health checks.

Why this answer

Blue/green deployment (C) is correct because it allows the team to route traffic to a new 'green' environment while keeping the old 'blue' environment idle, enabling instant rollback if testing fails. Canary releases (D) are correct because they incrementally shift a small percentage of traffic to a new version, allowing automated monitoring to detect issues before full rollout. Both practices ensure only healthy code reaches production by validating changes in a controlled, reversible manner.

Exam trap

CompTIA often tests the distinction between deployment strategies (blue/green, canary) and infrastructure management practices (IaC, immutable), so candidates mistakenly select IaC or immutable infrastructure because they associate 'automation' with provisioning rather than traffic management and health gating.

Full explanation →
399
MCQhard

A cloud administrator notices that a virtual machine is consuming excessive CPU resources with no apparent workload. Which of the following should the administrator investigate FIRST to determine the cause?

A.A misconfigured load balancer sending traffic to the VM
B.CPU hotplug settings on the hypervisor
C.A runaway process inside the VM
D.Memory overcommitment ratio
AnswerC

A runaway process (e.g., infinite loop) can consume 100% CPU even with no intended workload.

Why this answer

A runaway process inside the VM is the most likely cause when a VM exhibits high CPU utilization without an apparent workload. This could be due to a background service, malware, or an application stuck in an infinite loop. Option A is incorrect because a misconfigured load balancer would direct traffic to the VM, which would result in network and CPU activity associated with processing that traffic, not idle high CPU.

Option B is incorrect; CPU hotplug settings affect the ability to add CPUs but do not themselves cause high CPU usage. Option D is incorrect; memory overcommitment affects memory availability, not CPU utilization.

Full explanation →
400
MCQhard

A company uses a hybrid cloud model with an on-premises data center and a public cloud. The network team reports that traffic between the cloud and on-premises is experiencing high latency and packet loss. The cloud administrator verifies that the VPN connection is up. What is the most likely cause?

A.A firewall rule is blocking ICMP packets.
B.VMs are placed in different cloud regions.
C.The VPN tunnel has a mismatched MTU size.
D.The cloud provider is throttling bandwidth.
AnswerC

Mismatched MTU causes fragmentation and packet loss.

Why this answer

When a VPN tunnel is up but traffic experiences high latency and packet loss, a mismatched Maximum Transmission Unit (MTU) size is a common cause. This occurs because packets larger than the tunnel's MTU must be fragmented, and if fragmentation is not properly handled (e.g., due to the DF bit being set), packets are dropped, leading to retransmissions and increased latency. The symptoms align with MTU issues rather than simple connectivity or throttling problems.

Exam trap

The trap here is that candidates assume a 'VPN is up' means all traffic flows perfectly, but CompTIA often tests the subtlety that MTU mismatch causes performance degradation without breaking the tunnel itself, leading them to incorrectly blame firewall rules or bandwidth throttling.

How to eliminate wrong answers

Option A is wrong because ICMP packets are not required for VPN tunnel operation; blocking ICMP would cause ping failures but not necessarily high latency and packet loss on data traffic, and the VPN is already verified as up. Option B is wrong because VMs in different cloud regions would affect latency between those VMs, but the question specifies traffic between the cloud and on-premises data center, which is routed through the VPN tunnel regardless of VM placement. Option D is wrong because cloud providers typically throttle bandwidth based on usage limits or burst credits, which would manifest as reduced throughput rather than the combination of high latency and packet loss described.

Full explanation →
401
MCQeasy

A cloud administrator is tasked with ensuring that only encrypted connections are used to transfer files to a cloud storage bucket. Which of the following should the administrator enforce?

A.Use HTTP with a custom header.
B.Allow FTP but restrict to specific IPs.
C.Require HTTPS for all uploads.
D.Enable SFTP access to the bucket.
AnswerC

HTTPS encrypts data in transit.

Why this answer

HTTPS (HTTP over TLS) encrypts data in transit using TLS, ensuring that files uploaded to a cloud storage bucket are protected from eavesdropping and tampering. By requiring HTTPS for all uploads, the administrator enforces encrypted connections as mandated by the security policy, which is a standard practice for cloud storage services like AWS S3 or Azure Blob Storage.

Exam trap

The trap here is that candidates may confuse SFTP (which is encrypted) with FTP (which is not), and incorrectly assume that enabling SFTP is the correct answer, but the question specifically targets the standard encrypted protocol for cloud storage bucket uploads, which is HTTPS.

How to eliminate wrong answers

Option A is wrong because HTTP with a custom header does not provide encryption; the data is still transmitted in plaintext, making it vulnerable to interception. Option B is wrong because FTP transmits data and credentials in cleartext, and restricting by IP does not encrypt the connection, leaving it susceptible to packet sniffing. Option D is wrong because SFTP (SSH File Transfer Protocol) encrypts the connection, but the question specifically asks for encrypted connections to transfer files to a cloud storage bucket; while SFTP is encrypted, it is not the standard protocol for cloud storage bucket uploads (which typically use HTTPS), and enabling it may introduce unnecessary complexity or security risks if not properly managed.

Full explanation →
402
MCQeasy

A company wants to migrate its on-premises workloads to the cloud and requires full control over the operating system, installed software, and security configurations. Which cloud service model should they choose?

A.FaaS
B.IaaS
C.PaaS
D.SaaS
AnswerB

Correct. IaaS grants control over OS, storage, and applications.

Why this answer

IaaS provides virtualized computing resources where the customer manages the OS and above, giving full control.

Full explanation →
403
MCQeasy

A company wants to migrate its on-premises workloads to the cloud but must keep sensitive data on-premises due to regulatory requirements. Which cloud deployment model should the company use?

A.Multi-cloud
B.Public cloud
C.Hybrid cloud
D.Private cloud
AnswerC

Hybrid cloud allows sensitive data to remain on-premises while using public cloud resources for other workloads.

Why this answer

A hybrid cloud connects on-premises infrastructure with public cloud resources, allowing sensitive data to remain on-premises while leveraging the cloud for other workloads.

Full explanation →
404
MCQhard

A DevOps engineer is deploying an application on Kubernetes. The exhibit shows the status of pods and a describe output. The frontend pod is stuck in Pending state. Which action should the engineer take to resolve the issue?

A.Reduce the resource requests in the frontend deployment manifest.
B.Add a node affinity rule to schedule on nodes with more memory.
C.Change the service type from ClusterIP to NodePort.
D.Modify the image pull policy to Always.
AnswerA

Decreasing requests may allow the pod to fit on a node.

Why this answer

The frontend pod is stuck in Pending state because the cluster nodes lack sufficient resources (CPU or memory) to satisfy the pod's resource requests. Reducing the resource requests in the deployment manifest lowers the scheduling threshold, allowing the pod to fit on an available node. This directly addresses the most common cause of Pending pods: insufficient allocatable resources on any node.

Exam trap

CompTIA often tests the misconception that changing service types or image pull policies can resolve scheduling failures, when the root cause is almost always resource insufficiency or taints/tolerations.

How to eliminate wrong answers

Option B is wrong because adding a node affinity rule does not free up resources; it only constrains scheduling to specific nodes, which would likely fail if those nodes already lack capacity. Option C is wrong because changing the service type from ClusterIP to NodePort affects external access, not pod scheduling or resource availability. Option D is wrong because modifying the image pull policy to Always only forces a fresh image pull on pod start; it does not resolve resource constraints that prevent the pod from being scheduled.

