CCNA Describe cloud concepts Questions

In the shared responsibility model for IaaS, the customer retains control over the guest operating system, including applying security patches. Microsoft manages the physical host and hypervisor but does not patch the OS running inside the VM. Therefore, the customer is primarily responsible for keeping the OS up to date.

The consumption-based pricing model, also known as pay-as-you-go, is a core financial model in cloud computing where you are billed only for the specific resources you consume (e.g., compute hours, storage GB, data transfer). This model eliminates upfront capital expenditure and allows costs to scale dynamically with usage, directly aligning expenses with actual consumption rather than capacity.

Moving from a capital expense (CapEx) model—where servers, networking gear, and licenses are purchased upfront—to a pay-as-you-go monthly fee in Azure represents a shift to operational expenditure (OpEx). This cloud benefit allows the company to avoid large upfront investments and instead pay for only the compute, storage, and network resources consumed, aligning costs with usage.

Zone-redundant deployment (B) is the correct term because it specifically refers to replicating resources across multiple Azure availability zones within a single Azure region. Availability zones are physically separate datacenters with independent power, cooling, and networking, so deploying across them protects against a single datacenter-level failure while keeping the application within the same low-latency region.

The scenario describes shifting from capital expenditure (CapEx) for upfront hardware purchases to operational expenditure (OpEx) for ongoing, pay-as-you-go IT resource consumption. This is a core financial benefit of cloud computing, where costs are treated as variable operating expenses rather than fixed capital investments.

Deploying an application across multiple availability zones within an Azure region ensures that if one zone experiences an outage (e.g., due to power failure or network disruption), the application can continue serving traffic from the remaining zones. This architecture directly improves high availability by eliminating a single point of failure at the datacenter level, typically achieving a service-level agreement (SLA) of 99.99% for virtual machines when using two or more instances across zones.

Global reach through cloud infrastructure enables businesses to deploy applications in multiple geographic regions using the cloud provider's existing data centers, eliminating the need to build and manage physical infrastructure in each target market. Providers like Azure offer region pairs and geographies that allow low-latency access and compliance with local data residency requirements, enabling rapid global expansion.

Correct matches: Microsoft Entra ID for internal users, Azure AD B2C for customers, Managed Identities for Azure resources. Common confusions include swapping B2C with domain services or managed identities.

The Microsoft Trust Center is a dedicated website that provides detailed information about Microsoft's security, privacy, and compliance practices. It serves as a central resource for customers to understand how Microsoft protects their data, including certifications, audit reports, and regulatory compliance documentation. This aligns with the need for transparency in cloud services, making option B correct.

The primary difference is that a public cloud uses a multi-tenant architecture where infrastructure resources like compute, storage, and networking are shared across multiple unrelated customers, while a private cloud provisions dedicated infrastructure for a single organization, either on-premises or hosted by a third party. This distinction is fundamental to cloud deployment models as defined by NIST SP 800-145, which emphasizes resource pooling in public clouds versus single-tenant isolation in private clouds.

This scenario describes a shift from Capital Expenditure (CapEx), where large upfront costs are incurred for hardware, to Operational Expenditure (OpEx), where costs are based on actual usage and billed monthly. In cloud computing, OpEx aligns with the consumption-based model, where you pay only for resources consumed (e.g., compute hours, storage GB) without upfront commitments. This is a core financial benefit of cloud services like Azure, enabling variable costs instead of fixed capital investments.

Cloud computing enables rapid provisioning of resources through self-service portals and automation, allowing virtual machines, storage, and networks to be deployed in minutes via APIs or management consoles. This contrasts with on-premises environments where hardware procurement, racking, and configuration can take weeks. The speed of deployment is a core agility benefit of the cloud, directly supporting faster time-to-market for applications.

Azure data residency controls, combined with Azure regions and data sovereignty guarantees, ensure that customer data stays within specified geographic boundaries. Microsoft's contractual commitments in the Microsoft Products and Services Data Protection Addendum (DPA) address data sovereignty concerns.

Economies of scale in cloud computing means that cloud providers like AWS, Azure, or Google Cloud operate at a massive scale, allowing them to negotiate bulk discounts on hardware, power, and cooling. These cost savings are passed down to customers in the form of lower pay-as-you-go prices, making it cheaper for individual organizations than running their own on-premises data centers.

Elasticity is the correct term because it describes the ability to automatically scale computing resources up or down based on demand, combined with a pay-as-you-go pricing model. This allows the company to only pay for the resources they actually use, which is a core benefit of cloud computing.

