CompTIA Cloud+ Certification: Advanced Scaling, Resilience & Compliance

Question 1

A team is deciding whether to deploy a new application as a set of long-running virtual machines or as serverless functions triggered by events. Which factor most favors serverless functions?

●        A. A workload with steady, predictable, continuous demand

●        B. A workload with sporadic, event-driven demand and short execution times

●        C. A requirement for full OS-level control

●        D. A requirement to run legacy software with specific kernel dependencies

Explanation: Serverless functions are well suited to sporadic, event-driven workloads with short execution times, since billing is based on actual invocation rather than continuous uptime.

Question 2

Which of the following is a key benefit of using immutable infrastructure, where servers are replaced rather than modified in place during updates?

●        A. Reduced configuration drift since servers are never manually altered after deployment

●        B. Guaranteed lower compute costs in every scenario

●        C. Elimination of the need for testing

●        D. Removal of the need for version control

Explanation: Immutable infrastructure replaces rather than modifies servers, preventing configuration drift that can accumulate through repeated manual changes.

Question 3

Which high-availability technique distributes incoming requests across multiple healthy backend servers, automatically removing unhealthy servers from rotation?

●        A. Load balancing with health checks

●        B. Cold site failover

●        C. Manual traffic routing

●        D. Single-server hosting

Explanation: Load balancing with health checks automatically distributes traffic to healthy servers only, removing failed instances from rotation without manual intervention.

Question 4

Which deployment risk is specifically mitigated by maintaining detailed, version-controlled documentation of each release's changes?

●        A. Difficulty diagnosing which change caused a regression after deployment

●        B. Increased hardware costs

●        C. Reduced network bandwidth

●        D. Slower internet speeds

Explanation: Detailed, version-controlled release documentation makes it easier to trace a regression back to the specific change that introduced it.

Question 5

A company is deploying a new application and must decide the order of testing phases. Which testing phase should typically occur immediately before production release?

●        A. Unit testing

●        B. User acceptance testing

●        C. Requirements gathering

●        D. Initial design review

Explanation: User acceptance testing (UAT) is typically the final validation phase, confirming the system meets business needs immediately before production release.

Question 6

Which storage feature allows an organization to retain multiple historical copies of an object, protecting against accidental overwrites or deletions?

●        A. Object versioning

●        B. Data deduplication

●        C. Thin provisioning

●        D. RAID striping

Explanation: Object versioning preserves prior versions of a file whenever it changes, allowing recovery from accidental overwrites or deletions.

Question 7

A cloud technician discovers that a recent theory about the root cause of an outage was incorrect after testing. What should occur next per standard methodology?

●        A. Establish a new theory of probable cause and test it

●        B. Immediately implement a random fix

●        C. Close the ticket as resolved

●        D. Disable the affected system permanently

Explanation: If a theory is disproven, methodology calls for establishing and testing a new theory rather than guessing at a fix.

Question 8

Which practice reduces the risk of a single administrator's mistake causing a major outage by requiring a second person to review and approve significant production changes?

●        A. Peer review / change approval process

●        B. Removing all change controls for speed

●        C. Granting every engineer unrestricted production access

●        D. Disabling audit logging

Explanation: Requiring peer review and approval before significant production changes reduces the risk that a single person's error causes a major outage.

Question 9

Which backup target consideration is most important when an organization needs backups to survive a complete regional cloud outage?

●        A. Storing backups only within the same region as production

●        B. Storing backups in a geographically separate region or offsite location

●        C. Storing backups only on production servers

●        D. Not storing backups at all

Explanation: Backups stored in a geographically separate region protect against a complete regional outage, unlike backups kept only within the same region as production.

Question 10

An organization wants to ensure that logs cannot be altered or deleted by an attacker attempting to cover their tracks after a breach. Which practice addresses this?