Full explanation →
405
MCQeasy

A cloud engineer needs to collect and query log data from multiple cloud services in a centralized location. Which cloud service should be used for centralized log management?

A.Audit logging service
B.Monitoring service
C.Logging service
D.Storage service
AnswerC

Cloud Logging centralizes logs from all GCP services.

Why this answer

A centralized logging service allows log collection and querying from multiple sources, providing a single pane of glass for log analysis.

Full explanation →
406
Multi-Selecthard

A company needs to migrate a 100 TB on-premises file server to AWS S3. The migration must be completed within two weeks. The network bandwidth is limited to 1 Gbps. Which TWO services should be combined to accomplish this migration within the timeframe? (Select TWO.)

Select 2 answers
A.AWS Server Migration Service (SMS)
B.AWS DataSync
C.AWS Direct Connect
D.AWS Snowball Edge
E.Amazon S3 Transfer Acceleration
AnswersB, D

AWS DataSync is correct because it can automate and accelerate the transfer of data from on-premises to Snowball Edge and later sync changes, making it an essential companion to Snowball Edge for completing the migration within the timeframe.

Why this answer

(AWS Snowball Edge) is correct because it provides a physical storage device that can transfer 100 TB of data offline, bypassing the 1 Gbps bandwidth limitation. With 1 Gbps, the theoretical maximum transfer over the network would be approximately 10.8 TB per day, requiring over 9 days for 100 TB under ideal conditions, but real-world factors like protocol overhead and contention make two weeks infeasible. Snowball Edge can handle up to 80 TB per device, so two devices can complete the initial bulk migration well within the two-week window.

Option B (AWS DataSync) is also correct because it can be used to automate the transfer of data from on-premises to the Snowball Edge device, and later to sync any incremental changes after the initial load, ensuring data consistency and reducing manual effort. Together, Snowball Edge handles the bulk offline transfer, while DataSync manages the final sync and ongoing replication, meeting the two-week deadline.

Exam trap

The trap here is that candidates often choose only Snowball Edge, forgetting that a second service is required to complete the migration within the timeframe. They may overlook DataSync as the companion service for data synchronization and automation, or mistakenly believe that Transfer Acceleration or Direct Connect alone can accelerate the transfer sufficiently.

Full explanation →
407
Multi-Selecthard

A cloud engineer is planning a disaster recovery drill for a critical application that spans multiple availability zones. The drill must validate RTO and RPO without affecting production. Which THREE actions should the engineer include? (Choose three.)

Select 3 answers
A.Perform a failover to the secondary environment using production data
B.Terminate production instances to simulate a disaster
C.Verify that the recovered data is consistent with the source data at the last replication point
D.Delete all backups to ensure they are not used during the drill
E.Monitor the time taken to complete the failover and recovery
AnswersA, C, E

Using a secondary environment avoids production impact.

Why this answer

Performing a failover in a non-production environment validates recovery steps. Monitoring recovery time measures RTO, and verifying data integrity checks RPO.

Full explanation →
408
Multi-Selectmedium

A cloud engineer is troubleshooting a network connectivity issue between two subnets in a VPC. The engineer wants to capture and analyze traffic metadata to identify dropped packets. Which TWO tools can provide this information? (Select TWO.)

Select 2 answers
A.AWS X-Ray
B.Amazon CloudWatch Logs
C.AWS Network Firewall logs
D.AWS CloudTrail
E.VPC Flow Logs
AnswersC, E

Network Firewall logs provide detailed information about traffic that matches firewall rules, including dropped packets.

Why this answer

VPC Flow Logs capture metadata about IP traffic going to and from network interfaces. AWS X-Ray provides distributed tracing but for application-level requests, not raw network traffic. AWS CloudTrail logs API calls, not traffic.

Full explanation →
409
Multi-Selectmedium

A cloud administrator notices that an IAM user has permissions that are not explicitly assigned. The administrator suspects that the user is inheriting permissions through group membership or role assignment. Which TWO methods can the administrator use to identify all effective permissions for this user? (Choose TWO.)

Select 2 answers
A.List the user's group memberships and examine the policies attached to those groups and any roles the user can assume.
B.Review the user's recent access logs to see which actions were allowed.
C.Check the resource-based policies on each resource the user might access.
D.Use a 'simulate principal policy' API call to evaluate the user's effective permissions.
E.Log in as the root user and run a permissions report.
AnswersA, D

This helps in understanding the inherited permissions.

Why this answer

Group memberships and assumable roles are common sources of inherited permissions. By listing the user's groups and examining the policies attached to those groups, as well as any roles the user can assume, the administrator can trace the origin of the unexpected permissions. This method directly identifies the inheritance chain that grants permissions not explicitly assigned to the user.

Exam trap

CompTIA often tests the distinction between inherited permissions (from groups/roles) and explicit permissions, and the trap here is that candidates may confuse reviewing access logs (which show past actions) with evaluating effective permissions (which shows potential actions).

Full explanation →
410
MCQeasy

An organization is moving sensitive data to the cloud and must ensure it is encrypted while stored on disk. Which type of encryption should be implemented?

A.Encryption in transit
B.Encryption at rest
C.Hashing
D.Tokenization
AnswerB

Encryption at rest secures data stored on persistent media.

Why this answer

Encryption at rest protects data stored on disk, typically using AES-256.

Full explanation →
411
MCQeasy

A startup wants to develop a new web application with minimal upfront infrastructure management. They want to focus on writing code and not worry about operating system patches or scaling servers. Which cloud service model is MOST appropriate?

A.Functions as a Service (FaaS)
B.Infrastructure as a Service (IaaS)
C.Platform as a Service (PaaS)
D.Software as a Service (SaaS)
AnswerC

PaaS abstracts the underlying infrastructure, so the startup only writes and deploys code.

Why this answer

Platform as a Service (PaaS) provides a managed platform where the startup can deploy and run their web application code without managing the underlying infrastructure, including operating system patches and server scaling. This aligns with the requirement to focus on writing code while the cloud provider handles the operational overhead.

Exam trap

CompTIA often tests the distinction between PaaS and FaaS, where candidates mistakenly choose FaaS for any 'code-only' scenario, but FaaS is unsuitable for stateful web applications requiring persistent connections or long-running processes.

How to eliminate wrong answers

Option A (FaaS) is wrong because it is designed for event-driven, stateless functions that execute in response to triggers, not for hosting a full web application with persistent state and routing. Option B (IaaS) is wrong because it requires the startup to manage virtual machines, including OS patches and scaling, which contradicts the goal of minimal infrastructure management. Option D (SaaS) is wrong because it delivers ready-to-use software applications over the internet, not a platform for developing and deploying custom web applications.

Full explanation →
412
MCQmedium

A company uses Azure Log Analytics to centralize logs from multiple subscriptions. The security team requires that logs be retained for seven years to meet compliance regulations. What should the administrator configure to meet this requirement?

A.Export logs to Azure Blob Storage and set a lifecycle management policy
B.Set the retention policy in the Log Analytics workspace to 2555 days
C.Enable Azure Sentinel
D.Create a log-based alert to notify when logs are about to expire
AnswerB

Log Analytics supports retention up to 7 years (2555 days) when configured.

