CompTIA CV0-004 Cloud+ Exam Dumps and Practice Test Questions Set 8 Q 106-120
Visit here for our full CompTIA CV0-004 exam dumps and practice test questions.
Question 106:
A cloud administrator needs to ensure that virtual machines automatically scale based on CPU utilization. When CPU usage exceeds 80% for 5 minutes, additional instances should be launched. When CPU usage drops below 30% for 10 minutes, instances should be terminated. Which cloud feature is being configured?
A) Load balancing
B) Auto-scaling
C) High availability
D) Fault tolerance
Answer: B
Explanation:
Cloud computing offers numerous features that enable organizations to optimize resource utilization, reduce costs, and maintain performance during varying workload demands. Understanding the distinctions between different cloud capabilities is essential for implementing effective infrastructure solutions. The scenario describes a system that dynamically adjusts compute resources based on performance metrics, which represents a specific cloud capability.
Auto-scaling is a cloud feature that automatically adjusts the number of compute resources allocated to an application based on predefined conditions and metrics. This capability monitors specified performance indicators such as CPU utilization, memory usage, network throughput, or custom application metrics, and automatically provisions or terminates resources when thresholds are met. The scenario describes classic auto-scaling behavior where scaling policies define specific conditions that trigger scaling actions. When CPU utilization exceeds 80% for 5 minutes, this indicates increased demand requiring additional capacity, prompting the system to launch new instances to distribute the workload. Conversely, when CPU usage drops below 30% for 10 minutes, this indicates excess capacity that can be reduced to optimize costs by terminating unnecessary instances. Auto-scaling policies typically include cool-down periods to prevent rapid scaling actions that could cause instability, minimum and maximum instance counts to maintain baseline capacity and cost controls, and health checks to ensure new instances are functioning properly before receiving traffic. Organizations implement auto-scaling to handle unpredictable traffic patterns, maintain consistent application performance during demand spikes, optimize infrastructure costs by running only necessary resources, and eliminate manual intervention in capacity management. This elasticity represents one of cloud computing’s fundamental advantages over traditional infrastructure.
Option A is incorrect because load balancing distributes incoming traffic across multiple servers to optimize resource utilization and ensure no single server becomes overwhelmed. While load balancers work in conjunction with auto-scaling by distributing traffic to newly launched instances, load balancing itself doesn’t create or terminate instances based on performance metrics. Load balancers simply direct traffic to available healthy instances rather than dynamically adjusting the number of instances.
Option C is incorrect because high availability focuses on ensuring services remain accessible and operational with minimal downtime through redundancy and failover mechanisms. High availability architectures deploy resources across multiple availability zones or regions, implement redundant components, and use failover systems to maintain service continuity during failures. While auto-scaling can contribute to high availability by replacing failed instances, the scenario specifically describes scaling based on performance metrics rather than maintaining availability through redundancy.
Option D is incorrect because fault tolerance refers to a system’s ability to continue operating correctly even when components fail, typically through redundancy and real-time failover without service interruption. Fault-tolerant systems maintain duplicate components that immediately take over when primary components fail, ensuring zero downtime. The scenario describes adjusting capacity based on demand rather than maintaining operation during component failures, which distinguishes this from fault tolerance mechanisms.
Question 107:
An organization is migrating applications to the cloud and needs to categorize data based on sensitivity levels to apply appropriate security controls. Financial records and personal health information require the strongest protection. Which concept is the organization implementing?
A) Data masking
B) Data classification
C) Data encryption
D) Data loss prevention
Answer: B
Explanation:
Effective cloud security requires understanding the sensitivity and criticality of different data types to apply appropriate protection measures. Organizations handle various data categories with different regulatory requirements, business impacts, and security needs. Implementing systematic approaches to organize and protect data based on these characteristics is fundamental to cloud security strategy.
Data classification is the process of organizing data into categories based on sensitivity, criticality, regulatory requirements, and business value to apply appropriate security controls and handling procedures. Organizations establish classification schemes that typically include levels such as public, internal, confidential, and restricted or highly confidential. Each classification level has associated security requirements including access controls, encryption standards, storage locations, transmission methods, retention policies, and disposal procedures. The scenario describes categorizing data based on sensitivity levels, with financial records and personal health information requiring the strongest protection, which directly represents data classification activities. Financial records might fall under regulations like SOX or PCI-DSS, while personal health information is protected by HIPAA in the United States or similar healthcare privacy regulations globally. After classifying data, organizations implement technical controls such as encryption for data at rest and in transit, access controls limiting who can view or modify sensitive information, data loss prevention systems monitoring for unauthorized disclosure, and audit logging tracking all access to highly sensitive data. Classification also drives decisions about which cloud services are appropriate for different data types, whether data can be stored in public cloud environments, and what geographic regions are acceptable for data residency. Effective classification programs include clear definitions for each classification level, training for employees on proper data handling, regular reviews to reclassify data as sensitivity changes, and automated tools to discover and classify data at scale.
Option A is incorrect because data masking is a specific security technique that obscures sensitive data by replacing it with fictitious but realistic-looking data for use in non-production environments such as development and testing. While data masking might be applied based on classification decisions, masking itself is a security control rather than the process of categorizing data by sensitivity. Organizations mask classified sensitive data to allow developers and testers to work with realistic datasets without exposing actual sensitive information.
Option C is incorrect because data encryption is a security control that protects data confidentiality by converting information into an unreadable format without the proper decryption key. Encryption is typically applied based on classification decisions, where highly sensitive data requires encryption at rest and in transit. However, encryption is a protective measure implemented after classification rather than the categorization process itself.
