78 free CompTIA Cloud+ CV0-004 practice questions from the CertStash pack of 314, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 78 free here, all 314 in the pack, and each step includes the one before it.
Get all 314 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
A software engineer needs to transfer data over the internet using programmatic access while also being able to query the data. Which of the following will best help the engineer to complete this task?
Show answer and explanation
Correct answer: D. GraphQL
GraphQL is a query language and runtime that allows programmatic access to data over the internet while enabling flexible data querying. It specifically addresses the need to both transfer data and query it efficiently. SQL is for databases only, Web sockets are for real-time communication, and RPC is for remote procedure calls without query capabilities.
Why the other options are wrong
- A. SQL operates on databases, not for general internet data transfer and querying.
- B. Web sockets provide bidirectional communication but lack query capabilities.
- C. RPC enables remote function calls but does not provide query language functionality.
Question 2
Which of the following is a field of computer science that enables computers to identify and understand objects and people in images and videos?
Show answer and explanation
Correct answer: D. Computer vision
Computer vision is the field of computer science that enables machines to identify and understand objects and people in images and videos. It encompasses image recognition, object detection, and related tasks. Image reconstruction refers to rebuilding images from data, facial recognition is a specific application of computer vision, and natural language processing deals with text, not images.
Why the other options are wrong
- A. Image reconstruction is a technique within computer vision, not the broader field definition.
- B. Facial recognition is a specific application of computer vision, not the entire field.
- C. Natural language processing focuses on text and language, not visual understanding.
Question 3
A company needs to deploy its own code directly in the cloud without provisioning additional infrastructure. Which of the following is the best cloud service model for the company to use?
Show answer and explanation
Correct answer: A. PaaS
PaaS (Platform as a Service) is the ideal model for deploying code directly without provisioning infrastructure. The platform provider manages servers, storage, and networking while developers focus on application code. SaaS is for end-user applications, IaaS requires infrastructure provisioning, and XaaS is a generic term.
Why the other options are wrong
- B. SaaS provides finished applications to end-users, not a development deployment platform.
- C. IaaS requires the company to provision and manage infrastructure, defeating the purpose.
- D. XaaS is too generic and does not specifically address code deployment without infrastructure.
Question 4
A company just learned that the data in its object storage was accessed by an unauthorized party. Which of the following should the company have done to make the data unusable?
Show answer and explanation
Correct answer: D. The company should have encrypted the data at rest.
Encryption at rest ensures that even if data is accessed by unauthorized parties, it remains unreadable and unusable without the decryption key. This is the fundamental protection mechanism that makes stolen data worthless. Switching storage types does not protect data, hashing is for verification not protection, and changing permissions after a breach does nothing to secure already-accessed data.
Why the other options are wrong
- A. Storage type does not prevent unauthorized access or make data unusable if accessed.
- B. Hashing is a one-way function for verification, not encryption for making data unreadable.
- C. Changing permissions after unauthorized access has already occurred provides no retroactive protection.
Question 5
A customer relationship management application, which is hosted in a public cloud IaaS network, is vulnerable to a remote command execution vulnerability. Which of the following is the best solution for the security engineer to implement to prevent the application from being exploited by basic attacks?
Show answer and explanation
Correct answer: D. WAF
A WAF (Web Application Firewall) is specifically designed to protect web applications from exploits including remote command execution vulnerabilities by filtering malicious HTTP requests. It operates at the application layer and can detect and block attack patterns. IPS works at network level, ACLs control access but not application attacks, and DLP prevents data loss rather than stopping attacks.
Why the other options are wrong
- A. IPS (Intrusion Prevention System) operates at the network layer and is less effective against application-layer exploits.
- B. ACLs control network traffic access but cannot specifically prevent remote command execution attacks.
- C. DLP (Data Loss Prevention) focuses on preventing unauthorized data movement, not stopping application attacks.
Question 6
Which of the following is a difference between a SAN and a NAS?
Show answer and explanation
Correct answer: D. A NAS uses a slower protocol than a SAN.
NAS (Network Attached Storage) uses file-based protocols like NFS or SMB which operate at a higher abstraction layer and are inherently slower, while SAN (Storage Area Network) uses block-level protocols like Fibre Channel or iSCSI that provide direct block access with lower latency. This makes SAN faster than NAS. The other options contain false claims about SAN and NAS capabilities.
Why the other options are wrong
- A. SANs can use Fibre Channel, iSCSI over Ethernet, or other protocols, not exclusively fiber.
- B. SANs use block-level protocols (Fibre Channel, iSCSI), not standard Ethernet-based file protocols.
- C. NAS is slower than SAN due to its file-level protocol overhead, not faster.
Question 7
A cloud engineer is troubleshooting an application that consumes multiple third-party REST APIs. The application is randomly experiencing high latency. Which of the following would best help determine the source of the latency?
Show answer and explanation
Correct answer: D. Enabling tracing to detect HTTP response times and codes
Distributed tracing is the best tool for identifying latency sources in applications using multiple APIs. It tracks requests across services and shows HTTP response times and status codes, allowing engineers to pinpoint which third-party API call or service is causing delays. Centralized logging shows request data but not response timing details, flow logs capture packets but lack HTTP-level insight, and API gateways track requests but not end-to-end latency across third-party services.
Why the other options are wrong
- A. Centralized logging records requests but does not effectively measure response times and latency sources.
- B. Flow logs operate at the network packet level and lack application-layer HTTP timing information.
- C. API gateways track requests but cannot trace through third-party APIs to identify their latency contribution.
Question 8
A group of cloud administrators frequently uses the same deployment template to recreate a cloud-based development environment. The administrators are unable to go back and review the history of changes they have made to the template. Which of the following cloud resource deployment concepts should the administrator start using?
Show answer and explanation
Correct answer: D. Versioning
Versioning enables administrators to track, review, and revert changes to deployment templates over time. It maintains a complete history of modifications, allowing teams to understand what changed and when. Drift detection identifies configuration differences, repeatability ensures consistent deployments, and documentation provides manual notes , none of these provide automatic historical change tracking like versioning does.
Why the other options are wrong
- A. Drift detection identifies configuration divergence but does not provide change history.
- B. Repeatability ensures consistent redeployment but does not track historical changes.
- C. Documentation requires manual effort and does not provide systematic change history tracking.
Question 9
A government agency in the public sector is considering a migration from on premises to the cloud. Which of the following are the most important considerations for this cloud migration? (Choose two.)
Show answer and explanation
Correct answer: A, D. Compliance; Regulatory
For a government agency migrating to the cloud, Compliance and Regulatory considerations are paramount. Government entities operate under strict regulatory frameworks (HIPAA, FedRAMP, FISMA, etc.) and must ensure their cloud solutions meet compliance requirements. These are foundational decision criteria that will influence all other aspects of the migration and cannot be overlooked.
Why the other options are wrong
- B. IaaS vs. SaaS is a service model selection decision, important but secondary to compliance requirements.
- C. Firewall capabilities are a technical implementation detail that must be designed around compliance requirements, not a primary consideration.
- E. Implementation timeline is a project management concern that should be determined after compliance and regulatory requirements are established.
- F. Service availability is a technical requirement that must meet regulatory standards but is not itself a primary migration consideration for government agencies.
Question 10
A company wants to optimize cloud resources and lower the overhead caused by managing multiple operating systems. Which of the following compute resources would be best to help to achieve this goal?
Show answer and explanation
Correct answer: B. Containers
Containers are the best choice for optimizing cloud resources and reducing OS management overhead. Containers allow multiple applications to run on a single OS kernel, eliminating the need to manage separate operating systems for each workload. This significantly reduces resource consumption, simplifies management, and lowers operational overhead compared to running multiple VMs with their own OS instances.
Why the other options are wrong
- A. VMs require managing individual operating systems for each instance, directly contradicting the goal of reducing OS management overhead.
- C. Remote desktops do not reduce OS management overhead; they typically increase complexity and administrative burden.
- D. Bare-metal servers still require OS installation and management with no abstraction layer, failing to address the overhead reduction goal.
What people say about the full CV0-004 pack 4.9 from 9
Thanks for giving me the best CompTIA Cloud+ CV0-004 exam questions, I read and passed smoothly. Wonderful.
