CCNA Cloud Concepts Questions

Cross-region replication copies objects to geographically separate facilities, satisfying the facility-loss requirement, while checksum-based validation such as content-MD5 or provider-side integrity hashing detects bit rot and silent corruption over time. Both are provider-managed and require no application modification, matching every stated constraint for the archived video masters.

Replicating data across two providers requires reconciling differing consistency models, APIs and replication semantics, so writes may conflict or lag. This satisfies the stem's continuity goal by naming the hardest problem: keeping both providers' copies synchronised and interoperable during failover.

Object Lock enforces write-once-read-many (WORM) protection at the object level, preventing deletion or modification for a defined retention period. This directly satisfies the immutability and retention constraint for audit logs, unlike versioning or soft delete, which permit removal.

Instance size determines the hourly rate charged for compute or database capacity, so larger resource types raise the baseline cost. It is a primary input when estimating spend, since pricing scales directly with the selected resource type.

Measured service means the provider meters consumption of compute, storage and other resources, and bills accordingly. This metering underpins pay-as-you-go pricing, letting a business pay only for what it actually uses rather than a fixed upfront commitment.

Containers share the host operating system kernel while isolating each application through namespaces and cgroups, so multiple workloads run on one kernel without full OS duplication. This satisfies the stem's requirement of isolation while sharing the same OS kernel, unlike virtual machines, which each run a separate kernel.

IaaS gives the customer control over the guest OS, runtime, middleware, and application while the provider delivers compute, storage, and networking. Because the customer configures and patches the guest layer, it can implement PHI-specific controls directly, and the provider still exposes audit artifacts and signs a business associate agreement covering the underlying infrastructure.

A dedicated private circuit provides the private path the stem demands, while layering VPN encryption over it satisfies the requirement that all traffic be encrypted. Neither a standard internet VPN nor a public connection alone delivers both dedicated routing and confidentiality.

Public cloud offers rapid elasticity, allowing the retail company to scale resources up during peak shopping seasons and down during off-peak times. This matches demand and avoids over-provisioning. It is a key benefit because the company only pays for what it uses, improving cost efficiency and operational agility. This is a fundamental advantage of public cloud.

Data encryption, including at rest and in transit, remains the cloud user's responsibility because the provider cannot access or classify customer data. It satisfies the Shared Responsibility Model constraint that security of the data itself always stays with the consumer, regardless of service model.

Elasticity allows the company to automatically scale compute resources up during peak transcoding demand and down during off-peak hours, ensuring deadlines are met while reducing costs. This matches the need for rapid, dynamic provisioning and de-provisioning of resources based on workload. It directly addresses both the performance requirement and the cost-saving goal.

Cloud providers own and maintain the servers, networking and facilities, so the organisation no longer procures, racks, powers or patches physical hardware. This directly removes the burden of physical infrastructure management named in the scenario.

Horizontal scaling adds more nodes or instances to a pool, distributing load across them. Vertical scaling instead increases the resources, such as CPU, memory or storage, of a single existing node, so the axis of difference is node count versus node capacity.

Archive/Glacier storage suits seven-year compliance retention because retrieval latency is irrelevant when access is rarely required. Its lowest per-gigabyte cost directly satisfies the cost-effectiveness constraint, unlike cooler tiers priced for frequent access. Microsoft Entra ID is unrelated here; the deciding axis is retrieval latency traded against storage price.

Public cloud multi-tenancy pools compute, storage and network resources across customers, with logical isolation enforced by hypervisors and virtual networks. This satisfies the stem's definition directly: multiple customers share the same physical hardware while remaining logically separated.

A hybrid cloud combines private infrastructure with public cloud services and connects them, often through dedicated links. Keeping sensitive warehouse integration on private systems while running the scalable customer portal in the public cloud is precisely the hybrid pattern, letting each workload reside where its security and scalability requirements are best met.

Measured service underpins consumption-based billing: the provider meters resource usage, such as compute hours, and charges only for what is consumed. This directly satisfies the stem's requirement to pay solely for used compute power, unlike subscription or reserved models with fixed upfront commitments.

Elasticity automatically scales compute resources out during demand spikes and back in when traffic subsides, matching capacity to load in near real time. This satisfies the stem's requirement to rapidly increase and decrease resources, unlike scalability, which only describes growth capacity.

Availability zones are isolated data center groups within a region, connected by low-latency links, and are designed so that a failure in one zone does not affect others. Deploying identical stacks across multiple zones in the same metro area provides the hardware-failure resilience and low-latency failover the architects require, which is exactly the purpose of multi-AZ design.