Option D is incorrect because data loss prevention refers to technologies and processes that detect and prevent unauthorized transmission, storage, or use of sensitive information. DLP systems monitor data in motion, data at rest, and data in use to enforce policies preventing data breaches. While DLP policies are typically based on data classification, DLP represents the enforcement mechanism rather than the classification process that determines which data requires protection.
Question 108:
A cloud architect is designing a solution that requires virtual machines in different availability zones to communicate with low latency and high throughput. The traffic should remain on the cloud provider’s private network. Which networking component should be implemented?
A) Virtual private network
B) Virtual private cloud
C) Internet gateway
D) VPC peering
Answer: B
Explanation:
Cloud networking architecture requires careful consideration of connectivity requirements, security boundaries, performance characteristics, and isolation needs. Organizations must implement appropriate networking components to enable secure communication between cloud resources while meeting performance and security requirements. Understanding the purpose and capabilities of different networking components is essential for effective cloud architecture design.
A virtual private cloud provides an isolated private network environment within a public cloud infrastructure where customers can launch and manage resources with customizable network configurations. VPCs enable organizations to define private IP address ranges using RFC 1918 address space, create subnets across multiple availability zones, configure route tables controlling traffic flow, and implement security groups and network access control lists for traffic filtering. Within a VPC, resources in different availability zones can communicate using the cloud provider’s high-speed private network backbone without traffic traversing the public internet, ensuring low latency and high throughput. The scenario requires virtual machines in different availability zones to communicate privately with optimal performance, which a VPC architecture inherently provides. VPCs offer network isolation ensuring that customer resources are logically separated from other tenants, complete control over network configuration including IP addressing and routing, and the ability to extend on-premises networks using VPN or direct connect services. Organizations use VPCs to replicate traditional data center networking in the cloud while benefiting from cloud scalability and flexibility, host multi-tier applications with proper network segmentation, and ensure compliance requirements for data isolation and security are met.
Option A is incorrect because a virtual private network creates encrypted tunnels across public networks to provide secure connectivity between geographically separated networks. While VPNs can connect on-premises infrastructure to cloud environments or link multiple cloud regions, they add encryption overhead that can impact latency and throughput. For communication between availability zones within the same cloud region, a VPC provides better performance using the provider’s private network without VPN tunneling overhead.
Option C is incorrect because an internet gateway is a VPC component that enables communication between resources within the VPC and the public internet. Internet gateways allow resources with public IP addresses to send and receive traffic from the internet and perform network address translation. The scenario specifically requires private network communication between availability zones rather than internet connectivity, making an internet gateway inappropriate for this requirement.
Option D is incorrect because VPC peering establishes networking connections between two separate VPCs, either within the same region or across different regions, allowing resources in different VPCs to communicate using private IP addresses. While VPC peering is useful for connecting multiple isolated networks, the scenario describes communication between resources within different availability zones, which typically occurs within a single VPC rather than requiring peering between separate VPCs.
Question 109:
An organization uses multiple cloud service providers for different applications and needs a unified approach to manage identities and access across all cloud platforms. Users should authenticate once and access resources in any cloud environment. Which solution should be implemented?
A) Multi-factor authentication
B) Role-based access control
C) Federated identity management
D) Privileged access management
Answer: C
Explanation:
Modern organizations increasingly adopt multi-cloud strategies using services from different cloud providers to optimize costs, avoid vendor lock-in, and leverage specialized capabilities from various platforms. Managing user identities and access across multiple cloud environments presents significant challenges including administrative overhead, security risks from inconsistent access controls, and poor user experience from multiple authentication processes. Implementing appropriate identity management solutions is critical for security and operational efficiency.
Federated identity management enables users to access multiple systems and applications across different organizations or cloud platforms using a single set of credentials through trust relationships and standard authentication protocols. Federation uses standards such as Security Assertion Markup Language, OAuth, and OpenID Connect to exchange authentication and authorization information between identity providers and service providers. When implemented, users authenticate once with their organization’s identity provider, which issues security tokens containing authentication assertions and user attributes. These tokens are then presented to cloud service providers that trust the identity provider, granting access without requiring separate authentication. The scenario requires unified identity management across multiple cloud platforms with single sign-on capabilities, which federation specifically addresses. Federated identity management reduces administrative burden by centralizing user management in a single identity provider rather than maintaining separate accounts across multiple platforms, improves security through consistent access policies and centralized credential management, enhances user experience by eliminating multiple login processes, and enables stronger authentication methods including multi-factor authentication enforced by the central identity provider. Organizations typically implement federation using cloud-based identity providers such as Azure Active Directory, Okta, or Auth0 that support standard federation protocols and integrate with major cloud platforms.
Option A is incorrect because multi-factor authentication is a security control requiring users to provide multiple forms of verification such as passwords, security tokens, or biometric data to authenticate. While MFA significantly strengthens authentication security and should be implemented alongside federation, it doesn’t address the requirement for unified identity management across multiple cloud platforms or enable single sign-on capabilities. MFA can be enforced by a federated identity provider but represents a different security layer.
Option B is incorrect because role-based access control is an authorization model that grants permissions based on user roles rather than individual user identities. RBAC simplifies permission management by assigning users to roles with predefined access rights. While RBAC is important for managing authorization across cloud platforms, it doesn’t address the authentication challenge of managing separate identities across multiple providers or enable single sign-on. RBAC and federation work together, with federation handling authentication and RBAC managing authorization.