Just got my results, I passed. Passed every exam I used it for! Work as an IT engineer working through several certs this year. This is my main resource. Real exam questions at a cheap price.
Passed. Passed. Passed. Wonderful, thanks for your great CV0-004 exam questions.
Question 11
Given the following command: $docker pull images.comptia.org/user1/myimage:latest Which of the following correctly identifies images.comptia.org?
Show answer and explanation
Correct answer: A. Image registry
In the Docker pull command syntax, 'registry/repository:tag', the component 'images.comptia.org' represents the image registry, the server location where the Docker image is stored and retrieved from. This is the registry hostname that Docker contacts to download the image.
Why the other options are wrong
- B. The image creator is typically represented by the repository path (user1 in this case), not the registry domain.
- C. The image version is specified by the tag component after the colon (:latest).
- D. The image name is 'myimage', not the registry domain.
Question 12
An organization has been using an old version of an Apache Log4j software component in its critical software application. Which of the following should the organization use to calculate the severity of the risk from using this component?
Show answer and explanation
Correct answer: B. CVSS
CVSS (Common Vulnerability Scoring System) is the standard framework used to calculate and represent the severity of security vulnerabilities. It provides a numerical score that helps organizations prioritize remediation efforts. While CVE identifies vulnerabilities and CWE/CWSS describe weakness categories, CVSS is specifically designed for severity calculation.
Why the other options are wrong
- A. CWE (Common Weakness Enumeration) identifies types of weaknesses, not severity levels.
- C. CWSS (Common Weakness Scoring System) scores the weakness characteristics, not the vulnerability severity in a deployed system.
- D. CVE (Common Vulnerabilities and Exposures) identifies and catalogs vulnerabilities but does not score their severity.
Question 13
Which of the following is the most cost-effective way to store data that is infrequently accessed?
Show answer and explanation
Correct answer: C. Off-site
Off-site storage refers to cold storage solutions designed for infrequently accessed data, providing the lowest cost per gigabyte. Cold storage tiers are optimized for archival and long-term retention with minimal retrieval frequency, offering significant cost savings compared to hot or warm storage options that maintain higher availability and performance.
Why the other options are wrong
- A. Cold site refers to disaster recovery infrastructure, not data storage cost optimization.
- B. Hot site is a fully operational backup facility, relevant to business continuity but not data storage cost reduction.
- D. Warm site is a partially provisioned DR facility, more costly than cold storage for infrequently accessed data.
Question 14
Which of the following AI/ML technologies consumes text input to discern tone?
Show answer and explanation
Correct answer: D. Sentiment analysis
Sentiment analysis is the AI/ML technology specifically designed to analyze text input and determine the emotional tone or sentiment expressed, whether text conveys positive, negative, or neutral attitudes. It processes natural language to discern underlying emotions and attitudes.
Why the other options are wrong
- A. Text recognition (OCR) extracts text from images but does not analyze emotional tone.
- B. Computer vision processes visual images and does not analyze text sentiment.
- C. Visual recognition identifies objects and patterns in images, not text-based emotional content.
Question 15
A cloud engineer is implementing a deployment strategy with the following requirements: • At least two environments for production and development must be supported. • Changes in one environment must not impact the other environment. • The highest possible availability must be achieved. Which of the following deployment strategies should the engineer implement?
Show answer and explanation
Correct answer: B. Blue-green
Blue-green deployment maintains two identical production environments (blue and green) where one is active while the other is idle. This strategy perfectly meets all three requirements: it supports separate environments that don't impact each other, provides high availability through zero-downtime deployments (switching between environments), and ensures complete isolation between production and development through environment separation.
Why the other options are wrong
- A. Rolling deployment updates instances incrementally, which doesn't clearly separate environments and can cause temporary service degradation.
- C. In-place deployment updates existing infrastructure without maintaining separate environments, risking impact between them.
- D. Canary deployment gradually rolls out changes to a subset of instances, which doesn't maintain distinct separated environments.
Question 16
A cloud engineer is designing a cloud native, three-tier application. The engineer must adhere to the following security best practices: Minimal services should run on all layers of the stack. The solution should be vendor agnostic. Virtualization could be used over physical hardware. Which of the following concepts should the engineer use to design the system to best meet these requirements?
Show answer and explanation
Correct answer: B. Microservices
Microservices architecture best meets all three requirements: it minimizes services running on each layer by using small, focused services; it is vendor-agnostic as microservices can be deployed across any cloud platform or on-premises; and services can run on virtual machines or containerized environments. Microservices embody cloud-native design principles where minimal, specialized services are deployed independently. Virtual machines alone don't ensure minimal service deployment. Fan-out is a messaging pattern, not an architectural approach. Cloud-provided managed services create vendor lock-in, violating the vendor-agnostic requirement.
Why the other options are wrong
- A. Virtual machines alone do not ensure minimal services or vendor agnosticism; they are simply infrastructure.
- C. Fan-out is a messaging pattern for event distribution, not a system design pattern addressing the stated requirements.
- D. Cloud-provided managed services create vendor lock-in and dependency, directly conflicting with the vendor-agnostic requirement.
Question 17
A junior cloud administrator was recently promoted to cloud administrator and has been added to the cloud administrator group. The cloud administrator group is the only one that can access the engineering VM. The new administrator unsuccessfully attempts to access the engineering VM. However, the other administrators can access it without issue. Which of the following is the best way to identify the root cause?
Show answer and explanation
Correct answer: B. Reviewing the administrator’s permissions to access the engineering VM
Reviewing the administrator's permissions is the best way to identify the root cause. Since the new administrator was just added to the group and cannot access the VM while others in the same group can, the issue lies with the specific administrator's access configuration. This could involve group membership not properly propagating, role assignments, SSH key configuration, or other permission-related settings that need to be verified.
Why the other options are wrong
- A. Rebooting the VM would not resolve access issues related to permissions and could cause unnecessary downtime.
- C. Opening connections to 0.0.0.0/0 is a dangerous security practice that masks the real problem instead of solving it.
- D. Packet captures would show network traffic patterns but won't identify permission-related issues that are preventing access.
Question 18
A company receives files daily from a bank. The company requires that the files must be copied from the cloud storage resource to another cloud storage resource for further processing. Which of the following methods requires the least amount of effort to achieve the task?
Show answer and explanation
Correct answer: C. Event-driven architecture
Event-driven architecture requires the least effort for this scenario. The company can configure an event trigger in the source cloud storage that automatically initiates a copy operation to the destination storage when files arrive, requiring minimal manual intervention and coding. RPC and SOAP are lower-level communication protocols requiring custom development, and REST would require building custom API calls and orchestration logic, making them more effort-intensive than event-driven automation.
Why the other options are wrong
- A. RPC requires custom code implementation for each file transfer operation.
- B. SOAP is a complex protocol requiring significant development effort for file transfer orchestration.
- D. REST would require building custom API integrations and orchestration logic, more effort than event-driven triggers.
Question 19
A company’s VMs that are created using the noncritical application tag are automatically shut down at 5:00 p.m. using a cronjob. Which of the following actions would allow a cloud engineer to stop all unresponsive instances with the least effort in case the automation fails?
Show answer and explanation
Correct answer: C. Using the cloud provider command line to stop the instances based on tags
Using the cloud provider command line interface with tag-based filters requires the least effort because it automates the stopping process based on existing tags. This approach can target all instances with the 'noncritical application' tag in a single command, making it the most efficient and scalable solution compared to manual intervention, audit log analysis, or custom scripting.
Why the other options are wrong
- A. Audit logs are for tracking events that have already occurred; they don't directly stop instances and require manual analysis to identify which instances to stop.
- B. Using the web console requires manually identifying and checking each instance, which is tedious and inefficient at scale.
- D. Writing a Bash script requires more effort and setup time compared to using built-in CLI commands with tag filtering.
Question 20
Which of the following reduces the chance of introducing a misconfiguration into cloud deployment templates?
Show answer and explanation
Correct answer: B. Opening pull requests for changes
Opening pull requests for changes implements a review and approval process before code is merged. This peer review mechanism catches misconfigurations and errors before they are deployed to cloud infrastructure, reducing the risk of introducing mistakes into production templates.
