Courseiva

CompTIA Cloud+ CV0-004 (CV0-004) — Questions 451–525

977 questions total · 14pages · All types, answers revealed

Take a mock examExam hub
Page 6

Page 7 of 14

Page 8
451
MCQhard

A cloud architect is designing a multi-region application with a Recovery Time Objective (RTO) of 1 hour and a Recovery Point Objective (RPO) of 15 minutes. The application runs on virtual machines in a public cloud. Which disaster recovery strategy best meets these objectives?

A.Hot standby in a secondary region with synchronous replication
B.Active-active across two regions with load balancing
C.Cold standby with daily backups
D.Warm standby with hourly snapshots
AnswerA

Hot standby with synchronous replication provides RTO of minutes and RPO near zero, meeting the requirements.

Why this answer

Hot standby involves running a fully functional standby environment that can take over within minutes, achieving low RTO and RPO. Active-active can also meet these but may be more complex and costly; warm standby typically has longer RTO; cold standby has hours.

Full explanation →
452
Multi-Selecthard

A company is migrating to AWS and needs to meet PCI DSS compliance. Which THREE of the following should be implemented? (Choose three.)

Select 3 answers
A.Encrypting cardholder data at rest and in transit
B.Using single-factor authentication for all administrative access
C.Implementing a vulnerability management program
D.Enabling audit logging for all access to cardholder data
E.Using default VPC settings without changes
AnswersA, C, D

PCI DSS mandates encryption of cardholder data.

Why this answer

PCI DSS requires encryption of cardholder data, regular security testing (like vulnerability scanning), and audit logging. Using default VPC settings may not be secure. Single-factor authentication is insufficient.

Full explanation →
453
Drag & Dropmedium

Order the steps to migrate an on-premises database to a cloud-managed database service (e.g., RDS, Cloud SQL).

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

The correct sequence for migrating an on-premises database to a cloud-managed database service begins with creating the cloud database instance to serve as the target. Next, export the on-premises data (e.g., using mysqldump or pg_dump). The exported data is then uploaded to cloud storage (e.g., S3 or Cloud Storage) for accessibility.

After upload, import the data into the cloud database. Finally, update application connection strings to point to the new cloud database, completing the migration. This order minimizes downtime and ensures data integrity.

Full explanation →
454
Multi-Selecteasy

Which TWO of the following are benefits of using a content delivery network (CDN) with cloud-hosted applications? (Choose two.)

Select 2 answers
A.Reduces load on the origin server
B.Simplifies application architecture
C.Eliminates the need for HTTPS encryption
D.Reduces latency for end users by caching content at edge locations
E.Lowers overall infrastructure cost
AnswersA, D

CDN serves cached requests, reducing origin traffic.

Why this answer

A CDN caches static and dynamic content at edge servers, so requests for cached content are served from the edge rather than the origin server. This offloads traffic from the origin, reducing CPU, memory, and bandwidth consumption on the cloud-hosted application's backend. Option D is correct because edge servers are geographically distributed closer to end users, which minimizes network round-trip time and reduces latency for content delivery.

Exam trap

A common misconception is that a CDN simplifies application architecture or reduces costs, but in reality, it adds operational overhead and incurs additional service fees, while HTTPS remains mandatory for secure communication.

Full explanation →
455
MCQmedium

A cloud administrator is troubleshooting network connectivity issues between two VPCs in AWS. The administrator wants to examine traffic flow logs to identify dropped packets. Which AWS feature provides detailed network traffic logs for VPCs?

A.AWS X-Ray
B.AWS CloudTrail
C.VPC Flow Logs
D.Amazon CloudWatch Logs
AnswerC

VPC Flow Logs capture information about IP traffic going to and from network interfaces.

Why this answer

VPC Flow Logs capture IP traffic information for network interfaces in a VPC.

Full explanation →
456
MCQmedium

A security analyst is reviewing logs and finds that an unauthorized user accessed a storage blob in a cloud environment. The analyst needs to determine which permissions allowed the access. Which cloud feature provides a detailed view of effective permissions for a user?

A.Privileged Identity Management (PIM)
B.Role-Based Access Control (RBAC) with effective permissions analysis
C.Blueprints/Service Catalog
D.Policy Enforcement
AnswerB

Correct. RBAC's effective permissions feature aggregates all role assignments to show the net permissions.

Why this answer

Role-Based Access Control (RBAC) systems often provide an 'effective permissions' or 'check access' feature that allows an administrator to evaluate the cumulative permissions assigned to a specific user, group, or service principal for a given resource scope. This feature calculates the net effect of all role assignments, including inherited permissions from higher-level scopes such as management groups, subscriptions, and resource groups, enabling the analyst to pinpoint exactly which role granted the unauthorized access.

Exam trap

The trap here is that candidates often confuse RBAC's effective permissions feature with Privileged Identity Management (PIM), assuming PIM shows current permissions, when in fact PIM only manages role activation and does not compute the cumulative effective permissions across multiple role assignments.

How to eliminate wrong answers

Option A is wrong because Azure AD Privileged Identity Management (PIM) manages just-in-time activation and oversight of privileged roles, but it does not provide a detailed view of effective permissions for a specific user on a resource. Option C is wrong because Azure Blueprints is used for defining and deploying repeatable sets of Azure resources and policies (like compliance templates), not for evaluating effective user permissions. Option D is wrong because Azure Policy enforces rules and effects (e.g., deny, audit) on resource configurations, but it does not evaluate or display the effective RBAC permissions assigned to a user.

Full explanation →
457
MCQhard

During a security audit, it is discovered that a cloud application can be accessed using a shared service account that has elevated privileges. The audit recommends implementing a just-in-time (JIT) access model. What is the primary benefit of JIT access in this scenario?

A.Automates auditing of third-party access.
B.Allows for easier management of user identities.
C.Reduces the attack surface by minimizing persistent privileged access.
D.Eliminates the need for user authentication.
AnswerC

JIT ensures that elevated permissions are granted only for specific times and tasks, so compromised credentials have limited window of opportunity.

Why this answer

JIT access grants temporary elevated privileges only when needed, reducing the risk of standing privileged access. It enables real-time approval workflows. It does not directly manage identities nor automate audits of third-party access; those are secondary benefits.

Full explanation →
458
MCQhard

A cloud security team is implementing a secrets management solution for applications running on AWS. They need to automatically rotate database credentials every 30 days and avoid hardcoding secrets. Which service should they use?

A.AWS Identity and Access Management (IAM) roles
B.AWS Key Management Service (KMS)
C.AWS Secrets Manager
D.AWS Systems Manager Parameter Store
AnswerC

Secrets Manager manages secrets and supports automatic rotation.

Why this answer

AWS Secrets Manager allows automatic rotation of secrets (e.g., database credentials) and integration with AWS services. Parameter Store can store secrets but does not natively support automatic rotation. KMS is for encryption keys.

IAM roles are for AWS service permissions.

Full explanation →
459
MCQmedium

An organization uses multiple SaaS applications and wants to enforce data loss prevention policies and gain visibility into user activity. Which technology should they implement?

A.Security information and event management (SIEM)
B.Web Application Firewall (WAF)
C.Virtual private network (VPN)
D.Cloud Access Security Broker (CASB)
AnswerD

CASBs provide visibility and control over SaaS applications.

Why this answer

A Cloud Access Security Broker (CASB) provides visibility, compliance, data security, and threat protection for SaaS applications. WAF protects web applications, VPN provides remote access, and SIEM aggregates logs.

Full explanation →
460
MCQmedium

A cloud architect is designing a multi-tier application that must be resilient to the failure of an entire availability zone. Which of the following strategies BEST meets this requirement?

A.Place all instances behind a single load balancer in one zone
B.Implement auto-scaling within the same availability zone
C.Use larger instance types to handle more load
D.Deploy application instances across three availability zones with a load balancer
AnswerD

Multi-AZ deployment ensures continued operation if one zone fails.

Why this answer

Deploying across multiple availability zones provides high availability. Option A is wrong because vertical scaling does not address zone failure. Option B is wrong because auto-scaling within a single zone does not help if the zone fails.

Option C is wrong because a single load balancer in one zone is a single point of failure.

Full explanation →
461
MCQeasy

A company recently migrated its on-premises e-commerce application to a public cloud using lift-and-shift. After the migration, users report that the application is slower than before. The application consists of a web server, an application server, and a database server, all deployed on separate virtual machines. The cloud architecture uses the same instance sizes as the on-premises servers. The cloud administrator notices that the database server's disk I/O latency is higher than expected. What is the most likely cause of the performance degradation?

A.The database server is using standard HDD storage instead of SSD.
B.The cloud provider's network has high latency.
C.The application server is not load-balanced.
D.The web server has too many vCPUs allocated.
AnswerA

HDD has higher latency, impacting database performance.

Why this answer

The database server's disk I/O latency is higher than expected because the lift-and-shift migration likely retained the same storage type as on-premises, but the cloud environment's standard HDD (hard disk drive) storage has significantly lower IOPS and higher latency compared to SSD (solid-state drive) storage. In a public cloud, standard HDD is optimized for sequential workloads and infrequent access, not for the random I/O patterns typical of a database server, causing performance degradation. The administrator should have provisioned SSD-backed storage (e.g., AWS gp3 or Azure Premium SSD) for the database VM to match or exceed on-premises performance.

Exam trap

CompTIA often tests the misconception that 'cloud performance is always better' or that network latency is the default culprit, but the trap here is that disk storage tiering (HDD vs. SSD) is a common oversight in lift-and-shift migrations, and candidates may incorrectly blame network or compute resources instead of the storage layer.

