CompTIA Cloud+ Certification– Advanced Authentication, Containers, and Data Protection

Question 1

Scenario: A healthcare provider is modernizing access to its cloud-hosted patient portal for staff across several clinics. The cloud engineer is designing an identity solution for the company cloud that includes the following:

•          A way to confirm a user's identity using a physical security key in addition to a password.

•          A single dashboard showing every application a given staff member can access.

•          Alerts when a login occurs from an unusual location or device.

Answer Choices:

•          FIDO2/hardware token MFA (for confirming identity with a physical security key)

•          SSO with an application catalog (for a single dashboard of accessible applications)

•          Risk-based/adaptive authentication (for alerts on unusual login location or device)

Explanation:

•          FIDO2/hardware token MFA adds a physical possession factor to authentication, strengthening it beyond a password alone.

•          SSO with an application catalog gives users and administrators a unified view of every application a person can access.

•          Risk-based/adaptive authentication flags or challenges logins that deviate from a user's normal location or device pattern.

Question 2

Question: A team is releasing a major update to a billing system and needs a strategy that avoids running two full duplicate environments simultaneously while still updating instances gradually and monitoring for errors as it proceeds. Which of the following deployment strategies best meets this requirement?

•          A. Blue-green

•          B. Rolling

•          C. Canary

•          D. Recreate

Explanation: A rolling deployment updates instances incrementally within the existing environment rather than maintaining two separate full-scale environments, allowing the team to monitor for errors at each stage while gradually completing the update.

Question 3

Question: A company runs a Kubernetes cluster where new pods occasionally receive traffic before their readiness checks would normally pass, causing failed requests during scaling events. Which of the following should the cloud engineer implement to address this issue?

•          A. Configure a readiness probe with an appropriate initial delay

•          B. Disable liveness probes entirely

•          C. Reduce the replica count

•          D. Switch to a NodePort service type

Explanation: Configuring a readiness probe with an appropriate initial delay ensures Kubernetes only routes traffic to a pod once it reports itself as ready, preventing premature traffic from reaching pods that have not finished initializing.

Question 4

Question: An engineer reviews monitoring data and finds that a web server consistently processes requests with CPU usage under 30%, but the number of concurrent open connections regularly approaches the configured maximum. Which of the following actions would most likely explain the engineer's decision to horizontally scale the web tier?

•          A. The server reached its maximum number of concurrent connections.

•          B. The server's CPU usage remained consistently low.

•          C. A single slow database query was identified in the logs.

•          D. Disk usage on the server reached 60%.

Explanation: Horizontal scaling adds more instances to distribute incoming connections across a larger pool of servers. A connection count nearing its maximum, despite low CPU usage, indicates the bottleneck is connection capacity rather than compute, making horizontal scaling the appropriate response.

Question 5

Question: An engineer is building infrastructure for an e-commerce checkout service and wants to apply globally recognized, vendor-neutral hardening guidelines in addition to any required regulatory controls. Which of the following should the engineer use?

•          A. PCI DSS requirements only

•          B. CIS Benchmarks

•          C. Database connection pooling

•          D. A web application firewall

Explanation: CIS (Center for Internet Security) Benchmarks provide globally recognized, vendor-neutral configuration hardening guidelines that complement, but are distinct from, industry-specific regulatory requirements like PCI DSS.

Question 6

Question: A data pipeline generates several staged transformation files while converting raw input into a final aggregated report. Once the report is generated, the staged files serve no further purpose. Which of the following is the best way to treat this staged data?

•          A. As persistent data

•          B. As ephemeral data

•          C. As archival data

•          D. As replicated data

Explanation: Ephemeral data is short-lived and intended to be discarded automatically once its immediate processing purpose is fulfilled, accurately describing staged transformation files with no lasting value after report generation.

Question 7

Question: Which of the following is a constraint that applies to private container image repositories but generally does not apply to public repositories?

•          A. Images must use a specific base operating system

•          B. A valid credential or access token is required for any pull or push

•          C. Repositories are limited to a single tag per image

•          D. Images cannot be scanned for vulnerabilities

Explanation: Private image repositories require a valid credential or access token before any pull or push operation is permitted, unlike public repositories, which typically allow anonymous read access without authentication.

Question 8

Question: Which of the following is the most likely reason a company would repatriate a long-running, resource-intensive rendering workload from the public cloud to owned on-premises hardware?

•          A. To increase the ability to burst capacity for unpredictable spikes

•          B. To reduce ongoing costs for a steady, high-utilization workload

•          C. To eliminate the need for infrastructure monitoring

•          D. To avoid the use of containerization

Explanation: Workloads that run continuously at high utilization can become more expensive to operate in the public cloud over time than owning equivalent hardware outright, making repatriation a cost-effective decision for steady, resource-intensive workloads.

Question 9

Question: A cloud engineer is updating a configuration management agent currently at version 3.6 across a server fleet. Policy permits only the latest minor version update to avoid introducing breaking changes. Which of the following versions should the engineer update to?