Option D is incorrect because privileged access management focuses specifically on controlling, monitoring, and auditing access by users with elevated permissions to critical systems and sensitive data. PAM solutions typically include password vaulting, session recording, and just-in-time access provisioning for privileged accounts. While important for security, PAM addresses a specific subset of access management focused on high-risk accounts rather than providing unified identity management and single sign-on for all users across multiple cloud platforms.
Question 110:
A cloud administrator needs to troubleshoot connectivity issues between a web application and a database server in different subnets within the same VPC. Both resources have security groups configured. Which component should be checked FIRST to identify the problem?
A) Network access control lists
B) Route tables
C) Security group rules
D) Internet gateway configuration
Answer: C
Explanation:
Troubleshooting cloud networking issues requires systematic investigation of various network components that control traffic flow and connectivity. Cloud platforms implement multiple layers of network security and routing controls, each serving different purposes and having different precedence in traffic processing. Understanding the proper troubleshooting sequence and the function of each network component enables efficient problem resolution.
Security group rules should be checked first because they act as virtual firewalls controlling inbound and outbound traffic at the instance level and are the most common source of connectivity problems between cloud resources. Security groups operate as stateful firewalls, meaning they automatically allow return traffic for permitted connections, and they evaluate rules to determine whether traffic should be allowed based on protocol, port, and source or destination. When resources in different subnets cannot communicate, the security groups attached to both the source and destination instances must permit the required traffic. For a web application connecting to a database, the web server’s security group must allow outbound traffic to the database port, and the database server’s security group must allow inbound traffic from the web server on the database port. Security groups are frequently misconfigured because each instance can have multiple security groups with rules that interact in complex ways, default security groups deny all inbound traffic requiring explicit rules to allow connections, and administrators sometimes forget that both source and destination security groups affect connectivity. Checking security groups first is logical because they directly control instance-level connectivity, are frequently modified during deployments causing inadvertent blocks, are easily checked and modified without service disruption, and eliminate the most common connectivity issue before investigating more complex networking components.
Option A is incorrect as a first troubleshooting step because network access control lists operate at the subnet level rather than the instance level and are stateless, requiring explicit rules for both inbound and outbound traffic. NACLs typically have default rules allowing all traffic and are less frequently modified than security groups, making them a less likely source of connectivity problems. While NACLs should be checked if security groups are properly configured, they should be investigated after security groups because instance-level controls are more commonly misconfigured.
Option B is incorrect because route tables control how traffic is directed between subnets, to internet gateways, or through VPN connections. When both resources exist in the same VPC, even in different subnets, default route tables typically include local routes enabling communication between all subnets within the VPC CIDR block. Route table issues are less common for intra-VPC communication and would affect all traffic between subnets rather than specific instance connectivity, making them a lower priority in initial troubleshooting.
Option D is incorrect because internet gateways enable communication between VPC resources and the public internet and are not involved in connectivity between resources within the same VPC. The scenario describes communication between a web application and database server in the same VPC, which uses the VPC’s private network rather than internet routing. Internet gateway configuration would only be relevant if the connectivity issue involved accessing resources from the internet or if VPC resources needed to access external services.
Question 111:
An organization requires that all data stored in cloud object storage must be encrypted, and the organization must maintain complete control over encryption keys. Keys should never be accessible to the cloud service provider. Which encryption approach meets these requirements?
A) Cloud provider managed keys
B) Customer managed keys with cloud provider key management service
C) Client-side encryption with customer managed keys
D) Transparent data encryption
Answer: C
Explanation:
Data encryption in cloud environments involves multiple approaches with different implications for security, key management, compliance, and operational complexity. Organizations must carefully evaluate their requirements regarding key control, regulatory compliance, and trust in cloud providers when selecting encryption strategies. Understanding the distinctions between encryption approaches helps organizations implement solutions that meet their specific security and compliance requirements.
Client-side encryption with customer managed keys involves encrypting data within the customer’s environment before uploading it to cloud storage, with encryption keys generated, stored, and managed entirely by the customer using on-premises or customer-controlled key management systems. This approach ensures that data exists only in encrypted form within the cloud provider’s infrastructure, and the cloud provider never has access to unencrypted data or encryption keys. The scenario requires complete control over encryption keys with keys never accessible to the cloud provider, which client-side encryption uniquely satisfies. Organizations implement client-side encryption using encryption libraries integrated into applications or through client-side encryption tools provided by cloud vendors that allow customer key integration. This approach provides the highest level of key control and data confidentiality, meets stringent compliance requirements for industries with strict data protection regulations such as healthcare and finance, eliminates concerns about cloud provider key access or government requests for keys held by providers, and ensures data remains protected even if the cloud provider’s infrastructure is compromised. However, client-side encryption increases complexity because customers are responsible for key generation, storage, rotation, and backup, and losing encryption keys results in permanent data loss without recovery options from the cloud provider.
Option A is incorrect because cloud provider managed keys are generated, stored, and managed entirely by the cloud service provider with minimal customer involvement. While this approach simplifies key management and is appropriate for many use cases, the cloud provider has access to encryption keys and can theoretically decrypt customer data. This violates the requirement that keys never be accessible to the cloud service provider, making provider-managed keys unsuitable for organizations with strict key control requirements.
Option B is incorrect because customer managed keys with cloud provider key management service involves customers creating and managing keys using the provider’s key management infrastructure. While customers control key policies, access permissions, and key lifecycle, the keys are stored within the cloud provider’s key management system, and the provider performs encryption and decryption operations. Although the provider typically cannot access key material directly, the keys exist within provider infrastructure, which may not meet the requirement for complete isolation from the cloud provider.
