CCNA Management And Technical Operations Questions

ARM templates are JSON files that define the infrastructure and configuration for an Azure deployment declaratively. They enable repeatable, consistent deployments and can be integrated into CI/CD pipelines. This directly satisfies the requirement to define infrastructure as code and deploy it multiple times without manual steps. ARM templates also support parameters and variables for reusability.

S3 Lifecycle Policies automate transitions between storage classes, such as moving objects to Glacier Deep Archive after a set period, satisfying the seven-year retention requirement at the lowest cost. Manual tiering or versioning alone cannot enforce scheduled, cost-optimised long-term retention.

Traffic patterns directly determine how demand fluctuates over time, driving the choice between horizontal and vertical scaling and the use of auto-scaling. Peak-to-trough ratios and seasonality dictate provisioned capacity, ensuring resources match actual load without over-provisioning, which satisfies the scalability decision's need to align capacity with observed demand.

IaaS leaves the customer managing operating systems, middleware and runtime, while the provider handles only virtualisation, servers, storage and networking. This highest customer operational burden is precisely the differing management level the question asks about.

Tags attach metadata such as cost centre, project, or owner to resources, enabling billing reports to be grouped and filtered by those keys. This granular attribution satisfies the requirement for improved cost allocation across departments and workloads.

Terraform declaratively defines infrastructure resources in version-controlled configuration files, then provisions them through an automated workflow. This satisfies Infrastructure as Code because the desired-state definition, not manual console clicking, drives deployment, enabling repeatable, auditable environments. It is the only option expressing infrastructure through machine-readable code.

Monitoring and alerting thresholds define what detection signals trigger the incident response process, ensuring incidents are identified promptly rather than discovered by users. This satisfies the plan requirement to specify how incidents are detected and escalated.

A pre-signed URL grants time-limited, scoped access to a specific object without exposing credentials or making the file public. The external partner downloads via the signed link, satisfying secure sharing of sensitive data while the bucket remains private.

A cloud key management service with customer-managed keys lets the firm create, rotate, disable, and delete its own key material while the provider handles the hardened storage and cryptographic operations. Integrated audit logging records key usage events, satisfying the compliance trail requirement with minimal operational overhead.

Object lock in compliance mode prevents deletion or modification for a defined retention period, satisfying the immutability requirement. Transitioning to an archive class after 90 days reduces storage costs for long-term retention. Together, these actions meet both the seven-year retention and tamper-proof mandates. This is the correct combination for regulatory audit logs.

Database auditing and query logging capture executed statements and record them to a secure destination, providing the query-level audit trail the audit demands. It satisfies the requirement directly, unlike encryption or backup features, which do not log individual queries.

The SLA is the contractual document that states the provider's committed service levels, such as monthly uptime percentages, and describes remedies like service credits when those targets are missed. Reviewing it lets the manager verify whether the guarantee meets business needs and understand the escalation path for outages, which is exactly the concern described.

Azure Monitor collects platform metrics such as CPU utilisation from Azure virtual machines via the diagnostic pipeline, then visualises them in near real time through metrics explorer and dashboards, satisfying the requirement to capture and visualise fleet-wide CPU metrics.

Customer-managed keys in a cloud KMS let the organization generate, control, rotate, and revoke the key material itself. Enabling key usage logging produces an auditable record of every cryptographic operation, which directly satisfies the compliance requirement for independently auditable, customer-controlled encryption at rest. This is the standard pattern for regulated workloads on public cloud object storage.

Object lock applies write-once-read-many protection at the object level, and in compliance mode no user, including the root account, can delete or alter the object until the retention period expires. Setting a seven-year retention period directly enforces the regulatory requirement and provides the tamper-resistant guarantee the auditors are seeking.

A defined failover procedure supplies the sequenced, tested steps that shift workloads to the recovery environment, satisfying the stem's demand for robustness. Without documented invocation criteria, role assignments and rollback actions, recovery stalls during an actual outage, so the procedure converts standby capacity into workable continuity.

Caching static assets at edge nodes means repeat requests are served without touching the origin, directly cutting origin bandwidth, compute and egress costs. This satisfies the stem's benefit of relieving pressure on the backend infrastructure that would otherwise handle every user request.

A PodDisruptionBudget specifies the minimum number of pods that must remain available during voluntary disruptions such as node drains or upgrades. It prevents the eviction API from taking down too many replicas at once. This is the standard mechanism to ensure that maintenance operations respect availability requirements, directly addressing the second part of the scenario.

Standard OCI images and Kubernetes manifests or Helm charts are portable across conformant Kubernetes distributions such as EKS and AKS. Avoiding provider-specific extensions keeps the deployment artifacts reusable, so the workload can be moved between clouds with minimal changes, directly supporting the anti-lock-in objective.