High availability in Azure refers to the ability of services and resources to remain operational and accessible despite failures, with minimal planned or unplanned downtime. It is achieved through redundancy, fault tolerance, and automatic failover mechanisms, such as Azure Availability Zones and Availability Sets, which ensure that if one component fails, another takes over without significant interruption.

Resource pooling is the cloud computing concept most directly related to sustainability because it allows a cloud provider to serve multiple customers from the same shared physical infrastructure. By dynamically allocating and reallocating resources based on demand, the provider maximizes utilization rates, reducing the total number of physical servers and data centers needed. This consolidation directly lowers energy consumption and carbon emissions per workload, which is the core environmental benefit of shifting to the cloud.

On-premises data centers require significant upfront capital investment for hardware, which is capitalized as a capital expenditure (CapEx) and depreciated over time. Azure's pay-as-you-go model shifts costs to operational expenditure (OpEx), where you pay only for consumed resources with no upfront costs, directly impacting financial reporting by converting fixed costs to variable costs.

The shared responsibility model delineates that the cloud provider is responsible for the security 'of' the cloud, which includes physical infrastructure controls like biometric access and 24/7 surveillance at datacenters. This question specifically asks about physical security controls, which fall under the provider's domain regardless of the deployment model (IaaS, PaaS, or SaaS). Therefore, option B is correct because the provider must secure the physical premises housing the servers and storage.

Infrastructure as a Service (IaaS) provides virtualized computing resources over the internet, giving customers direct control over the operating system, storage, and networking components such as virtual networks and firewalls. Unlike higher-level service models, IaaS allows users to manage and configure the underlying infrastructure without physical hardware access, making it the model with the most customer control.

An Azure geography is a discrete market (e.g., United States, Europe) that contains at least one Azure region, and it is designed to preserve data residency and compliance boundaries. A region is a set of datacenters deployed within a latency-defined perimeter, connected through a dedicated regional low-latency network. Geographies ensure that customer data stays within the specified boundary for legal and regulatory requirements, even if a region fails.

Increasing the VM size from Standard_D2s_v3 to Standard_D8s_v3 adds more vCPUs and RAM to the same virtual machine, which is the definition of vertical scaling (scaling up). This approach is appropriate because the application cannot run on multiple servers simultaneously, so adding resources to the existing single VM is the only viable option to handle the increased load.

The 'Stop guessing capacity requirements' benefit, often referred to as 'Capacity Planning' in the Azure Well-Architected Framework, directly addresses the challenge of over-provisioning or under-provisioning infrastructure. Azure's elastic scaling model allows organizations to provision resources on demand and pay only for what they use, eliminating the need to predict future workloads precisely. This is a core advantage of the consumption-based model in cloud computing, where resources can be scaled up or down automatically based on real-time metrics.

Elasticity is the ability of a cloud system to automatically scale resources up or down based on demand. In this scenario, the platform provisions additional servers during the flash sale and deprovisions them afterward, directly demonstrating elasticity. This contrasts with other characteristics like high availability, which focuses on uptime, not dynamic scaling.

This scenario best illustrates broad network access because the document management system is accessible over the internet from any location using laptops or smartphones without requiring a VPN. Broad network access means resources can be accessed via standard network protocols (e.g., HTTPS) from a wide range of devices, including mobile phones and laptops, over public networks like Wi-Fi or cellular. The consultants' ability to log in and use the application from any internet-connected device directly demonstrates this characteristic.

The scenario describes a cost advantage that arises because Azure buys hardware and energy in bulk, reducing per-unit costs and spreading fixed expenses across many customers. This is the direct definition of economies of scale, a core cloud concept where large-scale operations lower the average cost per unit, enabling providers to offer services at a lower price than individual organizations could achieve on-premises.

Microsoft 365 is a SaaS offering because it provides ready-to-use productivity applications (e.g., Word, Excel, Teams) accessed via a web browser or client, with Microsoft managing the underlying infrastructure, operating system, and application updates. The customer simply consumes the software without needing to install or maintain servers or runtime environments.

Elasticity is the correct term because it specifically refers to the cloud's ability to automatically scale resources up or down in response to fluctuating demand, without requiring manual intervention. This is a core characteristic of cloud computing, enabling dynamic provisioning and de-provisioning of compute, storage, or network resources based on real-time metrics like CPU utilization or request count.