How to eliminate wrong answers

Option B is wrong because high network latency would affect all tiers (web, app, database) and manifest as general slowness, not specifically as high disk I/O latency on the database server; the question isolates the database's disk I/O as the symptom. Option C is wrong because the absence of load balancing on the application server would cause uneven traffic distribution and potential overload, not directly increase disk I/O latency on the database server. Option D is wrong because allocating too many vCPUs to the web server would not cause higher disk I/O latency on a separate database server; it might waste resources or cause CPU contention, but disk I/O is a storage-layer issue independent of web server vCPU count.

Full explanation →
462
MCQhard

A company uses AWS and wants to implement a disaster recovery plan with an RTO of 4 hours and RPO of 1 hour. They have a primary site in us-east-1 and a DR site in us-west-2. The application data is stored in Amazon RDS for MySQL. Which strategy meets both RTO and RPO with minimal data loss?

A.Use AWS Database Migration Service (DMS) for continuous replication to a separate RDS instance in us-west-2.
B.Create a cross-region read replica in us-west-2 and promote it during failover.
C.Export data to S3 using AWS Backup and restore in us-west-2.
D.Take daily automated snapshots of the RDS instance and copy them to us-west-2.
AnswerB

Cross-region read replicas provide low RPO and can be promoted quickly, meeting both RTO and RPO.

Why this answer

Cross-region read replicas for Amazon RDS provide asynchronous replication with a typical RPO of less than 5 minutes, easily meeting the 1-hour requirement. In a disaster, you can promote the replica to a primary instance within minutes, meeting the 4-hour RTO.

Full explanation →
463
MCQmedium

A company has a cloud-based application that uses an auto-scaling group across multiple Availability Zones (AZs). The application experiences periodic spikes in traffic. The auto-scaling policy uses a step scaling policy based on CPU utilization. The operations team notices that during a traffic spike, new instances are launched but take over five minutes to become healthy and begin serving traffic. During this time, existing instances are overloaded and some requests fail. The team wants to reduce the time it takes for new instances to handle traffic. Which action would be most effective?

A.Increase the instance type to a larger size so each instance can handle more traffic.
B.Use a pre-warmed, customized AMI with the application pre-installed and caches preloaded.
C.Reduce the cooldown period in the scaling policy to launch instances faster.
D.Move all instances to a single AZ to avoid cross-AZ latency.
AnswerB

A pre-warmed AMI reduces startup time by eliminating installation and cache warming steps.

Why this answer

Using a pre-warmed AMI with the application stack already configured and caching enabled significantly reduces the time required for an instance to become healthy because it avoids the need to install dependencies and warm caches on each startup.

Full explanation →
464
MCQmedium

A cloud administrator runs the command shown in the exhibit on a storage node in a hyper-converged cluster. The node is experiencing intermittent I/O errors and degraded performance. Based on the SMART data, what is the most likely cause of the issue?

A.The storage network is experiencing high latency.
B.The filesystem is corrupted and requires a repair.
C.The disk has developed bad sectors and is likely failing.
D.A RAID array is rebuilding, causing performance degradation.
AnswerC

The elevated reallocated and pending sector counts indicate physical disk degradation.

Why this answer

The SMART data from the storage node shows attributes such as Reallocated_Sector_Count, Current_Pending_Sector, and Offline_Uncorrectable with non-zero values, which are definitive indicators of physical bad sectors on the disk. These bad sectors cause intermittent I/O errors and degraded performance because the disk must retry reads/writes or remap sectors, increasing latency. Option C is correct because this pattern directly points to a failing disk, not a network, filesystem, or RAID issue.

Exam trap

The trap here is that candidates confuse SMART disk failure indicators with filesystem corruption or network issues, because intermittent I/O errors can superficially resemble symptoms of a corrupt filesystem or a flapping network link, but the SMART data provides direct hardware-level evidence that eliminates those possibilities.

How to eliminate wrong answers

Option A is wrong because high storage network latency would manifest as consistent packet loss or jitter across all nodes, not as SMART attributes indicating physical disk errors; the command shown is a SMART query, not a network diagnostic. Option B is wrong because filesystem corruption typically produces errors like 'structure needs cleaning' or 'input/output error' on specific files, not the SMART counters for reallocated or pending sectors, which are hardware-level indicators. Option D is wrong because a RAID array rebuilding would show a degraded or rebuilding state in the RAID controller status (e.g., mdadm or megaraid output), not in SMART data, and performance would be consistently slow during rebuild, not intermittent.

Full explanation →
465
MCQhard

An organization has a hybrid cloud environment with resources in both a private cloud and a public cloud. The operations team reports that the cloud management platform cannot collect monitoring data from the public cloud instances. The security team recently updated firewall rules. Which of the following is the MOST likely cause?

A.The load balancer in front of the management platform is misconfigured
B.The public cloud instances cannot reach the management platform's IP address due to firewall changes
C.The SNMP community string was modified on the instances
D.The management platform's NAT IP address was changed
AnswerB

Firewall updates may have blocked outbound traffic from instances to the management platform.

Why this answer

The security team's recent firewall rule update is the most likely cause because the cloud management platform typically uses specific ports and protocols (e.g., HTTPS on TCP 443, SSH on TCP 22, or WinRM on TCP 5985/5986) to collect monitoring data from public cloud instances. If the firewall rules block outbound traffic from the public cloud instances to the management platform's IP address, or block inbound traffic from those instances at the platform's side, the data collection will fail. This directly aligns with the reported symptom of the management platform being unable to collect monitoring data after a firewall change.

Exam trap

CompTIA often tests the candidate's ability to correlate a specific operational change (firewall rule update) with the most direct impact on network connectivity for monitoring, rather than distracting with unrelated configuration changes like SNMP strings or load balancer settings.

How to eliminate wrong answers

Option A is wrong because a misconfigured load balancer in front of the management platform would affect all traffic to the platform, not just monitoring data from public cloud instances, and the issue is specifically tied to the recent firewall rule update. Option C is wrong because while SNMP community string changes could disrupt monitoring, the question explicitly states the security team updated firewall rules, not SNMP configurations, and SNMP is not the only monitoring protocol used in hybrid cloud environments. Option D is wrong because changing the management platform's NAT IP address would require corresponding updates in routing and firewall rules; if this had occurred, the operations team would likely have reported a broader connectivity failure, not just a monitoring data collection issue, and the firewall rule update is the more immediate and likely cause.

Full explanation →
466
MCQeasy

A cloud engineer notices that a virtual machine running a critical application is experiencing high CPU usage. The engineer needs to resolve the issue without affecting other VMs on the same host. Which of the following actions should the engineer take first?

A.Restart the VM to clear the high CPU usage.
B.Increase the CPU allocation for the VM.
C.Migrate the VM to another host in the cluster.
D.Add another VM to the same host to distribute load.
AnswerC

Live migration moves the VM to a less loaded host, resolving the issue without downtime.

Why this answer

Migrating the VM to another host in the cluster (option C) is the correct first action because it immediately offloads the CPU pressure from the current host without impacting the VM's operation or other VMs. This leverages VMware vMotion or Microsoft Hyper-V Live Migration to move the running VM to a less-utilized host, isolating the performance issue while preserving uptime and avoiding resource contention.

Exam trap

CompTIA often tests the misconception that increasing a VM's resource allocation is the first troubleshooting step, when in fact it can cause resource starvation for other VMs; the correct first action is to migrate the VM to balance the load.

How to eliminate wrong answers

Option A is wrong because restarting the VM would cause application downtime and does not address the root cause of high CPU usage; it only temporarily clears the process queue. Option B is wrong because increasing the CPU allocation for the VM on the same host could starve other VMs of CPU resources, violating the requirement to not affect other VMs. Option D is wrong because adding another VM to the same host would increase overall CPU contention, worsening the problem for all VMs on that host.

Full explanation →
467
MCQeasy

A cloud administrator is designing a multi-tier application. The database tier must not be directly accessible from the internet, but the web tier must be able to connect to it. Which of the following should the administrator implement?

A.Implement an application load balancer in front of the database.
B.Place the database servers in a public subnet and restrict the security group.
C.Use a VPN connection for the web tier to access the database.
D.Place the database servers in a private subnet and configure the security group to allow inbound traffic from the web tier's security group.
AnswerD

This isolates the database from the internet and allows only the web tier to connect.

Why this answer

Placing the database servers in a private subnet ensures they have no direct internet route, meeting the security requirement. By configuring the security group to allow inbound traffic only from the web tier's security group, you enable the web tier to connect to the database while blocking all other traffic, including from the internet. This leverages AWS security group referencing (or similar cloud provider feature) to create a trusted, internal communication path.

Exam trap

The trap here is that candidates often confuse 'restricting the security group' with 'placing in a private subnet,' failing to realize that a public subnet inherently provides internet accessibility regardless of security group rules, which only filter traffic but do not remove the public route.

How to eliminate wrong answers

Option A is wrong because an application load balancer is designed to distribute traffic to web or application servers, not to provide secure database access; placing a load balancer in front of the database would expose it to the internet and add unnecessary complexity without preventing direct internet access. Option B is wrong because placing the database servers in a public subnet, even with a restrictive security group, still exposes them to potential internet-based attacks and violates the requirement that the database must not be directly accessible from the internet. Option C is wrong because a VPN connection is typically used for site-to-site or remote user access, not for internal web-to-database communication within the same cloud environment; it would add latency and overhead without addressing the core need for private subnet isolation.

Full explanation →
468
Multi-Selecthard

A company is migrating on-premises workloads to the cloud. They need to ensure high availability for a stateless web application across two availability zones. Which THREE components should be configured to meet this requirement?

Select 3 answers
A.An auto scaling group spanning both availability zones
B.A load balancer in front of the web tier
C.A read replica database in a different AZ
D.A single large compute instance to handle all traffic
E.Multiple subnets, each in a different availability zone
AnswersA, B, E

Correct; auto scaling maintains instance count across AZs.