Why the other options are wrong
- A. Git fetch retrieves updates but does not prevent misconfigurations; it's a retrieval operation without review controls.
- C. Using the web interface to update files bypasses version control and peer review, increasing misconfiguration risk.
- D. Committing directly to the main branch skips review processes and allows misconfigured templates to reach production immediately.
Question 21
A cloud engineer needs to deploy a new version of a web application to 100 servers. In the past, new version deployments have caused outages. Which of the following deployment types should the cloud engineer implement to prevent the outages from happening this time?
Show answer and explanation
Correct answer: B. Blue-green
Blue-green deployment maintains two identical production environments and switches traffic between them, allowing the new version to be fully tested before cutover. If issues occur, traffic can immediately revert to the previous version, preventing outages. This is the safest strategy for deployments that have caused outages in the past.
Why the other options are wrong
- A. Rolling deployment gradually updates servers, which means outages can still occur during the transition if the new version has issues.
- C. Canary deployment routes a small percentage of traffic to the new version first, but still risks outages if issues aren't caught before broader rollout.
- D. Round-robin is a load-balancing algorithm, not a deployment strategy, and does not address deployment safety.
Question 22
A company’s engineering department is conducting a month-long test on the scalability of an in-house-developed software that requires a cluster of 100 or more servers. Which of the following models is the best to use?
Show answer and explanation
Correct answer: D. IaaS
IaaS (Infrastructure as a Service) provides on-demand virtual computing resources including servers, storage, and networking. For a month-long scalability test requiring 100+ servers of in-house-developed software, IaaS offers the flexibility to provision and scale infrastructure independently, control the deployment environment, and test at scale without long-term commitment. This is exactly what IaaS is designed for.
Why the other options are wrong
- A. PaaS abstracts infrastructure and is designed for application platform services, limiting control over underlying server configurations needed for custom software testing.
- B. SaaS delivers ready-made applications and doesn't provide the infrastructure control needed to deploy and test custom in-house software.
- C. DBaaS focuses specifically on database services and doesn't address the need for general-purpose server infrastructure.
Question 23
Which of the following is a direct effect of cloud migration on an enterprise?
Show answer and explanation
Correct answer: D. Utility costs will be reduced on premises.
When workloads move to the cloud, the on-premises servers and supporting equipment are no longer needed to run them. This directly reduces on-premises power and cooling, so utility costs on premises go down.
Why the other options are wrong
- A. Reorganising the reporting structure is an optional business decision, not a direct result of migration.
- B. Compatibility issues are addressed as part of planning and testing the migration, not on premises afterwards.
- C. Cloud solutions do not inherently require fewer resources; the resources are simply provided and billed by the provider.
Question 24
A cloud architect attempts to modify a protected branch but is unable to do so. The architect receives an error indicating the action cannot be completed. Which of the following should the architect try instead?
Show answer and explanation
Correct answer: B. Creating a pull request
When unable to directly modify a protected branch, the standard approach is to create a pull request. Protected branches are intentionally restricted to prevent direct modifications, requiring changes to go through a formal review process. A pull request initiates this review workflow, allowing the proposed changes to be evaluated and merged through the protection mechanisms.
Why the other options are wrong
- A. Adding a new remote doesn't address the protected branch restriction and wouldn't enable modification.
- C. Merging a branch still requires the same protections to be satisfied as direct modification.
- D. Rebasing a branch is a technical operation that doesn't bypass branch protection rules and would face the same restrictions.
Question 25
Which of the following container storage types loses data after a restart?
Show answer and explanation
Correct answer: C. Ephemeral
Ephemeral storage is temporary and designed to be lost after a container restart or termination. It provides fast, temporary workspace for running containers but is not persisted. When a container is restarted or removed, any data stored in ephemeral storage is deleted, making it unsuitable for data that must survive container lifecycle events.
Why the other options are wrong
- A. Object storage is persistent cloud storage designed to retain data long-term.
- B. Persistent volumes are specifically designed to retain data across container restarts and terminations.
- D. Block storage provides persistent storage at the block level and retains data after restarts.
Question 26
A cloud resource increases its capacity based on seasonal activity. Which of the following best describes this type of cloud instance and the scaling approach?
Show answer and explanation
Correct answer: C. Elastic; triggered by trend
Elastic scaling refers to the ability of cloud resources to automatically increase or decrease capacity based on demand patterns. Seasonal activity is a predictable trend that triggers scaling decisions. Elastic resources automatically respond to trends (like seasonal patterns) without manual intervention, which matches the described behavior of capacity changes based on seasonal activity.
Why the other options are wrong
- A. Fixed capacity doesn't increase or decrease, and load-triggered scaling responds to immediate traffic rather than predictable seasonal trends.
- B. Permanent resources maintain constant capacity, and manual triggering requires human intervention, not automatic seasonal response.
- D. Ephemeral instances are typically short-lived and event-driven, not designed for sustained capacity increases tied to seasonal trends.
Question 27
Which of the following industry standards mentions that credit card data must not be exchanged or stored in cleartext?
Show answer and explanation
Correct answer: D. PCI-DSS
PCI-DSS (Payment Card Industry Data Security Standard) is the specific industry standard that mandates credit card data must not be exchanged or stored in cleartext. It requires encryption of cardholder data in transit and at rest. CSA provides cloud security guidance but not credit card-specific requirements, GDPR addresses personal data privacy more broadly, and SOC2 covers service organization controls but is not specifically focused on credit card data handling.
Why the other options are wrong
- A. CSA provides cloud security framework but doesn't specifically mandate cleartext restrictions for credit card data.
- B. GDPR focuses on personal data privacy generally, not specifically on credit card cleartext prohibition.
- C. SOC2 addresses internal controls and security but is not the primary standard for credit card data protection.
Question 28
A cloud engineer is reviewing a disaster recovery plan that includes the following requirements: System state, files, and configurations must be backed up on a weekly basis. The system state, file, and configuration backups must be tested annually. Which of the following backup methods should the engineer implement for the first week the plan is executed?
Show answer and explanation
Correct answer: D. Full
For the first week of executing a new backup plan, a full backup must be performed. Full backups capture the entire system state, files, and configurations, creating a complete baseline. Subsequent weekly backups could use incremental or differential methods, but the initial backup must be comprehensive. This establishes the foundation from which all future incremental backups will be based.
Why the other options are wrong
- A. Differential backups capture changes since the last full backup; they cannot be used as the initial backup without a baseline.
- B. Incremental backups only capture changes since the last backup of any type; they require a full backup baseline to be effective.
- C. Snapshots capture point-in-time system state but are not the conventional method for initial comprehensive backup plans requiring weekly execution.
Question 29
A cloud engineer wants to replace the current on-premises, unstructured data storage with a solution in the cloud. The new solution needs to be cost-effective and highly scalable. Which of the following types of storage would be best to use?
Show answer and explanation
Correct answer: C. Object
Object storage is ideal for unstructured data and excels at both cost-effectiveness and scalability. It stores data as objects with metadata, handles massive scale effortlessly, and typically costs less than other storage types due to its distributed nature and lack of indexing overhead. Object storage is the standard choice for cloud-based unstructured data repositories.
Why the other options are wrong
- A. File storage is organized hierarchically, which is less scalable and more expensive for large unstructured datasets.
- B. Block storage is structured for individual volumes and has higher costs per unit; it's not ideal for massive unstructured data.
- D. SANs are expensive enterprise storage solutions and not cost-effective for cloud migration scenarios.
Question 30
Which of the following migration types is best to use when migrating a highly available application, which is normally hosted on a local VM cluster, for usage with an external user population?
Show answer and explanation
Correct answer: C. On-premises to cloud
On-premises to cloud migration is the correct choice for this scenario. The application is currently on a local VM cluster (on-premises) and needs to be moved for usage by an external global user population. Cloud platforms provide the global reach, scalability, and distributed infrastructure necessary to support external users worldwide while maintaining high availability.
Why the other options are wrong
- A. Cloud to on-premises is the reverse direction and wouldn't meet the requirement of serving an external global user population.
- B. Cloud to cloud applies when already in a cloud environment, not when starting from on-premises.
