CompTIA Cloud+ Certification– Access Control, High Availability, and Automation

Question 1

Scenario: A government contractor must support a distributed workforce while maintaining strict access control. The cloud engineer is designing an identity solution for the company cloud that includes the following:

•          A way to grant users access based only on their job function.

•          A method to verify a device meets security requirements before granting network access.

•          Automatic revocation of access when an employee's role changes.

Answer Choices:

•          RBAC (for granting access based on job function)

•          NAC (for verifying device compliance before granting access)

•          Identity governance (for automatic access revocation on role change)

Explanation:

•          Role-Based Access Control (RBAC) assigns permissions according to a user's job function rather than to individuals directly.

•          Network Access Control (NAC) evaluates a device's security posture before allowing it onto the network.

•          Identity governance tools automatically adjust or revoke access as a user's role within the organization changes.

Question 2

Question: A team is deploying updates to a customer-facing API and needs to route production traffic to the new version instantly while retaining the ability to revert immediately if errors occur. Which of the following deployment strategies best meets this requirement?

•          A. Rolling

•          B. Blue-green

•          C. Canary

•          D. In-place

Explanation: A blue-green deployment maintains two complete, identical production environments. Traffic is switched instantly between them via a load balancer or DNS change, minimizing downtime and allowing an immediate rollback by simply switching traffic back to the previous environment.

Question 3

Question: A company runs an auto-scaling group of application servers behind a load balancer. During scaling events, newly launched instances fail health checks and are terminated before their startup scripts finish installing dependencies. Which of the following should the cloud engineer implement to address this issue?

•          A. Increase the health check grace period

•          B. Reduce the minimum instance count

•          C. Switch to scheduled scaling only

•          D. Disable the load balancer health checks entirely

Explanation: Increasing the health check grace period gives newly launched instances enough time to complete their startup scripts and dependency installation before the load balancer begins evaluating their health, preventing premature termination.

Question 4

Question: An engineer reviews monitoring dashboards and notices an application server's outbound network throughput is consistently near the interface limit during peak hours, causing request timeouts. Which of the following would most likely explain the engineer's decision to horizontally scale the application tier?

•          A. The server's network throughput is saturated at peak times.

•          B. The server's ephemeral storage reached 40% utilization.

•          C. A single application error was logged during a deployment.

•          D. The server's CPU utilization remained below 20%.

Explanation: Horizontal scaling adds more instances to distribute load across a larger pool of resources, including aggregate network throughput. Saturated network bandwidth on a single instance is a strong indicator that additional instances are needed to spread the traffic.

Question 5

Question: An engineer is designing infrastructure that must process government contract data and align with globally recognized security configuration baselines rather than a specific regulatory framework. Which of the following should the engineer use?

•          A. FedRAMP guidelines

•          B. CIS Benchmarks

•          C. Volume encryption

•          D. A secrets manager

Explanation: CIS (Center for Internet Security) Benchmarks provide globally recognized, consensus-driven, prescriptive configuration baselines for securely hardening systems, distinct from regulatory compliance frameworks tied to a specific industry or government.

Question 6

Question: A machine learning pipeline generates intermediate feature files while training a model. Once the final model artifact is produced, the intermediate feature files are no longer needed. Which of the following is the best way to treat this intermediate data?

•          A. As persistent data

•          B. As archival data

•          C. As ephemeral data

•          D. As replicated data

Explanation: Ephemeral data is short-lived and intended to be automatically discarded once its immediate purpose is fulfilled, which describes intermediate feature files that have no value after the final model has been produced.

Question 7

Question: Which of the following is a constraint that applies specifically to private container image repositories, as opposed to public ones?

•          A. Images cannot include multiple layers

•          B. Pulling or pushing an image requires valid credentials

•          C. Images must be limited to 1 GB in size

•          D. Only base images are permitted

Explanation: Private image repositories restrict access to authorized users or systems, meaning valid credentials or another authentication mechanism must always be presented before an image can be pulled from or pushed to the repository.

Question 8

Question: Which of the following is the most likely reason a company would move a stable, long-running application from a public cloud back to a privately owned data center?

•          A. To increase the ability to rapidly scale during traffic spikes

•          B. To reduce long-term costs for a predictable, steady workload

•          C. To eliminate the need for any backup strategy

•          D. To avoid using automation tools

Explanation: For workloads with stable, predictable resource needs, the ongoing operational cost of public cloud consumption can exceed the cost of owning and maintaining equivalent on-premises hardware over time, making repatriation financially attractive.

Question 9

Question: A cloud engineer is updating an internal monitoring agent currently on version 2.4 running on a fleet of VMs. Company policy allows only the latest minor version update to avoid introducing breaking changes. Which of the following versions should the engineer update to?

•          A. 1.9

•          B. 2.4.3

•          C. 2.9

•          D. 3.0

Explanation: In Semantic Versioning (MAJOR.MINOR.PATCH), a minor version update adds backward-compatible functionality and fixes without breaking existing behavior. Updating from 2.4 to 2.9 represents a safe minor version upgrade.