Option D is incorrect because transparent data encryption is typically associated with database encryption where the database management system automatically encrypts data before writing it to storage and decrypts it when reading. TDE is usually implemented at the database layer rather than the application layer and often uses keys managed by the database system or cloud provider. This approach doesn’t provide the level of key control required by the scenario, and keys may be accessible to the cloud provider depending on implementation.
Question 112:
A company is deploying a cloud-based application that must meet regulatory requirements for data residency, ensuring that data never leaves a specific geographic region. Which cloud capability should be configured to enforce this requirement?
A) Content delivery network
B) Geo-fencing
C) Load balancing
D) Data replication
Answer: B
Explanation:
Organizations operating in regulated industries or serving customers in jurisdictions with strict data protection laws face requirements regarding where data can be physically stored and processed. Data residency regulations such as GDPR in Europe, data localization laws in countries like Russia and China, and industry-specific regulations require organizations to ensure data remains within specific geographic boundaries. Cloud platforms provide capabilities to enforce geographic restrictions on data storage and processing to meet these compliance requirements.
Geo-fencing in cloud computing refers to policies and technical controls that restrict data storage, processing, and transmission to specific geographic regions by designating approved regions for resource deployment, implementing policies preventing data transfer across region boundaries, and configuring services to reject operations that would move data outside permitted locations. Cloud providers organize infrastructure into geographic regions containing multiple availability zones, and geo-fencing capabilities enable organizations to specify which regions are acceptable for their workloads. The scenario requires enforcing data residency to ensure data never leaves a specific geographic region, which geo-fencing directly addresses through technical and policy controls. Organizations implement geo-fencing by selecting specific regions when provisioning resources, configuring organization-wide policies through cloud governance tools that prevent resource creation outside approved regions, using service control policies or Azure Policy to enforce geographic restrictions programmatically, and implementing monitoring and alerting for any attempted policy violations. Geo-fencing ensures compliance with data residency regulations by providing technical enforcement rather than relying solely on procedural controls, gives organizations confidence that data remains within required jurisdictions, and enables auditing and demonstration of compliance for regulatory purposes.
Option A is incorrect because content delivery networks distribute content across multiple geographic locations to improve performance by serving users from nearby edge locations. While CDNs can be configured to operate within specific regions, their primary purpose is performance optimization through geographic distribution rather than enforcing data residency restrictions. CDNs typically cache content globally, which conflicts with strict data residency requirements unless carefully configured with regional restrictions.
Option C is incorrect because load balancing distributes traffic across multiple servers to optimize resource utilization, maximize throughput, and ensure high availability. Load balancers can distribute traffic within a region or across regions, but their purpose is traffic distribution rather than enforcing geographic data restrictions. While load balancers can be configured to route traffic only within specific regions, they don’t inherently enforce data residency policies or prevent data storage outside designated areas.
Option D is incorrect because data replication copies data to multiple locations to ensure redundancy, disaster recovery, and high availability. Replication typically involves copying data across multiple availability zones or regions, which could violate data residency requirements if replication targets are outside permitted jurisdictions. While replication can be configured to operate only within approved regions, the concept itself doesn’t enforce geographic restrictions and actually involves data movement that must be carefully controlled for compliance.
Question 113:
A cloud security team wants to implement a solution that continuously monitors cloud resource configurations and automatically alerts when resources are deployed that don’t comply with security policies. Which type of solution should be implemented?
A) Cloud access security broker
B) Security information and event management
C) Cloud security posture management
D) Intrusion detection system
Answer: C
Explanation:
Cloud environments present unique security challenges due to their dynamic nature, shared responsibility model, rapid resource provisioning, and complex configuration options. Organizations need visibility into cloud resource configurations and automated monitoring to identify security risks and compliance violations. Various security solutions address different aspects of cloud security, and selecting appropriate tools requires understanding their specific capabilities and use cases.
Cloud security posture management provides continuous visibility into cloud infrastructure configurations, identifies misconfigurations and compliance violations, and automatically assesses security risks across cloud environments. CSPM solutions integrate with cloud provider APIs to discover all resources within cloud accounts, analyze configurations against security best practices and compliance frameworks such as CIS benchmarks, PCI-DSS, and HIPAA, detect violations such as publicly accessible storage buckets, overly permissive security groups, or unencrypted databases, and generate alerts when non-compliant resources are deployed. The scenario specifically requires continuous configuration monitoring with automatic alerts for policy violations, which represents CSPM’s core functionality. CSPM tools provide organizations with unified visibility across multi-cloud environments showing all deployed resources and their configurations, automated compliance assessment reducing manual audit efforts, prioritized remediation guidance helping teams address the most critical issues first, and integration with infrastructure-as-code pipelines enabling security validation before resource deployment. Organizations implement CSPM to address the challenge of maintaining security in rapidly changing cloud environments where manual configuration reviews are insufficient, ensure consistency across development, staging, and production environments, and demonstrate compliance with regulatory requirements through continuous monitoring and documented evidence.
Option A is incorrect because cloud access security brokers sit between users and cloud service providers to enforce security policies, provide visibility into cloud application usage, and protect data in cloud applications. CASBs focus on monitoring and controlling how users access and use cloud services, detecting shadow IT, enforcing data loss prevention policies, and providing threat protection. While CASBs offer valuable security capabilities, they primarily address user behavior and data protection rather than continuously monitoring cloud resource configurations for compliance violations.
Option B is incorrect because security information and event management systems collect, aggregate, and analyze security events and logs from multiple sources to detect security incidents and support investigations. SIEM solutions excel at correlating events to identify suspicious activities, detecting threats based on patterns in log data, and providing centralized visibility into security events. However, SIEMs focus on analyzing security events and logs rather than continuously assessing cloud resource configurations against security policies, making them less appropriate for configuration compliance monitoring.