- D. On-premises to on-premises wouldn't address the need to serve external global users or leverage cloud benefits.
Question 31
A cloud administrator recently created three servers in the cloud. The goal was to create ACLs so the servers could not communicate with each other. The servers were configured with the following IP addresses: After implementing the ACLs, the administrator confirmed that some servers are still able to reach the other servers. Which of the following should the administrator change to prevent the servers from being on the same network?
Show answer and explanation
Correct answer: C. The IP address of Server 2 to 172.16.12.18
The mask 255.255.255.240 is /28, so each subnet has 16 addresses. Server 1 (172.16.12.7) and Server 2 (172.16.12.14) are both in 172.16.12.0/28, so they share a network. Server 3 (172.16.13.4) is in 172.16.13.0/28. Server 2's gateway, 172.16.12.17, is in the next block, 172.16.12.16/28, which shows where Server 2 belongs. Changing Server 2 to 172.16.12.18 places it in 172.16.12.16/28 with its gateway and off Server 1's network.
Why the other options are wrong
- A. 172.16.12.36 is in 172.16.12.32/28, which does separate the servers, but Server 1's gateway 172.16.12.1 would then be outside its subnet.
- B. 172.16.12.2 is still in 172.16.12.0/28 with Server 2, so they stay on the same network.
- D. 172.16.14.14 is on a separate network, but Server 2's gateway 172.16.12.17 would then be outside its subnet.
Question 32
A large corporation, which operates exclusively on private cloud environments, is considering a merger and acquisition of two smaller companies, which operate on premises and in public cloud environments. Which of the following considerations is the most important for the parent corporation?
Show answer and explanation
Correct answer: C. Platform compatibility and migration strategies
When merging companies with different infrastructure environments (private cloud, on-premises, and public cloud), the most critical consideration is platform compatibility and migration strategies. This encompasses how to unify disparate systems, ensure applications can interoperate, plan data migration paths, and maintain service continuity during integration. Without addressing platform compatibility and migration approaches first, the organization risks incompatible systems, data loss, and operational disruption. The other factors (costs, hardware, management) are secondary concerns that depend on resolving compatibility issues.
Why the other options are wrong
- A. While cost implications are important, they are secondary to ensuring the systems can actually work together.
- B. Networking and hardware are operational details that follow after determining platform compatibility strategy.
- D. Management overhead and vendor lock-in are concerns that arise after establishing a compatible technical foundation.
Question 33
A cloud administrator is provisioning infrastructure to run an application with the following requirements: • Ten midsize instances need to run as a cluster most of the day. • Sixteen midsize instances are required during peak hours. • Costs must be kept low. • The instances must be deployed in an IaaS model. • The application has no tolerance for service disruptions. Which of the following steps should the cloud architect take to host the application?
Show answer and explanation
Correct answer: C. Deploy reserved instances for normal operation and add pay-as-you-go instances during peak hours.
The application needs 10 instances consistently and 16 during peaks, with zero tolerance for disruptions and low costs. Reserved instances provide discounted rates for the baseline 10 instances running most of the day. During peak hours, adding pay-as-you-go instances for the additional 6 needed provides flexibility without overcommitting. This approach balances cost (reserved discounts for baseline) with reliability (no spot interruptions) and scalability (pay-as-you-go for peaks), meeting all requirements.
Why the other options are wrong
- A. Reserving 16 instances and turning off 6 wastes money, reserved instances are expensive whether running or not, and this defeats the purpose of reservations.
- B. Spot instances can be interrupted, violating the zero-tolerance for service disruptions requirement.
- D. Spot instances for normal operation violates the no-disruption requirement; scheduled scaling cannot guarantee availability on spot instances.
Question 34
An IT manager is planning a cloud deployment for a new company. The company does not want on-premises servers or applications. Which of the following is the best approach for the manager to take?
Show answer and explanation
Correct answer: B. Implementation, SaaS
The company wants no on-premises servers or applications, meaning they want a fully managed cloud solution where the provider handles everything. SaaS (Software as a Service) delivers complete applications over the cloud with no on-premises infrastructure or local application management required. This is the best approach for a company seeking to eliminate on-premises presence entirely and move entirely to cloud-delivered services.
Why the other options are wrong
- A. Colocation-PaaS is contradictory; colocation implies on-premises presence, which the company wants to avoid.
- C. Migration-IaaS still requires the company to manage virtual machines and infrastructure, leaving on-premises-like responsibilities.
- D. Hybrid-XaaS retains on-premises components, conflicting with the requirement to eliminate on-premises servers.
Question 35
Which of the following is the most common characteristic of SSDs?
Show answer and explanation
Correct answer: C. SSDs can be used for high-IOP applications.
SSDs excel at high-IOPS (Input/Output Operations Per Second) applications due to their lack of mechanical components and fast random access times. This is their most defining and commonly leveraged characteristic compared to spinning disks. SSDs are now cost-competitive with HDDs, available in large capacities, and used across all storage tiers including hot and cold storage, making the other options incorrect generalizations.
Why the other options are wrong
- A. SSDs have become price-competitive with HDDs and are no longer significantly more expensive in many applications.
- B. Modern SSDs are available in multiple terabytes, rivaling HDD capacities.
- D. SSDs are used across all storage tiers (hot, warm, cold) and are actually preferred for performance-critical applications.
Question 36
An engineer made a change to an application and needs to select a deployment strategy that meets the following requirements: Is simple and fast - Can be performed on two identical platforms Which of the following strategies should the engineer use?
Show answer and explanation
Correct answer: A. Blue-green
Blue-green deployment is the ideal strategy meeting both requirements. It involves two identical production environments (blue and green), with traffic switched from one to the other after deployment. This approach is simple, fast (the switch is instantaneous), and perfectly suited for two identical platforms. It allows quick rollback if needed and minimizes downtime.
Why the other options are wrong
- B. Canary deployment gradually rolls out changes to a subset of users, which is more complex and slower than the requirements specify.
- C. Rolling deployment updates instances incrementally, which is slower and doesn't align with the requirement for simple and fast deployment.
- D. In-place deployment modifies the existing environment directly, which carries higher risk and doesn't leverage having two identical platforms.
Question 37
A company recently set up a CDN for its photography and image-sharing website. Which of the following is the most likely reason for the company's action?
Show answer and explanation
Correct answer: B. To improve site speed
Content Delivery Networks (CDNs) are primarily implemented to improve site speed and performance by caching and serving content from geographically distributed servers closer to end users. For a photography and image-sharing website with significant image assets, a CDN reduces latency and improves load times by serving images from edge locations nearest to users.
Why the other options are wrong
- A. CDNs don't eliminate storage costs; they cache content but storage costs remain at the origin.
- C. While CDNs can provide some security benefits, that's not the primary reason for implementation in this context.
- D. CDNs don't prevent unauthorized access; they focus on content delivery and performance optimization.
Question 38
A customer is migrating applications to the cloud and wants to grant authorization using the classification levels of each system. Which of the following should the customer implement to ensure authorization to systems is granted when the user and system classification properties match? (Choose two.)
Show answer and explanation
Correct answer: A, D. Resource tagging; Attribute-based access control
To grant authorization based on matching classification properties between users and systems, the customer needs Resource tagging (A) to label systems with classification levels, and Attribute-based access control (D) to enforce authorization rules that compare user and resource attributes. Single sign-on (B) handles authentication, not attribute-based authorization. MFA (C) adds authentication factors. Token-based authentication (E) enables access but doesn't enforce attribute matching. A bastion host (F) is a security perimeter tool.
Why the other options are wrong
- B. SSO handles authentication but not attribute-based authorization matching.
- C. MFA strengthens authentication but doesn't enable classification-level matching.
- E. Token authentication doesn't enforce attribute-based authorization rules.
- F. Bastion hosts provide secure access pathways, not attribute-based control logic.
Question 39
Which of the following vulnerability management concepts is best defined as the process of discovering vulnerabilities?
Show answer and explanation
Correct answer: D. Identification
Identification is the vulnerability management concept that specifically refers to the discovery phase, finding and detecting vulnerabilities in systems and applications. While scanning is a technique used during identification, the process itself is called identification. This is the initial phase of the vulnerability management lifecycle.