Why this answer

Log Analytics workspaces allow setting retention policies up to 730 days (2 years) by default, but for longer retention, Azure Data Explorer or archive to Azure Storage with lifecycle management can be used. However, the question expects the correct answer as setting retention policy to 2555 days (7 years) is possible if workspace is configured for longer retention (up to 7 years with additional cost).

Full explanation →
413
MCQeasy

An organization is using Azure DevOps to implement a CI/CD pipeline. In which stage of the pipeline would automated unit tests typically be executed?

A.Deploy
B.Build
C.Verify
D.Source
AnswerB

Build stage compiles and runs unit tests.

Why this answer

Unit tests are typically run in the build stage after compilation. Source is for code fetching, deploy for release, and verify for post-deployment checks.

Full explanation →
414
MCQeasy

Refer to the exhibit. A cloud administrator runs this command on a VM. Which of the following is most likely causing the high 'wa' value?

A.Disk I/O bottleneck
B.Network congestion
C.High CPU load
D.Insufficient memory
AnswerA

High 'wa' indicates CPU waiting for disk I/O, suggesting a bottleneck.

Why this answer

The 'wa' value in the output of the 'top' or 'vmstat' command represents the percentage of time the CPU spends waiting for I/O operations to complete. A high 'wa' value indicates that the CPU is frequently idle because it is waiting for data from storage devices, which is a classic symptom of a disk I/O bottleneck. This occurs when the storage subsystem cannot keep up with the read/write requests from the VM, causing the CPU to stall.

Exam trap

A common trap in CompTIA Cloud+ exams is to misinterpret a high 'wa' value as a symptom of high CPU load or memory pressure, when in fact it specifically indicates the CPU is waiting for disk I/O, not that it is busy processing.

How to eliminate wrong answers

Option B is wrong because network congestion would manifest as high 'si' (softirq) or 'st' (steal time) values, or as packet drops and latency in network-specific metrics, not as CPU wait time for I/O. Option C is wrong because high CPU load is indicated by a high 'us' (user) or 'sy' (system) value, not 'wa'; a high 'wa' actually means the CPU is idle waiting for I/O, not busy processing. Option D is wrong because insufficient memory typically causes high 'si' and 'so' (swap in/out) values in vmstat or high 'wa' only indirectly if swapping causes heavy disk I/O, but the direct cause of a high 'wa' is the disk I/O bottleneck itself, not the memory shortage.

Full explanation →
415
MCQeasy

A company wants to deploy a Lambda function that processes objects uploaded to an S3 bucket. Which event trigger should be configured on the Lambda function?

A.API Gateway
B.CloudWatch Events
C.S3 bucket event notification
D.SQS
AnswerC

S3 can publish events to Lambda when objects are uploaded.

Why this answer

S3 bucket event notifications can be configured to directly invoke a Lambda function when objects are uploaded. This is the native, serverless integration where S3 publishes an event (e.g., s3:ObjectCreated:Put) to Lambda, triggering the function automatically without any intermediary service.

Exam trap

CompTIA Cloud+ often tests the misconception that SQS or CloudWatch Events are required to bridge S3 and Lambda, when in fact S3 can invoke Lambda directly via its event notification feature.

How to eliminate wrong answers

Option A is wrong because API Gateway is used to create RESTful or WebSocket APIs that trigger Lambda functions via HTTP requests, not for S3 object upload events. Option B is wrong because CloudWatch Events (now Amazon EventBridge) is used for scheduling or responding to AWS service events, but it is not the direct trigger for S3 object uploads; S3 can send events directly to Lambda without CloudWatch. Option D is wrong because SQS is a message queue service; while Lambda can poll SQS, S3 can send events directly to Lambda without needing an SQS queue as an intermediary.

Full explanation →
416
MCQmedium

A company is migrating to a public cloud and wants to understand security responsibilities. According to the shared responsibility model, which of the following is the customer responsible for in an IaaS deployment?

A.Patching the guest operating system
B.Network infrastructure security
C.Physical security of data centers
D.Hypervisor security
AnswerA

The customer manages the guest OS and must apply patches.

Why this answer

In IaaS, the customer is responsible for securing the operating system, applications, and data, including patching the guest OS.

Full explanation →
417
MCQeasy

A cloud administrator needs to receive real-time notifications when CPU utilization exceeds 90% on a production server. Which AWS service should be used to trigger an alert based on a metric threshold?

A.CloudWatch Alarms
B.Amazon SNS
C.AWS Config
D.AWS CloudTrail
AnswerA

CloudWatch Alarms monitor metrics and trigger actions based on defined thresholds.

Why this answer

CloudWatch Alarms monitor metrics and trigger actions when a threshold is breached. SNS is a notification channel, not a metric monitor. CloudTrail logs API calls, and Config tracks configuration changes.

Full explanation →
418
MCQhard

A cloud engineer is configuring auto-scaling for a web application. The scaling policy should add 2 instances when CPU utilization exceeds 80% for 5 consecutive minutes and remove 1 instance when CPU drops below 50% for 10 minutes. Which type of scaling policy should they use?

A.Scheduled scaling policy
B.Target tracking scaling policy
C.Simple scaling policy
D.Step scaling policy
AnswerD

Step scaling allows defined steps (add/remove specific numbers) based on metric thresholds.

Why this answer

Step scaling allows adding or removing a specific number of instances based on the size of the alarm breach. Target tracking adjusts to maintain a target metric value. Simple scaling is older and less flexible.

Scheduled scaling is time-based.

Full explanation →
419
MCQmedium

During a deployment using a script, an administrator receives a 'Permission Denied' error. What is the most likely cause?

A.The service account lacks necessary IAM roles
B.Network latency is causing timeouts
C.The deployment is targeting the wrong region
D.The instance has insufficient storage
AnswerA

The service account lacks necessary IAM roles.

Why this answer

A service account lacking necessary IAM roles would cause a 'Permission Denied' error. Option B is incorrect because network latency would cause timeouts, not permission errors. Option C is incorrect because targeting the wrong region might cause resource not found errors, but not 'Permission Denied'.

Option D is incorrect because insufficient storage would cause disk full errors, not permission errors.

Full explanation →
420
MCQeasy

A company uses a cloud load balancer to distribute traffic to web servers. The load balancer health checks are failing for all instances. The instances are running and can be accessed directly via their private IPs from within the VPC. What is the most likely cause?

A.The load balancer's cross-zone load balancing is disabled.
B.The load balancer's listeners are configured on the wrong ports.
C.The security group of the instances is not allowing traffic from the load balancer.
D.The instances are not registered with the target group.
AnswerC

The load balancer sends health checks from a specific source; if the security group doesn't allow it, health checks fail.

Why this answer

The most likely cause is that the security group attached to the web server instances does not include an inbound rule allowing traffic from the load balancer's source IP addresses or the load balancer's security group. Even though the instances are healthy and reachable via private IPs from within the VPC, the load balancer's health check probes (typically HTTP/HTTPS or TCP) are blocked by the instance-level firewall, causing all health checks to fail.

Exam trap

The trap here is that candidates assume that because the instances are reachable via private IP from within the VPC, the load balancer should also be able to reach them, but they forget that the load balancer's health check traffic is subject to the instance's security group rules, which must explicitly permit the load balancer's source.

How to eliminate wrong answers

Option A is wrong because cross-zone load balancing affects how traffic is distributed across instances in different Availability Zones, not the ability of health checks to reach instances. Option B is wrong because listener port misconfiguration would cause client requests to fail, but health checks are sent on the configured health check port, which is independent of the listener port; the question states health checks are failing, not client traffic. Option D is wrong because if instances were not registered with the target group, the load balancer would not even attempt health checks; the question states health checks are failing, implying the instances are registered but unreachable by the health check probes.