Data sovereignty is the concept that data is subject to the laws and regulations of the country or region where it is physically stored. By ensuring their cloud provider's data centers are located in specific geographic areas, the company is directly addressing data sovereignty requirements to comply with local data residency laws, such as GDPR in Europe or the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada.

Economies of scale is the correct answer because cloud providers like Azure operate massive, standardized data centers that serve millions of customers simultaneously. This allows them to negotiate bulk discounts on hardware, power, and cooling, and to spread fixed operational costs across a vast customer base, resulting in per-unit costs far lower than what a single company would pay for an equivalent on-premises deployment.

Migrating from on-premises physical servers to Azure virtual machines shifts the cost model from Capital Expenditure (CapEx) — paying the full hardware cost upfront every three years — to Operational Expenditure (OpEx), where you pay only for the compute, storage, and network resources you actually consume on a monthly basis. This aligns costs directly with usage, avoiding large upfront investments and enabling better cash flow management.

This scenario describes a hybrid cloud because the company uses a mix of on-premises infrastructure (production scheduling servers and file servers) and a public cloud service (Microsoft 365 for email). In a hybrid cloud model, organizations integrate on-premises resources with public cloud services, allowing data and applications to be shared between them. Here, the email system runs in Microsoft's public cloud while all other systems remain on-premises, creating a hybrid deployment.

The correct matches are: Azure Virtual Machines (IaaS), Azure Functions (serverless compute), Azure Queue Storage (simple messaging), and Azure Service Bus (enterprise messaging). Common confusions include mixing up serverless with IaaS and simple messaging with enterprise brokers.

This scenario describes resource pooling, where the provider's computing resources (such as storage, memory, and network bandwidth) are pooled to serve multiple customers using a multi-tenant model. Virtualization technology creates isolated virtual machines for each tenant, ensuring logical separation of data and applications while sharing the same physical hardware. This is a core characteristic of cloud computing as defined by NIST SP 800-145.

A hybrid cloud deployment combines public cloud resources (Azure) with on-premises infrastructure, connected via technologies like VPNs or Azure ExpressRoute. Running customer-facing apps on Azure while keeping sensitive HR data on-premises exemplifies this blend, allowing organizations to maintain compliance or low latency for critical data while leveraging cloud scalability.

Elasticity is the ability of a cloud system to automatically scale resources up or down based on real-time demand. In this scenario, the autoscale rule dynamically adds two VM instances when CPU exceeds 75% and removes them when CPU drops below 30%, closely matching resource consumption to traffic spikes. This on-demand provisioning and de-provisioning of compute capacity is the defining characteristic of elasticity.

Edge computing is the correct concept because it involves processing data near the source (the factory floor) rather than sending it to a centralized cloud data center. This reduces latency by performing initial analysis locally, with only summarized results transmitted to the cloud. The scenario explicitly describes local processing to minimize delay, which is the core purpose of edge computing.

Elasticity is the ability to dynamically scale resources up or down to match demand. In this scenario, the autoscale rule adds VMs at 8:30 AM to handle the predictable peak load and removes them at 5:30 PM, demonstrating automatic resource provisioning and de-provisioning based on a schedule. This is a textbook example of elasticity in cloud computing.

Azure can offer a lower price for a three-year reserved instance because of economies of scale. Microsoft operates massive, globally distributed data centers that purchase hardware, power, and cooling in bulk, significantly reducing per-unit costs. This cost advantage is passed to customers who commit to longer-term reservations, as the provider can better predict and optimize resource utilization.

Azure SQL Database is a Platform as a Service (PaaS) offering where Microsoft manages the underlying infrastructure, including the operating system and the SQL Server database engine. Under the shared responsibility model, Microsoft is responsible for applying security patches to the database engine, while the customer is responsible for securing their data, access controls, and database-level configurations. This frees the customer from manual patching tasks they performed on-premises.

Disaster recovery (DR) in cloud computing refers to the strategies and processes used to restore IT systems and data after a catastrophic failure, such as a natural disaster or large-scale outage. Azure supports DR primarily through Azure Site Recovery (ASR), which orchestrates replication, failover, and failback of virtual machines and workloads between Azure regions or from on-premises to Azure, ensuring business continuity with defined recovery point objectives (RPO) and recovery time objectives (RTO).

The scenario describes a developer provisioning a virtual machine directly through the Azure portal without any human intervention from IT or operations staff. This aligns with the cloud characteristic of on-demand self-service, where users can provision and manage computing resources as needed automatically, without requiring manual approval or interaction with service providers.