Why this answer

An auto scaling group spanning both availability zones (Option A) ensures that the stateless web application can automatically replace failed instances and maintain the desired capacity across multiple AZs, which is essential for high availability. By distributing instances across AZs, the application can tolerate an entire AZ failure without losing all compute capacity.

Exam trap

The trap here is that candidates often confuse database-level high availability (like read replicas or multi-AZ database replication) with application-tier high availability, leading them to select a database option (C) when the question explicitly targets the stateless web tier.

Full explanation →
469
MCQmedium

A cloud engineer is tasked with deploying a containerized application on Kubernetes. The application must handle varying loads, and the deployment should automatically replace failed containers. Which Kubernetes object should the engineer use to achieve self-healing and scalability?

A.ConfigMap
B.Service
C.Deployment
D.Pod
AnswerC

A Deployment ensures desired number of Pods are running and supports rolling updates.

Why this answer

A Deployment is the correct Kubernetes object because it manages ReplicaSets to provide declarative updates, self-healing (automatic replacement of failed pods), and scalability (adjusting replica counts). Unlike a standalone Pod, a Deployment ensures the desired state is maintained, automatically rescheduling containers if they fail.

Exam trap

CompTIA Cloud+ often tests the misconception that a Pod alone provides self-healing, but in Kubernetes, a Pod is a non-self-healing atomic unit; only controllers like Deployment (or StatefulSet/DaemonSet) provide automatic replacement and scaling.

How to eliminate wrong answers

Option A (ConfigMap) is wrong because it is used to inject configuration data (e.g., environment variables, files) into pods, not to manage pod lifecycle, self-healing, or scaling. Option B (Service) is wrong because it provides a stable network endpoint and load balancing for a set of pods, but does not handle pod replacement or scaling of replicas. Option D (Pod) is wrong because a single Pod lacks self-healing capabilities; if the Pod fails, it is not automatically replaced unless managed by a higher-level controller like a Deployment.

Full explanation →
470
MCQmedium

An organization's cloud environment has a policy that all administrative access must be logged and recorded. Which of the following is the best method to enforce this policy?

A.Require multifactor authentication.
B.Use a bastion host with session recording.
C.Implement a VPN connection for all administrators.
D.Configure syslog forwarding for all devices.
AnswerB

A bastion host can log and record all administrative actions.

Why this answer

A bastion host with session recording provides a centralized, auditable gateway for administrative access. It logs all commands and keystrokes, directly meeting the policy requirement that all administrative access must be logged and recorded. This method captures the full session activity, not just connection metadata.

Exam trap

The trap here is that candidates often confuse logging (e.g., syslog) with session recording, failing to recognize that syslog only captures discrete events, not the full interactive session required by the policy.

How to eliminate wrong answers

Option A is wrong because multifactor authentication (MFA) strengthens authentication but does not log or record administrative sessions; it only verifies identity. Option C is wrong because a VPN connection encrypts traffic and authenticates users but does not inherently log or record the commands or actions performed during the administrative session. Option D is wrong because syslog forwarding collects system logs (e.g., authentication events, errors) but does not capture interactive session content like keystrokes or command output, which is required for full session recording.

Full explanation →
471
MCQmedium

A cloud engineer deployed the infrastructure shown. The load balancer's health checks are failing for the EC2 instance. Which of the following is the MOST likely cause?

A.The web server is not running HTTP.
B.The health check endpoint /health does not exist on the web server.
C.The EC2 instance is in the wrong subnet.
D.The security group does not allow traffic from the load balancer.
AnswerB

The user_data script does not create a /health page; it only installs httpd.

Why this answer

The health check is failing because the load balancer is configured to check the /health endpoint, but the web server does not have that endpoint defined. Without a matching route or file for /health, the server returns a non-2xx/3xx status code (e.g., 404 Not Found), causing the load balancer to mark the instance as unhealthy.

Exam trap

The trap here is that candidates often assume a security group or subnet misconfiguration is the root cause, but the question specifically describes health checks failing (not timing out), which points to an application-layer issue like a missing endpoint rather than a network-layer problem.

How to eliminate wrong answers

Option A is wrong because the health check failure is not due to the web server not running HTTP; the server could be running HTTP on the correct port but still fail if the specific /health endpoint is missing. Option C is wrong because the EC2 instance being in the wrong subnet would prevent the load balancer from routing traffic at all, but the question states health checks are failing, implying the instance is reachable but not responding correctly to the health check request. Option D is wrong because if the security group did not allow traffic from the load balancer, the health check requests would be dropped entirely, resulting in a timeout rather than a specific endpoint failure; the scenario points to a missing endpoint, not a network access issue.

Full explanation →
472
MCQhard

A cloud engineer is configuring an auto-scaling policy for a batch processing application that takes about 10 minutes to initialize before it can start processing jobs. To avoid premature termination of instances that have just started, what should the engineer configure?

A.Disable scale-in for the first 10 minutes using a scheduled action
B.Use a lifecycle hook to put the instance in a 'wait' state until initialization is complete
C.Set the health check grace period to 600 seconds
D.Increase the cooldown period to 600 seconds
AnswerB

Lifecycle hooks allow you to perform custom actions and control the instance's lifecycle, preventing early termination.

Why this answer

A lifecycle hook can put instances in a pending state until they complete initialization. Cooldown periods prevent scaling actions but do not prevent termination of new instances.

Full explanation →
473
MCQmedium

An organization is migrating a MySQL database to Amazon RDS using AWS DMS. They want to minimize downtime by using ongoing replication from the source. Which DMS feature should they enable to capture changes as they occur on the source database?

A.Data validation
B.Change Data Capture (CDC)
C.Full load
D.Schema conversion
AnswerB

Captures ongoing changes for minimal downtime migration.

Why this answer

Change Data Capture (CDC) captures ongoing changes. Full load transfers existing data; schema conversion converts schemas; validation checks data integrity.

Full explanation →
474
MCQmedium

A company is using a SaaS application and wants to gain visibility into user activity and enforce data loss prevention policies. Which technology should be deployed?

A.Intrusion Detection System (IDS)
B.Web Application Firewall (WAF)
C.Cloud Access Security Broker (CASB)
D.Network Access Control (NAC)
AnswerC

CASB sits between users and SaaS to monitor and enforce policies.

Why this answer

A Cloud Access Security Broker (CASB) provides visibility, compliance, and data security controls for SaaS applications.

Full explanation →
475
MCQhard

A company uses AWS and Azure for different workloads. To improve latency for global users, the company wants to direct traffic to the cloud provider and region closest to the user. Which DNS routing policy should the company implement?

A.Failover routing policy
B.Weighted routing policy
C.Latency routing policy
D.Geolocation routing policy
AnswerD

Geolocation routing directs traffic based on the user's location, allowing mapping to specific endpoints.

Why this answer

Geolocation routing policy routes traffic based on the user's geographic location, allowing the company to direct users to the nearest provider and region.

Full explanation →
476
Multi-Selecthard

A company is migrating a large on-premises application to AWS. The application uses a SQL Server database and requires minimal downtime. The database is 1 TB. Which THREE services or features should the team consider to achieve a successful migration with minimal downtime? (Select 3)

Select 3 answers
A.AWS Snowball
B.AWS Schema Conversion Tool (AWS SCT)
C.AWS Boto3
D.AWS Database Migration Service (DMS) with change data capture (CDC)
E.AWS Direct Connect
AnswersB, D, E

Correct. SCT helps convert the schema from SQL Server to the target (e.g., Amazon RDS).

Why this answer

AWS DMS with CDC enables ongoing replication. AWS SCT converts the schema if needed. Snowball is for offline data transfer which would cause downtime.

Direct Connect improves network stability. Boto3 is a Python SDK, not a migration service.

Full explanation →
477
MCQhard

A company is migrating a legacy application that requires static public IP addresses for licensing. The cloud provider assigns public IPs dynamically by default. Which solution should the administrator recommend while minimizing cost?

A.Use a NAT gateway with a static IP.
B.Assign elastic IP addresses (or static public IPs) to the instances.
C.Use static private IPs.
D.Use a VPN connection.
AnswerB

Elastic IPs are static public IPs that can be associated with instances at no cost while in use.

Why this answer

Elastic IP addresses (or static public IPs) provide persistent public IPv4 addresses that can be associated with instances, meeting the licensing requirement for static public IPs. This is the most cost-effective solution as it only incurs charges for allocated but unused Elastic IPs, whereas other options introduce additional infrastructure costs or fail to address the requirement.

Exam trap

The trap here is that candidates may choose a NAT gateway (Option A) thinking it provides a static public IP for the instance, but a NAT gateway only translates outbound traffic and does not assign a public IP to the instance for inbound licensing checks, while also incurring higher costs.

How to eliminate wrong answers

Option A is wrong because a NAT gateway with a static IP provides outbound internet access but does not assign a static public IP directly to the instance for inbound licensing validation; it also incurs hourly and data processing costs, increasing expenses unnecessarily. Option C is wrong because static private IPs are not publicly routable and cannot satisfy the licensing requirement for static public IP addresses. Option D is wrong because a VPN connection creates an encrypted tunnel to a remote network but does not provide a static public IP address for the instance; it adds complexity and cost without meeting the core requirement.

Full explanation →
478
MCQhard

A company is deploying a containerized microservices architecture on Azure Kubernetes Service (AKS). The security team requires that all container images are scanned for vulnerabilities before deployment. Which deployment approach should the DevOps team implement to ensure only approved images are used?