Compliance management continuously audits, reports and remediates against corporate policies and regulatory frameworks, directly satisfying the stem's requirement to ensure the cloud environment adheres to security and regulatory standards rather than merely deploying or monitoring resources.

Auditing API access logs is a core cloud monitoring task, satisfying the need to track who called which service and when. It provides the visibility required for security, compliance and troubleshooting across cloud resources, complementing metrics and alerting rather than replacing them.

The Service Level Agreement defines the provider's guaranteed uptime percentage, plus the specific exclusions, measurement windows and remedies that bound that commitment. Reviewing the SLA directly satisfies the stem's requirement to understand both scope and limitations, since those limitations appear only in the SLA's exclusions and service-credit terms.

Azure Database for PostgreSQL Flexible Server is a managed platform-as-a-service offering that automates patching, backups, and zone-redundant high availability while preserving full PostgreSQL compatibility. The team keeps control over schema design, indexes, and query tuning, and administrative overhead for routine maintenance is largely eliminated.

A SOC 2 Type II report is issued by an independent auditor and describes the design and operating effectiveness of the provider's controls over a period of time. It gives leadership evidence that security and availability controls were consistently applied, which is exactly the independent validation the due diligence effort requires.

Continuous log shipping replicates transaction logs to a standby database, enabling an RPO as low as a few minutes and allowing automated failover within the 2-hour RTO. This directly meets both objectives by minimizing data loss and recovery time. It is the appropriate architectural change for a critical database with strict RPO and RTO requirements.

Upgrading to a higher-performance storage volume directly addresses the I/O bottleneck by increasing IOPS and reducing latency, satisfying the stem's high I/O wait constraint. Storage throughput, not CPU or memory, governs disk-bound wait times, so this change targets the actual limiting resource rather than masking symptoms elsewhere.

Infrastructure as code stores the desired state of the environment in version-controlled templates, so every change is reviewable, repeatable, and reversible. This directly supports controlled change management after cutover because modifications go through the same review and approval process as application code, and drift can be detected by comparing deployed state to the template.

Manual DB snapshots are retained until explicitly deleted, so they satisfy long-term retention beyond the automated backup window. Copying the snapshot to another Region provides additional durability and disaster recovery. This action, combined with automated backups, ensures both point-in-time recovery and long-term retention as required.

Patching operating systems keeps cloud workloads secure and compliant, directly satisfying the maintenance requirement to remediate vulnerabilities across compute instances. Unlike provisioning or decommissioning, patching is an ongoing operational task performed throughout a resource's lifecycle, making it a core component of cloud resource maintenance under CompTIA Cloud+ objectives.

Least privilege restricts each account, service and process to only the permissions its function requires, shrinking the exploitable attack surface if credentials are compromised. This directly satisfies the stem's requirement for a best practice securing a cloud virtual machine.

Automated patch management applies updates across the fleet on a schedule without manual intervention per instance, satisfying the requirement for automatic software patch updates. It is cloud-native because it uses managed tooling rather than bespoke scripting.

Azure Cost Management budgets let you define a scope, time grain, and amount, then trigger alerts when actual or forecasted spend crosses configured thresholds. Attaching an action group routes the alert to email, SMS, or automation, which satisfies the automated notification requirement without relying on manual review.

Read replicas create additional database copies that serve read-only queries, offloading SELECT traffic from the primary instance. Distributing reads across replicas directly relieves the bottleneck, improving read performance without altering the write path or schema.

Auto Scaling health checks continuously probe instance and ELB status, then terminate and replace instances failing those checks, maintaining desired capacity automatically. This satisfies the requirement to replace unhealthy EC2 instances without manual intervention, unlike scaling policies that only react to demand metrics.

AWS WAF inspects incoming HTTP(S) requests at the Application Load Balancer and applies rule groups that block SQL injection and cross-site scripting patterns before traffic reaches the EC2 instances. It requires no application code changes, integrates natively with ALB, and satisfies the security team's mandate for inline inspection.

SSE-S3 provides server-side encryption with AWS managed keys, where AWS handles key management, rotation, and storage. It requires no additional configuration or overhead from the operations team, and it encrypts all objects at rest by default. This meets the compliance requirement for encryption at rest with minimal management effort, making it the simplest and most cost-effective option.

Policy enforcement automation continuously applies and audits configuration rules across cloud resources, satisfying the stem's compliance consideration by replacing manual checks with repeatable, evidence-generating controls. It detects drift against regulatory baselines in near real time, ensuring Microsoft Entra ID and workload settings remain auditable without relying on periodic human review.