Option D is incorrect because intrusion detection systems monitor network traffic or host activities to identify malicious activities and policy violations based on known attack signatures or anomalous behaviors. IDS solutions detect threats such as network attacks, malware communications, and unauthorized access attempts by analyzing traffic patterns and comparing them against threat intelligence. While IDS is important for detecting active threats, it doesn’t provide continuous configuration assessment or alert on misconfigured cloud resources as described in the scenario.
Question 114:
An organization uses Infrastructure as Code to provision cloud resources and wants to ensure that all infrastructure changes are reviewed before deployment. Which practice should be implemented?
A) Automated deployment pipelines
B) Blue-green deployments
C) Pull request reviews
D) Continuous integration
Answer: C
Explanation:
Infrastructure as Code revolutionizes infrastructure management by treating infrastructure definitions as software code that can be version controlled, tested, and deployed through automated processes. While IaC provides numerous benefits including consistency, repeatability, and automation, it also requires appropriate controls to prevent errors, security vulnerabilities, and compliance violations from being deployed into production environments. Implementing proper governance and quality assurance processes for infrastructure code is essential for maintaining security and stability.
Pull request reviews implement a peer review process where infrastructure code changes must be reviewed and approved by team members before merging into main branches and deploying to environments. This practice involves developers creating feature branches for infrastructure changes, submitting pull requests containing proposed modifications with descriptions of changes and justifications, designated reviewers examining code for errors, security issues, compliance violations, and adherence to best practices, and requiring approval from one or more reviewers before changes can be merged and deployed. The scenario requires ensuring all infrastructure changes are reviewed before deployment, which pull request reviews directly provide through mandatory peer review workflows. Pull request reviews enable teams to identify security misconfigurations such as overly permissive access rules or unencrypted resources before deployment, catch errors in infrastructure code that could cause service disruptions, ensure consistency with organizational standards and naming conventions, and create documentation of who approved changes and why through pull request history. Organizations typically enforce pull request reviews using branch protection rules in version control systems that prevent direct commits to main branches, require specific reviewers such as security team members for sensitive changes, and integrate automated security scanning tools that check for common vulnerabilities in infrastructure code.
Option A is incorrect because automated deployment pipelines execute the process of building, testing, and deploying infrastructure code automatically based on triggers such as code commits. While pipelines are essential for IaC implementation and can include automated checks, the pipeline itself is the execution mechanism rather than the review process. Automated pipelines should include review steps as gates, but automation alone doesn’t ensure human review of changes before deployment.
Option B is incorrect because blue-green deployments are a deployment strategy that maintains two identical production environments, allowing organizations to deploy changes to the inactive environment, test thoroughly, and switch traffic to the new version with minimal downtime. While blue-green deployments reduce deployment risk, they represent a deployment technique rather than a review process for infrastructure changes. Blue-green strategies help with rollback capabilities but don’t provide the change review and approval workflow described in the scenario.
Option D is incorrect because continuous integration is a development practice where developers frequently merge code changes into a shared repository, triggering automated builds and tests to detect integration issues early. While CI is valuable for Infrastructure as Code by providing rapid feedback on code quality, it focuses on automated testing and integration rather than human review and approval of changes. CI should complement pull request reviews by providing automated validation, but it doesn’t replace the need for peer review before deployment.
Question 115:
A cloud architect is designing a disaster recovery solution with a Recovery Time Objective of 4 hours and a Recovery Point Objective of 1 hour. Which disaster recovery strategy would be MOST appropriate?
A) Backup and restore
B) Pilot light
C) Warm standby
D) Multi-site active-active
Answer: C
Explanation:
Disaster recovery planning requires balancing business continuity requirements with cost considerations by selecting appropriate strategies based on acceptable downtime and data loss. Organizations define recovery objectives including Recovery Time Objective, the maximum acceptable time to restore services after a disruption, and Recovery Point Objective, the maximum acceptable amount of data loss measured in time. Different disaster recovery strategies provide varying levels of protection with corresponding cost implications, and selecting the right approach requires understanding business requirements and recovery capabilities.
Warm standby disaster recovery strategy maintains a scaled-down but fully functional version of the production environment that runs continuously with core services active, data replication keeping systems reasonably current, and resources ready to scale up quickly when disaster occurs. In warm standby configurations, critical systems and databases run continuously in the disaster recovery environment using smaller instance sizes or reduced capacity, data replication occurs continuously or at frequent intervals ensuring minimal data loss, and upon disaster declaration, the standby environment is scaled up to production capacity and traffic is redirected. The scenario requires RTO of 4 hours and RPO of 1 hour, which warm standby effectively satisfies by maintaining running systems that can be scaled quickly within the RTO window and implementing continuous data replication supporting the tight RPO requirement. Warm standby provides balance between cost and recovery speed by running reduced infrastructure continuously, avoiding the time needed to provision and configure resources from scratch, supporting RPO requirements through continuous data replication while maintaining acceptable recovery times, and enabling regular testing without disrupting production services. Organizations implement warm standby for business-critical applications where several hours of downtime is acceptable but complete rebuilding would take too long to meet business requirements.
Option A is incorrect because backup and restore involves taking regular backups of data and systems with restoration from backups when disaster occurs. This approach typically requires significant time to provision infrastructure, restore data, and configure systems, making it suitable for longer RTOs measured in days rather than hours. The recovery process involves provisioning new infrastructure, restoring data from backup storage, reconfiguring applications, and testing before returning to service. While backup and restore is cost-effective for less critical systems, it cannot consistently meet a 4-hour RTO given the time required for infrastructure provisioning and data restoration.