This scenario describes a shift from Capital Expenditure (CapEx) to Operational Expenditure (OpEx). CapEx involves upfront purchases of physical assets like servers and storage, which are capitalized and depreciated over time. OpEx, on the other hand, is a pay-as-you-go model where costs are incurred based on actual usage, such as monthly cloud subscription fees for compute and storage resources.

The scenario describes a consumption-based billing model where charges are incurred only for the hours each VM is actually running, and no charges apply when VMs are in the 'Stopped (deallocated)' state. This directly exemplifies the 'measured service' characteristic of cloud computing, where resource usage (e.g., compute hours) is metered and billed based on actual consumption, enabling pay-as-you-go pricing.

The shift from upfront hardware purchases (capital expenditure) to paying only for consumed resources monthly is the definition of operational expenditure (OpEx). In Azure, this is enabled by the consumption-based pricing model, where you are billed for compute hours, storage GBs, and data egress rather than owning physical assets. This directly addresses the CFO's concern about financial impact by converting large upfront costs into predictable, variable monthly payments.

The hybrid cloud model is correct because it combines on-premises infrastructure (private cloud) with public cloud services, enabling the company to keep sensitive applications in its own datacenter for compliance while using the public cloud for burst capacity and development/testing. This directly matches the scenario's requirement for a unified environment that spans both local and cloud resources.

The scenario demonstrates on-demand self-service because the development team lead was able to provision and configure an Azure virtual machine directly through the Azure portal without any human interaction from Microsoft's staff. This characteristic allows users to automatically obtain computing resources, such as VM time and storage, as needed without requiring manual approval or provisioning from the cloud provider's IT team.

Elasticity is the cloud computing characteristic that enables automatic scaling of resources up or down based on real-time demand. In this scenario, the e-commerce application needs to handle a tenfold traffic increase during holidays without over-provisioning for the rest of the year, which is exactly what elasticity provides by adding or removing server capacity dynamically and charging only for what is used.

This scenario describes a fully managed database service where the provider handles backups, patching, and high availability, and the customer does not manage any underlying servers. This is the definition of Platform as a Service (PaaS), which provides a managed platform (including database engines like Azure SQL Database) where the customer only manages data and schema, while the provider handles the OS, runtime, and infrastructure.

Measured service, because the scenario describes Azure's ability to continuously monitor resource usage (compute hours, storage, data transfer) and provide detailed billing data. This aligns with NIST's definition of measured service, where cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). The granular invoice is a direct output of this metering and reporting feature.

Geo-distribution in cloud computing refers to the global footprint of a cloud provider's infrastructure, with datacenters deployed across multiple geographic regions. This allows applications to be hosted closer to end users, reducing network latency and improving the user experience. It also supports data residency requirements and disaster recovery by replicating data across regions.

The billing model for Azure SQL Database, which itemizes usage based on data stored and transactions per second (DTUs), directly demonstrates the 'Measured service' characteristic. This is because cloud providers meter and charge for resource consumption (storage and DTUs) with pay-per-use billing, providing transparency for both the provider and consumer. The detailed invoice showing exact usage and charges is the hallmark of measured service, where usage is monitored, controlled, and reported.

Under the shared responsibility model, the customer is always responsible for managing data and access identities, regardless of whether the service is IaaS, PaaS, or SaaS. This includes classifying data, encrypting data at rest and in transit, and configuring identity and access management (IAM) policies. Even in SaaS, where the provider manages the application, the customer must control who has access and how data is protected.

Azure supports GDPR data residency by offering data center regions within the EU (e.g., West Europe, North Europe, France Central) and including contractual commitments in the Microsoft Online Services Terms that guarantee customer data remains stored in the chosen EU region. Customers must explicitly select these regions during resource deployment and can use Azure Policy to enforce region restrictions, but the core support comes from Azure's physical infrastructure and legal agreements, not automatic enforcement.

A hybrid cloud deployment model is most suitable because it combines on-premises infrastructure (private cloud) with public cloud services like Azure. This allows the company to keep sensitive data on-premises to meet regulatory compliance while leveraging Azure for development and testing workloads, which do not have the same data residency constraints.

An SLA is a legally binding contract between a cloud provider and a customer that specifies guaranteed uptime, performance, and credits for breaches, while an SLO is an internal target (e.g., 99.9% uptime) that the provider sets to meet or exceed the SLA. The SLA defines the minimum commitment; the SLO is a stricter internal goal used to drive operational excellence and avoid SLA violations.