Full explanation →
421
MCQhard

A company running a critical web application wants to protect against SQL injection and cross-site scripting attacks. The application is behind a load balancer. Which type of service should be deployed to provide this protection?

A.Network firewall
B.DDoS protection service
C.Intrusion detection system
D.Web application firewall (WAF)
AnswerD

A web application firewall (WAF) inspects HTTP/HTTPS traffic and can block SQL injection and XSS attacks, making it the correct choice.

Why this answer

A web application firewall (WAF) is designed to protect web applications from common web exploits like SQL injection and cross-site scripting. It can be integrated with load balancers to inspect HTTP/HTTPS traffic and filter malicious requests based on customizable rules. This makes it the correct choice for the described threat scenario.

Exam trap

The trap here is that candidates often confuse a web application firewall with a DDoS protection service, thinking the latter provides application-layer attack protection. However, DDoS protection focuses on volumetric attacks while a WAF handles web-specific exploits like SQL injection and XSS.

How to eliminate wrong answers

Option A is wrong because AWS Network Firewall is a stateful managed firewall for VPC network traffic, operating at layers 3-4 and 7 for network protocols, but it does not provide application-layer inspection for SQL injection or XSS payloads in HTTP requests. Option B is wrong because AWS Shield Advanced provides DDoS protection against volumetric and state-exhaustion attacks, not against application-layer threats like SQL injection or XSS. Option C is wrong because AWS GuardDuty is a threat detection service that analyzes VPC flow logs, DNS logs, and CloudTrail events for malicious activity, but it does not actively block or filter web application attacks like SQL injection or XSS.

Full explanation →
422
MCQhard

A cloud operations team is implementing structured logging for better querying. They have decided to use JSON format. What is a key benefit of structured logging over unstructured logging?

A.Easier to read for humans
B.Enables querying specific fields
C.Reduced storage costs
D.Faster log ingestion
AnswerB

Structured logs allow field-level queries.

Why this answer

Structured logging (e.g., JSON) enables efficient querying and filtering of log data.

Full explanation →
423
MCQhard

A company deploys a multi-region active-active application on AWS. They use Route 53 with a latency routing policy. Traffic from Europe is routed to the eu-west-1 region, but during a regional failure, some European users experience timeouts. Which routing policy should be added to improve availability?

A.Latency-based routing with health checks and failover
B.Geolocation routing
C.Failover routing
D.Weighted routing
AnswerA

Health checks detect failure and Route 53 can redirect to the next best region, improving availability.

Why this answer

Combining latency with failover routing provides automatic failover to a healthy region.

Full explanation →
424
MCQhard

A company is designing a cloud network architecture for a three-tier application. The web tier must be accessible from the internet, the application tier should only be accessible from the web tier, and the database tier should only be accessible from the application tier. The company uses a single VPC with multiple subnets. The security team requires that all traffic between tiers be encrypted in transit. The architect proposes using security groups and network ACLs. Which combination of security group rules meets these requirements while following the principle of least privilege?

A.Web: inbound 443 from 0.0.0.0/0, outbound to app SG:8443. App: inbound from web SG:8443, outbound to db SG:3306. DB: inbound from app SG:3306.
B.Web: inbound 443 from 0.0.0.0/0, outbound to 0.0.0.0/0:0-65535. App: inbound from web SG:443, outbound to 0.0.0.0/0:0-65535. DB: inbound from app SG:3306, outbound to 0.0.0.0/0:0-65535.
C.Web: inbound 443 from 0.0.0.0/0 and 22 from 0.0.0.0/0, outbound to app SG:443. App: inbound from web SG:443, outbound to db SG:3306. DB: inbound from app SG:3306.
D.Web: inbound 443 from 0.0.0.0/0, outbound to app subnet CIDR:1433. App: inbound from web subnet CIDR:443, outbound to db subnet CIDR:3306. DB: inbound from app subnet CIDR:3306.
AnswerA

Uses security groups for fine-grained control, allows only required traffic, and encrypts traffic (HTTPS on web, database encryption assumed).

Why this answer

It uses security group (SG) references to enforce strict, stateful traffic flow between tiers: the web SG allows inbound HTTPS (443) from the internet and outbound to the app SG on port 8443; the app SG allows inbound only from the web SG on port 8443 and outbound to the DB SG on port 3306; the DB SG allows inbound only from the app SG on port 3306. This follows least privilege by restricting each tier’s communication to only the necessary ports and source/destination SGs, and the use of TLS/SSL on port 443 and 8443 ensures encryption in transit as required.

Exam trap

The trap here is that candidates often confuse security group statefulness with network ACL statelessness, or they mistakenly use broad CIDR ranges (like 0.0.0.0/0) for outbound rules instead of specific SG references, violating least privilege and encryption requirements.

How to eliminate wrong answers

Option B is wrong because it allows overly permissive outbound rules (0.0.0.0/0 on all ports) from each tier, violating least privilege by permitting unnecessary outbound traffic and potentially exposing the app and DB tiers to the internet. Option C is wrong because it includes inbound SSH (port 22) from 0.0.0.0/0 on the web tier, which is not required for the three-tier architecture and introduces an unnecessary attack surface; also, it uses port 443 for web-to-app traffic instead of the specified port 8443, which may not match the application’s encryption requirements. Option D is wrong because it uses subnet CIDR ranges instead of security group references, which is less granular and does not automatically adapt to changes in instance IPs; additionally, it uses port 1433 (SQL Server) instead of the required port 3306 (MySQL) for the database tier, and port 443 for web-to-app traffic instead of 8443.

Full explanation →
425
MCQhard

A cloud engineer is troubleshooting an issue where an application running in a container on a Kubernetes cluster is unable to resolve DNS names. The cluster uses CoreDNS. The engineer checks the CoreDNS pod logs and sees no errors. Which of the following should the engineer check next?

A.The Kubernetes DNS service IP address
B.The container's /etc/resolv.conf file
C.The cloud provider's DNS resolver settings
D.The network policy for the namespace
AnswerB

If this file does not point to CoreDNS, DNS resolution fails.

Why this answer

The container's /etc/resolv.conf file. In Kubernetes, pods use the DNS configuration specified in their /etc/resolv.conf, which should point to the CoreDNS service IP. If this file is misconfigured (e.g., due to a custom pod DNS policy or a problem with the kubelet), DNS resolution will fail.

The CoreDNS pod logs show no errors, indicating CoreDNS is running fine, so the issue is likely in how the pod is configured to contact CoreDNS. Option A (checking the Kubernetes DNS service IP) is not the next step because the DNS service IP is typically correct; the problem is whether the pod is using it. Option C (checking the cloud provider's DNS resolver settings) is for external DNS resolution, not for internal cluster DNS.

Option D (checking network policies) would cause traffic to be dropped entirely, not just DNS, and would likely show in logs or other symptoms.

Full explanation →
426
Multi-Selectmedium

A cloud architect is designing a highly available application on AWS. The application must be fault-tolerant and able to withstand the failure of an entire Availability Zone. Which TWO actions should the architect take? (Select TWO.)