With measured service and pay-as-you-go, the company is billed only for the resources it actually consumes. This means it does not pay for idle servers or over-provisioned capacity, which is a direct financial benefit. It reduces waste and allows costs to track actual usage.

Availability zones are isolated locations within a region, each with independent power, cooling, and networking. Distributing instances across multiple zones ensures that the loss of one data center does not take down the application. This is the standard high-availability pattern for protecting against a single data center failure while keeping latency low.

PaaS satisfies the stem's constraint by abstracting the OS, runtime, and hardware layers, leaving the provider responsible for patching, scaling, and infrastructure. The company retains control only over its application code and data, which matches the stated requirement precisely. IaaS would still demand OS management, while SaaS removes application control entirely.

Elastic scaling lets the company match resource consumption to actual demand, avoiding the cost of overprovisioning for peak loads. This is a direct economic benefit because the company pays only for what it uses and can respond to business changes without long procurement cycles for new hardware.

Geographical distribution protects against regional outages.

BYOK allows the customer to generate, manage, and control their own encryption keys while using the cloud provider's infrastructure. The healthcare company wants to control the keys, which is exactly what BYOK provides. This satisfies the requirement for data encryption at rest and in transit while keeping key management in the company's hands, which is often necessary for compliance with regulations such as HIPAA.

An internet gateway provides the route between a VPC and the public internet, performing NAT for instances with public IP addresses. It satisfies the stem's requirement that a public-subnet instance reach the internet, since without this attached gateway no external traffic can flow.

SaaS delivers a complete, provider-managed application over the internet. The cloud provider handles the infrastructure, operating system, middleware, and application updates, so the marketing agency only needs to configure and use the CRM. This directly matches the goal of eliminating server maintenance, patching, and database administration.

SaaS delivers a complete application managed by the provider, billed per user, with patching, availability, and application maintenance handled on the provider side. This matches the practice's lack of administrative staff and its desire for a subscription-based email and collaboration service with no infrastructure to manage.

SaaS provides a complete, vendor-managed application accessed through a browser or thin client. The provider handles servers, storage, patching, and application updates, which matches the agency's need to avoid all infrastructure and software management. Email and collaboration suites are classic SaaS offerings, so this model directly satisfies the stated requirement.

Measured service means the provider automatically controls and optimizes resource use through metering, and consumers pay only for what they consume. This pay-as-you-go model is a core characteristic of cloud computing and supports the shift from capital expenditure to operational expenditure. For the company's migration, it enables cost transparency and aligns spending with actual usage, which is essential to the cloud value proposition.

CDNs serve content from geographically distributed locations, placing data closer to the user.

Multi-AZ deployment spreads resources across physically separate availability zones within one region, each with independent power, cooling and networking. A complete data centre failure therefore only takes down one zone; the workload keeps running from the surviving zones, satisfying the stem's survival requirement without the latency of cross-region replication.

A backup strategy is essential because it defines how data is copied, retained and restored after disruption, directly satisfying the plan's recovery point and recovery time objectives. Without documented backup frequency, storage location and restoration procedures, the organisation cannot recover lost data or meet the availability commitments a disaster recovery plan must address.

A VPC Endpoint creates a private connection between the VPC and supported cloud services, routing traffic through the provider's internal network rather than the public internet. This satisfies the requirement to access cloud services privately.

Elasticity automatically provisions and deprovisions compute capacity in response to real-time demand, scaling out during the campaign and back in afterwards without manual intervention. This matches the stem's requirement for automatic, unprompted adjustment, whereas scalability alone only describes the capacity ceiling.

Multi-Region deployment replicates workloads across geographically separate Azure regions, so a regional outage leaves another region serving traffic. This directly satisfies the stem's requirement for geographic separation to sustain availability during a regional disaster, unlike availability zones, which only span a single region.

SaaS delivers fully managed applications over the internet, so end users simply authenticate through a browser without installing, patching or hosting anything. This satisfies the stem's requirement, since the provider owns the entire stack beneath the application.

Object versioning retains every overwrite and delete as a distinct, retrievable version, so an accidental deletion removes only the current version while prior versions remain intact. This directly satisfies the stem's protection requirement, letting administrators restore the last good object without external backups.

A private cloud provides dedicated infrastructure for a single organization, which can satisfy regulatory mandates for dedicated physical hardware and reduce noisy neighbor interference. It also allows the firm to optimize the environment for sub-millisecond latency. This model aligns with the need for isolation, control, and compliance.