B is correct because on-demand self-service allows users to provision cloud resources like virtual machines and storage automatically, without requiring human interaction or manual approval from a central IT team. This characteristic is defined by NIST SP 800-145 as the ability for a consumer to unilaterally provision computing capabilities as needed, which directly matches the startup's requirement for no-wait provisioning.

A hybrid cloud deployment model explicitly combines on-premises infrastructure (private cloud or local datacenter) with public cloud resources, enabling data and application portability through technologies like VPNs, dedicated interconnects, or orchestration tools. This model allows workloads to burst to the public cloud during peak demand while keeping sensitive data on-premises, fulfilling the scenario described in the question.

Resource pooling is the cloud characteristic that allows a provider to serve multiple customers from the same physical infrastructure, using multi-tenant models. This sharing enables economies of scale because the provider can amortize hardware costs across many tenants, reducing per-customer pricing. The scenario directly describes multi-tenancy and shared infrastructure, which is the essence of resource pooling.

This scenario describes scalability, specifically the ability to scale out (increase capacity) for a promotional event and then scale in (reduce resources) afterward, paying only for what is used. Azure Auto Scaling (e.g., Virtual Machine Scale Sets or Azure App Service autoscale) automatically adjusts compute resources based on demand, aligning with the pay-as-you-go model. The key is that resources are temporarily increased and then reduced, which is the hallmark of scalability, not just the ability to handle load.

This scenario describes Software as a Service (SaaS) because the startup is using a fully managed cloud-based email application accessed via a web browser, with no local installation required. The provider handles all updates, maintenance, and infrastructure, which is the defining characteristic of SaaS. Examples include Microsoft 365 or Google Workspace, where the consumer only uses the software without managing the underlying platform or infrastructure.

Defense in depth is a layered security strategy that uses multiple, independent security controls across different layers of the IT stack (network, compute, storage, application, data) to protect assets. If one layer is breached, additional layers are in place to prevent or limit further compromise. This approach is fundamental to Azure's security architecture, where tools like Azure Firewall, Network Security Groups (NSGs), Azure Policy, and Azure Defender work together to provide overlapping protections.

The shared responsibility model defines the division of security and compliance obligations between the cloud provider and the customer. The provider is responsible for the security 'of' the cloud (physical hosts, network, hypervisor), while the customer is responsible for security 'in' the cloud (data, access management, OS configuration). This division varies by service model (IaaS, PaaS, SaaS), but the core principle is that security is a shared, not transferred, responsibility.

Serverless computing is a cloud execution model where the cloud provider dynamically manages the allocation and provisioning of servers. Developers write and deploy code in the form of functions (e.g., AWS Lambda, Azure Functions) without provisioning or managing any underlying server infrastructure, and they are billed only for the actual compute time consumed during execution, not for idle capacity.

Cloud computing enables self-service provisioning of resources via APIs, allowing a development team to spin up a complete test environment in minutes without waiting for hardware procurement. This directly demonstrates 'increased speed and agility' by reducing the time from idea to deployment, a core benefit of Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) models.

Software as a Service (SaaS) is a cloud computing model where the provider hosts and manages the entire software application, including the underlying infrastructure, middleware, and data. Customers access the application over the internet (typically via a web browser or API) without needing to install, maintain, or update anything locally. This model shifts all operational responsibility to the provider, making it the most 'hands-off' cloud service model for the customer.

The scenario describes automatically scaling the number of virtual machines up and down based on the queue size, which directly aligns with the cloud characteristic of elasticity. Elasticity allows resources to be dynamically provisioned and de-provisioned to match workload demand, ensuring the company never pays for idle capacity. This is distinct from high availability, fault tolerance, or disaster recovery, which focus on uptime, redundancy, and data protection rather than dynamic scaling.

Sustainability directly addresses the goal of reducing carbon footprint through the use of renewable energy. Cloud providers like Microsoft Azure invest in renewable energy projects and carbon offset programs, enabling customers to lower their environmental impact by consolidating workloads in energy-efficient data centers. This benefit is explicitly tied to environmental responsibility, not operational metrics like uptime or resource scaling.

Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. By deploying the application across multiple zones, the solution remains operational if one entire datacenter fails, as the other zones continue to serve traffic. This directly addresses the requirement to survive a single datacenter outage within a region.

Azure charges for outbound data transfer (egress) from Azure data centers to the internet or other regions, while inbound data transfer (ingress) into Azure is free. This pricing model encourages customers to move data into Azure without upfront cost, but charges apply when data leaves Azure's network, reflecting the bandwidth costs incurred by Microsoft.