●        A. Write-once, immutable log storage

●        B. Storing logs only on the compromised system

●        C. Disabling logging to reduce attack surface

●        D. Deleting logs weekly to save space

Explanation: Immutable, write-once log storage prevents attackers from altering or deleting log evidence after gaining access, preserving forensic integrity.

Question 11

Which security practice involves regularly reviewing which users and service accounts have access to specific resources, removing access that is no longer needed?

●        A. Access recertification/entitlement review

●        B. Data masking

●        C. Load balancing

●        D. Auto-scaling

Explanation: Access recertification periodically reviews and validates that existing access is still needed, removing stale or excessive permissions.

Question 12

An organization wants to standardize how new cloud environments are provisioned so that every deployment includes required tagging, logging, and security baselines automatically. Which approach achieves this?

●        A. Landing zone/deployment template with built-in guardrails

●        B. Manual configuration by each individual engineer

●        C. No standardization, allowing full engineer discretion

●        D. Disabling all default configurations

Explanation: A landing zone or standardized deployment template embeds required guardrails (tagging, logging, security baselines) into every new environment automatically.

Question 13

An operations team notices repeated manual escalations for a routine, well-understood issue that has a documented fix. Which improvement would reduce the operational burden going forward?

●        A. Automating the documented fix as a self-healing remediation

●        B. Hiring more staff to manually respond to each occurrence

●        C. Ignoring the issue since it is well understood

●        D. Removing the documentation

Explanation: Automating a well-documented, repeatable fix as a self-healing remediation reduces the ongoing manual burden of responding to the same issue repeatedly.

Question 14

Which cloud cost model allows an organization to commit to a specific level of usage over one or three years in exchange for a significantly discounted rate compared to on-demand pricing?

●        A. Spot pricing

●        B. Reserved instance pricing

●        C. Pay-as-you-go pricing

●        D. Free tier pricing

Explanation: Reserved instance pricing offers discounted rates in exchange for a committed usage term, unlike flexible on-demand or interruptible spot pricing.

Question 15

Which backup consideration determines how long backup data must be legally retained before it can be deleted, often driven by regulatory requirements?

●        A. Retention policy

●        B. Compression ratio

●        C. Deduplication rate

●        D. Network throughput

Explanation: A retention policy defines the required duration backups must be kept, often dictated by regulatory or business requirements.

Question 16

An organization is planning a phased migration of 200 applications to the cloud. Which factor should primarily determine the order in which applications are migrated?

●        A. Application complexity, dependencies, and business risk

●        B. Alphabetical order of application names

●        C. The birthday of the application owner

●        D. Random selection with no criteria

Explanation: Migration order should be driven by complexity, dependency mapping, and business risk, prioritizing lower-risk, less-complex applications early to build confidence and process maturity.

Question 17

A cloud technician is troubleshooting a reported outage but has not yet gathered enough information to form a theory. What should be done next?

●        A. Gather additional information through questions, logs, and observation

●        B. Immediately implement a random fix

●        C. Close the ticket as unable to reproduce

●        D. Escalate without further investigation

Explanation: Before forming a theory, sufficient information must be gathered through questioning, log review, and direct observation of the issue.

Question 18

Which architectural pattern decouples application components using message queues, allowing services to process requests asynchronously and independently?

●        A. Tightly coupled monolith

●        B. Event-driven/asynchronous messaging architecture

●        C. Single-threaded synchronous processing

●        D. Manual batch processing only

Explanation: Event-driven architectures use message queues to decouple components, allowing them to process work asynchronously and scale independently.

Question 19

Which operational practice ensures that critical alerts are routed to the correct on-call engineer automatically, with escalation to a secondary contact if not acknowledged within a set time?

●        A. An on-call rotation with automated escalation policies

●        B. A single shared email inbox with no rotation

●        C. Disabling alerts during off-hours

●        D. Manual phone calls with no defined process

Explanation: Automated on-call rotations with escalation policies ensure alerts reach the right person quickly and automatically escalate if unacknowledged.