Select 2 answers
A.Store application state on the local instance store
B.Deploy EC2 instances in a single Availability Zone
C.Use a single large EC2 instance
D.Deploy EC2 instances across two or more Availability Zones
E.Configure an Auto Scaling group to span multiple Availability Zones
AnswersD, E

Multiple zones provide redundancy for zone failure.

Why this answer

Deploying across multiple Availability Zones and using an auto scaling group across those zones ensures that if one zone fails, the application continues in the other zones.

Full explanation →
427
Multi-Selecthard

A cloud engineer is troubleshooting a performance issue where a web server cluster experiences high latency during peak hours. The cluster uses an auto-scaling group behind a load balancer. Which THREE steps should the engineer take to identify the root cause?

Select 3 answers
A.Monitor CPU and memory utilization on the web servers
B.Analyze web server access logs for slow requests
C.Check the load balancer's backend instance health status
D.Reduce the number of instances in the auto-scaling group
E.Review security group rules for the load balancer
AnswersA, B, C

High resource usage can cause slow responses.

Why this answer

High CPU or memory utilization on web servers directly indicates resource contention, which can cause increased request processing time and latency. Monitoring these metrics helps identify if the auto-scaling group is under-provisioned or if a specific instance is overloaded, guiding scaling policy adjustments.

Exam trap

The trap here is that candidates may think reducing instances (Option D) is a valid troubleshooting step, but it is a remediation action that can mask the root cause and potentially crash the application under load.

Full explanation →
428
Multi-Selectmedium

A cloud architect is evaluating deployment strategies for a microservices application that requires high availability and minimal downtime during updates. Which TWO deployment methods should the architect consider?

Select 2 answers
A.Immutable deployment
B.Rolling deployment
C.In-place deployment
D.Canary deployment
E.Blue/green deployment
AnswersB, E

Correct: Rolling updates a subset of instances at a time, maintaining availability.

Why this answer

Both rolling deployment (B) and blue/green deployment (E) are suitable for microservices applications requiring high availability and minimal downtime during updates. Rolling deployment updates instances incrementally, replacing old versions with new ones in batches while keeping the application available. Blue/green deployment maintains two identical environments (blue and green), allowing traffic to be switched instantly from the old version to the new version, thus minimizing downtime.

These strategies align with the requirements for high availability and minimal downtime.

Exam trap

A common trap is confusing deployment strategies (like rolling and blue/green) with testing strategies (like canary), where canary is primarily a testing method that also reduces risk but may not provide the same level of high availability as rolling or blue/green.

Full explanation →
429
MCQmedium

A company uses a SaaS application for customer relationship management (CRM). The security team wants to monitor user activities and enforce data loss prevention (DLP) policies. Which type of security tool should be deployed?

A.Intrusion Detection System (IDS)
B.Security Information and Event Management (SIEM)
C.Cloud Access Security Broker (CASB)
D.Web Application Firewall (WAF)
AnswerC

CASB is designed for SaaS security and governance.

Why this answer

A Cloud Access Security Broker (CASB) provides visibility into SaaS usage, monitors user activities, and can enforce DLP policies across cloud applications.

Full explanation →
430
Multi-Selectmedium

A company is implementing multi-factor authentication (MFA) for cloud console access. Which TWO of the following are valid MFA methods? (Select TWO.)

Select 2 answers
A.A password and a hardware TOTP token
B.Two different passwords
C.A password and a security question
D.A username and password
E.A fingerprint and a smart card
AnswersA, E

Combines something you know (password) with something you have (token).

Why this answer

A hardware TOTP token generates a time-based one-time password (RFC 6238) that changes every 30 or 60 seconds, providing a second factor independent of the user's password. Combining this with a password satisfies the MFA requirement of using two different authentication factors (something you know and something you have).

Exam trap

CompTIA Cloud+ often tests the distinction between multi-step authentication (e.g., password then security question) and true multi-factor authentication, where candidates mistakenly believe any two sequential credentials count as MFA.

Full explanation →
431
MCQhard

A cloud administrator is troubleshooting why web-server-01 is not receiving traffic from an internet-facing load balancer. The load balancer is in the same VPC and subnet. According to the exhibit, what is the most likely reason?

A.The security group attached to the instance does not allow traffic from the load balancer
B.The instance is in a stopped state
C.The instance is not in the same VPC as the load balancer
D.The instance does not have a public IP address
AnswerA

The security group must allow inbound HTTP/HTTPS from the load balancer's security group or CIDR.

Why this answer

The exhibit likely shows the instance's security group 'web-sg' but no inbound rule allowing HTTP traffic from the load balancer. Since the load balancer is internet-facing and in the same VPC, it can route traffic to the instance via private IP. However, the instance's security group must explicitly allow inbound traffic from the load balancer (or its security group).

Without that rule, traffic is blocked. Therefore, the most likely reason is the security group not allowing traffic from the load balancer, making option A correct.

Full explanation →
432
MCQmedium

A company's IaaS environment has a high rate of failed login attempts to a critical database server. The security team wants to temporarily block the source IPs after 5 failed attempts within 10 minutes. Which security control should be implemented?

A.Enable TLS mutual authentication for the database.
B.Deploy a web application firewall (WAF) with rate-limiting rules.
C.Implement a cloud access security broker (CASB).
D.Configure host-based firewall rules on each database server.
AnswerD

Host-based firewalls, combined with log monitoring tools like fail2ban, can dynamically block IPs after a configured number of failed login attempts within a time window.

Why this answer

Host-based firewall rules on each database server can be configured to dynamically block source IPs after a threshold of failed login attempts. For example, tools like fail2ban can monitor authentication logs and automatically update the host-based firewall (e.g., iptables or Windows Firewall) to temporarily block IPs that exceed the failure limit. This provides precise, dynamic control without relying on a centralized appliance.

Option A is incorrect because TLS mutual authentication secures the connection but does not block IPs. Option B is incorrect because a WAF only inspects HTTP/HTTPS traffic, not database protocols like MySQL or PostgreSQL. Option C is incorrect because a CASB is designed for cloud application access, not database server protection.

Exam trap

Candidates often assume a WAF can protect any server, but WAFs only filter HTTP/HTTPS traffic. For database servers, host-based firewalls with dynamic rule updates are the practical solution.

Full explanation →
433
MCQeasy

What is the primary benefit of using Infrastructure as Code (IaC)?

A.Improved network performance
B.Full manual control over resources
C.Consistent and repeatable deployments
D.Lower cloud service costs
AnswerC

IaC codifies infrastructure, ensuring the same environment every time.

Why this answer

IaC ensures consistent and repeatable deployments by defining infrastructure in code. Option A is wrong because improved network performance is not a direct benefit. Option B is wrong because manual control is the opposite of automation.

Option D is wrong because IaC may reduce costs through automation but consistency is key.

Full explanation →
434
MCQeasy

Which of the following is the best practice for securely storing secrets such as database passwords in a cloud environment?

A.Hard-code the secrets in the application code.
B.Store secrets in a configuration file in the repository.
C.Encrypt secrets and store them in a shared storage.
D.Use a dedicated secrets management service.
AnswerD

Services like AWS Secrets Manager or Azure Key Vault are purpose-built for secure secret storage.

Why this answer

Dedicated secrets management services provide secure storage, rotation, and access control.

Full explanation →
435
Multi-Selecteasy

Which TWO of the following are common security concerns specific to a public cloud infrastructure?