Question 10

Question: An internal reporting dashboard was recently migrated to the cloud. Employees in the sales region report they cannot load the dashboard, while employees in the operations region can access it normally. Which of the following actions should the administrator take first to resolve the issue?

•          A. Increase the subscription quota.

•          B. Review and correct the affected group's access permissions.

•          C. Disable API rate limiting.

•          D. Resize the underlying compute instance.

Explanation: Because one group of users can access the dashboard without issue, the core infrastructure and network paths are functioning. A group-specific access failure points directly to a permissions or access-control misconfiguration affecting only that group.

Question 11

Question: Which of the following can be used to establish a scalable, centralized hub for connecting numerous VPCs and multiple on-premises locations, avoiding a complex mesh of individual peering connections?

•          A. Subnet

•          B. Transit gateway

•          C. Content delivery network

•          D. NAT gateway

Explanation: A cloud transit gateway functions as a central hub that scales connectivity across numerous VPCs and on-premises locations, eliminating the operational complexity of a full mesh of individual point-to-point peering connections.

Question 12

Question: A cloud application intermittently fails to write records to a database service. A cloud engineer reviews the following log entries: [ERROR] HTTP 503 - Service Unavailable / [INFO] Write capacity exceeded / [WARNING] Requests throttled. Which of the following is the best resolution?

•          A. Increase network bandwidth to the database.

•          B. Implement exponential backoff and retry logic.

•          C. Restart the database service.

•          D. Reduce the database instance size.

Explanation: The log entries indicate the application is exceeding the database's provisioned write capacity. Implementing exponential backoff causes the client to progressively wait longer between retries, reducing pressure on the database until capacity becomes available.

Question 13

Question: A cloud engineer must identify the root cause of a performance degradation affecting a distributed application composed of several containerized services. Metrics and logs exist independently for each container. Which of the following is the best way to determine the source of the issue?

•          A. Enabling distributed tracing across services

•          B. Reviewing only the front-end service's logs

•          C. Restarting each container sequentially

•          D. Increasing the CPU allocation for all containers

Explanation: Distributed tracing follows a single request as it travels across multiple services, recording the time spent in each one. This makes it possible to pinpoint exactly which service in a distributed application is responsible for a performance bottleneck.

Question 14

Question: A company is consolidating multiple project teams into a shared cloud environment and needs to attribute cloud spending back to each project accurately. Which of the following enables consumption tracking with the most efficiency?

•          A. Requiring each project team to submit expense reports manually

•          B. Assigning each project a separate cloud provider account

•          C. Automatically tagging all resources with project metadata

•          D. Restricting each project to a fixed monthly resource quota

Explanation: Automated resource tagging attaches metadata, such as a project identifier, to every resource as it is deployed. This provides accurate, granular cost-allocation data without requiring separate accounts or manual reporting processes.

Question 15

Question: Which of the following tools is purpose-built to define and provision cloud infrastructure resources using a declarative configuration language that can be version-controlled and reused across environments?

•          A. Docker

•          B. Terraform

•          C. Jenkins

•          D. Git

Explanation: Terraform is an Infrastructure as Code tool designed specifically to define and provision cloud infrastructure using declarative configuration files, which can be version-controlled and reused across multiple environments or providers.

Question 16

Question: A document-sharing application allows users to upload PDF files. The design includes an API credential for cloud object storage and a backend API server with a public IP. A security review finds numerous end-user IP addresses authenticating directly to object storage using the backend's API credential. Which of the following is the most likely explanation?

•          A. The backend server is deployed in multiple regions.

•          B. A separate application is also writing to the same bucket.

•          C. The application issues temporary, scoped credentials for direct client uploads.

•          D. The backend server sits behind a content delivery network.

Explanation: When numerous end-user IP addresses authenticate directly to object storage using the same API credential, it typically indicates the application generates temporary, scoped credentials so that file uploads bypass the backend server and go directly to storage.

Question 17

Question: Which of the following services is most appropriate for routing incoming HTTPS requests to different backend server pools based on the hostname requested by the client?

•          A. Layer 4 load balancer

•          B. Layer 7 load balancer

•          C. Web application firewall

•          D. Reverse DNS resolver

Explanation: A Layer 7 (application layer) load balancer can inspect the contents of an HTTP/HTTPS request, including the hostname in the request header, allowing it to intelligently route traffic to different backend pools serving different domains.

Question 18

Question: Which of the following are typically the cloud provider's responsibility in a provider-managed Infrastructure as a Service (IaaS) offering? (Select two)

•          A. Configuring guest operating system firewall rules

•          B. Maintaining the physical hardware and hypervisor

•          C. Managing application-level access permissions

•          D. Ensuring physical facility power and cooling

•          E. Patching the guest operating system

•          F. Managing the customer's application code

Explanation: In an Infrastructure as a Service model, the cloud provider is responsible for the physical infrastructure layer, including hardware, the hypervisor, and facility-level concerns like power and cooling. The customer remains responsible for the guest operating system, applications, and access permissions running on top of that infrastructure.