Question 20

An organization wants to ensure that its incident response process clearly defines roles and responsibilities before an actual incident occurs. Which document supports this?

●        A. An incident response plan

●        B. A vulnerability scan report

●        C. A load testing report

●        D. A vendor invoice

Explanation: An incident response plan defines roles, responsibilities, and procedures in advance, ensuring a coordinated response when an actual incident occurs.

Question 21

An application's error logs show repeated 'connection refused' messages when attempting to reach a dependent internal service. Which area should be checked first?

●        A. Whether the dependent service is running and listening on the expected port

●        B. The application's marketing copy

●        C. The end user's monitor resolution

●        D. The vendor's billing cycle

Explanation: 'Connection refused' errors typically indicate the target service is not running or not listening on the expected port, making that the first area to check.

Question 22

Following a successful fix for a recurring outage, which action helps prevent the same root cause from affecting other similar systems in the environment?

●        A. Proactively applying the same fix or safeguard across other systems with the same configuration

●        B. Only fixing the one system that was reported

●        C. Disabling monitoring on similar systems

●        D. Removing documentation of the root cause

Explanation: Proactively applying the fix or safeguard to other systems sharing the same root-cause configuration prevents the same issue from recurring elsewhere.

Question 23

A newly migrated application performs well under normal load but degrades sharply during nightly batch processing, correlating with a scheduled backup job. Which cause is most likely?

●        A. Resource contention between the backup job and the application for shared I/O or CPU

●        B. A DNS misconfiguration

●        C. An expired software license

●        D. A user interface bug

Explanation: Performance degradation correlating with a scheduled backup job points to resource contention for shared I/O, CPU, or network bandwidth during that window.

Question 24

Which practice ensures that cryptographic keys are recoverable by an authorized party (such as the organization, not the original key holder) in case an employee is unavailable, while maintaining strict access controls?

●        A. Key escrow

●        B. Key rotation

●        C. Data masking

●        D. Tokenization

Explanation: Key escrow securely stores a copy of encryption keys with a trusted third party or process, allowing authorized recovery without relying solely on one individual.

Question 25

An organization's operations runbook specifies that after any failover event, the team must document the timeline, root cause, and corrective actions. What is this document commonly called?

●        A. A post-incident review (post-mortem)

●        B. A service level agreement

●        C. A penetration test report

●        D. A vendor contract

Explanation: A post-incident review (post-mortem) documents the timeline, root cause, and corrective actions following an incident to support learning and prevention.

Question 26

An application's database queries that previously completed in milliseconds now take several seconds, though the database server's resource utilization appears normal. Which cause should be investigated next?

●        A. Missing or degraded database indexes, or query plan changes

●        B. The office Wi-Fi password

●        C. The vendor's stock price

●        D. The color of the database administration tool's interface

Explanation: Slow queries despite normal server resource utilization often point to missing/degraded indexes or unfavorable query execution plans rather than raw capacity.

Question 27

An operations team wants to measure how effectively they are meeting their committed service levels over time. Which practice supports this?

●        A. SLA compliance tracking and reporting

●        B. Data masking

●        C. Penetration testing

●        D. Federation configuration

Explanation: Tracking and reporting SLA compliance over time shows whether committed service levels (uptime, response time, etc.) are consistently being met.

Question 28

A cloud technician needs to determine whether a reported issue is a genuine problem or expected behavior under current conditions. Which step of the troubleshooting methodology does this represent?

●        A. Identifying the problem

●        B. Documenting the resolution

●        C. Closing the ticket

●        D. Escalating to management

Explanation: Determining whether reported behavior is actually a problem is part of the initial problem identification step in the troubleshooting process.

Question 29

Which deployment consideration addresses ensuring that a new application version can coexist with the previous version's data schema during a phased rollout?