Select 2 answers
A.Exposure of insecure application programming interfaces (APIs).
B.Physical theft of servers from data centers.
C.Packet sniffing on the provider's internal network.
D.Misconfiguration of cloud resources leading to data exposure.
E.Hypervisor-level malware.
AnswersA, D

APIs are often targeted by attackers if not properly secured.

Why this answer

Options A and D are correct. Insecure APIs are a top cloud security concern because they allow programmatic access and can be exploited if not properly secured. Misconfiguration of cloud resources is a leading cause of data exposure in public cloud environments.

Option B is incorrect because physical theft is the provider's responsibility and is not a common customer concern. Option C is incorrect because packet sniffing on the provider's internal network is mitigated by network segmentation and encryption, and is not a typical threat in public clouds. Option E is incorrect because hypervisor-level malware is rare and providers quickly patch vulnerabilities.

Full explanation →
436
MCQhard

A cloud architect is designing a VPC with three tiers: web, application, and database. Which subnet design provides the best security posture?

A.Web in public subnet, app and database in private subnets with appropriate routing
B.Web and app in public subnets, database in private subnet
C.All tiers in private subnets with a VPN
D.All tiers in the same public subnet with security groups
AnswerA

This separates internet-facing from internal tiers, reducing risk.

Why this answer

It follows the principle of least privilege and network segmentation. Placing the web tier in a public subnet allows it to receive internet traffic, while the application and database tiers reside in private subnets with no direct internet access. This design ensures that only the web tier is exposed, and the database is isolated, accessible only via the application tier through controlled routing, significantly reducing the attack surface.

Exam trap

The CV0-004 exam often tests the misconception that security groups alone are sufficient for network segmentation, leading candidates to choose Option D, but security groups are stateful firewalls at the instance level and do not replace the need for subnet-level isolation and controlled routing paths.

How to eliminate wrong answers

Option B is wrong because placing the application tier in a public subnet exposes it to the internet, increasing the risk of direct attacks on application logic and potentially compromising the database. Option C is wrong because placing all tiers in private subnets with a VPN is overly restrictive and impractical for a web-facing application; it would require all users to have VPN access, which is not typical for public web services. Option D is wrong because placing all tiers in the same public subnet violates network segmentation best practices; security groups alone cannot prevent lateral movement between tiers if an attacker compromises one instance, as they share the same network broadcast domain and routing path.

Full explanation →
437
MCQeasy

Which storage type is most suitable for hosting a shared file system accessible by multiple virtual machines in a cloud environment?

A.Archive storage
B.Object storage
C.Block storage
D.File storage
AnswerD

File storage supports shared access via NFS or SMB.

Why this answer

File storage (option D) is the correct choice because it provides a hierarchical, shared file system that multiple virtual machines can mount simultaneously using standard protocols like NFS (Network File System) or SMB/CIFS. This allows concurrent read/write access with file-level locking, making it ideal for shared workloads such as home directories, content management, or collaboration tools in a cloud environment.

Exam trap

The CV0-004 exam often tests the misconception that block storage can be shared by multiple VMs, but the trap here is that block storage is a single-attach device unless you implement a complex clustered file system (e.g., GFS2 or OCFS2), which is not the default or simplest solution for shared access.

How to eliminate wrong answers

Option A is wrong because archive storage is designed for long-term, infrequently accessed data with high retrieval latency, not for active, concurrent file sharing by multiple VMs. Option B is wrong because object storage uses a flat namespace with HTTP-based APIs (e.g., S3) and lacks native file system semantics like hierarchical directories and file-level locking, making it unsuitable for shared file system access. Option C is wrong because block storage presents raw volumes (e.g., iSCSI or NVMe-oF) that can only be attached to a single VM at a time; it does not support concurrent multi-VM access without a clustered file system overlay, which adds complexity and is not a native feature.

Full explanation →
438
MCQhard

An organization is migrating a legacy monolithic application to the cloud using a re-platform approach (lift and shift with minimal changes). After migration, performance is worse than on-premises. Which of the following is the BEST next step to improve performance without significant application changes?

A.Refactor the application into microservices and use Kubernetes.
B.Increase the size of the virtual machines and allocate more vCPUs.
C.Move the application to a containerized environment using Docker.
D.Implement a content delivery network (CDN) to cache static assets.
AnswerB

Scaling up provides more CPU and memory, which can improve performance for resource-intensive applications without requiring architectural changes.

Why this answer

In a re-platform (lift and shift) migration, the application's architecture remains unchanged, so performance issues often stem from insufficient cloud resources. Increasing the VM size and allocating more vCPUs directly addresses resource contention without requiring code modifications, making it the best immediate step.

Exam trap

CompTIA often tests the misconception that cloud-native solutions like containers or microservices are always the answer, but the trap here is that the question explicitly limits changes, making vertical scaling the only viable option without re-architecting.

How to eliminate wrong answers

Option A is wrong because refactoring into microservices and using Kubernetes requires significant application changes, contradicting the 'minimal changes' constraint. Option C is wrong because containerization with Docker still requires application packaging and orchestration changes, and does not inherently improve performance without addressing resource allocation. Option D is wrong because a CDN caches only static assets, which does not resolve performance bottlenecks in a monolithic application's dynamic processing or database queries.

Full explanation →
439
MCQeasy

A company recently migrated its on-premises backup server to a cloud virtual machine running Windows Server with a dedicated data disk for backups. The backup software is configured to write to a folder on the data disk. After two weeks, the backup jobs start failing with 'disk full' errors. The cloud engineer logs into the VM and verifies that the data disk has 500 GB of total space and the backup folder shows only 300 GB used. However, the operating system reports the disk as 100% full. The engineer also notices that the recycle bin on the data disk appears to be empty. Which of the following is the MOST likely cause of the discrepancy?

A.Shadow copies (Volume Shadow Copies) are consuming space on the data disk
B.The cloud provider has imposed a quota on the disk's storage capacity that is lower than the provisioned size
C.The recycle bin on the data disk contains deleted backup files that are not counted
D.The backup software is compressing data, causing the disk to appear full due to index fragmentation
AnswerA

VSS snapshots can consume disk space without appearing in the backup folder or recycle bin.

Why this answer

Previous backups moved to the system volume shadow copy (VSS) snapshots can consume hidden space. The operating system sees the disk as full because VSS takes up space that is not visible in normal file counting. Option B is wrong: cloud provider quotas on a VM's managed disk are not enforced at the OS level; the OS sees the full provisioned size.

Option C is wrong: the recycle bin was noted as empty, so it cannot account for the discrepancy. Option D is wrong: compression reduces the amount of space used, and index fragmentation does not cause the OS to report 100% full when only 300 GB is used.

Full explanation →
440
Drag & Dropmedium

Arrange the steps to configure auto-scaling for a group of virtual machines based on CPU utilization.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First define the template, then the group, then the scaling policy, attach it, and test.

Full explanation →
441
Multi-Selectmedium

A cloud architect is designing a monitoring solution for a serverless application. The architect needs to collect custom application metrics and set up anomaly detection alerts. Which TWO services should be used? (Select TWO.)

Select 2 answers
A.Configuration management service
B.Cloud monitoring service
C.Cloud monitoring service with anomaly detection alerts
D.Cloud audit logging service
E.Cloud logging service for log storage
AnswersB, C

CloudWatch can store custom metrics via the PutMetricData API.