On-demand self-service is a defining characteristic of the public cloud: consumers provision compute, storage, and network through APIs or portals automatically, with no provider staff involvement. This is inherent to the model and directly relevant because the logistics firm could stand up routing-engine capacity whenever needed without waiting on a vendor ticket.

Identity and Access Management provides the directory constructs — users, groups, roles, and policies — used to authenticate principals and authorise their access to cloud resources, satisfying the requirement to create and manage those identities securely.

Block storage presents raw volumes over protocols such as iSCSI or Fibre Channel, giving the low latency and high IOPS that high-frequency trading logs demand for instant analysis. Object and file storage add overhead unsuited to this workload.

PaaS delivers a managed platform where the provider handles the operating system, runtime, middleware, and scaling infrastructure, while the customer focuses on application code and configuration. This matches the startup's desire to configure web server settings and deploy code without patching servers. By abstracting the lower layers, PaaS minimizes operational overhead while still giving control over the application environment, making it the best fit.

Under the shared responsibility model, the customer is responsible for security in the cloud, which includes classifying data, enabling encryption, and managing identity and access. The provider supplies the tools, but the customer must configure them correctly. This ensures that only authorized employees can access the data and that it is encrypted as required.

Rapid elasticity is the cloud characteristic that allows resources to scale out and in automatically and quickly as demand changes. In this scenario, the platform can add server instances when CPU utilization rises during the flash sale and remove them afterward, matching capacity to demand without manual provisioning. This directly addresses the need for automatic, dynamic scaling.

PaaS delivers managed runtimes, middleware and operating systems, so developers deploy code while the provider handles patching, scaling and servers. This directly satisfies the stem's constraint of building applications without managing underlying infrastructure, unlike IaaS, which still requires OS administration, or SaaS, which offers finished software rather than a deployment platform.

A NAT Gateway performs source network address translation, letting instances in a private subnet initiate outbound connections to the internet while remaining unreachable inbound. This satisfies the stem's requirement: the application needs outbound access for updates, but no route to the internet exists without this component.

Multiple availability zones within a region are physically separated data centers with independent power, cooling, and networking, so the application can survive the loss of an entire zone. Configuring automatic failover, such as a load balancer with health checks and multi-AZ instances, ensures minimal downtime. This approach directly satisfies the need to remain available during a data center outage while keeping latency low within the region.

A multi-region active-active deployment runs duplicate resources in a second region and can automatically shift traffic when one region fails. Because the company is willing to pay for duplicate resources and wants automatic failover, this approach directly satisfies the requirement to remain available during a full region outage.

Elasticity benefit.

A hybrid deployment connects private infrastructure with public cloud resources, allowing workloads to burst outward for peak demand while sensitive data remains on company-owned hardware. This satisfies both the CIO's elasticity goal and the legal mandate. The legacy application can remain largely unchanged while the hybrid architecture absorbs seasonal load, making this the balanced and compliant choice.

SaaS delivers fully managed applications over the internet, so the provider handles servers, storage, and software updates. The design firm can simply subscribe, upload files, and let designers access them from any device via a browser or app. This matches the requirement to avoid managing infrastructure or installing and maintaining software locally.

This is secure and temporary.

Spot instances use spare cloud capacity at steep discounts but can be reclaimed when demand rises. For a batch transcoding job that can tolerate interruptions and is idle most of the day, spot instances minimize cost while providing the burst capacity needed when new content arrives, directly matching the stated tolerance for interruptions.

CPU utilization is the standard Auto Scaling trigger because it directly reflects compute load across instances. When average CPU breaches the target threshold, the group scales out, satisfying the stem's need for the most common metric driving instance increases.

FaaS platforms such as AWS Lambda run code in response to events without provisioning or managing servers, scaling per invocation. This satisfies the stem's serverless, event-driven requirement, unlike IaaS or PaaS, which still require capacity or runtime management.

Customer-managed keys let the hospital generate, store, and rotate encryption keys outside the provider's exclusive control. Because the provider lacks standing access to the key material, it cannot decrypt the records at rest. This satisfies the compliance officer's requirement while still allowing the provider to store the encrypted data, making it the appropriate capability.

In a public cloud, the provider owns and maintains the physical servers, so the customer no longer needs to purchase hardware upfront. This shifts costs from capital expenditure (CapEx) to operational expenditure (OpEx). Eliminating large upfront hardware purchases is a primary financial benefit of cloud adoption. This directly addresses the CFO's concern about reducing capital costs.

