Scenario practice questions

A cloud administrator is troubleshooting a connectivity issue between two VPCs in the same region. Which TWO actions should the administrator verify? (Choose two.)

Trap 1: Security group rules

Security groups are not the first step; they filter traffic but peering connectivity is lower-level.

Trap 2: VPN tunnel configuration

VPN tunnel is for different connectivity, not VPC peering.

Trap 3: Internet gateway attachment

Internet gateway is unrelated to VPC peering.

A
VPC peering connection status
The peering connection must be active.
B
Route table entries
Route tables must have routes to the peered VPC CIDR.
C
Security group rules
Why wrong: Security groups are not the first step; they filter traffic but peering connectivity is lower-level.
D
VPN tunnel configuration
Why wrong: VPN tunnel is for different connectivity, not VPC peering.
E
Internet gateway attachment
Why wrong: Internet gateway is unrelated to VPC peering.

Question 2hardmultiple choice

A company running a critical web application wants to protect against SQL injection and cross-site scripting attacks. The application is behind a load balancer. Which type of service should be deployed to provide this protection?

Trap 1: Network firewall

A network firewall filters traffic based on IP addresses and ports but does not inspect application-layer payloads for SQL injection or XSS.

Trap 2: DDoS protection service

A DDoS protection service mitigates volumetric attacks but does not provide application-layer filtering for web exploits.

Trap 3: Intrusion detection system

An intrusion detection system monitors for suspicious activity but may not have the granularity or rule sets specifically for web application attacks.

A
Network firewall
Why wrong: A network firewall filters traffic based on IP addresses and ports but does not inspect application-layer payloads for SQL injection or XSS.
B
DDoS protection service
Why wrong: A DDoS protection service mitigates volumetric attacks but does not provide application-layer filtering for web exploits.
C
Intrusion detection system
Why wrong: An intrusion detection system monitors for suspicious activity but may not have the granularity or rule sets specifically for web application attacks.
D
Web application firewall (WAF)
A web application firewall (WAF) inspects HTTP/HTTPS traffic and can block SQL injection and XSS attacks, making it the correct choice.

Question 3mediummultiple choice

A DevOps team uses Jenkins for CI/CD. They want to automatically deploy containerized applications to a Kubernetes cluster. Which Jenkins feature or plugin can integrate with Kubernetes to manage deployments?

Trap 1: Jenkins Declarative Pipeline

Declarative Pipeline is a syntax for pipeline definitions, not a Kubernetes integration tool.

Trap 2: Jenkins Blue Ocean

Blue Ocean is a UI for Jenkins pipelines, not a Kubernetes integration tool.

Trap 3: Jenkins Multibranch Pipeline

Multibranch Pipeline automatically creates pipelines for branches but does not directly integrate with Kubernetes.

A
Jenkins Declarative Pipeline
Why wrong: Declarative Pipeline is a syntax for pipeline definitions, not a Kubernetes integration tool.
B
Jenkins Blue Ocean
Why wrong: Blue Ocean is a UI for Jenkins pipelines, not a Kubernetes integration tool.
C
Jenkins Multibranch Pipeline
Why wrong: Multibranch Pipeline automatically creates pipelines for branches but does not directly integrate with Kubernetes.
D
Kubernetes plugin
The Kubernetes plugin enables Jenkins to dynamically create agents in Kubernetes and deploy workloads.

Question 4mediummultiple choice

A DevOps team uses CloudFormation to manage multi-account infrastructure. They need to deploy a common set of resources across multiple AWS accounts in an organization. Which CloudFormation feature should they use?

Trap 1: Nested stacks

Nested stacks organize templates within a stack, but not across accounts.

Trap 2: Drift detection

Drift detection identifies differences, not deployment across accounts.

Trap 3: Change sets

Change sets preview changes before execution, not for multi-account.

A
Nested stacks
Why wrong: Nested stacks organize templates within a stack, but not across accounts.
B
Drift detection
Why wrong: Drift detection identifies differences, not deployment across accounts.
C
Stack sets
StackSets enable cross-account, cross-region deployments.
D
Change sets
Why wrong: Change sets preview changes before execution, not for multi-account.

Question 5hardmultiple choice

A company uses AWS and wants to verify that its disaster recovery plan meets the defined RTO and RPO objectives. Which type of testing should be performed to simulate a real failover scenario without impacting production?

Trap 1: Tabletop exercise

Tabletop exercises are discussion-based, not a real failover test.

Trap 2: Chaos engineering

Chaos engineering tests system resilience but not specifically DR plan RTO/RPO.

Trap 3: Partial failover test

Partial tests may not fully validate RTO/RPO for the entire system.

A
Tabletop exercise
Why wrong: Tabletop exercises are discussion-based, not a real failover test.
B
Chaos engineering
Why wrong: Chaos engineering tests system resilience but not specifically DR plan RTO/RPO.
C
Full-scale DR drill
Full-scale DR drill involves executing the failover plan to validate RTO/RPO without impacting production (using a sandbox or isolated environment).
D
Partial failover test
Why wrong: Partial tests may not fully validate RTO/RPO for the entire system.

Question 6hardmultiple choice

During a security audit, it is discovered that a cloud application can be accessed using a shared service account that has elevated privileges. The audit recommends implementing a just-in-time (JIT) access model. What is the primary benefit of JIT access in this scenario?

Trap 1: Automates auditing of third-party access.

Auditing is a separate concern; JIT can record but its primary benefit is reducing standing privileges.

Trap 2: Allows for easier management of user identities.

Identity management is broader; JIT is specifically about privilege timing.

Trap 3: Eliminates the need for user authentication.