Option B is incorrect because pilot light maintains minimal infrastructure in the disaster recovery environment with only the most critical core services running, such as database replication, while all other systems remain inactive. When disaster occurs, additional infrastructure must be provisioned and applications deployed before services can be restored. Pilot light typically supports RTOs of several hours to days because provisioning and configuring application servers, scaling databases, and deploying applications takes significant time. The 4-hour RTO might be challenging with pilot light depending on application complexity.
Option D is incorrect because multi-site active-active disaster recovery runs fully functional production environments in multiple locations simultaneously, with all sites actively serving traffic and maintaining synchronized data. This strategy provides near-zero RTO and RPO by having fully operational environments ready to handle traffic immediately if one site fails. While multi-site active-active offers the best recovery capabilities, it requires running multiple full production environments continuously, making it significantly more expensive than necessary for the scenario’s 4-hour RTO and 1-hour RPO requirements. Active-active is appropriate for mission-critical applications requiring near-zero downtime but represents over-engineering for the specified recovery objectives.
Question 116:
A company is migrating a legacy application to the cloud and needs to lift-and-shift the existing servers with minimal changes. The application requires specific operating system configurations and installed software. Which cloud service model is MOST appropriate for this migration?
A) Software as a Service
B) Platform as a Service
C) Infrastructure as a Service
D) Function as a Service
Answer: C
Explanation:
Cloud service models represent different levels of abstraction and management responsibility between cloud providers and customers. Understanding the characteristics, use cases, and trade-offs of each service model is essential for selecting appropriate solutions for specific application requirements and migration strategies. The scenario describes a lift-and-shift migration requiring preservation of existing configurations with minimal changes, which points toward a specific service model.
Infrastructure as a Service provides virtualized computing resources over the internet, including virtual machines, storage, and networking, while customers retain control over operating systems, middleware, applications, and data. IaaS gives organizations maximum flexibility and control over their computing environment, allowing them to replicate existing on-premises infrastructure in the cloud with minimal architectural changes. The scenario requires migrating a legacy application with specific operating system configurations and installed software using a lift-and-shift approach, which IaaS directly supports by providing virtual machines where customers can install any operating system, configure system settings exactly as needed, install required software packages and dependencies, and maintain existing application architectures without refactoring. IaaS is ideal for lift-and-shift migrations because it minimizes changes to existing applications, allows organizations to move quickly without redesigning applications, supports legacy systems that may not be compatible with higher-level service models, and provides the control needed for applications with specific infrastructure requirements. Organizations use IaaS when they need operating system level access for custom configurations, want to avoid application refactoring during initial cloud migration, require specific software versions or configurations not available in managed services, or plan to modernize applications gradually after initial migration. The trade-off with IaaS is that customers remain responsible for operating system patching, security configuration, capacity planning, and other infrastructure management tasks that would be handled by the provider in higher-level service models.
Option A is incorrect because Software as a Service delivers fully functional applications over the internet that are managed entirely by the service provider. SaaS customers access applications through web browsers or APIs without any control over underlying infrastructure, operating systems, or application code. Examples include email services, customer relationship management systems, and collaboration tools. SaaS requires no migration of existing applications because customers use the provider’s application instead, making it inappropriate for the scenario’s requirement to migrate a legacy application with specific configurations.
Option B is incorrect because Platform as a Service provides a managed platform for developing, running, and managing applications without managing underlying infrastructure. PaaS offers runtime environments, development tools, databases, and middleware managed by the provider while customers focus on application code and data. PaaS typically requires refactoring applications to work within the platform’s constraints and use provided services, which conflicts with the lift-and-shift requirement for minimal changes. While PaaS simplifies infrastructure management, it doesn’t provide the operating system level control needed for applications with specific configuration requirements.
Option D is incorrect because Function as a Service, also known as serverless computing, allows customers to deploy individual functions that execute in response to events without managing servers or runtime environments. FaaS requires completely restructuring applications into small, stateless functions that integrate with provider-managed services. This approach represents the opposite of lift-and-shift migration, requiring extensive application refactoring and architectural changes. FaaS is ideal for new cloud-native applications or significant modernization efforts but inappropriate for minimally modified legacy application migrations.
Question 117:
A cloud administrator needs to provide temporary credentials to a third-party contractor who requires access to specific S3 buckets for a two-week project. The credentials should automatically expire and provide only the minimum necessary permissions. Which AWS feature should be used?
A) IAM user with access keys
B) IAM role with temporary security credentials
C) Root account credentials
D) S3 bucket policy with public access
Answer: B
Explanation:
Cloud security best practices emphasize the principle of least privilege, ensuring users and applications receive only the minimum permissions necessary to perform their tasks. Managing access for temporary workers, contractors, and external parties requires mechanisms that provide appropriate access while minimizing security risks. Understanding different identity and access management capabilities enables organizations to implement secure, scalable access controls that adapt to various business scenarios.
IAM roles with temporary security credentials provide time-limited access to AWS resources without requiring long-term credentials such as passwords or access keys. Roles define permissions through attached policies, and when assumed, roles provide temporary credentials valid for a specified duration from minutes to hours. The scenario requires providing temporary access to a contractor for a specific time period with minimum necessary permissions, which IAM roles perfectly address through time-limited credentials that automatically expire, eliminating the need to manually revoke access when the project ends, permission boundaries that restrict access to only required resources through precise policy definitions, and the ability to track and audit all actions taken using the role through CloudTrail logging. Organizations implement IAM roles for temporary access by creating a role with policies granting specific permissions to required S3 buckets, configuring a trust policy specifying who can assume the role, such as federated users or specific AWS accounts, setting maximum session duration appropriate for the work period, and providing the contractor with instructions to assume the role using AWS Security Token Service. Temporary credentials automatically expire without requiring administrator intervention, roles can be configured to require multi-factor authentication before assumption for additional security, and permissions can be easily modified if requirements change without affecting authentication mechanisms. This approach eliminates risks associated with long-term credentials such as credential leakage, forgotten access that persists after projects end, and difficulties tracking credential usage across multiple projects.