●        A. Backward compatibility of the data schema

●        B. Physical server color

●        C. Marketing timeline

●        D. Employee vacation schedule

Explanation: Backward-compatible schema design allows old and new application versions to operate against the same data during a phased rollout without breaking either version.

Question 30

An organization is implementing zero trust principles in its cloud environment. Which statement best reflects a core tenet of zero trust?

●        A. Trust is granted automatically to any device inside the corporate network perimeter

●        B. No user or device is trusted by default, and verification is required for every access request

●        C. Once authenticated, a user retains access indefinitely without re-verification

●        D. Internal network traffic does not need to be inspected

Explanation: Zero trust assumes no implicit trust based on network location; every access request must be verified regardless of where it originates.

Question 31

Which practice specifically supports capacity planning by analyzing historical resource utilization trends to forecast when additional compute capacity will be needed?

●        A. Trend analysis of historical utilization data

●        B. One-time penetration testing

●        C. Data masking

●        D. Federation setup

Explanation: Trend analysis of historical utilization data allows teams to forecast future capacity needs and plan procurement or scaling proactively.

Question 32

An application experiences a sudden spike in error rates immediately following an auto-scaling event that added new instances. Which cause should be investigated first?

●        A. Whether new instances are missing required configuration or bootstrap steps

●        B. The physical color of the server chassis

●        C. The vendor's press release schedule

●        D. The office thermostat setting

Explanation: Errors correlating with newly scaled instances often indicate those instances are missing configuration, secrets, or bootstrap steps applied to the original fleet.

Question 33

Which encryption approach uses the same key for both encrypting and decrypting data, offering faster performance but requiring secure key distribution?

●        A. Asymmetric encryption

●        B. Symmetric encryption

●        C. Hashing

●        D. Tokenization

Explanation: Symmetric encryption uses a single shared key for both encryption and decryption, which is fast but requires secure key distribution between parties.

Question 34

Users report slow file uploads to a cloud storage service, but download speeds are normal. Which area is most likely the cause?

●        A. Upload bandwidth constraints or client-side throttling

●        B. The storage service's read replica configuration

●        C. The DNS TTL setting

●        D. The office printer configuration

Explanation: Asymmetric performance affecting only uploads points toward upload-specific bandwidth limits or client-side throttling rather than a general service issue.

Question 35

An organization wants a framework to identify, assess, and prioritize risks to its cloud environment based on likelihood and potential impact. Which practice does this describe?

●        A. Risk assessment

●        B. Data masking

●        C. Load testing

●        D. Federation

Explanation: A risk assessment systematically identifies threats and vulnerabilities, then evaluates them by likelihood and impact to prioritize mitigation efforts.

Question 36

An organization needs to determine the appropriate number of compute nodes for a new application launch. Which approach uses historical data and projected growth to make this determination?

●        A. Capacity planning during the design phase

●        B. Guessing based on competitor announcements

●        C. Provisioning the maximum possible size regardless of need

●        D. Delaying sizing decisions until after launch

Explanation: Capacity planning during design uses historical and projected data to right-size infrastructure before launch, avoiding under- or over-provisioning.

Question 37

Which troubleshooting step ensures that a resolved issue does not silently reoccur after the immediate fix is applied?

●        A. Ongoing monitoring and verification of full system functionality after resolution

●        B. Deleting all related documentation

●        C. Disabling alerts for that specific service

●        D. Closing the ticket immediately without follow-up

Explanation: Ongoing monitoring after a fix confirms the issue truly stays resolved rather than assuming a one-time check is sufficient.

Question 38

An organization's deployment pipeline includes an automated step that scans container images for known vulnerabilities before allowing them to be deployed. Which practice does this represent?

●        A. Shift-left security scanning in the CI/CD pipeline

●        B. Post-incident forensics

●        C. Manual quarterly audits only

●        D. Disabling security checks for speed

Explanation: Scanning container images for vulnerabilities before deployment is a shift-left practice, catching issues earlier in the pipeline rather than after release.