Rapid elasticity is a NIST essential characteristic. Imaging archives experience variable study volumes, so the ability to scale capacity outward quickly and release it when demand falls demonstrates the elasticity that distinguishes cloud from fixed-capacity hosting. Auditors confirming this trait would verify that capacity can grow and shrink with demand rather than being permanently provisioned.

Direct Connect establishes a dedicated private fibre link between your on-premises data centre and the VPC, bypassing the public internet entirely. This satisfies the stem's core constraint of private connectivity, offering consistent latency and higher bandwidth than IPsec VPN tunnels, which route traffic over the public internet.

Selecting a region within the required country ensures data residency, while customer-managed keys in a key management service give the company direct control over key creation, rotation, and revocation. This satisfies both the regulatory data location mandate and the requirement for direct key control. The provider still manages the underlying infrastructure, but the company controls the keys.

Rapid elasticity allows cloud resources to scale out automatically when demand increases and scale in when demand drops, matching capacity to workload. In this scenario, the flash sale spike can be absorbed by provisioning additional instances on demand, then releasing them afterward. This directly prevents the slowdown without the cost of permanently adding on-premises hardware, making it the characteristic that solves the stated problem.

An SLA specifies which services and components are covered and lists exclusions, such as scheduled maintenance or customer misconfiguration. Understanding the scope prevents false assumptions about what is guaranteed. If critical services are excluded, the company may need additional mitigation, so this is a key consideration.

NoSQL databases use flexible, schema-less document, key-value or graph models rather than rigid relational tables, so they store unstructured data natively. Their shared-nothing architecture partitions data across nodes, delivering the horizontal scaling the application demands.

Provisioned IOPS SSD decouples performance from capacity, guaranteeing sustained IOPS and consistent low latency. General-purpose SSDs share throughput and can burst only briefly, so they cannot satisfy the database's demanding IOPS and latency constraint under continuous load.

IaaS provides virtualized compute, storage, and networking on which the firm can install and manage its own operating system and application. Because the workload can be lifted and shifted without code changes and the firm retains OS-level administrative control, IaaS matches both the no-modification constraint and the requirement to manage patching and runtime configuration itself.

Cloud compute is billed by consumption, often per second or per minute, so transcoding jobs incur charges only while running. This variable, usage-based billing is a defining characteristic of the cloud model and must be modeled against the fixed cost of owned servers. It directly reflects how the workload's duration drives cloud spend.

Multi-AZ deployment satisfies the synchronous replication requirement by maintaining a standby replica in a separate availability zone, with writes committed to both before acknowledgement. This delivers the low recovery time and automatic failover the stem demands, unlike read replicas, which replicate asynchronously and cannot provide zero-data-loss zone resilience.

A private cloud deployment keeps the workload on infrastructure dedicated to the single organisation, giving full control over data residency, isolation and compliance controls. This satisfies the strict regulatory requirements that a shared public or community cloud tenancy could not guarantee for the database.

Multi-tenancy allows multiple customers to share the same physical infrastructure, but logical isolation ensures that each tenant's data and processes are separated. This isolation, enforced through virtualization, access controls, and network segmentation, prevents other customers from accessing the retail company's data. It is the characteristic that directly addresses the security concern in a shared environment.

Spreading resources across multiple regions and using global traffic management ensures that if one region fails, traffic can be redirected to another region. This directly addresses the need to survive a full region outage. It introduces additional cost and complexity, which the company is willing to accept, making it the most appropriate design.

Measured service satisfies the metered-usage constraint by automatically monitoring, controlling and reporting resource consumption, enabling pay-per-use billing. Unlike fixed-capacity on-premises models, it provides the elasticity and cost transparency that define cloud computing under the NIST model.

PaaS delivers a managed platform including the operating system, middleware, and runtime, so the customer only deploys and manages the application and its data. For a small agency with limited IT staff, this removes the burden of patching and scaling the underlying stack. The agency can focus on its custom CRM application while the provider handles the platform.

Resource pooling lets the provider serve multiple customers from shared physical or virtual capacity, dynamically assigning and reassigning resources as demand shifts. This multi-tenant model delivers the economies of scale, cost efficiency and elasticity that distinguish cloud from dedicated single-tenant hosting.

PaaS provides a platform including runtime, middleware, and database services, allowing developers to deploy code without managing the underlying infrastructure. The team is responsible for their application and data, which matches the PaaS model. This is the correct answer because the team focuses on code while the provider manages the platform.