EventBridge schedules cron-style rules, invoking Lambda at 02:00 nightly without any server running between executions. This satisfies the stem's requirement for an automated, recurring trigger, since Lambda supplies the serverless compute and EventBridge supplies the time-based event source.

Object lock in compliance mode enforces a write-once-read-many model where no user, including the root account, can delete or overwrite the protected object version until the retention period expires. This satisfies the legal hold requirement at the storage layer without depending on application code.

Independent audit reports and certifications give the firm documented evidence that the provider's security and operational controls have been examined against recognized standards. They support the compliance officer's demand for independent assessment and help map provider controls to the firm's own regulatory obligations. These artifacts are typically available through the provider's trust or compliance portal.

Cloud monitoring services evaluate metric streams against defined thresholds over a specified evaluation period. Creating an alarm on average CPU utilization with an 80 percent threshold and a five-minute evaluation window, plus a notification action such as an email or webhook, delivers automatic alerting exactly as requested. This is the native, low-effort way to convert a metric condition into an actionable notification.

Blue/green deployment maintains two identical environments, routing traffic to the new green stack only after validation, then switching back instantly if faults appear. This pattern delivers near-zero-downtime releases with rapid rollback, a defining characteristic of common cloud deployment patterns.

A documented, tested rollback plan makes changes reversible in practice rather than only on paper. Validating it in staging reveals gaps such as data migrations that cannot be cleanly undone, so the team knows the true recovery time. This directly addresses the reversibility goal and complements review and traceability controls.

Infrastructure as Code templates capture the declarative configuration of the application tier, including network topology, instance types, and load balancer settings. Reapplying these templates in a recovery region recreates the environment consistently without manual rebuilds, which is exactly what is missing when only database backups exist. This directly addresses the requirement to redeploy the application tier identically.

Migration scripts apply ordered schema changes, such as adding columns or altering types, while preserving existing rows through the transition. This satisfies the stem's constraint of updating the schema without data loss, since ad-hoc manual edits or dropping and recreating tables would destroy the existing records.

SSH encrypts the entire management session over TCP port 22, providing the secure remote shell access the stem demands for Linux-based cloud VMs. Its native integration with Linux and key-based authentication satisfies the encrypted remote management constraint directly, unlike RDP (Windows-oriented) or unencrypted Telnet.

Azure Application Gateway is a layer 7 load balancer that supports URL path-based routing, multiple-site hosting, and TLS/SSL termination. It is designed for HTTP/HTTPS traffic and can route requests to different backend pools based on the URL. This directly satisfies the requirement to distribute HTTP traffic with URL-based routing and TLS termination in a single region.

Spreading the stateless fleet across multiple availability zones means the loss of one zone only removes a subset of instances, and the load balancer automatically stops routing to unhealthy targets. Because the application holds no local state, remaining instances absorb the traffic without data reconciliation, giving a very low recovery time with almost no manual intervention.

Multi-AZ deployment distributes resources across physically separate availability zones within a region, each with independent power, cooling, and networking. This satisfies the resilience requirement by surviving the complete failure of any single data centre without application downtime.

Centralised configuration management stores configuration in one authoritative source and pushes updates to all containers automatically, removing manual edits. This satisfies the stem's constraint of propagating configuration changes across hundreds of containers without manual intervention.

Cloud providers bill for provisioned block storage regardless of attached state, so an unused volume continues accruing charges until removed. Deleting the volume releases the underlying capacity and terminates billing; detaching or stopping merely preserves the resource and its cost.

Active connection count reports how many concurrent connections the load balancer is currently handling. Rising values approaching its capacity indicate the balancer is struggling with concurrent user connections, directly satisfying the metric the scenario requires.

CloudFormation provisions infrastructure as code, letting templates define and deploy AWS resources repeatably without manual configuration. This directly satisfies the automation requirement in the stem, since template-driven orchestration removes human intervention from resource creation and updates, making it a core service for automating cloud infrastructure deployment.

Under the Shared Responsibility Model, the provider secures the cloud infrastructure, while the customer configures security groups, IAM policies and data. Security group rules are customer-controlled access decisions, so their configuration sits firmly on the customer's side of the divide.

Spot Instances use spare AWS capacity and cost up to 90% less than On-Demand. Because the workload is stateless and interruption-tolerant, Spot interruption notices can be handled by draining connections or terminating instances without data loss. This matches the requirement for the lowest cost while maintaining high availability through a diversified fleet across multiple Spot capacity pools.

Federating both clouds to a central identity provider means authentication and group membership are managed in one place. Access to each provider is granted through role or group mappings, so disabling the central account immediately blocks access everywhere. This satisfies both the unified policy requirement and the rapid revocation requirement without duplicating identity stores.