Question 39

An organization wants a backup strategy that provides the fastest possible restore time by always keeping one complete, ready-to-use copy of data, even though it requires the most storage space nightly. Which strategy fits this goal?

●        A. Nightly full backups

●        B. Weekly full with daily incrementals

●        C. Monthly archive only

●        D. No backups, relying on replication alone

Explanation: Nightly full backups provide the fastest restore since each backup is a complete, standalone copy, at the cost of higher storage consumption.

Question 40

Which compliance framework specifically governs how organizations that handle credit card transactions must protect cardholder data?

●        A. HIPAA

●        B. PCI DSS

●        C. FERPA

●        D. COPPA

Explanation: The Payment Card Industry Data Security Standard (PCI DSS) sets requirements specifically for protecting cardholder payment data.

Question 41

Which storage redundancy approach replicates data synchronously across multiple availability zones within a region to protect against a zone-level failure?

●        A. Locally redundant storage (single zone only)

●        B. Zone-redundant storage

●        C. No redundancy

●        D. Archive-only storage

Explanation: Zone-redundant storage synchronously replicates data across multiple availability zones, protecting against the failure of any single zone.

Question 42

A company's security team wants to simulate a phishing campaign against employees to measure and improve awareness. What category of activity does this represent?

●        A. Security awareness training/testing

●        B. Penetration testing of infrastructure

●        C. Vulnerability scanning

●        D. Data classification

Explanation: Simulated phishing campaigns are a form of security awareness training designed to measure and improve employee resistance to social engineering.

Question 43

A company must securely store database credentials used by an application without hardcoding them into source code. Which solution addresses this?

●        A. A secrets management service/vault

●        B. A public code repository

●        C. A shared spreadsheet

●        D. Plaintext environment variables committed to source control

Explanation: A secrets management service securely stores and controls access to credentials, avoiding the risks of hardcoding them into source code.

Question 44

Which type of firewall operates specifically at the cloud provider's virtual network layer, controlling traffic between subnets and instances based on rules such as source IP and port?

●        A. Security group / network access control list

●        B. Web application firewall

●        C. Host-based antivirus

●        D. Data loss prevention appliance

Explanation: Security groups and network ACLs are cloud-native firewalls that control traffic at the virtual network layer based on IP, port, and protocol rules.

Question 45

A company wants to ensure that its cloud environment automatically scales down non-production development environments outside of business hours to save cost. Which practice supports this?

●        A. Scheduled auto-scaling/shutdown automation for non-production resources

●        B. Running all environments at full capacity 24/7 regardless of use

●        C. Manually shutting down servers each night

●        D. Disabling cost monitoring

Explanation: Scheduled automation that scales down or shuts off non-production resources outside business hours directly reduces unnecessary cost.

Question 46

A company discovers that an attacker gained access using valid but stolen credentials, with no malware involved. Which control would have most directly reduced the likelihood of this specific attack succeeding?

●        A. Multifactor authentication

●        B. Antivirus software

●        C. Data deduplication

●        D. RAID redundancy

Explanation: MFA requires a second verification factor beyond the password, meaning stolen credentials alone would not have been sufficient for the attacker to gain access.

Question 47

Which environment sizing strategy provisions resources to match current baseline demand exactly, relying on auto-scaling to handle spikes rather than pre-provisioning for peak load?

●        A. Static peak provisioning

●        B. Baseline provisioning with elastic scaling for spikes

●        C. No provisioning at all

●        D. Manual quarterly resizing only

Explanation: Baseline provisioning paired with elastic scaling matches steady-state demand while relying on auto-scaling to absorb temporary spikes, improving cost efficiency.

Question 48

Which practice helps an operations team quickly identify which specific recent change caused a new production issue, out of several changes deployed the same day?