Why the other options are wrong
- A. Scanning is a technique or tool used during identification, not the overall concept of discovering vulnerabilities.
- B. Assessment is the evaluation and prioritization phase that occurs after vulnerabilities are identified.
- C. Remediation is the correction and patching phase that follows assessment and prioritization.
Question 40
An organization’s web application experiences periodic bursts of traffic when a new video is launched. Users are reporting poor performance in the middle of the month. Which of the following scaling approaches should the organization use to scale based on forecasted traffic?
Show answer and explanation
Correct answer: A. Scheduled
Scheduled scaling is the correct approach because the organization knows in advance when traffic bursts will occur (when new videos are launched). The poor performance in the middle of the month indicates predictable, recurring patterns. Scheduled scaling allows the infrastructure to proactively scale up before the anticipated traffic spike, ensuring adequate resources are available without manual intervention during the event.
Why the other options are wrong
- B. Manual scaling requires human intervention at the time of the surge, which is reactive rather than proactive and doesn't address the predictable nature of the traffic pattern.
- C. Event-based scaling responds to specific triggering events but doesn't leverage the organization's knowledge of when video launches occur.
- D. Load-based scaling reacts to current traffic levels after the fact, which would still result in performance issues during the initial burst.
Question 41
Which of the following models will best reduce the cost of running short-term, non-critical workloads?
Show answer and explanation
Correct answer: B. Spot instance
Spot instances offer the lowest cost compute resources by allowing organizations to bid on unused cloud capacity at significantly discounted rates (up to 90% off on-demand pricing). They are ideal for short-term, non-critical workloads that can tolerate interruptions, making them the most cost-effective option for this use case.
Why the other options are wrong
- A. Reserved instances require upfront commitment for longer periods and are better for predictable, long-term workloads.
- C. Pay-as-you-go pricing is more expensive than spot instances for the same computational resources.
- D. Dedicated hosts are significantly more expensive and designed for licensing or performance requirements, not cost optimization.
Question 42
A CI/CD pipeline is used to deploy VMs to an IaaS environment. Which of the following can be used to harden the operating system once the VM is running?
Show answer and explanation
Correct answer: D. Ansible
Ansible is a configuration management and orchestration tool that can harden running operating systems by applying security configurations, patches, and policies automatically. It can be integrated into CI/CD pipelines to apply hardening scripts and configurations to VMs after they are deployed.
Why the other options are wrong
- A. Docker is a containerization platform, not a tool for hardening running VM operating systems.
- B. Kubernetes is a container orchestration platform, not a tool for OS-level hardening of VMs.
- C. Git is a version control system; it doesn't directly harden operating systems.
Question 43
A new application that will be deployed to cloud VMs has the following requirements: • Low inter-VM latency • Horizontal scaling support • 98.5% availability • 8vCPU and 16GB • Ability to split jobs across VMs Which of the following will best meet these requirements?
Show answer and explanation
Correct answer: B. Load balanced 4vCPU with 8GB RAM on single availability zone
The application requires 8vCPU and 16GB per instance, horizontal scaling support, and 98.5% availability. Option B uses load-balanced 4vCPU with 8GB RAM instances in a single availability zone, which allows horizontal scaling by adding more VMs while meeting the total resource requirements through multiple instances and load balancing. This approach supports job distribution across VMs, maintains low inter-VM latency (single AZ), and achieves the required availability through redundancy. Single region deployment avoids multi-region latency penalties while single AZ is acceptable for 98.5% (not requiring 99.9%+) when using load balancing.
Why the other options are wrong
- A. Multi-region deployment adds unnecessary latency and complexity; the 98.5% availability requirement doesn't justify multi-region overhead.
- C. Multiple availability zones increases latency between VMs and costs; single AZ with load balancing is sufficient for 98.5% availability.
- D. A single VM cannot scale horizontally and offers no redundancy; it cannot split jobs across VMs or meet availability requirements.
Question 44
Which of the following package managers would most likely be used with Ubuntu Linux?
Show answer and explanation
Correct answer: D. APT
APT (Advanced Package Tool) is the standard package manager for Ubuntu and other Debian-based Linux distributions. It handles software installation, updates, and removal through command-line tools like apt-get and apt. YUM and DNF are used by Red Hat-based systems (RHEL, CentOS, Fedora), while Pacman is specific to Arch Linux.
Why the other options are wrong
- A. YUM is the package manager for Red Hat-based systems, not Ubuntu.
- B. DNF is the package manager for Fedora and newer Red Hat-based systems, not Ubuntu.
- C. Pacman is the package manager for Arch Linux, not Ubuntu.
Question 45
Five thousand employees always access the company’s public cloud-hosted web application on a daily basis during the same time frame. Some users have been reporting performance issues while attempting to connect to the web application. Which of the following is the best configuration approach to resolve this issue?
Show answer and explanation
Correct answer: B. Scale horizontally based on a schedule.
Since 5,000 employees access the application during the same time frame daily, this is a predictable, recurring pattern. Scheduled horizontal scaling is optimal, resources can be scaled out before the predictable peak time and scaled back after, minimizing costs while ensuring capacity. Vertical scaling (A, C) has limitations and higher costs; event-based scaling (D) reacts too late to predictable patterns. Schedule-based horizontal scaling (B) proactively addresses known demand.
Why the other options are wrong
- A. Vertical scaling has limits and higher per-unit costs; it's also reactive rather than proactive for predictable patterns.
- C. Vertical scaling is expensive, has hardware limits, and is reactive to load rather than proactive for predictable patterns.
- D. Event-based scaling reacts after load appears, causing temporary performance issues; scheduled scaling prevents this for predictable patterns.
Question 46
A cloud server needs to automatically allocate more resources during sudden peak times. This allocation does not need to occur in regular intervals. Which of the following scaling approaches should be used?
Show answer and explanation
Correct answer: A. Event
Event-based scaling allocates resources in response to specific triggers or events rather than on a schedule or regular interval. Since the requirement specifies that resource allocation should occur during sudden peak times without regular intervals, event-based scaling is the appropriate approach, it responds to real-time demand signals.
Why the other options are wrong
- B. Manual scaling requires human intervention and is not automatic.
- C. Trending-based scaling uses historical patterns to predict future needs, but doesn't specifically address sudden, unpredictable peak times.
- D. Scheduled scaling operates on predetermined time intervals, which contradicts the requirement for irregular, sudden peak allocation.
Question 47
A developer is building a new application version using a CI/CD pipeline. The developer receives the following error message log when the build fails. Which of the following is the most likely cause of this failure?
Show answer and explanation
Correct answer: D. Dependency issue
The error message 'ModuleNotFoundError: No module named 'requests'' indicates that the application is trying to import a module that is not available in the build environment. This is a classic dependency issue where a required Python package (in this case, 'requests') has not been installed or is not listed in the project's dependency configuration file (requirements.txt, setup.py, etc.). The traceback shows the failure occurs during import at line 4 of app.py, which is a runtime dependency resolution problem, not a build pipeline configuration issue.
Why the other options are wrong
- A. Incorrect version would manifest as version mismatch errors or compatibility warnings, not as a missing module import error.
- B. Test case failures would occur during the test phase and would show assertion errors or test-specific failure messages, not module import errors.
- C. A broken build pipeline would typically show configuration errors, syntax errors, or pipeline stage failures, not missing module errors during application execution.
Question 48
Which of the following vulnerability management phases includes the process of discovering newly introduced security vulnerabilities?
Show answer and explanation
Correct answer: A. Scanning
Scanning is the phase where security vulnerabilities are actively discovered and identified through automated tools that probe systems for known vulnerabilities. While Identification (B) is a related term, Scanning specifically describes the technical discovery process. Reporting comes after findings are analyzed, and Remediation addresses fixing the vulnerabilities. The question asks which phase includes the discovery process, making Scanning the most precise answer.
Why the other options are wrong
- B. Identification is more about classifying and documenting discovered vulnerabilities rather than the discovery process itself.
- C. Reporting occurs after vulnerabilities are found and analyzed, not during the discovery phase.
- D. Remediation is the phase where vulnerabilities are fixed, which comes after discovery.