A.Store all images in a private registry without any scanning.
B.Use Docker Content Trust to sign images and verify signatures during deployment.
C.Enable Azure Container Registry tasks for automatic vulnerability scanning and enforce with Azure Policy.
D.Deploy an admission controller that checks image signatures only.
AnswerC

ACR tasks scan images and Azure Policy can deny non-compliant deployments.

Why this answer

Azure Container Registry (ACR) Tasks can automatically scan images for vulnerabilities using Microsoft Defender for Cloud, and Azure Policy can enforce that only images from approved registries or with passing scan results are deployed to AKS. This ensures that all container images are scanned before deployment and that only compliant images are used, meeting the security team's requirement.

Exam trap

The trap here is that candidates often confuse image signing (e.g., Docker Content Trust or Notary) with vulnerability scanning, assuming that signing alone ensures security, but signing only verifies image origin and integrity, not the presence of vulnerabilities.

How to eliminate wrong answers

Option A is wrong because storing images in a private registry without scanning does not enforce vulnerability scanning or approval, leaving the system exposed to known vulnerabilities. Option B is wrong because Docker Content Trust only signs images and verifies signatures during deployment, but it does not perform vulnerability scanning; it ensures image integrity and provenance, not security compliance. Option D is wrong because an admission controller that checks image signatures only verifies cryptographic signatures, not vulnerability scan results, so it does not ensure images are free of vulnerabilities.

Full explanation →
479
Multi-Selectmedium

A cloud security engineer is hardening a Kubernetes cluster. Which TWO measures should be implemented to improve container security? (Choose two.)

Select 2 answers
A.Implement runtime security monitoring
B.Store secrets in ConfigMaps
C.Disable audit logging to reduce overhead
D.Use default service accounts for all pods
E.Enable image scanning for vulnerabilities
AnswersA, E

Runtime security detects suspicious container behavior.

Why this answer

A is correct because runtime security monitoring (e.g., using Falco, Sysdig, or Aqua Security) detects and alerts on anomalous behavior within running containers, such as unexpected system calls, privilege escalations, or file system changes. This is a critical layer of defense that complements image scanning by catching threats that bypass static checks, such as zero-day exploits or compromised containers. Without runtime monitoring, malicious activity inside a container can go undetected until significant damage occurs.

Exam trap

A common misconception is that ConfigMaps are a secure place for secrets, but ConfigMaps lack encryption and access control features, making them unsuitable for sensitive data.

Full explanation →
480
MCQmedium

A company is deploying a global web application that serves static content (images, CSS, JavaScript) to users worldwide. They want to reduce latency and offload traffic from the origin servers. Which service should they implement?

A.Auto-scaling group
B.VPN connection
C.Load balancer
D.Content Delivery Network (CDN)
AnswerD

CDN caches content at edge locations, reducing latency.

Why this answer

A Content Delivery Network (CDN) caches static content at edge locations worldwide, reducing latency and offloading origin servers.

Full explanation →
481
MCQmedium

A security team discovers that a container image used in production contains a known vulnerability in one of its base image layers. Which action should be taken to remediate this issue?

A.Rebuild the container image using an updated base image
B.Delete the container and recreate it from the same image
C.Apply a security patch to the running container
D.Enable runtime security monitoring to detect exploitation attempts
AnswerA

Rebuilding with a patched base image resolves the vulnerability at the image level.

Why this answer

The vulnerability is in the base image, so rebuilding the image using an updated base image that includes the security fix is the correct remediation. Additionally, scanning images in a CI/CD pipeline can catch vulnerabilities before deployment.

Full explanation →
482
Multi-Selecthard

A cloud architect is designing a multi-tier application on a public cloud. The application must be highly available and fault-tolerant within a single region. Which three items should be included in the architecture? (Select THREE.)

Select 3 answers
A.Deploy resources in multiple availability zones
B.Place a load balancer in front of the web tier
C.Use a single instance in one availability zone
D.Use a single database instance without replication
E.Implement health checks for all instances
AnswersA, B, E

Availability zones are isolated within a region; using multiple provides fault isolation.

Why this answer

High availability within a region requires distributing resources across availability zones, using load balancers for traffic distribution, and implementing health checks for automatic failover.

Full explanation →
483
MCQhard

A company is migrating a legacy application to a Kubernetes cluster in the cloud. The application requires a database password to be accessible at runtime. Which approach aligns with cloud security best practices for secrets management?

A.Store the password as a Kubernetes Secret and mount it as a volume
B.Hardcode the password in the application code
C.Use a secrets management solution like HashiCorp Vault with a sidecar container to inject the password
D.Inject the password as an environment variable in the pod spec
AnswerC

Vault provides secure, audited access to secrets and integrates well with Kubernetes.

Why this answer

Storing secrets in a dedicated secrets manager like HashiCorp Vault or AWS Secrets Manager is recommended. Kubernetes Secrets should be avoided if possible, and secrets should never be hardcoded or stored in environment variables directly.

Full explanation →
484
MCQmedium

A company is running a stateless web application on a public cloud. They expect traffic to spike during certain hours. Which scaling strategy would be most cost-effective and efficient?

A.Using a larger instance type and scheduling scaling actions
B.Pre-provisioning double capacity permanently
C.Horizontal scaling using auto-scaling groups based on CPU utilization
D.Vertical scaling with manual adjustments before anticipated spikes
AnswerC

Auto-scaling adds or removes instances automatically based on demand, optimizing cost and performance.

Why this answer

Horizontal scaling (adding more instances) combined with auto-scaling based on metrics like CPU usage allows the application to handle spikes cost-effectively without over-provisioning.

Full explanation →
485
MCQeasy

Which of the following storage types is most suitable for hosting a shared file system that multiple virtual machines need to access concurrently using NFS?

A.Archive storage
B.File storage
C.Block storage
D.Object storage
AnswerB

Correct. File storage supports NFS for concurrent access.

Why this answer

File storage (e.g., EFS, Azure Files) provides a shared file system accessible via NFS or SMB.

Full explanation →
486
MCQmedium

A mid-sized company is migrating its on-premises applications to a public cloud. The security team has implemented a cloud access security broker (CASB) to monitor and enforce policies for sensitive data. The company uses a multi-cloud environment with both AWS and Azure. After deployment, the security team receives alerts that a developer accidentally exposed a set of credentials in a public GitHub repository. The credentials were associated with a service account that has read-write access to an AWS S3 bucket containing customer PII (personally identifiable information). The team immediately revokes the credentials and rotates the access keys. The security team wants to prevent such incidents in the future and ensure that any exposed credentials are promptly detected without relying solely on manual GitHub scans. The company also wants to maintain a least-privilege model for all cloud resources. Given this scenario, which of the following actions should the security team take FIRST to reduce the risk of credential exposure and improve detection?

A.Implement a periodic secret scanning tool that runs every 24 hours and reports any found credentials to the security team.
B.Configure the CASB to integrate with the GitHub API to continuously scan for exposed secrets and automatically trigger alerts.
C.Disable all public repositories and require all code to be stored in private repositories with strict branch protection rules.
D.Require all developers to use a password manager to store secrets and set up a process to manually review GitHub commits.
AnswerB

CASB can monitor SaaS applications like GitHub for policy violations, including exposed credentials, and provide real-time alerts.

Why this answer

A CASB is designed to integrate with cloud services like GitHub via APIs to provide continuous monitoring and policy enforcement. By configuring the CASB to scan GitHub repositories in real-time, the security team can detect exposed credentials immediately upon commit, rather than relying on periodic scans or manual reviews. This aligns with the requirement for prompt detection without manual intervention and leverages the existing CASB investment for multi-cloud environments.

Exam trap

CompTIA often tests the distinction between periodic and continuous detection mechanisms, where candidates may choose a periodic scanning tool (Option A) because it seems simpler, but the question explicitly requires prompt detection without relying solely on manual scans, making real-time CASB integration the correct first action.

How to eliminate wrong answers

Option A is wrong because a periodic secret scanning tool that runs every 24 hours introduces a detection delay, which contradicts the requirement for prompt detection of exposed credentials; real-time detection is needed to minimize the window of exposure. Option C is wrong because disabling all public repositories and requiring private repositories with branch protection rules reduces the attack surface but does not address the detection of already-exposed credentials or prevent accidental commits of secrets to private repositories; it also ignores the need for continuous monitoring. Option D is wrong because requiring developers to use a password manager and manually review commits is a procedural control that lacks automation and scalability, failing to meet the requirement for prompt detection without relying solely on manual scans.

Full explanation →
487
Multi-Selectmedium

A cloud engineer is designing a patching strategy for a fleet of Windows servers running in AWS. The engineer needs to automate patching, define a maintenance window, and have the ability to roll back patches if issues occur. Which two AWS services or features should be used to meet these requirements? (Choose TWO.)

Select 2 answers
A.AWS Systems Manager Patch Manager
B.AWS Backup
C.AWS Systems Manager Maintenance Windows
D.AWS CloudFormation
E.AWS Config
AnswersA, C

Patch Manager automates patching.

Why this answer

AWS Systems Manager Patch Manager provides automated patching, and maintenance windows define schedules. Rollback can be handled via creating snapshots before patching (not a service but a feature). The correct two are Patch Manager and Maintenance Windows.

Full explanation →
488
Multi-Selecteasy

Which TWO of the following are effective methods to protect data in transit within a cloud environment? Select two.

Select 2 answers
A.Object-level ACLs
B.Server-side encryption with AES-256
C.Data masking
D.VPN overlay networks
E.TLS/SSL encryption
AnswersD, E

VPNs encrypt traffic between endpoints or networks.

Why this answer

Options D and E are correct because VPN overlay networks and TLS/SSL encryption both protect data in transit by encrypting the communication channel. Option A (object-level ACLs) controls access to data but does not encrypt it in transit. Option B (server-side encryption with AES-256) protects data at rest.