●        A. Deploying changes independently with clear versioning and change logs, rather than bundling unrelated changes

●        B. Bundling all changes into a single large weekly release with no individual tracking

●        C. Avoiding any documentation of changes

●        D. Disabling monitoring during deployment days

Explanation: Deploying changes independently with clear versioning makes it far easier to isolate which specific change caused a new issue, compared to bundling many changes together.

Question 49

A company wants new application deployments to automatically register with monitoring and alerting systems without manual configuration. Which practice supports this?

●        A. Embedding monitoring agent installation and auto-registration into the deployment template

●        B. Manually configuring monitoring after every deployment

●        C. Disabling monitoring by default

●        D. Relying on end users to report issues

Explanation: Embedding monitoring agent setup directly into deployment templates ensures every new resource is automatically observable without manual follow-up steps.

Question 50

A company wants to eliminate a single point of failure for its database tier by deploying a primary node and a synchronously replicated standby node that can take over automatically. Which architecture pattern does this describe?

●        A. Database clustering with automatic failover

●        B. Cold backup archiving

●        C. Manual database replication

●        D. Single-node scaling

Explanation: Clustering with automatic failover keeps a synchronized standby ready to take over immediately if the primary node fails, removing a single point of failure.

Question 51

Which document defines an organization's acceptable use policies, data handling requirements, and security responsibilities that all employees must follow?

●        A. Security policy

●        B. Service level agreement

●        C. Non-disclosure agreement

●        D. Statement of work

Explanation: A security policy formally documents acceptable use, data handling, and security responsibilities expected of all employees.

Question 52

A DevOps team wants to test a new feature with a small percentage of real users to gather feedback before a full release, while being able to instantly disable the feature if issues arise. Which technique supports this?

●        A. Feature flagging

●        B. Big bang deployment

●        C. Cold site failover

●        D. Manual rollback only

Explanation: Feature flags allow specific features to be toggled on or off for subsets of users independently of a full deployment, enabling controlled testing and instant rollback.

Question 53

A design team is deciding between a monolithic architecture and a microservices architecture for a new application. Which tradeoff is most associated with microservices?

●        A. Simpler operational overhead with a single deployable unit

●        B. Increased architectural complexity in exchange for independent scalability and deployment

●        C. Guaranteed lower total cost in all cases

●        D. Elimination of the need for monitoring

Explanation: Microservices offer independent scalability and deployment but introduce additional operational complexity compared to a single monolithic unit.

Question 54

A team is migrating an application and needs to move both the virtual machine and its associated physical-to-virtual conversion in a single coordinated step, minimizing downtime. Which migration approach best supports this?

●        A. A live migration tool with minimal cutover window

●        B. A manual copy-paste of files with no tooling

●        C. Rebuilding the application from scratch

●        D. Ignoring downtime requirements entirely

Explanation: Live migration tools coordinate the conversion and cutover with minimal downtime, compared to manual or ground-up rebuild approaches.

Question 55

An operations team wants to reduce the manual effort required to apply routine security patches across hundreds of servers each month. Which solution addresses this most directly?

●        A. Automated patch management with scheduled deployment windows

●        B. Manually patching each server by hand

●        C. Disabling patching entirely

●        D. Patching only when a breach occurs

Explanation: Automated patch management applies updates across many systems on a schedule, drastically reducing manual effort compared to patching each server individually.

Question 56

Which factor is most important when selecting a cloud region for hosting an application that serves financial transactions requiring strict data residency compliance?

●        A. The region's marketing name

●        B. Legal and regulatory data residency requirements

●        C. The region's average temperature

●        D. The number of data centers physically visible from the highway

Explanation: For regulated data, legal and regulatory residency requirements are the primary driver in selecting where data can be physically hosted.

Question 57

A cloud administrator finds that a scheduled automation task began failing after a scheduled maintenance window on the underlying platform. Which troubleshooting step is most appropriate first?