JIT still requires authentication; it just limits the duration of elevated privileges.

A
Automates auditing of third-party access.
Why wrong: Auditing is a separate concern; JIT can record but its primary benefit is reducing standing privileges.
B
Allows for easier management of user identities.
Why wrong: Identity management is broader; JIT is specifically about privilege timing.
C
Reduces the attack surface by minimizing persistent privileged access.
JIT ensures that elevated permissions are granted only for specific times and tasks, so compromised credentials have limited window of opportunity.
D
Eliminates the need for user authentication.
Why wrong: JIT still requires authentication; it just limits the duration of elevated privileges.

Question 7mediummultiple choice

A mid-sized company is migrating its on-premises applications to a public cloud. The security team has implemented a cloud access security broker (CASB) to monitor and enforce policies for sensitive data. The company uses a multi-cloud environment with both AWS and Azure. After deployment, the security team receives alerts that a developer accidentally exposed a set of credentials in a public GitHub repository. The credentials were associated with a service account that has read-write access to an AWS S3 bucket containing customer PII (personally identifiable information). The team immediately revokes the credentials and rotates the access keys. The security team wants to prevent such incidents in the future and ensure that any exposed credentials are promptly detected without relying solely on manual GitHub scans. The company also wants to maintain a least-privilege model for all cloud resources. Given this scenario, which of the following actions should the security team take FIRST to reduce the risk of credential exposure and improve detection?

Trap 1: Implement a periodic secret scanning tool that runs every 24 hours…

Periodic scanning introduces a delay; continuous monitoring via CASB is more effective for immediate detection.

Trap 2: Disable all public repositories and require all code to be stored…

This prevents future public exposure but does not detect existing leaks or cover all scenarios.

Trap 3: Require all developers to use a password manager to store secrets…

This relies on user compliance and manual review, which is error-prone and not automated.

A
Implement a periodic secret scanning tool that runs every 24 hours and reports any found credentials to the security team.
Why wrong: Periodic scanning introduces a delay; continuous monitoring via CASB is more effective for immediate detection.
B
Configure the CASB to integrate with the GitHub API to continuously scan for exposed secrets and automatically trigger alerts.
CASB can monitor SaaS applications like GitHub for policy violations, including exposed credentials, and provide real-time alerts.
C
Disable all public repositories and require all code to be stored in private repositories with strict branch protection rules.
Why wrong: This prevents future public exposure but does not detect existing leaks or cover all scenarios.
D
Require all developers to use a password manager to store secrets and set up a process to manually review GitHub commits.
Why wrong: This relies on user compliance and manual review, which is error-prone and not automated.

Read the full Ansible explanation →

Question 8mediummultiple choice

A cloud engineer is writing an Ansible playbook to provision virtual machines in Azure. The playbook includes a task that uses the 'azure_rm_virtualmachine' module. Which of the following best describes Ansible's architecture in this scenario?

Trap 1: Ansible uses agents installed on target VMs to execute modules.

Ansible is agentless; it does not require agents on targets.

Trap 2: Ansible is a managed service in Azure that runs playbooks…

Ansible is not a managed service; it can be run from a control node.

Trap 3: Ansible requires Python to be installed only on the control node.

Python is also needed on target machines for module execution.

A
Ansible uses agents installed on target VMs to execute modules.
Why wrong: Ansible is agentless; it does not require agents on targets.
B
Ansible is a managed service in Azure that runs playbooks automatically.
Why wrong: Ansible is not a managed service; it can be run from a control node.
C
Ansible requires Python to be installed only on the control node.
Why wrong: Python is also needed on target machines for module execution.
D
Ansible is agentless and uses SSH or WinRM to connect to target machines.
Correct. Ansible connects to targets without installing agents.

Question 9easymultiple choice

A cloud administrator needs to monitor CPU utilization of a group of virtual machines and automatically add more instances when utilization exceeds 80% for 5 minutes. Which cloud service should the administrator use to define this scaling policy?

Trap 1: Configuration management service

Config evaluates resource configurations, not scaling.

Trap 2: Audit logging service

CloudTrail is for auditing API calls, not for scaling.

Trap 3: Systems management service

Systems Manager is for patching and configuration, not scaling.

A
Configuration management service
Why wrong: Config evaluates resource configurations, not scaling.
B
Audit logging service
Why wrong: CloudTrail is for auditing API calls, not for scaling.
C
Auto scaling service
Auto Scaling manages scaling policies including step scaling.
D
Systems management service
Why wrong: Systems Manager is for patching and configuration, not scaling.

Question 10hardmultiple choice

A security analyst is investigating a potential data exfiltration from a cloud environment. The analyst finds that an instance IAM role was assumed by a compromised user, and the role has permissions to read from a sensitive database. What is the BEST way to prevent this type of attack in the future?

Trap 1: Add a resource-based policy to the database to deny access from the…

This would block the role entirely, not just compromised users.

Trap 2: Rotate the IAM role's access keys every 30 days.

Key rotation reduces exposure window but does not prevent a compromised user from assuming the role.

Trap 3: Remove the IAM role and use a service account instead.

Service accounts are less secure than roles with MFA policies.

A
Enforce MFA for all users and require MFA when assuming the role.
MFA adds a second factor, making it much harder for attackers to use stolen credentials.
B
Add a resource-based policy to the database to deny access from the role.
Why wrong: This would block the role entirely, not just compromised users.
C
Rotate the IAM role's access keys every 30 days.
Why wrong: Key rotation reduces exposure window but does not prevent a compromised user from assuming the role.
D
Remove the IAM role and use a service account instead.
Why wrong: Service accounts are less secure than roles with MFA policies.