Option C (data masking) obscures data but does not protect it during transmission.

Full explanation →
489
MCQhard

A company runs a stateless web application on AWS EC2 instances behind an Application Load Balancer. To reduce costs, they want to use the most cost-effective compute option that can handle variable traffic and be interrupted. Which pricing model should they use for the EC2 instances?

A.Dedicated hosts
B.Spot instances
C.Reserved instances
D.On-demand instances
AnswerB

Spot instances are cost-effective and suited for variable, interruption-tolerant workloads.

Why this answer

Spot instances offer significant cost savings but can be interrupted, making them suitable for stateless, fault-tolerant workloads that can handle interruptions.

Full explanation →
490
MCQmedium

A security team wants to implement host-based intrusion detection on their virtual machines in a public cloud. Which approach provides the most effective detection while minimizing performance impact?

A.Install an antivirus agent on each VM.
B.Enable network traffic logging at the hypervisor level.
C.Enable VPC flow logs and analyze them.
D.Use a cloud-native security service that deploys an agent to monitor system logs and file integrity.
AnswerD

These services are purpose-built for host-based intrusion detection and are optimized for cloud environments.

Why this answer

Cloud-native security services that deploy agents on each VM provide host-based intrusion detection by monitoring system logs and file integrity, which is the most effective method for host-level threats. Options A, B, and C are incorrect: A (antivirus) focuses on malware, not intrusion detection; B and C are network-based, not host-based, and may not capture host-level events.

Full explanation →
491
MCQeasy

A cloud administrator is automating the deployment of a web application on AWS. The administrator wants to define the infrastructure as code using a declarative language that supports drift detection. Which tool should the administrator use?

A.AWS CodeDeploy
B.Ansible
C.Terraform
D.CloudFormation
AnswerD

CloudFormation provides built-in drift detection to compare stack resources with template.

Why this answer

CloudFormation is a declarative AWS service for infrastructure as code that supports drift detection, which identifies changes made to resources outside of template management.

Full explanation →
492
MCQhard

A company uses GitHub Actions to build and deploy a microservices application. They want to automate the deployment to a Kubernetes cluster only when changes are pushed to the main branch. Which GitHub Actions event trigger should be used in the workflow?

A.on: workflow_dispatch:
B.on: push: branches: [ main ]
C.on: schedule: - cron: '0 0 * * *'
D.on: pull_request: branches: [ main ]
AnswerB

Correct. Runs workflow on push to main branch.

Why this answer

The 'push' event with branch filters triggers on pushes to main. 'pull_request' triggers on PR events; 'schedule' triggers on a cron; 'workflow_dispatch' triggers manually.

Full explanation →
493
MCQhard

A cloud architect manages a hybrid cloud environment where on-premises workloads are being migrated to a public cloud provider. The company uses a cloud-native container orchestration platform (e.g., Amazon EKS) for microservices. Recently, a critical application experienced intermittent connectivity failures between microservices during peak hours. The architect observes that the Kubernetes cluster uses a Calico network plugin with BGP peering to on-premises routers. The cluster nodes are spread across three Availability Zones, and the application pods communicate across zones. The architect also notes that the BGP session between the cluster and on-premises routers uses a single physical interface per node, and the on-premises routers have equal-cost multipath (ECMP) configured for the cluster node IPs. During peak hours, the on-premises routers experience high CPU utilization, and some BGP flaps occur. Which of the following is the MOST effective solution to improve connectivity reliability?

A.Reduce the number of ECMP paths on the on-premises routers to lower CPU utilization.
B.Increase the number of ECMP paths to improve traffic distribution.
C.Add a second physical interface on each cluster node and peer with multiple on-premises routers.
D.Replace BGP with static routes between the cluster and on-premises network.
AnswerC

This provides redundancy and reduces load per BGP session, minimizing flaps and improving reliability.

Why this answer

Adding a second physical interface per node enables redundant BGP peering with multiple on-premises routers, eliminating the single point of failure. This reduces BGP flap impact during peak hours by distributing control-plane load and providing failover paths, directly addressing the high CPU utilization and intermittent connectivity caused by ECMP instability.

Exam trap

The trap here is that candidates assume ECMP tuning (reducing or increasing paths) is the fix, but the root cause is the single physical interface creating a control-plane bottleneck and flap vulnerability, not the number of ECMP paths.

How to eliminate wrong answers

Option A is wrong because reducing ECMP paths would concentrate traffic onto fewer links, increasing per-path load and potentially worsening CPU utilization on the on-premises routers, not solving the BGP flap issue. Option B is wrong because increasing ECMP paths would add more next-hop entries to the routing table, further raising CPU utilization on the on-premises routers and exacerbating BGP flaps during peak hours. Option D is wrong because replacing BGP with static routes removes dynamic failover and route advertisement, making the hybrid environment brittle and unable to adapt to node or link failures, which would degrade connectivity reliability.

Full explanation →
494
MCQhard

An administrator deployed a new web application using an auto-scaling group. Users report that the application becomes slow after a few hours. The administrator examines the scaling policy and notices that the CPU utilization threshold is set to 80% for scale-out and 20% for scale-in. What is the most likely issue?

A.The scale-in threshold is too low, causing instances to be terminated prematurely
B.The load balancer is misconfigured
C.The application has a memory leak
D.The scale-out threshold is too high, causing delayed scaling
AnswerD

At 80% CPU, scaling out only occurs after significant load, delaying additional capacity.

Why this answer

A scale-out threshold of 80% means that new instances are only added when CPU utilization reaches 80%, which can cause delays in scaling out, leading to performance degradation as the application becomes slow over time. Option A is incorrect because a low scale-in threshold of 20% would cause premature termination of instances, not slowness. Option B is incorrect because load balancer misconfiguration would typically cause immediate failures or uneven traffic distribution, not gradual slowdown.

Option C is incorrect because a memory leak would cause degradation over time, but the specific symptom of slowness after a few hours combined with the scaling policy thresholds points to the scaling configuration as the primary issue.

Full explanation →
495
MCQmedium

A company wants to connect its on-premises data center to a public cloud provider with a dedicated, high-bandwidth, low-latency connection. The connection must be private and not traverse the internet. Which connectivity option should be used?

A.Site-to-Site VPN
B.Internet gateway
C.VPC peering
D.Direct Connect or ExpressRoute
AnswerD

These provide dedicated private connections with consistent performance.

Why this answer

Direct Connect (AWS) or ExpressRoute (Azure) provides a dedicated private connection from on-premises to the cloud. VPN uses the internet and has lower performance. Internet gateway is for internet access.

VPC peering connects VPCs within the cloud.

Full explanation →
496
MCQeasy

An organization is deploying a new application using Infrastructure as Code (IaC) with Terraform. The development team needs to ensure that the same configuration is applied consistently across development, staging, and production environments. What is the best practice for managing these Terraform configurations?

A.Hardcode environment-specific values within the main configuration file.
B.Manually update the configuration for each environment before deployment.
C.Use a single Terraform configuration with different variable files for each environment.
D.Maintain separate Terraform workspaces or directories for each environment.
AnswerD

Best practice for isolation and consistency.

Why this answer

Using separate Terraform workspaces or directories for each environment enforces isolation of state files and configuration, preventing accidental cross-environment changes. This approach aligns with Infrastructure as Code best practices by allowing environment-specific variables and resources while maintaining a single source of truth for the core configuration.

Exam trap

The trap here is that candidates confuse using variable files (Option C) with proper environment isolation, not realizing that Terraform workspaces or separate directories are required to manage distinct state files and prevent cross-environment interference.

How to eliminate wrong answers

Option A is wrong because hardcoding environment-specific values within the main configuration file violates the principle of configuration drift and makes the code non-reusable across environments. Option B is wrong because manually updating the configuration for each environment before deployment introduces human error and defeats the purpose of IaC automation. Option C is wrong because using a single Terraform configuration with different variable files for each environment still shares the same state file, risking state corruption and making it impossible to manage environments independently.

Full explanation →
497
MCQeasy

A company uses a multi-cloud strategy with workloads on AWS and Azure. An application running on an Amazon EC2 instance in a VPC uses an Azure SQL Database as its backend via a site-to-site VPN. Recently, users reported intermittent timeouts when accessing the application. The EC2 instance passes health checks, and the VPN tunnel status shows as 'UP' from both sides. The application logs show 'Cannot open server 'azuresql.database.windows.net' requested by the login. The login failed.' Which of the following is the MOST likely cause of the issue?

A.The EC2 instance has exhausted its CPU credits, causing the application to become unresponsive.
B.The Azure SQL Database firewall does not allow traffic from the EC2 instance's IP address or the VPN gateway's IP.
C.The VPN tunnel is not properly routing traffic to Azure, causing intermittent connectivity.
D.The EC2 instance does not have sufficient IAM permissions to connect to Azure SQL Database.
AnswerB

Azure SQL has a firewall that must explicitly permit the source IP. The error 'login failed' often indicates the IP is blocked. The admin should add the VPN gateway's public IP to the allowed list.

Why this answer

The error message 'Cannot open server 'azuresql.database.windows.net' requested by the login. The login failed.' indicates that the Azure SQL Database server rejected the connection attempt. Since the VPN tunnel is 'UP' and the EC2 instance passes health checks, the most likely cause is that the Azure SQL Database firewall rules do not include the source IP address of the traffic coming from the EC2 instance — either the EC2 instance's private IP (if traffic is routed through the VPN) or the public IP of the VPN gateway.

Azure SQL Database uses server-level firewall rules to allow client IP addresses, and without an explicit rule, all connections are blocked.

Exam trap

The trap here is that candidates see a VPN tunnel status of 'UP' and assume connectivity is fully functional, overlooking that Azure SQL Database has its own separate firewall layer that must explicitly permit the source IP address of the connecting client.

