CompTIA Cloud+ Certification Exam

Question 1

Scenario: A highly regulated business is required to work remotely, and the risk tolerance is very low. The cloud engineer is designing an identity solution for the company cloud that includes the following:

• User login security that minimizes user login.
• Tracks user activity and monitors for suspicious behavior.
• Requires secondary authentication.

Answer Choices:

• SSO (for user login security that minimizes user login)
• NAC / MFA (for tracking user activity / secondary authentication)
• SIEM (for server monitoring)
• SSO, NAC, and SIEM (or appropriate matching selections configured in the interface).

Explanation:

• Single Sign-On (SSO) streamlines user login requirements.
• Network Access Control (NAC) or monitoring tools help track user network behavior.
• Security Information and Event Management (SIEM) collects and monitors server security events.

Question 2

Question: A business is implementing a deployment strategy for a mission-critical application that requires:

• Minimal downtime
• Fast rollback

Which of the following is the best strategy to meet these requirements?

• A. In-place
• B. Blue-green
• C. Rolling
• D. Canary

Explanation:
A blue-green deployment strategy maintains two identical production environments (blue and green). Because traffic can be switched instantly between environments via a load balancer, downtime is minimized, and rolling back to the previous version is virtually instantaneous if an issue arises.

Question 3

Question: A company implements a web farm with 100 servers behind an application load balancer. During scaling events, new web servers that are placed in service have not loaded all their modules, which causes some requests to the web farm to fail. Which of the following should the cloud engineer implement to address the scaling issue?

• A. Instance warm-up
• B. Scheduled scaling
• C. Event-based scaling
• D. Load balancer passthrough

Explanation:
Instance warm-up ensures that newly scaled instances have enough time to initialize and load necessary modules or configurations before the load balancer starts routing production traffic to them, thereby preventing request failures.

Question 4

Question: An engineer receives information about an application issue and reviews the events. The engineer decides to horizontally scale the application server. Which of the following would most likely explain the engineer's decision?

• A. The web server reached the maximum number of TCP sessions.
• B. Ephemeral storage for the server OS reached 90%.
• C. A runtime error in the application logs indicated a bug in the application.
• D. The application server averages 50% CPU and spiked to 90% CPU.

Explanation:
Horizontal scaling involves adding more compute instances (servers) to handle heavy compute loads. A spike to high CPU usage indicates resource saturation on the current instance, making horizontal scaling an ideal remedy to distribute the workload.

Question 5

Question: An engineer is building infrastructure to store credit card data. The infrastructure must be efficient and align with global industry best practices. Which of the following is the best for the engineer to use?

• A. CIS Benchmarks
• B. GDPR guidelines
• C. Storage encryption
• D. Secrets management

Explanation:
CIS (Center for Internet Security) Benchmarks provide globally recognized, consensus-driven prescriptive best practices for securing IT systems and infrastructure securely and efficiently.

Question 6

Question: A process runs that creates several pieces of intermediate data before producing a final output. After the process completes, there is no requirement to keep the intermediate data. Which of the following is the best way to treat the intermediate data?

• A. As ephemeral data
• B. As persistent data
• C. As supporting data
• D. As caching data

Explanation:
Ephemeral data is short-lived data that is automatically discarded or deleted once its immediate processing purpose is complete, making it ideal for unneeded intermediate files.

Question 7

Question: Which of the following is a constraint for private image repositories?

• A. Cannot be digitally signed
• B. Accessible only on private subnets
• C. Mandates TLS v1.3
• D. Requires authentication

Explanation:
Private image repositories restrict access to authorized users or systems only, meaning that explicitly passing credentials or establishing proper authentication is always a mandatory prerequisite to pull or push images.

Question 8

Question: Which of the following is the most likely reason for migrating data from multiple public cloud providers to on-premises?

• A. To avoid vendor lock-in
• B. To decrease capital expenditure
• C. To comply with local laws regarding privacy
• D. To decrease payroll costs for server administrators (or context-specific compliance/control option matching video)

Question 9

Question: A cloud engineer is updating a company's Git system that is currently hosted on version 7.1 of a VM. To avoid potential breaking changes, only the latest minor updates are allowed. Which of the following versions should the engineer update the Git system to?

• A. 6.5
• B. 7.6
• C. 7.9
• D. 8.1

Explanation:
In Semantic Versioning (MAJOR.MINOR.PATCH), updating minor versions allows feature additions and bug fixes in a backward-compatible manner without breaking changes. Going from 7.1 to 7.9 represents a safe minor version upgrade step.

Question 10

Question: A database application was recently migrated from an on-premises server to the cloud. Users have been reporting that the application is not accessible. A subset of users from another department can connect to the application. Which of the following actions should the administrator take to fix the issue?

• A. Increase the subscription quota.
• B. Update the permissions.
• C. Disable API throttling.
• D. Increase the VM size.

Explanation:
Since some users can access the application successfully, the core infrastructure and network routes are functional. The fact that a specific subset of users cannot connect points directly to an access-control restriction, meaning permissions or IAM rules need to be updated.

Question 11

Question: Which of the following can connect multiple VPCs and an on-premises network?

• A. Subnet
• B. CDN
• C. Peering
• D. Transit gateway

Explanation:
A cloud Transit Gateway acts as a central hub that simplifies and scales connectivity between multiple Virtual Private Clouds (VPCs) and on-premises networks.