Question 49
A cloud developer receives a security vulnerability scan report and needs to analyze and record the true positives. Which of the following vulnerability management steps is this an example of?
Show answer and explanation
Correct answer: A. Assessment
Assessment is the vulnerability management step where findings from scanning are analyzed to determine which vulnerabilities are true positives versus false positives. This analysis and recording of legitimate vulnerabilities represents the assessment phase where raw scan results are evaluated and validated. The other steps (identification, scanning scope, remediation) occur either before or after this analytical phase.
Why the other options are wrong
- B. Identification is the process of discovering vulnerabilities, not analyzing scan results for accuracy.
- C. Scanning scope refers to defining what systems and applications will be scanned, not analyzing results.
- D. Remediation is the step of fixing vulnerabilities, which comes after assessing and prioritizing them.
Question 50
A SaaS provider introduced new software functionality for customers as part of quarterly production enhancements. After an update is implemented, users cannot locate certain transactions from an inbound integration. During the investigation, the application owner finds the following error in the logs: Error: REST API - Deprecated call is no longer supported in this release. Which of the following is the best action for the application owner to take to resolve the issue?
Show answer and explanation
Correct answer: A. Update the custom integration to use a supported function.
The error explicitly states that a deprecated API call is no longer supported. The application owner must update the custom integration to use the current supported API functions. This is the direct and immediate solution to the problem. While testing (B) is good practice, it wouldn't have prevented this issue if the SaaS provider didn't communicate the deprecation clearly. Users monitoring updates (C) doesn't solve the technical problem, and reverting (D) avoids the issue rather than resolving it.
Why the other options are wrong
- B. Testing is preventative but doesn't resolve the current deprecated API call issue.
- C. User monitoring doesn't fix the technical incompatibility with the deprecated API.
- D. Reverting avoids the problem; the provider's new version must eventually be adopted with updated integrations.
Question 51
A cloud engineer wants to implement a monitoring solution to detect cryptojacking and other cryptomining malware on cloud instances. Which of the following metrics would most likely be used to identify the activity?
Show answer and explanation
Correct answer: D. Percent of CPU utilization
CPU utilization is the most reliable metric to detect cryptomining activity. Cryptojacking malware consumes significant CPU resources to perform mining calculations, causing abnormally high and sustained CPU usage. This metric directly correlates with the computational intensity of mining operations.
Why the other options are wrong
- A. Disk I/O does not significantly correlate with cryptomining activity, which is primarily CPU-intensive.
- B. Network packets may show minimal anomalies during cryptomining; the activity is computationally intensive rather than network-intensive.
- C. Memory utilization remains relatively normal during cryptomining; the strain is on processing power rather than memory.
Question 52
A cloud engineer is receiving multiple alerts from the infrastructure monitoring agent. The alerts state that all the VMs in the public subnet are at 100% CPU utilization. However, when the engineer checks the network utilization of the VMs, the network throughput is at normal levels. Which of the following is the most likely cause of this issue?
Show answer and explanation
Correct answer: B. Cryptojacking
Cryptojacking is the unauthorized use of computing resources to mine cryptocurrency, which causes high CPU utilization while generating minimal network traffic. The scenario perfectly matches this profile: 100% CPU usage but normal network throughput. Ransomware, DDoS, and zombie instances would typically show different resource utilization patterns (encryption activity varies, DDoS generates network traffic, zombies are compromised systems with varied behavior).
Why the other options are wrong
- A. Ransomware would show variable CPU patterns during encryption and decryption operations, plus file system activity.
- C. DDoS attacks would typically cause high network utilization, not just CPU usage with normal network throughput.
- D. Zombie instances would exhibit compromised system behavior but not necessarily consistent 100% CPU with normal network.
Question 53
A database administrator performs a full backup periodically and keeps several versions in a cloud instance with increasing storage costs. Which of the following should the administrator consider doing to manage backup retention?
Show answer and explanation
Correct answer: B. Set up a time frame for the deletion of old backup files.
The administrator is managing increasing storage costs from multiple backup versions. The most direct solution is to establish a retention policy that automatically deletes old backup files after a defined timeframe, reducing storage overhead. This involves setting rules for how long backups are kept before deletion, which directly addresses the cost management problem. Option B specifically targets the retention lifecycle management needed to control storage growth.
Why the other options are wrong
- A. Data sensitivity classification helps determine security requirements but doesn't address the storage cost issue.
- C. Identifying recovery granularity needs is important for design but doesn't reduce storage costs of existing backups.
- D. Differential backups optimize backup efficiency but don't directly address deletion of old versions or cost reduction.
Question 54
A high-usage cloud resource needs to be monitored in real time on specific events to guarantee its availability. Which of the following actions should be used to meet this requirement?
Show answer and explanation
Correct answer: B. Create a dashboard with visualizations to filter the status of critical activities
Creating a dashboard with visualizations allows the engineer to monitor specific events and the resource's status in real time, providing immediate visibility into critical activities and availability. This enables quick response to issues and meets the real-time monitoring requirement for a high-usage critical resource.
Why the other options are wrong
- A. A ping command is a basic connectivity check and does not provide the real-time event-specific monitoring or detailed availability guarantees needed.
- C. Collecting daily activity dumps is post-hoc analysis, not real-time monitoring, and does not guarantee immediate detection of availability issues.
- D. An hourly scan is too infrequent for real-time monitoring and may miss critical events or outages that occur between scans.
Question 55
A company implements a web farm with 100 servers behind an application load balancer. During scaling events, new web servers that are placed in service have not loaded all their modules, which causes some requests to the web farm to fail. Which of the following should the cloud engineer implement to address the scaling issue?
Show answer and explanation
Correct answer: A. Instance warm-up
Instance warm-up configures a grace period during which newly launched instances are allowed to complete initialization and module loading before the load balancer routes traffic to them. This prevents requests from failing due to incomplete startup on new servers during scaling events.
Why the other options are wrong
- B. Scheduled scaling plans scaling events in advance but doesn't address the issue of incomplete module loading on new instances.
- C. Event-based scaling triggers scaling based on metrics but doesn't solve the problem of instances not being ready to serve traffic.
- D. Load balancer passthrough is not a standard feature and doesn't address instance initialization requirements.
Question 56
Which of the following refers to the idea that data should stay within certain borders or territories?
Show answer and explanation
Correct answer: C. Data sovereignty
Data sovereignty refers to the concept that data is subject to the laws and governance structures of the country or region where it is located or collected, and must remain within certain borders or territories. This is a legal and regulatory concept that ensures compliance with regional data protection laws.
Why the other options are wrong
- A. Data classification refers to categorizing data by sensitivity level (public, confidential, restricted), not geographical boundaries.
- B. Data retention refers to policies governing how long data is kept before deletion, not territorial boundaries.
- D. Data ownership refers to who has legal rights and responsibility for data assets, not geographical location requirements.
Question 57
A bank informs an administrator that changes must be made to backups for long-term reporting purposes. Which of the following is the most important change the administrator should make to satisfy these requirements?
Show answer and explanation
Correct answer: C. Retention of the backups
For long-term reporting purposes, the most critical change is the retention period of backups. Long-term reporting requires that backups be kept for extended durations to support historical data analysis and compliance requirements. Retention directly addresses how long data must be preserved for reporting needs.
Why the other options are wrong
- A. While backup location matters for accessibility and compliance, it does not directly address the long-term retention requirement.
- B. The type of backup (full, incremental, differential) affects efficiency but not the core requirement for long-term availability.
- D. The backup schedule determines frequency but not the duration for which backups are kept for reporting purposes.
Question 58
A cloud service provider requires users to migrate to a new type of VM within three months. Which of the following is the best justification for this requirement?
Show answer and explanation
Correct answer: D. The equipment is reaching end of life and end of support
Equipment reaching end of life and end of support is the most compelling justification for mandatory migration. When hardware reaches end of support, vendors no longer provide security patches, bug fixes, or technical support, creating serious security and compliance risks that necessitate migration to newer, supported infrastructure.
Why the other options are wrong
- A. Security flaws can typically be patched on existing VMs without requiring migration to a new VM type.