•          A. 2.9

•          B. 3.6.4

•          C. 3.9

•          D. 4.0

Explanation: In Semantic Versioning (MAJOR.MINOR.PATCH), a minor version update adds backward-compatible features and fixes without breaking existing functionality. Updating from 3.6 to 3.9 represents a safe minor version upgrade.

Question 10

Question: A recently migrated scheduling application is inaccessible to contractors, while full-time employees can access it without issue. Which of the following actions should the administrator take first to resolve the issue?

•          A. Increase the application's subscription quota.

•          B. Investigate and correct the contractor group's access permissions.

•          C. Disable API rate limiting for the application.

•          D. Increase the size of the underlying compute instance.

Explanation: Because full-time employees can access the application normally, the underlying infrastructure and network paths are functioning correctly. An access failure limited to the contractor group points directly to a permissions or access-control misconfiguration for that group.

Question 11

Question: Which of the following can serve as a centralized, scalable hub connecting many VPCs across multiple regions and several on-premises branch offices?

•          A. Elastic load balancer

•          B. Transit gateway

•          C. Internet gateway

•          D. Subnet

Explanation: A transit gateway acts as a centralized, scalable hub for connecting numerous VPCs and on-premises networks, eliminating the need to manage a complex mesh of individual peering connections between every pair of networks.

Question 12

Question: A cloud application intermittently fails to send notifications through a third-party messaging API. A cloud engineer reviews the following log entries: [ERROR] HTTP 429 - Too Many Requests / [INFO] Rate limit exceeded / [WARNING] Message queued for retry. Which of the following is the best resolution?

•          A. Increase the messaging service's allocated storage.

•          B. Implement exponential backoff and retry logic.

•          C. Restart the notification service.

•          D. Increase the application server's instance size.

Explanation: The HTTP 429 error indicates the application is exceeding the messaging API's allowed request rate. Implementing exponential backoff causes the client to wait progressively longer between retries, reducing pressure on the API until requests can succeed.

Question 13

Question: A cloud engineer must determine why a checkout process spanning several microservices is experiencing intermittent delays. Logs and metrics exist independently for each microservice. Which of the following is the best way to determine the source of the issue?

•          A. Enabling distributed tracing across all microservices

•          B. Reviewing only the payment service's error logs

•          C. Increasing the timeout value for every service

•          D. Restarting the checkout service on a schedule

Explanation: Distributed tracing follows a single checkout request as it passes through each microservice, recording the time spent at every stage. This makes it possible to pinpoint exactly which service is responsible for the intermittent delay.

Question 14

Question: A company is onboarding several business units into a shared cloud environment and needs to attribute cloud spending accurately to each unit without slowing down deployments. Which of the following enables consumption tracking with the most efficiency?

•          A. Requiring each business unit to request budget approval before every deployment

•          B. Automatically tagging all resources with business unit metadata

•          C. Creating a separate cloud account for each business unit

•          D. Limiting each business unit to a fixed set of instance types

Explanation: Automated resource tagging attaches business unit metadata to every resource at the time of deployment, enabling accurate, granular cost-allocation reporting without introducing approval bottlenecks or the overhead of separate accounts.

Question 15

Question: Which of the following tools is specifically designed to provision and manage cloud infrastructure using declarative configuration files that support versioning and repeatable deployment across environments?

•          A. Terraform

•          B. Docker

•          C. Git

•          D. Jenkins

Explanation: Terraform is an Infrastructure as Code tool purpose-built to provision and manage cloud infrastructure using declarative configuration files that can be version-controlled and applied repeatably across multiple environments.

Question 16

Question: A photo backup application allows users to upload images directly from their phones. The design includes an API credential for cloud object storage and a backend server with a public IP. A security review finds a large number of end-user IP addresses connecting directly to object storage using the backend's API credential. Which of the following is the most likely explanation?

•          A. The backend server is deployed across multiple availability zones.

•          B. The application issues temporary, scoped credentials so devices upload directly to storage.

•          C. A separate application shares the same object storage bucket.

•          D. The backend server operates behind a reverse proxy.

Explanation: When numerous end-user IP addresses authenticate directly to object storage using the same API credential, it typically indicates the application generates temporary, scoped credentials so uploads bypass the backend server and go directly to storage.

Question 17

Question: Which of the following services is most appropriate for routing HTTPS requests to different backend pools depending on the specific subdomain requested by the client?

•          A. Layer 4 load balancer

•          B. Content delivery network

•          C. Layer 7 load balancer

•          D. NAT gateway

Explanation: A Layer 7 (application layer) load balancer can inspect the content of an HTTP/HTTPS request, including the subdomain in the host header, allowing it to intelligently route traffic to different backend pools based on that value.