Azure Policy evaluates resource properties against defined rules and enforces effects such as deny or audit, so non-compliant VM names or missing cost-tracking tags are blocked or flagged. This satisfies the stem's requirement to enforce naming conventions and tags consistently across all virtual machines.

SSE-KMS with a customer managed key gives the firm control over the key policy and lifecycle. Enabling automatic key rotation rotates the backing key material on a defined schedule, and CloudTrail records KMS API calls such as Encrypt and Decrypt, providing the key-usage audit trail. Together these satisfy control, rotation, and logging requirements.

Placing application instances in multiple regions near user concentrations reduces the physical distance data must travel, directly lowering round-trip latency. It also provides regional fault isolation, so an outage in one region does not take down the entire service, satisfying both the latency and high availability goals.

Cost allocation reports break spend down by tag, subscription, resource group or service, exposing which workload or team is driving the overrun. This satisfies the stem's requirement to identify the source of excess spend before remediation, rather than merely observing the total.

Providers bill egress traffic leaving their network, so cross-region replication, internet downloads and multi-cloud architectures incur charges. This metered data transfer rate is a primary cost driver, satisfying the stem's requirement for a factor governing cloud spend.

A managed instance group with health checks and autohealing continuously monitors instance health and automatically recreates unhealthy instances. When configured as a regional managed instance group, it can distribute instances across multiple zones and recreate them in a healthy zone if one zone fails. This provides automatic recovery without manual intervention, meeting the requirement.

The application tier shows sustained CPU near 95 percent with rising queue depth, which is the classic signal for horizontal scaling. Adding instances distributes the request load and reduces queue depth, restoring response times while keeping the service available. A target tracking policy on CPU utilization automates this for future peaks without manual intervention.

The status dashboard publishes real-time health per region and service, showing active incidents and remediation progress during outages. Checking it verifies current infrastructure state directly, satisfying the stem's requirement to confirm the provider's live operational status.

Committed use discounts (CUDs) provide significant discounts (up to 57% for most machine types) in exchange for committing to a 1- or 3-year term for a specific amount of vCPU and memory. This is ideal for predictable, steady-state workloads, as it reduces cost without impacting performance. It aligns with cost optimization best practices by leveraging long-term commitments for baseline usage.

Enabling MFA on the root account is the first practice because the root account holds unrestricted access to all resources and billing. MFA adds a second authentication factor, so a leaked password alone cannot compromise the entire cloud account, satisfying the stem's initial security hardening requirement.

Each cloud provider supplies its own native monitoring console, so correlating performance and availability across AWS, Azure and GCP demands a unified monitoring tool that aggregates metrics and logs into a single pane of glass, satisfying the cross-provider visibility requirement.

Systems Manager Automation lets you build runbooks that perform actions such as stopping or resizing instances, and it integrates with CloudWatch alarms and Amazon EventBridge to trigger automatically. It can also invoke Lambda or send notifications, so it satisfies the requirement for unattended remediation plus Slack notification without writing a custom application.

A managed service such as RDS handles provisioning, patching, backups and scaling, so the customer's team no longer performs those database administration tasks. This directly reduces operational overhead compared with running a self-managed database on a virtual machine.

AWS Compute Optimizer analyses historical CloudWatch utilisation metrics for EC2 instances and returns rightsizing recommendations with over-provisioned and under-provisioned findings. This satisfies the stem's constraint of historical-utilisation-based rightsizing guidance, unlike CloudWatch alone, which only reports raw metrics without recommendations.

Re-platforming modifies the underlying platform — such as upgrading to a supported OS — while preserving the application's core code and logic. This resolves the unsupported-OS constraint without the cost and risk of a full rewrite that re-architecting would demand.

A DynamoDB table provides the state-locking mechanism Terraform requires when using the AWS S3 backend, acquiring a lock before any plan or apply and releasing it afterwards. This prevents concurrent CI/CD pipeline runs from modifying the same state file simultaneously, satisfying the stem's requirement to block parallel modifications.

Blue/green deployment maintains two identical environments, routing production traffic only to the live one. Updates deploy to the idle environment first, where they can be verified in isolation before traffic switches over, satisfying the requirement to validate changes in a controlled environment prior to production rollout.

The cluster autoscaler watches for pods that cannot be scheduled due to insufficient node resources and adds nodes to the node pool. When demand drops and nodes are underutilized, it drains and removes them. This directly addresses the reported scheduling pressure while providing the automatic scale-in the team needs to control cost.

Security groups act as virtual stateful firewalls at the instance or resource level. By default they deny all inbound traffic, so explicitly allowing only TCP 80 and 443 from any source achieves the desired minimal attack surface for the web tier while automatically permitting return traffic for established connections.