Option A is incorrect because IAM users with access keys provide long-term credentials that don’t automatically expire and require manual management. Access keys remain valid until explicitly deleted or rotated, creating security risks if not properly managed after the contractor’s project ends. Organizations must remember to revoke access manually, and forgotten credentials can remain active indefinitely, creating security vulnerabilities. While access keys could work functionally, they don’t provide the automatic expiration and simplified management that roles offer for temporary access scenarios.
Option C is incorrect because root account credentials provide complete unrestricted access to all AWS resources and services within the account, representing the highest privilege level available. Using root credentials violates the principle of least privilege, creates significant security risks because root account compromise affects the entire AWS account, and prevents proper access auditing because actions cannot be attributed to specific individuals. AWS strongly recommends against using root credentials for regular operations and especially for sharing with external parties.
Option D is incorrect because S3 bucket policies with public access make bucket contents accessible to anyone on the internet without authentication. Public access completely eliminates access controls and accountability, exposes data to unauthorized parties beyond the intended contractor, cannot be time-limited to expire automatically, and represents a serious security vulnerability for any data that isn’t intended for public consumption. Bucket policies can grant access to specific principals, but public access is never appropriate for controlled contractor access to organizational data.
Question 118:
An organization wants to monitor cloud spending and receive alerts when costs exceed predefined thresholds. The solution should provide visibility into costs by service, department, and project. Which cloud financial management practice should be implemented?
A) Reserved instances
B) Cost allocation tags
C) Auto-scaling policies
D) Spot instances
Answer: B
Explanation:
Cloud computing’s pay-as-you-go model offers flexibility and eliminates upfront infrastructure investments, but it also creates challenges for cost management and budget control. Organizations need visibility into cloud spending patterns, the ability to attribute costs to specific business units or projects, and mechanisms to control spending before it exceeds budgets. Implementing effective cloud financial management practices enables organizations to optimize costs while maintaining necessary services and performance.
Cost allocation tags are metadata labels attached to cloud resources that enable organizations to categorize and track spending across different dimensions such as departments, projects, environments, cost centers, or applications. Tags consist of key-value pairs like «Department: Marketing» or «Project: Website-Redesign» that are applied to resources during creation or added afterward. Cloud providers aggregate costs by tag values, enabling detailed cost reporting and analysis. The scenario requires monitoring spending with visibility by service, department, and project, along with alerts for threshold violations, which cost allocation tags enable by providing the categorization foundation for cost analysis and budget monitoring. Organizations implement cost allocation tagging by establishing tagging standards defining required tags and naming conventions, applying tags consistently across all resources using infrastructure as code or automation, activating cost allocation tags in the cloud provider’s billing console to include them in cost reports, creating cost allocation reports filtered and grouped by tag values to understand spending patterns, and configuring budgets with alerts based on tag-filtered spending to receive notifications when specific departments or projects approach or exceed thresholds. Effective tagging strategies enable chargeback or showback models where IT costs are allocated to consuming business units, identify optimization opportunities by revealing which projects or services consume the most resources, support compliance and governance by ensuring resources are properly categorized and accountable, and enable forecasting and planning based on historical spending patterns for specific cost categories.
Option A is incorrect because reserved instances are a pricing model where customers commit to using specific compute capacity for one or three year terms in exchange for significant discounts compared to on-demand pricing. While reserved instances reduce costs for predictable workloads, they don’t provide the cost visibility, categorization, or threshold alerting capabilities described in the scenario. Reserved instances are a cost optimization technique rather than a cost monitoring and allocation solution.
Option C is incorrect because auto-scaling policies automatically adjust compute capacity based on demand or performance metrics, helping optimize costs by running only necessary resources. While auto-scaling can reduce spending by eliminating idle resources, it doesn’t provide cost visibility by department or project, enable spending categorization, or create budget alerts. Auto-scaling focuses on matching capacity to demand rather than cost allocation and monitoring.
Option D is incorrect because spot instances allow customers to bid on unused cloud capacity at potentially significant discounts compared to on-demand pricing, with the trade-off that instances can be terminated with short notice when the provider needs capacity. Spot instances offer cost savings for fault-tolerant and flexible workloads but don’t address the requirement for cost visibility, allocation, and threshold alerting. Like reserved instances, spot instances are a pricing model for cost optimization rather than a cost management and monitoring solution.
Question 119:
A cloud security team discovers that a storage bucket containing sensitive customer data was accidentally configured with public read access. Which security principle was violated, and what control could have prevented this?
A) Defense in depth; implementing encryption
B) Least privilege; enabling automatic access reviews
C) Secure by default; using service control policies
D) Separation of duties; requiring dual authorization
Answer: C
Explanation:
Cloud security requires implementing multiple security principles and controls to protect data and resources from unauthorized access, accidental exposure, and malicious activities. Understanding fundamental security principles helps organizations design robust security architectures that prevent common vulnerabilities. The scenario describes a configuration error that exposed sensitive data, which relates to specific security principles and preventive controls.