How to eliminate wrong answers

Option A is wrong because CPU credit exhaustion would cause performance degradation or throttling, not a specific login failure error from Azure SQL Database; the application logs clearly show a database authentication error, not a timeout or resource exhaustion. Option C is wrong because the VPN tunnel status is 'UP' from both sides, and the error is a login failure from the database server, not a routing or connectivity issue; if routing were broken, the application would likely see a network timeout or unreachable host error, not a specific SQL login failure. Option D is wrong because IAM permissions are an AWS construct used for AWS services (e.g., S3, DynamoDB) and have no bearing on authenticating to an Azure SQL Database; Azure SQL uses SQL authentication or Azure AD authentication, not AWS IAM.

Full explanation →
498
Multi-Selectmedium

A cloud administrator is troubleshooting a failed backup job that was supposed to back up a database to a cloud storage bucket. The job fails with an access denied error. Which two likely causes should the administrator investigate? (Choose two.)

Select 2 answers
A.The database is offline during backup
B.The IAM role assigned to the backup service lacks write permissions to the bucket
C.The backup schedule is misconfigured
D.The storage bucket has been deleted
E.The backup software version is incompatible
AnswersB, D

Insufficient permissions directly cause access denied errors.

Why this answer

Correct options are B and D. Option B is likely because the IAM role assigned to the backup service lacks write permissions to the bucket, resulting in an access denied error. Option D is likely because if the storage bucket has been deleted, the backup job cannot write to it, also producing an access denied error.

Option A is incorrect because an offline database would cause a connection error, not access denied. Option C is incorrect because a misconfigured backup schedule would prevent the job from running at the scheduled time, not cause an access denied error. Option E is incorrect because version incompatibility typically results in a software error, not an access denied error.

Full explanation →
499
Multi-Selectmedium

A cloud administrator is troubleshooting a connectivity issue between two VPCs in the same region. Which TWO actions should the administrator verify? (Choose two.)

Select 2 answers
A.VPC peering connection status
B.Route table entries
C.Security group rules
D.VPN tunnel configuration
E.Internet gateway attachment
AnswersA, B

The peering connection must be active.

Why this answer

The correct answers are A and B. The VPC peering connection must be in the 'active' state (A), and the route tables in both VPCs must have routes pointing to the peering connection (B). Security group rules (C) are not the primary check because security groups are stateful and allow return traffic by default; they can be configured to block traffic but are not the first thing to verify in this scenario.

VPN tunnel configuration (D) is a different connectivity method. Internet gateway attachment (E) is for internet access, not VPC peering.

Full explanation →
500
MCQeasy

A DevOps team is implementing a CI/CD pipeline to deploy a microservices application on Kubernetes. The team wants to ensure that the deployment automatically rolls back if the new version fails health checks after the update. Which Kubernetes feature should be configured in the deployment manifest?

A.A readiness probe with a low failure threshold
B.A startup probe with a long initial delay
C.A ConfigMap for health check endpoints
D.A liveness probe with a high failure threshold
AnswerA

Readiness probes control whether a pod is considered ready; failures can trigger rollback.

Why this answer

A readiness probe determines if a pod is ready to serve traffic. If it fails, the rolling update pauses or rolls back depending on the deployment strategy's progressDeadlineSeconds and revisionHistoryLimit.

Full explanation →
501
Multi-Selectmedium

A company is designing a disaster recovery solution with a recovery time objective (RTO) of 1 hour and a recovery point objective (RPO) of 15 minutes. Which TWO strategies would meet these requirements? (Select TWO.)

Select 2 answers
A.Active-active
B.Hot standby
C.Backup and restore
D.Warm standby
E.Cold standby
AnswersB, D

Hot standby has resources ready and can fail over within minutes, meeting RTO of 1 hour and RPO of 15 minutes.

Why this answer

Hot standby provides near-zero RTO and RPO, while warm standby can achieve RTO of 1 hour and RPO of 15 minutes if properly configured. Cold standby and backup/restore typically have longer RTO/RPO.

Full explanation →
502
MCQhard

A company is migrating a legacy monolithic application to a microservices architecture on the cloud. The application has tight coupling and shared database schemas. Which migration strategy should the company adopt to reduce risk and enable iterative migration?

A.Re-platform to a managed service and rewrite later
B.Use the strangler fig pattern to gradually replace components
C.Containerize the monolithic application and run it on a cluster
D.Lift and shift the entire application, then refactor in-place
AnswerB

Allows iterative migration with risk reduction.

Why this answer

The strangler fig pattern is the correct migration strategy because it allows the company to incrementally replace specific functionalities of the legacy monolithic application with new microservices, reducing risk by keeping the existing system operational during the transition. This approach directly addresses the tight coupling and shared database schema issues by enabling gradual decomposition without requiring a complete rewrite or a risky big-bang migration.

Exam trap

The trap here is that candidates often confuse the strangler fig pattern with containerization or lift-and-shift, mistakenly believing that simply moving the monolith to containers or a managed service constitutes a migration strategy, when in fact those approaches do not break the tight coupling or enable iterative decomposition.

How to eliminate wrong answers

Option A is wrong because re-platforming to a managed service and rewriting later does not address the tight coupling and shared database schema issues; it merely shifts the monolithic application to a different hosting environment without breaking dependencies, and the deferred rewrite introduces significant technical debt and risk. Option C is wrong because containerizing the monolithic application and running it on a cluster (e.g., Kubernetes) preserves the tight coupling and shared database schema, offering no architectural decomposition and failing to enable iterative migration to microservices. Option D is wrong because lift and shift followed by in-place refactoring is a high-risk, big-bang approach that attempts to refactor the entire monolith at once, which is prone to extended downtime and regression issues, and does not support the iterative, low-risk migration required.

Full explanation →
503
MCQeasy

A cloud engineer wants to receive real-time notifications when a CloudWatch Alarm enters the ALARM state. Which notification channel can be configured directly within the CloudWatch Alarm action?

A.PagerDuty
B.AWS Chatbot
C.Amazon Simple Notification Service (SNS)
D.Slack webhook
AnswerC

CloudWatch Alarms can directly notify an SNS topic.

Why this answer

CloudWatch Alarms can directly send notifications to an SNS topic, which can then deliver to email, SMS, etc.

Full explanation →
504
MCQeasy

Which cloud service model provides the customer with the most control over the operating system and software stack?

A.FaaS
B.SaaS
C.PaaS
D.IaaS
AnswerD

IaaS provides virtual machines, storage, and networking; the customer manages the OS and above.

Why this answer

IaaS provides virtualized computing resources where the customer manages the OS, middleware, and applications. PaaS abstracts the OS, SaaS provides complete applications, and FaaS abstracts the runtime entirely.

Full explanation →
505
MCQeasy

A cloud administrator wants to be notified immediately via email when a critical alert is triggered. Which notification channel should they configure?

A.Email
B.AWS Config
C.Amazon SNS
D.AWS CloudTrail
AnswerA

Email is a direct notification channel.

Why this answer

Email is a typical notification channel for alerts.

Full explanation →
506
MCQhard

A company is migrating a legacy application to a public cloud. The application requires a static IP address for licensing. The security team insists on encrypting all traffic between the application and the database. Which of the following should the cloud architect implement?

A.Create a VPN connection between the application and database subnets.
B.Assign a static public IP address and use NAT.
C.Use TLS certificates on the web server.
D.Deploy a site-to-site VPN from the cloud to the on-premises data center.
AnswerA

A VPN encrypts traffic between the two subnets, and a static IP can be assigned to the application.

Why this answer

Creating a VPN connection between the application and database subnets establishes an encrypted tunnel (using IPsec or TLS-based VPN protocols) that ensures all traffic between the two subnets is encrypted, meeting the security team's requirement. Additionally, the application's need for a static IP address can be satisfied by assigning a static private IP to the application instance within its subnet, while the VPN provides secure communication without exposing traffic to the public internet.

Exam trap

Candidates may mistakenly choose option B (Assign an elastic IP and use NAT) thinking it provides encryption, but NAT does not encrypt traffic. Option C (TLS certificates on the web server) protects only web traffic, not internal database connections. Option D (site-to-site VPN) is for connecting on-premises to cloud, not for internal cloud subnet-to-subnet encryption.

In CompTIA Cloud+, the correct approach is to use a VPN connection between subnets within the same cloud provider to encrypt all traffic between the application and database.

How to eliminate wrong answers

Option B is wrong because assigning an elastic IP and using NAT only provides a static public IP address for outbound internet access and does not encrypt traffic between the application and database; NAT translates IP addresses but does not provide encryption. Option C is wrong because TLS certificates on the web server only encrypt traffic between clients and the web server (typically HTTPS), not the internal traffic between the application and the database, which is a different communication path. Option D is wrong because a site-to-site VPN connects the cloud VPC to an on-premises data center, but the question specifies that the application and database are both in the public cloud, so this would not encrypt traffic between them within the same cloud environment.

Full explanation →
507
MCQmedium

A company's disaster recovery plan requires them to restore a database to a specific point in time. Which backup strategy should they use?

A.Continuous replication for DR
B.Cross-region replication
C.Full daily backup
D.Snapshot-based backup
AnswerA

Continuous replication allows recovery to any point in time.

Why this answer

Continuous replication enables point-in-time recovery by maintaining ongoing changes.

Full explanation →
508
MCQeasy

A cloud administrator needs to view the console output of a VM that failed to boot. Which feature should they use to access the boot logs?

A.CloudWatch Logs agent
B.Console output / serial console
C.VM screenshot
D.System log from the hypervisor
AnswerB

Console output provides the boot log from the virtual machine.