●        A. Review the maintenance window's release notes for breaking changes

●        B. Immediately rebuild the entire environment

●        C. Disable all automation permanently

●        D. Ignore the failures since they started recently

Explanation: Since the failure timing aligns with a maintenance window, reviewing release notes for breaking changes introduced during that maintenance is the logical first step.

Question 58

Which consideration is most critical when planning the network bandwidth and timing for a large one-time bulk data migration to the cloud?

●        A. Whether a physical data transfer appliance may be more efficient than transferring over the network

●        B. The number of team members attending the migration meeting

●        C. The color scheme of the migration project plan

●        D. The vendor's social media presence

Explanation: For very large datasets, physical transfer appliances can be more time- and cost-efficient than transferring over limited network bandwidth.

Question 59

An architect is designing a globally distributed application and needs traffic to be automatically routed to the nearest healthy regional endpoint. Which capability should be implemented?

●        A. Global/geo-based load balancing with health checks

●        B. A single regional load balancer

●        C. Manual DNS updates during outages

●        D. Static IP assignment with no failover

Explanation: Global or geo-based load balancing routes users to the nearest healthy endpoint automatically, improving performance and availability.

Question 60

Which practice involves comparing actual cloud resource costs against a predefined budget on a recurring basis to catch overspending early?

●        A. Budget variance analysis

●        B. Data classification

●        C. Penetration testing

●        D. Load balancing configuration

Explanation: Budget variance analysis regularly compares actual spend to planned budget, helping identify and address overspending trends early.

Question 61

Which metric best represents the overall reliability of a system by measuring the average time a component operates before it fails?

●        A. MTBF (Mean Time Between Failures)

●        B. MTTR (Mean Time To Repair)

●        C. RPO

●        D. RTO

Explanation: MTBF measures the average operational time between failures, serving as an indicator of a component's or system's reliability.

Question 62

Which practice ensures that a deployment automation script does not accidentally run against the wrong environment, such as deploying test code to production?

●        A. Environment-specific configuration and explicit environment targeting checks

●        B. Removing all environment labels

●        C. Using identical credentials across all environments

●        D. Disabling confirmation prompts

Explanation: Explicit environment targeting and environment-specific configuration reduce the risk of accidentally deploying to the wrong environment.

Question 63

Users intermittently receive HTTP 503 errors from a web application during peak traffic, while off-peak performance is normal. Which cause is most likely?

●        A. Insufficient backend capacity or connection limits being reached during peak load

●        B. A permanently misconfigured DNS record

●        C. An expired SSL certificate

●        D. A missing software license

Explanation: Errors specifically during peak traffic point to backend capacity or connection limits being exceeded under load, rather than a constant configuration issue.

Question 64

Which factor should be evaluated when deciding whether a workload should be deployed using reserved instances versus spot/preemptible instances?

●        A. Whether the workload is fault-tolerant and can handle sudden interruption

●        B. The color of the provider's logo

●        C. The number of characters in the application name

●        D. The physical distance to the nearest coffee shop

Explanation: Spot/preemptible instances can be reclaimed with little notice, so they are only appropriate for fault-tolerant workloads that can handle interruption; reserved instances suit steady, uninterruptible workloads.

Question 65

A troubleshooting effort has resolved an incident. Which final step ensures future technicians can benefit from what was learned?

●        A. Thoroughly documenting the problem, cause, and resolution

●        B. Deleting all logs related to the incident

●        C. Avoiding discussion of the incident with the team

●        D. Immediately moving on without any record

Explanation: Thorough documentation of the problem, root cause, and resolution ensures the knowledge is available to help resolve similar issues faster in the future.

Question 66

A technician has tested a theory of probable cause and confirmed it is correct. According to standard troubleshooting methodology, what is the next step?

●        A. Establish a plan of action to resolve the problem and implement the solution

●        B. Restart the troubleshooting process from the beginning

●        C. Immediately close the ticket without a fix

●        D. Escalate without attempting resolution

Explanation: Once a theory is confirmed, the next step is to establish a plan of action and implement the solution to resolve the issue.