Secure by default is a security principle requiring that systems and resources are configured with the most restrictive security settings by default, requiring explicit actions to grant less restrictive access rather than requiring explicit actions to secure resources. This principle prevents accidental exposure by ensuring that newly created resources start in a secure state. The scenario describes a storage bucket accidentally configured with public access, which violates secure by default because storage buckets should default to private access requiring explicit configuration to enable public access. Service control policies provide preventive controls that enforce organizational security requirements across cloud accounts by defining rules that restrict what actions can be performed, even by administrators. SCPs could prevent this incident by implementing policies that block public access configuration on storage buckets containing sensitive data, deny modifications to bucket policies that would grant public access, require approval workflows before allowing public access configurations, and enforce organization-wide restrictions regardless of individual account settings. Organizations implement secure by default through technical controls such as service control policies that prevent insecure configurations, default deny policies requiring explicit allow rules for access grants, automated security checks that validate configurations meet security standards, and guard rails that block dangerous operations before they take effect. This approach shifts the security burden from remembering to secure each resource to intentionally deciding to allow less restrictive access, reducing human error and configuration mistakes that lead to data exposure.
Option A is incorrect because defense in depth involves implementing multiple layers of security controls so that if one layer fails, others provide protection. While encryption protects data confidentiality, it doesn’t prevent public access configurations. Encrypted data in publicly accessible buckets remains problematic because encryption keys might be compromised, metadata and file structures remain visible, and public access violates compliance requirements regardless of encryption. Defense in depth is important but addressing the root cause requires preventing public access configurations rather than relying solely on encryption.
Option B is incorrect because least privilege requires granting users and services only the minimum permissions necessary to perform their functions. While least privilege is important for access control, automatic access reviews periodically verify that users still require their assigned permissions but don’t prevent initial misconfigurations. Access reviews are detective controls that identify problems after they occur rather than preventive controls that stop misconfigurations from happening. The scenario requires preventing public access configuration rather than detecting it through reviews.
Option D is incorrect because separation of duties divides critical tasks among multiple people to prevent fraud and errors, requiring collusion to circumvent controls. Dual authorization requires two authorized individuals to approve sensitive actions before they execute. While separation of duties and dual authorization add oversight, they don’t address the fundamental issue of resources defaulting to potentially insecure configurations. Additionally, dual authorization creates operational friction and might not be practical for routine configuration tasks, making it less appropriate than preventive technical controls.
Question 120:
A company runs a multi-tier web application in the cloud with web servers, application servers, and database servers in different subnets. The security team wants to ensure that database servers can only receive traffic from application servers and cannot initiate outbound connections to the internet. Which security approach should be implemented?
A) Network segmentation with security groups
B) Web application firewall
C) VPN encryption
D) DDoS protection
Answer: A
Explanation:
Cloud network security requires implementing controls that restrict traffic flow between different tiers of applications, minimize attack surfaces, and enforce the principle of least privilege at the network level. Multi-tier architectures separate application components into different layers with specific communication requirements between tiers. Implementing appropriate network security controls ensures that compromised components cannot easily access other parts of the infrastructure and that applications function according to designed security requirements.
Network segmentation with security groups divides the cloud network into isolated segments with different security requirements and uses virtual firewall rules to control traffic between segments. In multi-tier architectures, placing each application tier in separate subnets with appropriate security groups implements a layered security approach where web servers in public subnets receive internet traffic, application servers in private subnets receive traffic only from web servers, and database servers in isolated subnets receive traffic only from application servers. The scenario requires ensuring database servers only receive traffic from application servers and cannot initiate outbound internet connections, which network segmentation with properly configured security groups directly addresses. Organizations implement this by creating security group rules for database servers that allow inbound traffic only from application server security groups on required database ports, deny all other inbound traffic by default, allow outbound traffic only to application servers for return connections due to stateful nature of security groups, and explicitly deny or simply omit rules for internet-bound traffic. Security groups provide stateful filtering automatically allowing return traffic for established connections, support defining rules based on source security groups rather than IP addresses for easier management as instances change, enable granular control at the instance level allowing different rules for different server roles, and provide defense in depth when combined with network ACLs at the subnet level. This approach limits blast radius if application servers are compromised by preventing direct database access from other components, prevents database servers from being used for outbound attacks if compromised, and enforces architectural security requirements through technical controls rather than relying on procedural safeguards.
Option B is incorrect because web application firewalls protect web applications from common attacks such as SQL injection, cross-site scripting, and other OWASP Top 10 vulnerabilities by filtering and monitoring HTTP traffic between users and web applications. WAFs operate at the application layer analyzing HTTP requests and responses but don’t control network traffic between internal application tiers like application servers and database servers. WAFs protect the web tier from external attacks but don’t address the requirement to restrict database server connectivity to only application servers.
Option C is incorrect because VPN encryption creates secure encrypted tunnels for data transmission across untrusted networks, typically used for connecting remote users or linking geographically separated networks. VPNs provide confidentiality and integrity for data in transit but don’t restrict which sources can connect to database servers or prevent database servers from initiating outbound connections. The scenario describes traffic control between internal application tiers within the same cloud environment rather than securing connections across untrusted networks.
Option D is incorrect because DDoS protection defends against distributed denial of service attacks that attempt to overwhelm systems with massive traffic volumes, making services unavailable to legitimate users. DDoS protection services absorb attack traffic, filter malicious requests, and ensure application availability during attacks. While important for internet-facing services, DDoS protection doesn’t control traffic between internal application tiers or restrict database server connectivity as required in the scenario. DDoS protection focuses on availability against external attacks rather than internal traffic segmentation and access control.