Why this answer

Cloud providers offer console output or serial console access to view boot logs. Screenshots are also available but console output is the direct log. CloudWatch Logs might capture logs if the OS sends them, but for boot issues, console output is the native method.

Full explanation →
509
Multi-Selecthard

Which THREE are common causes of network latency in a cloud environment? (Choose three.)

Select 3 answers
A.Firewall rule misconfiguration
B.DNS resolution delays
C.Jumbo frame misconfiguration
D.High bandwidth utilization
E.Packet loss
AnswersA, C, E

Misconfigured firewall rules can cause dropped packets or added inspection delay.

Why this answer

Firewall rule misconfiguration (A) is a common cause of network latency in a cloud environment because overly restrictive or incorrectly ordered rules can force traffic to be inspected multiple times or dropped and retransmitted. For example, a misconfigured stateful firewall may require packets to traverse multiple security groups or network ACLs, adding processing delay per packet. This is especially impactful in virtualized environments where firewall processing is offloaded to the hypervisor or a virtual appliance, introducing micro-latency.

Exam trap

The trap in the CompTIA Cloud+ exam is that candidates often confuse 'high bandwidth utilization' with 'network congestion,' but the exam tests that latency is caused by queuing delay from saturation, not utilization alone, and that DNS delays are a pre-connection issue, not a latency factor during data transfer.

Full explanation →
510
MCQhard

A cloud operations team is investigating why a batch processing job that runs nightly in a cloud environment has been failing intermittently. The job processes data from an external API and writes results to a database. The error logs show "Connection timed out" when calling the external API. However, manual calls from the same cloud environment succeed. What is the most likely cause?

A.The external API rate limit has been exceeded.
B.The database connection pool is exhausted.
C.The batch job's service account has been disabled.
D.The cloud firewall is blocking outbound traffic during the batch window.
AnswerA

Correct. Rate limiting causes intermittent timeouts when batch calls exceed the allowed threshold, while manual calls succeed.

Why this answer

Intermittent timeouts during batch execution suggest the external API is rate-limiting the high volume of automated calls, while manual calls succeed because they are infrequent.

Full explanation →
511
MCQeasy

A cloud administrator needs to design a storage solution that provides block-level access for a database server and must be highly durable. Which storage type should be used?

A.File storage
B.Block storage
C.Archive storage
D.Object storage
AnswerB

Block storage provides raw volumes that databases can use and is durable.

Why this answer

Block storage is the correct choice because it provides raw, low-latency block-level access that database servers require for high-performance read/write operations. It also supports features like RAID, snapshots, and replication to achieve high durability, making it ideal for transactional databases.

Exam trap

CompTIA often tests the misconception that object storage can serve as a high-performance block store, but candidates must remember that object storage lacks the low-latency, block-level access and filesystem semantics required for transactional databases.

How to eliminate wrong answers

Option A is wrong because file storage uses a hierarchical file system with network protocols like NFS or SMB, which introduces overhead and is not optimized for the low-latency, block-level I/O patterns of a database server. Option C is wrong because archive storage is designed for long-term retention of infrequently accessed data, with high latency and no block-level access, making it unsuitable for active database workloads. Option D is wrong because object storage uses a flat namespace with HTTP-based APIs (e.g., S3) and is optimized for unstructured data, not for the block-level, random read/write operations required by databases.

Full explanation →
512
MCQhard

A company is migrating its on-premises application to a public cloud. The application requires low-latency access to a legacy database that cannot be moved to the cloud. The cloud deployment must use a hybrid architecture. Which network connectivity solution should the cloud architect recommend to minimize latency and provide secure, reliable communication?

A.Use a dedicated private connection via a cloud provider's direct connect service.
B.Route traffic through the public internet with encryption.
C.Deploy a CloudFront distribution to cache database queries.
D.Establish a site-to-site VPN over the internet.
AnswerA

Dedicated connections offer consistent performance and security.

Why this answer

A dedicated private connection via a cloud provider's direct connect service (e.g., AWS Direct Connect, Azure ExpressRoute, or Google Cloud Interconnect) establishes a private, physical link between the on-premises data center and the cloud VPC. This bypasses the public internet entirely, providing consistent low-latency performance, higher bandwidth, and a more reliable connection for hybrid architectures where the legacy database remains on-premises.

Exam trap

CompTIA often tests the misconception that a site-to-site VPN is sufficient for low-latency hybrid connectivity, but the trap here is that VPNs over the internet cannot guarantee consistent latency or bandwidth, whereas a dedicated private connection provides a Service Level Agreement (SLA) for performance and reliability.

How to eliminate wrong answers

Option B is wrong because routing traffic through the public internet with encryption (e.g., HTTPS or IPsec) introduces variable latency, potential packet loss, and security risks from exposure to internet-based threats, making it unsuitable for low-latency requirements. Option C is wrong because CloudFront (or any CDN) is a content delivery service for caching static or dynamic web content at edge locations; it cannot cache database queries or provide a network path to an on-premises database, and it adds unnecessary complexity without addressing the hybrid connectivity need. Option D is wrong because a site-to-site VPN over the internet, while encrypted and secure, relies on the public internet's best-effort routing, which introduces jitter and higher latency compared to a dedicated private connection, failing the low-latency requirement.

Full explanation →
513
Multi-Selecthard

A company is migrating its on-premises application to a public cloud. The application consists of a web server, an application server, and a database. They want to minimize management overhead while ensuring the application can scale automatically. Which THREE cloud service models should they consider for each component to achieve this goal? (Select THREE.)

Select 3 answers
A.SaaS for database
B.PaaS for database
C.IaaS for web server
D.PaaS for application server
E.PaaS for web server
AnswersB, D, E

Managed database services like RDS offer auto-scaling and reduced management.

Why this answer

For web server: PaaS (e.g., AWS Elastic Beanstalk) can manage the runtime and scaling. For application server: PaaS also works. For database: PaaS (e.g., Amazon RDS) provides managed database with auto-scaling.

IaaS would require more management of OS and scaling. SaaS is complete application, not appropriate for custom components. FaaS could be used but is more granular.

Full explanation →
514
MCQmedium

A company is designing a disaster recovery (DR) plan for a critical application hosted in a public cloud. The application requires a recovery time objective (RTO) of 1 hour and a recovery point objective (RPO) of 15 minutes. Which of the following DR strategies BEST meets these requirements?

A.Backup and restore with daily backups.
B.Cold standby with nightly backups.
C.Pilot light with hourly snapshots.
D.Warm standby with continuous data replication.
AnswerD

Warm standby with continuous replication meets both RTO and RPO targets.

Why this answer

Warm standby with continuous data replication meets the RTO of 1 hour and RPO of 15 minutes because it maintains a partially scaled-down replica of the production environment that can be quickly scaled up, and continuous replication (e.g., using asynchronous replication or Change Block Tracking) ensures data loss is limited to seconds or minutes, well within the 15-minute RPO.

Exam trap

CompTIA often tests the distinction between 'pilot light' and 'warm standby' — the trap here is that candidates confuse hourly snapshots (pilot light) with continuous replication, failing to recognize that hourly snapshots cannot achieve a 15-minute RPO.

How to eliminate wrong answers

Option A is wrong because daily backups provide an RPO of up to 24 hours, far exceeding the required 15 minutes, and the restore process would take much longer than 1 hour, failing the RTO. Option B is wrong because cold standby involves no pre-provisioned resources, requiring manual provisioning and configuration that typically takes hours, exceeding the 1-hour RTO, and nightly backups provide an RPO of up to 24 hours. Option C is wrong because pilot light with hourly snapshots provides an RPO of up to 1 hour, which exceeds the 15-minute requirement, and the snapshots are not continuous, so data loss could be significant.

Full explanation →
515
Drag & Dropmedium

Arrange the steps to configure a VPN connection between an on-premises network and a cloud VPC.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Start with cloud-side gateway, on-premises gateway representation, configure on-prem device, create connection, then routing.

Full explanation →
516
MCQeasy

A cloud user is unable to connect to a web server VM from the internet after a security group rule was modified. The VM is running and can be pinged from other VMs in the same subnet. What is the most likely cause?

A.The VM's local firewall is blocking the traffic.
B.The VM's routing table is missing a default gateway.
C.The inbound rule for HTTP/HTTPS was removed or misconfigured.
D.The VM's DNS settings are incorrect.
AnswerC

Security groups control inbound traffic; missing rule blocks internet access.

Why this answer

Modifying a security group rule likely removed or misconfigured the inbound HTTP/HTTPS rule, blocking internet traffic to the web server. The VM is accessible from other VMs in the same subnet (via private IP), indicating the OS and local services are running, but internet connectivity is controlled by the security group. Option A (local firewall) is unlikely because internal ping works.

Option B (missing default gateway) would affect all outbound and inbound traffic. Option D (DNS) affects name resolution, not direct IP connectivity.

Full explanation →
517
MCQhard

An e-commerce company is deploying a disaster recovery solution across two cloud regions. The primary region runs the production workload. The recovery region should have a fully provisioned environment that can take over immediately in case of a failure. Which deployment strategy BEST meets this requirement while minimizing costs?

A.Backup and restore to the recovery region upon failure
B.Multi-site active-active with load balancers
C.Pilot light with minimal resources running in recovery
D.Warm standby in the recovery region
AnswerD

Warm standby has a fully provisioned but potentially smaller environment that can be scaled up quickly for failover.

Why this answer

Warm standby is the correct strategy because it maintains a fully provisioned, scaled-down copy of the production environment in the recovery region that can be activated immediately upon failover. This meets the requirement for immediate takeover while minimizing costs by running only the essential resources (e.g., a minimal number of compute instances, a standby database) instead of a full active-active deployment.