Question 19

Question: A company's on-site backup repository was encrypted during a ransomware attack, forcing the team to rely on a much older off-site backup and resulting in significant data loss. Which of the following backup features would most directly prevent this outcome in a future attack?

•          A. Deduplication

•          B. Compression

•          C. Immutability

•          D. Snapshot scheduling

Explanation: Immutable backup storage, often implemented as Write Once, Read Many (WORM), prevents backup data from being modified, deleted, or encrypted for a defined retention period, ensuring a clean, recent backup remains available even after a ransomware attack.

Question 20

Question: A cloud engineer maintains an IaC template that deploys a service to one cloud region. Management now requires the same service to be deployed to six additional regions with minimal duplicated code. Which of the following options best fulfills this requirement?

•          A. Duplicate the entire IaC repository for each new region.

•          B. Create a separate Git branch per region and merge changes manually.

•          C. Create per-region variable files and reuse the existing IaC templates.

•          D. Manually deploy each region's resources through the cloud console.

Explanation: Infrastructure as Code is designed for reuse. Creating parameterized variable files for each region allows the same underlying templates to be reused across all deployments, avoiding duplicated code and supporting consistent, scalable multi-region rollouts.

Question 21

Question: Which of the following Git commands combines fetching changes from a remote repository with merging them into the current local branch in a single step?

•          A. git pull

•          B. git fetch

•          C. git commit

•          D. git rebase

Explanation: The git pull command retrieves changes from a remote repository and immediately merges them into the current local working branch, combining the fetch and merge operations into a single command.

Question 22

Question: A cloud engineer is troubleshooting a failed VPC peering request between the following networks: Network 1: 192.168.0.0/23, Network 2: 192.168.1.0/24. Which of the following is causing the issue?

•          A. Missing route table entries

•          B. Overlapping subnet ranges

•          C. Mismatched MTU settings

•          D. Expired peering authorization

Explanation: VPC peering requires that the two networks being peered have no overlapping IP address ranges. Because 192.168.1.0/24 falls entirely within 192.168.0.0/23, the address ranges overlap, preventing the peering connection from being established.

Question 23

Question: A security engineer is documenting a disaster recovery plan and needs to specify the maximum acceptable duration the primary application can remain offline before causing unacceptable business impact. Which of the following metrics should the engineer include?

•          A. RTO

•          B. Latency

•          C. IOPS

•          D. Jitter

Explanation: Recovery Time Objective (RTO) defines the maximum acceptable duration of downtime an application can experience during a disaster before the business impact becomes unacceptable, making it a critical metric in disaster recovery planning.

Question 24

Question: A data warehouse hosted on cloud VMs backed by standard hard disk drives is experiencing slow query performance during large batch reporting jobs. Which of the following would an administrator most likely consider for optimization?

•          A. Network latency between availability zones

•          B. Storage throughput and IOPS

•          C. Application connection pooling settings

•          D. DNS resolution caching

Explanation: Standard spinning hard disk drives provide significantly lower IOPS and throughput than solid-state drives. Upgrading storage performance removes the disk bottleneck that is limiting batch reporting queries against large datasets.

Question 25

Question: A cloud engineer must improve the resilience of a production database that currently runs as a single instance in one availability zone. The new design must support automatic failover during a zone outage and allow restoring data to an exact moment before a failure occurred. Which of the following best meets these requirements?

•          A. A single larger database instance

•          B. A read-only replica in the same zone

•          C. A Multi-AZ database deployment with automated backups

•          D. A local snapshot taken once per week

Explanation: A Multi-AZ database deployment automatically maintains a synchronous standby copy of the database in a separate availability zone, enabling automatic failover during an outage, while automated backups support restoring the database to a specific point in time.

Question 26

Question: An e-commerce company that stores and processes customer credit card numbers is preparing for its annual security audit. Which of the following compliance standards is most relevant to this audit?

•          A. SOC 2

•          B. ITIL

•          C. PCI DSS

•          D. CIS

Explanation: The Payment Card Industry Data Security Standard (PCI DSS) is the mandatory security standard for any organization that stores, processes, or transmits credit card data, making it the most relevant standard for this audit.

Question 27

Question: A cloud engineer is configuring a new Linux VM and encounters the error: Temporary failure in name resolution. Investigation reveals the /etc/resolv.conf file contains no entries. Which of the following lines should the engineer add to the file to fix the issue?

•          A. ifconfig eth0 192.168.1.10

•          B. nameserver 8.8.8.8

•          C. traceroute 8.8.8.8

•          D. hostname webserver01

Explanation: An empty /etc/resolv.conf file means the Linux instance has no DNS server configured for name resolution. Adding a nameserver entry with a valid DNS server IP address restores the ability to resolve hostnames.