Question 67

An organization wants to reduce the risk of configuration drift across hundreds of servers that were originally deployed identically. Which practice helps detect and correct this drift?

●        A. Automated configuration compliance scanning against a defined baseline

●        B. Manually inspecting each server once a year

●        C. Disabling all configuration management tools

●        D. Allowing engineers unrestricted, untracked changes

Explanation: Automated compliance scanning against a defined baseline detects when systems have drifted from their intended configuration, enabling correction.

Question 68

Which security concept refers to the potential entry points an attacker could use to compromise a system, and which organizations aim to minimize?

●        A. Attack surface

●        B. Recovery point objective

●        C. Chargeback model

●        D. Elasticity

Explanation: Attack surface refers to the total set of exposed points (ports, services, interfaces) an attacker could potentially exploit; minimizing it reduces risk.

Question 69

A company's DR plan requires failing over to a secondary cloud region within 15 minutes of a declared outage. Which metric does this 15-minute target represent?

●        A. RPO

●        B. RTO

●        C. MTBF

●        D. SLA penalty threshold

Explanation: A specific target time to restore operations after a declared outage represents the Recovery Time Objective (RTO).

Question 70

An organization's automated certificate renewal process failed silently, resulting in an expired TLS certificate causing an outage. Which practice would most directly have prevented this outage?

●        A. Proactive monitoring and alerting on certificate expiration dates

●        B. Disabling HTTPS entirely

●        C. Increasing server CPU allocation

●        D. Reducing backup frequency

Explanation: Proactive monitoring and alerting on upcoming certificate expirations would have flagged the failed renewal before the certificate actually expired.

Question 71

An organization is deploying a new application and must determine appropriate network segmentation between the web, application, and database tiers. Which principle should guide this design?

●        A. Placing all tiers in a single flat network with no segmentation

●        B. Segmenting tiers so each only communicates with what it explicitly needs

●        C. Exposing the database tier directly to the internet for convenience

●        D. Disabling all firewalls between tiers

Explanation: Segmenting tiers so each communicates only with what it explicitly needs limits the blast radius if one tier is compromised.

Question 72

An organization wants to ensure that a compromised application cannot use overly broad permissions to access unrelated cloud resources. Which practice most directly reduces this risk?

●        A. Granting broad administrator access to all applications by default

●        B. Applying least-privilege, scoped IAM roles per application

●        C. Disabling all logging

●        D. Removing all firewalls for simplicity

Explanation: Scoped, least-privilege IAM roles limit what a compromised application can access, containing the impact of a breach.

Question 73

Which security control specifically limits the blast radius of a compromised cloud credential by requiring temporary, time-limited access tokens instead of long-lived static credentials?

●        A. Short-lived, temporary access tokens

●        B. Permanent API keys with no expiration

●        C. Shared administrator accounts

●        D. Disabling authentication entirely

Explanation: Temporary, time-limited access tokens expire quickly, reducing the window during which a compromised credential could be misused.

Question 74

Which testing approach verifies that a system can handle an expected number of concurrent users performing typical actions without significant performance degradation?

●        A. Load testing

●        B. Unit testing

●        C. Static code analysis

●        D. Documentation review

Explanation: Load testing evaluates system performance under an expected level of concurrent user activity to confirm it meets performance requirements.

Question 75

A company is evaluating whether to use thin provisioning or thick provisioning for a new set of storage volumes. What is the primary benefit of thin provisioning?

●        A. It guarantees the full allocated capacity is reserved immediately

●        B. It allocates storage on demand as data is actually written, improving utilization

●        C. It eliminates the need for backups

●        D. It requires no monitoring of storage consumption

Explanation: Thin provisioning allocates physical storage only as data is actually written, improving overall utilization compared to reserving full capacity upfront.