Question 18

Question: Which of the following are typically the customer's responsibility when using a provider-managed container orchestration service (such as a managed Kubernetes offering)? (Select two)

•          A. Maintaining the control plane's underlying hardware

•          B. Configuring application-level network policies within the cluster

•          C. Patching the control plane software

•          D. Managing the container images and application deployments

•          E. Provisioning the physical data center network

•          F. Maintaining the hypervisor beneath worker nodes

Explanation: In a managed Kubernetes offering, the provider is responsible for the control plane's hardware, patching, and underlying hypervisor. The customer remains responsible for the workloads running on the cluster, including container images, deployments, and application-level network policies.

Question 19

Question: A company's most recent backup snapshots were corrupted by an attacker with administrative access during a ransomware incident, forcing recovery from a much older backup and significant data loss. Which of the following backup features would most directly prevent this outcome from recurring?

•          A. Deduplication

•          B. Immutability with retention locks

•          C. Compression

•          D. Incremental snapshots

Explanation: Immutable backups with retention locks prevent snapshot data from being altered or deleted, even by an account with administrative privileges, for a defined retention period, ensuring a clean, recent backup remains available after a compromise.

Question 20

Question: A cloud engineer maintains an IaC configuration that deploys an application to a single cloud region. The team now needs the application deployed to five additional regions with minimal duplicated code. Which of the following options best fulfills this requirement?

•          A. Manually configure each region through the cloud provider console.

•          B. Create region-specific variable files and reuse the existing IaC templates.

•          C. Duplicate the entire codebase into a new repository per region.

•          D. Create a separate Git branch for each region and deploy from each manually.

Explanation: Infrastructure as Code is designed to be reusable across environments. Creating region-specific variable files allows the same underlying templates to be reused for every deployment, avoiding duplicated code and enabling scalable, consistent multi-region rollouts.

Question 21

Question: Which of the following Git commands permanently records staged changes to the local repository's history?

•          A. git add

•          B. git commit

•          C. git push

•          D. git stash

Explanation: The git commit command permanently records staged changes to the local repository's history, creating a new commit that can later be pushed to a remote repository or referenced by other commands.

Question 22

Question: A cloud engineer is troubleshooting a failed VPC peering request between the following networks: Network 1: 172.16.0.0/20, Network 2: 172.16.4.0/24. Which of the following is causing the issue?

•          A. A missing security group rule

•          B. Overlapping subnet ranges

•          C. An unresponsive DNS resolver

•          D. A route table size limit

Explanation: VPC peering requires that the two networks being peered have no overlapping IP address ranges. Because 172.16.4.0/24 falls entirely within 172.16.0.0/20, the address ranges overlap, preventing the peering connection from being established.

Question 23

Question: A security engineer is finalizing a business continuity plan and needs to document the metric describing the maximum acceptable delay between when data is generated and when it is safely captured in a backup. Which of the following metrics should the engineer include?

•          A. RTO

•          B. RPO

•          C. MTU

•          D. Jitter

Explanation: Recovery Point Objective (RPO) defines the maximum acceptable amount of time between data generation and its capture in a backup, representing the maximum tolerable data loss window in the event of a disruption.

Question 24

Question: A content management system hosted on cloud VMs using standard hard disk drives experiences slow page load times when handling large numbers of concurrent editors. Which of the following would an administrator most likely consider for optimization?

•          A. DNS caching configuration

•          B. Storage throughput and IOPS

•          C. Load balancer session stickiness

•          D. Application session timeout duration

Explanation: Standard spinning hard disk drives offer significantly lower IOPS and throughput than solid-state drives. Upgrading storage performance removes the disk bottleneck limiting the system's ability to handle concurrent read and write operations from many editors.

Question 25

Question: A cloud engineer must redesign a single-instance production database to withstand a full availability zone outage while also supporting restoration to a precise moment shortly before an accidental data deletion. Which of the following best meets these requirements?

•          A. A larger single database instance

•          B. A manually triggered monthly export

•          C. A Multi-AZ database deployment with automated backups

•          D. A local read replica in the same zone

Explanation: A Multi-AZ database deployment automatically maintains a synchronous standby replica in a separate availability zone for automated failover, while automated backups allow the database to be restored to a specific point in time before an accidental deletion.

Question 26

Question: A European e-commerce company is preparing for an audit regarding how it collects, stores, and processes the personal data of its customers in the cloud. Which of the following compliance standards is most relevant to this audit?

•          A. GDPR

•          B. ITIL

•          C. CIS

•          D. PCI DSS

Explanation: The General Data Protection Regulation (GDPR) governs how organizations collect, store, and process the personal data of individuals in the European Union, making it the most relevant standard for this audit.

Question 27

Question: A cloud engineer configures a new Linux VM and encounters the error: Name or service not known when attempting to reach an internal registry. Investigation shows the /etc/resolv.conf file has no entries. Which of the following lines should the engineer add to the file to fix the issue?

•          A. nameserver 172.16.0.53

•          B. arp -a

•          C. ss -tulwn

•          D. mount -a

Explanation: An empty /etc/resolv.conf file means the Linux instance has no configured DNS server for resolving hostnames. Adding a nameserver entry with a valid DNS server IP address resolves the internal name resolution failure.