Why this answer

A cloud monitoring service can collect custom application metrics, and a monitoring service with anomaly detection capabilities can trigger alerts when behavior deviates from normal patterns. Cloud audit logging services are for auditing API calls, not metrics.

Full explanation →
442
MCQeasy

Users are unable to load a web page on a newly deployed web server. The security group for the server allows inbound HTTP from 0.0.0.0/0. The web service is running and listening on port 80. Which of the following is the MOST likely cause?

A.The DNS record for the domain is not yet propagated.
B.The VM's firewall is blocking inbound requests on port 80.
C.The load balancer target group is unhealthy.
D.The web server is listening on the wrong IP address.
AnswerD

A common misconfiguration is binding the web server to 127.0.0.1 or a private IP instead of the public-facing IP, causing external requests to fail.

Why this answer

If the web server is listening on an IP address other than the one clients are reaching (e.g., 127.0.0.1 or a different private IP), inbound HTTP requests will not be processed even though the security group allows traffic on port 80. This is a common misconfiguration where the server binds to a loopback or incorrect interface, causing it to ignore external packets.

Exam trap

CompTIA often tests the distinction between network-level security groups and OS-level firewall or binding configurations, trapping candidates who assume that allowing inbound traffic in the security group is sufficient for connectivity.

How to eliminate wrong answers

Option A is wrong because DNS propagation affects name resolution, not the ability to load a page via IP address; if the server is reachable by IP, DNS is irrelevant. Option B is wrong because the VM's firewall (e.g., iptables or Windows Firewall) is a separate layer from the cloud security group, and the question states the security group allows HTTP, but the VM's OS-level firewall could still block port 80—however, this is less likely than a binding issue given the server is 'newly deployed' and listening on port 80. Option C is wrong because a load balancer target group being unhealthy would only affect traffic through the load balancer, not direct access to the web server; the question does not mention a load balancer.

Full explanation →
443
Multi-Selectmedium

Which THREE of the following are common causes of application performance degradation in a cloud environment? (Choose three.)

Select 3 answers
A.Insufficient number of security groups
B.Network latency and bandwidth limitations
C.Application code that is poorly optimized
D.Resource exhaustion (CPU, memory, disk I/O)
E.Overprovisioned storage
AnswersB, C, D

High latency or low bandwidth can cause delays in data transmission.

Why this answer

Options B, C, and D are correct. Network latency and bandwidth limitations (B) slow data transfer, directly degrading performance. Poorly optimized application code (C) causes inefficiencies like excessive resource consumption or blocking operations.

Resource exhaustion (D) — including CPU, memory, or disk I/O — throttles application throughput. Option A is incorrect because insufficient security groups affect traffic rules but not performance; they may block or allow traffic but don't degrade speed. Option E is incorrect because overprovisioned storage means excess capacity, which does not degrade performance; underprovisioned storage would cause issues.

Full explanation →
444
MCQhard

A company runs an e-commerce platform on a public cloud. The architecture consists of a front-end load balancer, a web server tier, and an RDS database. The web servers are in an auto-scaling group across two availability zones. The database is a single Multi-AZ deployment. After a recent traffic surge, the web servers scaled but the database CPU utilization reached 90%, causing slow page loads. The database is a db.r5.large instance with 16 GB RAM and 2 vCPUs. The company expects double the traffic during the upcoming holiday season. The budget is limited. Which action should the cloud architect take to address the database bottleneck while minimizing cost?

A.Implement a fully managed caching layer, such as ElastiCache, in front of the database
B.Add read replicas of the database and configure the application to use them for read queries; implement auto-scaling for read replicas based on average CPU utilization
C.Separate the database into multiple smaller databases using sharding
D.Upgrade the database to a larger instance type, such as db.r5.2xlarge
AnswerB

Read replicas distribute read traffic, reducing primary CPU load, and auto-scaling ensures cost efficiency.

Why this answer

Adding read replicas offloads read queries from the primary database, reducing CPU utilization. Auto-scaling read replicas based on average CPU utilization ensures cost efficiency by scaling only when needed, which aligns with the limited budget and expected traffic surge. This approach directly addresses the bottleneck without requiring a costly instance upgrade or complex sharding.

Exam trap

CompTIA often tests the misconception that upgrading instance size is the simplest fix, but the trap here is that horizontal scaling with read replicas is more cost-effective and elastic for read-heavy workloads than vertical scaling, especially when budget is limited.

How to eliminate wrong answers

Option A is wrong because a fully managed caching layer like ElastiCache reduces read load but does not address high CPU utilization from write-heavy or complex query workloads; it also adds cost and complexity without directly scaling database compute capacity. Option C is wrong because sharding introduces significant architectural complexity, operational overhead, and potential data consistency issues, which is not justified for a single Multi-AZ RDS instance with a predictable traffic surge; it is overkill for this scenario. Option D is wrong because upgrading to a larger instance type (db.r5.2xlarge) increases cost linearly without guaranteeing optimal resource utilization, and it does not provide the elasticity needed to handle variable traffic spikes cost-effectively.

Full explanation →
445
MCQhard

An organization is deploying a multi-tier application in the cloud. The web tier uses auto scaling, and the database tier uses a managed database service. During a load test, the web tier scales up correctly, but the database performance degrades significantly, causing timeout errors. The administrator reviews the database metrics and finds that CPU and memory are normal, but the number of connections is high. Which of the following is the BEST action to resolve the issue?

A.Add read replicas to offload read traffic from the primary database.
B.Increase the maximum number of web servers in the auto scaling group.
C.Increase the compute size of the database instance.
D.Implement connection pooling on the web servers to limit database connections.
AnswerD

Connection pooling reduces the number of simultaneous database connections, improving performance.

Why this answer

The issue is that the database is overwhelmed by a high number of connections, not by CPU or memory pressure. Connection pooling on the web servers reuses a fixed set of database connections, reducing the connection overhead and preventing the database from hitting its maximum connection limit. This directly addresses the symptom of high connection count without changing the database's compute capacity or the web tier's scaling behavior.

Exam trap

The trap here is that candidates confuse high connection count with high CPU/memory load and choose to scale the database vertically (Option C), when the real issue is connection exhaustion that is solved by pooling.

How to eliminate wrong answers

Option A is wrong because read replicas only offload read queries, but the problem is connection count, not read load; the database is likely experiencing connection exhaustion from both reads and writes. Option B is wrong because increasing the maximum number of web servers would increase the number of concurrent database connections, worsening the problem. Option C is wrong because CPU and memory are normal, so increasing compute size does not address the connection limit; the bottleneck is the maximum number of allowed connections, not resource saturation.

Full explanation →
446
MCQeasy

A cloud administrator is configuring a Linux VM as a router. The iptables rules are shown. The administrator can SSH into the VM from the network but cannot forward traffic between interfaces. What is the most likely cause?

A.The INPUT chain has a rule dropping invalid packets
B.The INPUT chain is missing a rule to allow forwarded traffic
C.The FORWARD chain's default policy is DROP and no rules allow forwarding
D.The NAT table is misconfigured
AnswerC

With default policy DROP and no FORWARD rules, all forwarded packets are dropped.

Why this answer

The FORWARD chain in iptables controls traffic that passes through the VM (i.e., traffic not destined for the VM itself). If its default policy is DROP and no explicit ACCEPT rules exist for forwarding, the kernel will drop all forwarded packets, preventing the VM from acting as a router. SSH access works because it uses the INPUT chain, which is separate from FORWARD.