- B. Updates affecting current VM state could be managed through patching and maintenance windows without full migration.
- C. Infrastructure maintenance can typically be performed on existing VMs through scheduled downtime rather than requiring VM type changes.
Question 59
A cloud solutions architect needs to design a solution that will collect a report and upload it to an object storage service every time a virtual machine is gracefully or non-gracefully stopped. Which of the following will best satisfy this requirement?
Show answer and explanation
Correct answer: A. An event-driven architecture that will send a message when the VM shuts down to a log-collecting function that extracts and uploads the log directly from the storage volume
An event-driven architecture listening for VM shutdown events and triggering a function to collect and upload logs is the cloud-native best practice. This approach decouples the event source from the response, scales automatically, and works for both graceful and non-graceful shutdowns without requiring code embedded on the VM.
Why the other options are wrong
- B. Webhooks on API calls may miss non-graceful shutdowns and require external system configuration; event-driven is more reliable.
- C. Object storage services cannot independently scrape VM disks; they require external triggers to retrieve data.
- D. Scripts embedded on the VM OS may fail during non-graceful shutdowns and are less reliable than infrastructure-level event handling.
Question 60
A social networking company operates globally. Some users from Brazil and Argentina are reporting the following error: website address was not found. Which of the following is the most likely cause of this issue?
Show answer and explanation
Correct answer: B. Regional DNS provider outage
A regional DNS provider outage is the most likely cause because the issue is geographically localized to Brazil and Argentina, while users in other regions presumably can access the site normally. This pattern indicates a problem with the DNS infrastructure serving that specific region rather than a global DNS misconfiguration, client-side issue, or DNSSEC problem affecting all users globally.
Why the other options are wrong
- A. Client DNS misconfiguration would affect individual users or networks, not a geographic region consistently; also, multiple users reporting the same issue suggests a server-side problem.
- C. DNS server misconfiguration would typically affect all users globally or all users of a particular nameserver, not just a specific geographic region.
- D. DNSSEC key mismatch would cause validation failures across all regions attempting to validate DNSSEC signatures, not just specific geographic areas.
Question 61
Which of the following files should be used to install software with a package manager?
Show answer and explanation
Correct answer: C. package.deb
The .deb file format is the standard package file used by package managers like apt and dpkg on Debian-based Linux distributions. It contains pre-built binaries and metadata that package managers can directly install. While .tar files can contain source code and package.json is for Node.js dependencies, only .deb is a native package manager format designed for system-level software installation.
Why the other options are wrong
- A. package.json is for Node.js/npm package management, not a system package manager format.
- B. package.zip is a compressed archive, not a package manager format.
- D. package.tar is a generic archive format that may require extraction and manual compilation rather than direct package manager installation.
Question 62
A cloud security analyst is looking for existing security vulnerabilities on software applications. Which of the following describes this vulnerability management phase?
Show answer and explanation
Correct answer: D. Identification
Identification is the phase where security vulnerabilities are discovered and found in software applications. This is the first phase of vulnerability management where a security analyst actively searches for and detects existing vulnerabilities. Analysis comes after identification to assess severity and impact, reporting comes after analysis, and remediation is the final phase of fixing the vulnerabilities.
Why the other options are wrong
- A. Analysis occurs after identification, examining the nature and severity of discovered vulnerabilities.
- B. Reporting documents findings after analysis, not during the discovery phase.
- C. Remediation is the fixing phase, coming after identification and analysis.
Question 63
A cloud administrator is building a company-standard VM image, which will be based on a public image. Which of the following should the administrator implement to secure the image?
Show answer and explanation
Correct answer: C. Hardening
Hardening is the process of securing a system by reducing its attack surface through disabling unnecessary services, closing ports, applying patches, removing unnecessary software, and implementing security configurations. When building a standard VM image from a public base image, hardening directly addresses security by removing default vulnerabilities and unnecessary components present in the public image.
Why the other options are wrong
- A. ACLs control access to resources but don't secure the image itself during its creation.
- B. Least privilege is a security principle but not a specific image security implementation mechanism.
- D. Vulnerability scanning detects vulnerabilities but doesn't eliminate them; hardening actively removes security weaknesses.
Question 64
Which of the following do developers use to keep track of changes made during software development projects?
Show answer and explanation
Correct answer: D. Code versioning
Code versioning is the standard practice developers use to track changes, manage different versions, and maintain history of modifications during software development. Version control systems like Git allow teams to collaborate, maintain code history, and revert to previous states when needed.
Why the other options are wrong
- A. Code drifting is not a real development term; it refers to uncontrolled divergence but is not the formal mechanism for tracking changes.
- B. Code control is too vague and not the specific terminology used in the industry for change tracking.
- C. Code testing is about verifying functionality, not tracking changes during development.
Question 65
Which of the following is the most cost-effective and efficient strategy when migrating containers to the cloud?
Show answer and explanation
Correct answer: B. Replatform
Replatforming (B) is the most cost-effective and efficient strategy for migrating containers to the cloud. It involves moving containerized applications to cloud-native container services (like managed Kubernetes or container registries) with minimal code changes, preserving existing investments while gaining cloud benefits and managed service advantages. This balances cost efficiency against the high expense of full refactoring and achieves faster time-to-value compared to other strategies.
Why the other options are wrong
- A. Retiring containers means abandoning working applications, which is not a migration strategy.
- C. Retaining containers on-premises does not migrate them to the cloud.
- D. Refactoring for cloud-native architecture is more expensive and time-consuming than replatforming.
Question 66
A company's data must be recoverable in other regions of the world in the event of a disaster. The data must be available in an RPO of one hour. Which of the following should a cloud administrator apply to meet these requirements?
Show answer and explanation
Correct answer: A. Replication
RPO (Recovery Point Objective) of one hour means data must be recoverable with a maximum one-hour loss. Replication is the technology that continuously copies data to other regions in near-real-time, ensuring that data is always available in remote locations and can be recovered within the specified RPO window. Replication maintains synchronous or asynchronous copies of data across geographies, directly addressing the requirement for regional disaster recovery within a specific RPO.
Why the other options are wrong
- B. Retention defines how long to keep data, not how to make it available in other regions for recovery.
- C. Encryption protects data but does not enable geographic availability or disaster recovery.
- D. Scheduling is a timing tool but does not create the geographic redundancy needed for regional disaster recovery.
Question 67
A company has ten cloud engineers working on different manual cloud deployments. In the past, engineers have had difficulty keeping deployments consistent. Which of the following is the best method to address this issue?
Show answer and explanation
Correct answer: C. Configuration as code
Configuration as code (IaC) is the best method to ensure consistent deployments across multiple engineers and environments. It codifies deployment specifications so they can be version-controlled, reviewed, and executed identically each time, eliminating the variability that comes with manual deployments. This directly addresses the consistency problem the company faces.
Why the other options are wrong
- A. Deployment documentation provides guidance but relies on manual interpretation, which was the source of inconsistency.
- B. Service logging monitors what happened after deployment but does not prevent inconsistencies during deployment.
- D. Change ticketing tracks changes but does not enforce consistency in how deployments are executed.
Question 68
Once a change has been made to templates, which of the following commands should a cloud architect use next to deploy an IaaS platform?
Show answer and explanation
Correct answer: D. git push
After making changes to templates, a cloud architect must commit those changes locally with git commit, then push them to the remote repository with git push to deploy the IaaS platform. The git push command is the final step that makes the changes available for deployment automation to pull and apply to the infrastructure.
Why the other options are wrong
- A. git pull retrieves changes from remote but doesn't send local changes; it's used before making changes, not after.
- B. git fetch downloads remote changes without integrating them; it doesn't push local template changes to enable deployment.
- C. git commit stages changes locally but doesn't push them to the remote repository where deployment automation can access them.
Question 69
Which of the following compute resources is the most optimal for running a single scripted task on a schedule?
Show answer and explanation
Correct answer: D. Serverless function
Serverless functions are optimal for running single scripted tasks on a schedule. They eliminate infrastructure management overhead, charge only for execution time, scale automatically, and integrate seamlessly with scheduling services. This model provides cost efficiency and simplicity for short-duration, scheduled workloads.