Exam trap

The trap here is confusing 'pilot light' with 'warm standby'—pilot light has minimal core services running but requires manual scaling and provisioning of the full stack, whereas warm standby has a fully provisioned (though scaled-down) environment ready to take over instantly.

How to eliminate wrong answers

Option A is wrong because backup and restore requires time to provision and boot resources from backups, which cannot achieve immediate takeover. Option B is wrong because multi-site active-active runs full production capacity in both regions simultaneously, which maximizes costs and is not minimal. Option C is wrong because pilot light runs only core services (e.g., database replicas) and requires manual provisioning of the full application stack upon failover, delaying recovery.

Full explanation →
518
MCQeasy

A company wants to centralize logs from multiple AWS services and analyze them using SQL-like queries. Which service should they use?

A.AWS CloudTrail
B.Amazon S3
C.Amazon CloudWatch Logs Insights
D.AWS Config
AnswerC

CloudWatch Logs Insights enables interactive querying of log data using a purpose-built query language.

Why this answer

Amazon CloudWatch Logs Insights allows querying log data using a SQL-like query language. CloudWatch Logs is the centralized log management service in AWS.

Full explanation →
519
MCQmedium

A cloud administrator is designing network security for a three-tier application. The web tier must be accessible from the internet, but the application and database tiers should only be reachable from the web tier. Which security group configuration should be used?

A.Use separate security groups: web allows HTTP/HTTPS from 0.0.0.0/0; app allows traffic from web security group; db allows traffic from app security group
B.Assign the same security group to all tiers and use a single inbound rule
C.Place all tiers in the same subnet and use a network ACL to permit all traffic
D.Configure a network ACL for each subnet with allow rules for the required traffic
AnswerA

Security groups can reference other security groups as sources, providing fine-grained control.

Why this answer

It uses separate security groups for each tier, implementing the principle of least privilege. The web tier security group allows HTTP/HTTPS from 0.0.0.0/0 for internet access, while the app tier security group references the web tier security group as its source, ensuring only traffic from the web tier can reach the application tier. Similarly, the database tier security group references the app tier security group, restricting access exclusively to the application tier.

This configuration enforces strict east-west traffic control and prevents direct internet access to the internal tiers.

Exam trap

A common trap is confusing the functionality of stateful security groups with stateless network ACLs. Candidates may choose network ACLs (Option D) thinking they provide similar control, not realizing that security groups support logical references to other security groups, which is essential for dynamic tier-to-tier access in a three-tier architecture.

How to eliminate wrong answers

Option B is wrong because assigning the same security group to all tiers with a single inbound rule would allow all tiers to communicate with each other without restriction, violating the principle of least privilege and potentially exposing the database tier to the web tier or the internet. Option C is wrong because placing all tiers in the same subnet and using a network ACL to permit all traffic eliminates subnet-level segmentation, allowing any instance in the subnet to reach any other instance, and network ACLs are stateless, requiring explicit return rules, which adds complexity and risk. Option D is wrong because while network ACLs can provide subnet-level filtering, they are stateless and do not support security group references as sources; they require manual IP address management and cannot dynamically reference the web tier's security group, making them less precise and harder to maintain for tier-to-tier access control.

Full explanation →
520
MCQmedium

A financial services company is deploying a PCI-DSS compliant workload in a public cloud. The deployment must include a web application (port 443) and a database (port 3306). The security requirements mandate that the web application is internet-facing, but the database must be in a private subnet with no direct internet access. The cloud administrator creates two VPCs: one for the web tier and one for the database tier. The web tier is deployed in VPC-A with a public subnet and an internet gateway. The database tier is deployed in VPC-B with a private subnet and a NAT gateway for outbound updates. The administrator configures VPC peering between VPC-A and VPC-B, and updates route tables accordingly. The web application can connect to the database, but the database cannot initiate outbound connections to the internet for updates. What is the most likely issue?

A.The database security group does not allow outbound traffic to the internet
B.The route table in VPC-B does not have a default route to the NAT gateway
C.The VPC peering connection does not support DNS resolution between VPCs
D.The NAT gateway in VPC-B cannot be used for internet access through a VPC peering connection
AnswerD

NAT gateways do not support traffic through VPC peering; each VPC needs its own NAT gateway.

Why this answer

The NAT gateway in VPC-B cannot be used for internet access through a VPC peering connection because VPC peering does not support transitive routing. When the database in VPC-B tries to reach the internet via the NAT gateway, traffic must go through the VPC peering connection to VPC-A and then to the internet gateway, but VPC peering does not allow a route that forwards traffic from one VPC to another VPC's internet gateway. The database's outbound traffic to the internet is effectively blocked because the NAT gateway's default route (0.0.0.0/0) points to the internet gateway in VPC-B, but the database's traffic must first traverse the peering connection, which is not a valid path for internet-bound traffic in this architecture.

Exam trap

The trap here is that candidates assume a NAT gateway in the same VPC as the database can provide internet access through a VPC peering connection, but they overlook the non-transitive nature of VPC peering, which prevents routing traffic from a peered VPC to an internet gateway or NAT gateway in the other VPC.

How to eliminate wrong answers

Option A is wrong because the database security group's outbound rules are not the issue; security groups are stateful, so if the database initiates outbound traffic, the return traffic is automatically allowed, but the problem is that the database cannot reach the internet at all due to routing limitations. Option B is wrong because the route table in VPC-B likely does have a default route to the NAT gateway (as stated in the scenario), but even with that route, the database cannot use the NAT gateway for internet access because the NAT gateway resides in VPC-B and cannot route traffic through a VPC peering connection to another VPC's internet gateway. Option C is wrong because DNS resolution between VPCs is not relevant to the database's inability to initiate outbound internet connections; the issue is about network routing and internet access, not DNS.

Full explanation →
521
MCQeasy

A cloud administrator needs to ensure that log data is retained for one year to meet compliance requirements. Which action should be taken for the log group in CloudWatch Logs?

A.Set the log group's retention policy to 365 days
B.Create a CloudWatch Events rule to delete logs after one year
C.Increase the log group's data durability by enabling encryption
D.Export logs to Amazon S3 and delete the log group
AnswerA

This automatically deletes logs older than 365 days, meeting compliance.

Why this answer

CloudWatch Logs allows setting a retention policy on log groups to automatically expire log events after a specified number of days. Setting it to 365 days meets the one-year requirement.

Full explanation →
522
Multi-Selectmedium

A company is experiencing intermittent connectivity issues between its on-premises data center and a public cloud environment over a VPN connection. Which TWO of the following should the administrator check to troubleshoot the problem?

Select 2 answers
A.Verify that the internet bandwidth is sufficient.
B.Validate the route tables on both sides of the VPN.
C.Ensure the cloud storage performance is adequate.
D.Check the DNS resolution of cloud endpoints.
E.Review the VPN logs and monitor packet loss.
AnswersB, E

Incorrect routes can cause traffic to be dropped or misrouted.

Why this answer

Route tables control the path that traffic takes between networks. If the route tables on either the on-premises VPN device or the cloud virtual network gateway do not have the correct entries (e.g., missing routes for the remote subnet or incorrect next-hop IPs), traffic can be dropped or misdirected, causing intermittent connectivity. Validating these routes ensures that packets destined for the cloud or on-premises are properly forwarded over the VPN tunnel.

Exam trap

CompTIA often tests the misconception that intermittent VPN issues are always bandwidth-related, but the real culprit is usually routing misconfiguration or tunnel instability, which is why route validation and log/packet-loss analysis are the correct pair.

Full explanation →
523
MCQeasy

Which of the following is a characteristic of serverless computing (FaaS)?

A.You pay for allocated resources regardless of usage
B.You are charged per execution or compute time
C.You must manage the underlying servers
D.You have to provision capacity in advance
AnswerB

Pay-per-execution is a key serverless feature.

Why this answer

FaaS executes code in response to events and charges only for the compute time consumed.

Full explanation →
524
MCQeasy

A company is migrating to the cloud and needs to transfer 200 TB of data from an on-premises data center to GCP. The network bandwidth is limited, so they want to use a physical appliance for offline transfer. Which GCP service should they use?

A.Azure Data Box
B.Transfer Appliance
C.AWS DataSync
D.Storage Transfer Service
AnswerB

Google's offline physical appliance for large data transfers.

Why this answer

Storage Transfer Service is for online transfers; Transfer Appliance is Google's offline physical device; DataSync is AWS; Azure Data Box is Microsoft's offline device.

Full explanation →
525
MCQeasy

A cloud administrator notices that a virtual machine is unresponsive. The VM is running on a hypervisor host that shows high CPU utilization. What should the administrator do first?

A.Reboot the hypervisor host
B.Increase the VM's vCPU count
C.Migrate the VM to another host
D.Check the VM console for OS-level issues
AnswerD

Checking the console allows direct assessment of the VM's OS state, such as a hung process or login prompt.

Why this answer

The first step in troubleshooting an unresponsive VM is to check the VM console for OS-level issues. This allows the administrator to see if the OS is hung, has a kernel panic, or is waiting for input. Option A is wrong because rebooting the hypervisor host would affect all VMs and is a drastic measure that should only be taken after other diagnostics.

Option B is wrong because increasing the VM's vCPU count does not address the root cause of unresponsiveness and could worsen resource contention on an already overloaded host. Option C is wrong because migrating the VM to another host is premature without first determining if the issue is OS-related; also, migration might not be possible if the VM is completely unresponsive.

Full explanation →
Page 6

Page 7 of 14

Page 8

All pages

1234567891011121314

Practice CV0-004 by domain

Target a specific domain to shore up weak areas.

Cloud Architecture and DesignDeploymentSecurityOperations and SupportTroubleshooting
See all domains with question counts →