Exam trap

The trap here is that candidates confuse the INPUT chain (for local traffic) with the FORWARD chain (for transit traffic), assuming that allowing SSH implies forwarding is also allowed, when in fact they are handled by completely separate chains.

How to eliminate wrong answers

Option A is wrong because the INPUT chain dropping invalid packets affects only traffic destined for the VM itself, not forwarded traffic; SSH connectivity proves INPUT is functional. Option B is wrong because forwarded traffic is governed by the FORWARD chain, not the INPUT chain; the INPUT chain has no role in forwarding decisions. Option D is wrong because the NAT table is used for source/destination NAT (e.g., masquerading) and does not control basic IP forwarding; even with correct NAT, packets will be dropped if the FORWARD chain blocks them.

Full explanation →
447
MCQeasy

An organization is migrating a legacy application to a public cloud. The application requires a static IP address that does not change after a VM is stopped. Which of the following should the cloud architect use to meet this requirement?

A.Reserved IP address
B.Elastic IP address
C.Ephemeral IP address
D.Floating IP address
AnswerA

Reserved IPs are static and remain allocated to the account even when the VM is off.

Why this answer

A reserved IP address is a static, persistent public IP that remains assigned to a VM even when the VM is stopped or deallocated. In public cloud platforms like Azure, a reserved IP (or static IP) is explicitly set to not change across VM lifecycle events, meeting the requirement for a fixed address that survives stop/deallocate operations.

Exam trap

CompTIA often tests the distinction between cloud-agnostic terminology and vendor-specific terms (e.g., 'Reserved IP' vs 'Elastic IP'), trapping candidates who pick a correct AWS concept but fail to recognize the generic term required by the exam.

How to eliminate wrong answers

Option B (Elastic IP address) is wrong because Elastic IP is an AWS-specific term for a static public IP that persists across stop/start, but it is not the generic cloud term used in the CV0-004 exam; the question asks for the general concept, and 'Reserved IP' is the correct cross-platform term. Option C (Ephemeral IP address) is wrong because an ephemeral IP is temporary and is released when the VM is stopped or deallocated, directly contradicting the requirement for a static IP. Option D (Floating IP address) is wrong because a floating IP is typically used in OpenStack or on-premises environments for dynamic remapping between instances, not for a persistent static IP that remains attached to a single VM across stop/start cycles.

Full explanation →
448
MCQeasy

An organization is migrating its on-premises virtualization environment to a public cloud. The current environment uses VMware vSphere with VM templates. The cloud provider supports importing VMs in OVF format. Which step should the cloud administrator take to prepare the VMs for migration?

A.Take a snapshot of each VM and copy the snapshot files.
B.Export each VM as an OVF template.
C.Convert each VM to an ISO image.
D.Copy the VM's VMDK files and import them as VHDX.
AnswerB

OVF is a standard format for VM import/export.

Why this answer

The cloud provider supports importing VMs in OVF format, which is an open standard for packaging and distributing virtual appliances. Exporting each VM as an OVF template from VMware vSphere creates the necessary .ovf descriptor file and accompanying disk files (e.g., .vmdk) that the provider can directly import. This is the correct preparation step because it produces the exact format required by the target cloud platform.

Exam trap

The trap here is that candidates may confuse 'export as OVF' with other common VMware operations like taking snapshots or copying VMDK files, not realizing that OVF is the specific format required by the cloud provider for direct import.

How to eliminate wrong answers

Option A is wrong because a snapshot captures a point-in-time state of the VM but does not produce a portable, importable format like OVF; snapshot files are tied to the original VM and cannot be directly imported into a cloud provider. Option C is wrong because an ISO image is used for OS installation media or data discs, not for virtual machine disk images; converting a VM to ISO would lose the VM's configuration, snapshots, and file system structure. Option D is wrong because VMDK files are VMware's native disk format, but the provider expects OVF format, not raw VMDK or VHDX; importing VMDK files directly would require additional conversion steps and the provider's import process specifically requires the OVF package.

Full explanation →
449
MCQhard

Which deployment strategy minimizes risk by gradually shifting a small percentage of traffic to a new version before full rollout?

A.Canary deployment
B.In-place deployment
C.Rolling deployment
D.Blue-green deployment
AnswerA

Canary releases send a small amount of traffic to the new version to test stability.

Why this answer

A canary deployment minimizes risk by routing a small percentage of traffic (e.g., 5-10%) to the new version while the majority continues to use the stable version. This allows real-world validation of the new version under production load before a full rollout, and if issues are detected, traffic can be instantly redirected back to the old version. The strategy is named after the 'canary in a coal mine' concept, where early detection of problems prevents widespread impact.

Exam trap

CompTIA often tests the distinction between canary and rolling deployments, where candidates mistakenly think rolling deployment also uses a small traffic percentage, but rolling updates instances sequentially without the deliberate traffic-splitting and validation phase that defines a canary.

How to eliminate wrong answers

Option B (In-place deployment) is wrong because it directly replaces the existing version on the same infrastructure without any traffic shifting or gradual rollout, meaning any failure affects all users immediately. Option C (Rolling deployment) is wrong because it gradually replaces instances one by one (or in batches) but does not intentionally isolate a small traffic percentage for validation; it updates all instances over time without a canary's targeted risk assessment. Option D (Blue-green deployment) is wrong because it maintains two identical environments (blue and green) and switches all traffic at once from the old to the new version, which does not involve a gradual traffic shift or small percentage testing.

Full explanation →
450
MCQhard

A cloud operations team is troubleshooting a performance issue with a database that is running on a virtual machine. The database is experiencing high latency during peak hours. Metrics show that CPU and memory usage are below 50%, but disk I/O latency spikes. The database is hosted on a cloud provider's virtual machine with premium SSDs. Which of the following is the MOST likely cause of the disk I/O latency?

A.The OS is paging memory to disk due to insufficient RAM.
B.The virtual machine's network bandwidth is saturated.
C.The disk IOPS limit is being exceeded during peak loads.
D.The database application is CPU-bound.
AnswerC

Exceeding provisioned IOPS results in throttling, causing increased latency.

Why this answer

Premium SSDs have defined IOPS limits that, when exceeded during peak loads, cause disk I/O latency spikes. Since CPU and memory are below 50%, the bottleneck is at the storage layer, not compute or memory. The high latency indicates the disk queue depth is growing as requests exceed the provisioned IOPS cap, leading to queuing delays.

Exam trap

A common trap is to attribute high disk I/O latency to memory pressure (paging), but since memory usage is low, the real cause is hitting the disk's IOPS ceiling.

How to eliminate wrong answers

Option A is wrong because the OS paging memory to disk would show high memory usage (near 100%) and increased disk reads/writes, but metrics show memory usage below 50%, ruling out insufficient RAM. Option B is wrong because network bandwidth saturation would manifest as network latency or packet loss, not disk I/O latency spikes; the issue is specifically with disk performance, not network throughput. Option D is wrong because the database being CPU-bound would show CPU usage at or near 100%, but metrics indicate CPU usage is below 50%, so the CPU is not the bottleneck.

Full explanation →
Page 5

Page 6 of 14

Page 7

All pages

1234567891011121314

Practice CV0-004 by domain

Target a specific domain to shore up weak areas.

Cloud Architecture and DesignDeploymentSecurityOperations and SupportTroubleshooting
See all domains with question counts →