Why the other options are wrong
- A. Bare-metal servers require significant operational overhead and are overkill for simple scripted tasks.
- B. Managed containers add unnecessary complexity for a single scheduled script compared to serverless functions.
- C. Virtual machines require continuous management, patching, and incur costs even when idle between scheduled executions.
Question 70
An organization is hosting a seminar with eight individuals who need to connect to their own dedicated VM. The technician used the following VM configurations: • IP address: DHCP • NIC: 1Gbps • Network: 10.1.10.0/29 Several users are unable to access their VMs. Which of the following best describes the reason?
Show answer and explanation
Correct answer: A. Not enough addresses are available.
A /29 subnet provides only 6 usable IP addresses (8 total minus network and broadcast addresses). With eight individuals each needing a dedicated VM, there are insufficient addresses available. The network 10.1.10.0/29 cannot accommodate eight separate VMs, which is why several users cannot access their VMs.
Why the other options are wrong
- B. Routes misconfiguration would affect connectivity but not prevent address assignment for a smaller subset of users.
- C. Traffic congestion on a 1Gbps link would not prevent users from connecting; it would cause slowness, not connection failures.
- D. DHCP functionality issues would affect all users equally, not just several, and the core problem is insufficient address space.
Question 71
A cloud engineer hardened the WAF for a company that operates exclusively in North America. The engineer did not make changes to any ports, and all protected applications have continued to function as expected. Which of the following configuration changes did the engineer most likely apply?
Show answer and explanation
Correct answer: B. The engineer blocked all traffic originating outside the region
Blocking all traffic originating outside the region is a hardening measure that would restrict access to North American sources only, improving security without affecting protected applications that operate exclusively in North America. This directly hardens the WAF by reducing attack surface from external regions. The other options either relate to access control rather than WAF hardening or could cause compatibility issues without being true hardening measures.
Why the other options are wrong
- A. MFA for WAF configuration access improves administrative security but doesn't harden the WAF itself against traffic threats.
- C. Security patches are important but the question indicates no port changes and continued function, suggesting patches weren't the focus of this hardening effort.
- D. TLS upgrade could impact compatibility with older clients and wouldn't necessarily be a primary hardening change that maintains "all protected applications have continued to function."
Question 72
A developer sends multiple requests to a SaaS application in a short amount of time. The developer realizes that the entire server and all other users can no longer send requests to the application. Which of the following best describes the issue?
Show answer and explanation
Correct answer: B. API rate limiting
API rate limiting is the protection mechanism that restricts the number of requests a client can make in a given time period. When a developer exceeds this limit by sending many requests rapidly, the server blocks all further requests, affecting both the developer and other users. This is the intended behavior of rate limiting to prevent server overload. A full outage (C) would prevent all access regardless of request volume, service quotas (A) are broader resource limitations, and regional availability (D) relates to geographic service distribution.
Why the other options are wrong
- A. Service quotas typically limit total resource consumption over time rather than immediately blocking all server access due to rapid requests.
- C. A full outage would indicate complete system failure, not a responsive mechanism triggered by request volume.
- D. Regional service availability concerns geographic distribution of services, not request throttling mechanisms.
Question 73
A company developed an online trading platform. The engineering team selected event-based scaling for the platform’s underlying resources. The platform resources scale up with every 2,000 subscribed users. The engineering team finds out that although compute utilization is low scaling is still occurring. Which of the following statements best explains why this is the case?
Show answer and explanation
Correct answer: D. Event-based scaling does not take resource load into account.
Event-based scaling triggers based on specific events (in this case, user subscriptions reaching 2,000) regardless of actual resource demand. Since compute utilization is low, the problem is that the scaling mechanism is not considering actual load, it only reacts to the subscription event. This shows event-based scaling's limitation of being decoupled from real resource metrics.
Why the other options are wrong
- A. While some systems may have separate scale-down logic, this doesn't explain why scaling occurs when utilization is low.
- B. The frequency of 2,000 users is not inherently inappropriate; the issue is that events don't correlate with load.
- C. Tracking user subscriptions as a scaling trigger is reasonable; the problem is this metric doesn't reflect actual resource consumption.
Question 74
A developer is building a tool on the cloud that needs to allow other developers to programmatically read and write to the web application resources. Which of the following should the developer do to meet these requirements with the least complexity?
Show answer and explanation
Correct answer: A. Build a REST API endpoint.
A REST API endpoint is the standard, least complex solution for allowing other developers programmatic read/write access to web application resources. It provides a standard, language-agnostic interface with minimal overhead. Cloud portal access (B) is manual, not programmatic. SQL access (C) exposes the database directly, which is a security and architectural anti-pattern. RPC (D) is outdated and more complex than REST.
Why the other options are wrong
- B. Cloud portal access is manual and doesn't enable programmatic access for developers.
- C. Direct SQL access violates security principles and doesn't provide proper abstraction.
- D. RPC is outdated and more complex than modern REST APIs for this use case.
Question 75
Which of the following best describes a characteristic of a hot site?
Show answer and explanation
Correct answer: D. All servers are replicated from the main site in an online status.
A hot site is a fully operational disaster recovery site where all servers are continuously replicated and maintained in an online, ready-to-use state. This means data and system state are actively synchronized from the main site, allowing immediate failover with minimal or no downtime. The defining characteristic is that servers are already running and up-to-date, not offline or partially configured like warm or cold sites.
Why the other options are wrong
- A. Clustering is a local redundancy technique, not a characteristic that defines a hot site's geographic separation.
- B. Load balancing between main and hot site is an operational decision, not a defining characteristic of what makes a site "hot."
- C. Hourly offline backups describe a backup strategy, not a hot site, which maintains online replication.
Question 76
A DevOps engineer is receiving reports that users can no longer access the company’s web application after hardening of a web server. The users are receiving the following error: ERR SSL VERSION OR CIPHER MISMATCH. Which of the following actions should the engineer take to resolve the issue?
Show answer and explanation
Correct answer: B. Configure TLS 1.2 or newer.
The error 'SSL VERSION OR CIPHER MISMATCH' indicates that the client and server cannot agree on a compatible SSL/TLS version or cipher suite. After hardening, the server likely disabled older, insecure SSL/TLS versions. Configuring TLS 1.2 or newer ensures both modern security standards and compatibility with current clients that support these versions.
Why the other options are wrong
- A. Restarting the web server won't resolve a configuration mismatch issue.
- C. Updating the web server software may not be necessary if the current version supports TLS 1.2+.
- D. WAF logs would show what traffic reached the WAF, but the SSL mismatch occurs at the TLS handshake level before WAF inspection.
Question 77
A company operates a website that allows customers to upload, share, and retain full ownership of their photographs. Which of the following could affect image ownership as the website usage expands globally?
Show answer and explanation
Correct answer: A. Sovereignty
As the website expands globally, data sovereignty (A) becomes the critical factor affecting image ownership. Different countries have varying laws regarding data residency, ownership rights, data protection, and privacy regulations. Where customer data is physically stored and processed determines which jurisdictions' laws apply, which can directly impact the company's and customers' legal rights and ownership claims over the photographs.
Why the other options are wrong
- B. Data classification organizes data by sensitivity level but does not affect ownership rights.
- C. Litigation holds preserve data during legal proceedings but do not affect underlying ownership.
- D. Retention policies define how long data is kept but do not determine who owns the data.
Question 78
Which of the following describes the main difference between public and private container repositories?
Show answer and explanation
Correct answer: A. Private container repository access requires authorization, while public repository access does not require authorization.
The main difference is that private container repositories require authorization credentials to access and pull images, while public repositories allow anyone to access and pull images without authentication. This access control distinction is the fundamental difference between the two repository types and directly affects security and intellectual property protection.
Why the other options are wrong
- B. While browsing capabilities may differ between some implementations, this is not the main defining difference between public and private repositories.
- C. License types (proprietary vs. open-source) are independent of whether a repository is public or private; both can use any license type.
- D. Both public and private repositories expose Dockerfiles equally; repository privacy doesn't obscure Dockerfile content, and this is not a key difference.
That was 78 of 314.
The full CompTIA Cloud+ CV0-004 pack has all 314 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 157 free as one PDF by email. Get the Half Pack →