Question 12

Question: A cloud application fails to retrieve data from an API. A cloud engineer reviews the following log:
[ERROR] HTTP 423 - Too many requests
[INFO] API rate limit exceeded
[WARNING] API throttled
Which of the following is the best resolution?

• A. Upgrade the network bandwidth.
• B. Increase the database storage.
• C. Implement exponential backoff
• D. Restart the API server.

Explanation:
An HTTP 423/throttling error means the application is sending requests too quickly and hitting rate limits. Implementing an exponential backoff algorithm makes the client wait progressively longer periods between retry attempts, relieving pressure on the API.

Question 13

Question: A cloud engineer must find the root cause of a recent performance issue. Logs and metrics have been collected and are available. Which of the following is the best way to determine the source of the issue?

• A. Aggregating logs
• B. Enabling tracing
• C. Performing code review
• D. Enabling verbose logging

Explanation:
Aggregating logs into a centralized platform allows engineers to correlate, parse, and search across multiple data sources simultaneously to track down the root cause of historical performance issues.

Question 14

Question: A company is migrating various resource types to the cloud. The company needs to know the tracking cost per business unit. Which of the following enables consumption tracking with the most efficiency?

• A. Assigning each business unit a different VPC
• B. Creating a site where each business unit gets approval before deploying resources
• C. Tagging all resources with the business unit information automatically
• D. Instructing each business unit to deploy to a different cloud provider

Explanation:
Cloud resource tagging allows organizations to attach metadata labels to resources. Automated tagging enforces cost-allocation tracking efficiently across multi-service deployments without requiring isolated network architectures per department.

Question 15

Question: Which of the following can be used to deploy VM instances to an IaaS public cloud environment in a standardized and repeatable way?

• A. Git
• B. Terraform
• C. Kubernetes
• D. Docker

Explanation:
Terraform is an Infrastructure as Code (IaC) tool specifically built to provision and manage cloud infrastructure resources across IaaS providers in a declarative, automated, and repeatable manner.

Question 16

Question: A web application allows end users to upload files. The application design includes the following:

• An API credential for cloud object storage
• A web server using a single virtual machine with a public IP

During an audit of API credential use, the security operations team identifies many public IP addresses connecting to the cloud object storage using the same API credential. Which of the following is the most likely reason for this finding?

• A. Other applications are also using cloud object storage.
• B. The application is uploading to object storage directly from the client.
• C. The application and users can access the application from multiple regions.
• D. The web server is in a VPC with a NAT gateway.

Explanation:
If multiple end-user public IP addresses are directly authenticating and uploading to object storage using the application's API credentials, it typically indicates that the application design passes temporary credentials to the client browser/app so clients upload objects directly to storage rather than routing files through the web server.

Question 17

Question: Which of the following services is most appropriate for routing requests in front of a replica set of virtual machines that host multiple websites?

• A. Forward proxy
• B. Content delivery network
• C. Layer 7 load balancer
• D. Web application firewall

Explanation:
A Layer 7 (application layer) load balancer inspects HTTP/HTTPS traffic content (such as host headers or URL paths) to intelligently route incoming web traffic across multiple backend virtual machines hosting different websites.

Question 18

Question: Which of the following is a customer responsible for in a provider-managed database service? (Select two)

• A. Operating system patches (Note: often handled fully by PaaS providers, but check specific curriculum mapping; typically table-level permissions and data encryption fall to the customer)
• B. Table-level permissions
• C. Minor database engine updates
• D. Cluster configuration
• E. Row-level encryption
• F. Availability of hardware for scaling

Explanation:
In a fully managed database service (PaaS), the cloud provider manages underlying infrastructure patches, hardware availability, and engine maintenance. The customer retains responsibility for data-layer security components such as access control permissions, table schemas, and data encryption keys.

Question 19

Question: A company recently experienced a ransomware attack. The recovery process was slow because the on-site backups were compromised and off-site backups were used. Which of the following features would enable a faster recovery if a ransomware attack would happen again?

• A. Integrity
• B. Encryption
• C. Immutability
• D. Replication

Explanation:
Immutability (Write Once, Read Many / WORM storage policies) ensures that once backup data is written, it cannot be modified, deleted, or encrypted by ransomware for a predefined retention period, ensuring clean and rapid recovery.

Question 20

Question: A cloud engineer creates an IaC repository to deploy an application to a specific region. The cloud engineer receives a new request to deploy the same application to ten different regions. Which of the following options best fulfils this new request?

• A. Create a branch for each new region in the current repository, and configure the CI/CD pipeline to deploy them.
• B. Create a new Git repository for each new region, and configure the CI/CD pipeline to deploy them.
• C. Create a branch for each new region in the current repository, and use IAC to deploy the application.
• D. Create variables file for each new region in the current repository as CaC, and use IaC to deploy the application.

Explanation:
Infrastructure as Code (IaC) is designed to be reusable. Parameterizing deployments using configuration/variable files for different regions avoids code duplication and allows scalable, consistent multi-region deployments from a single code repository.

Question 21

Question: Which of the following commands allows a cloud developer to download code from a remote repository?

• A. git commit
• B. git push
• C. git pull
• D. git merge

Explanation:
git pull fetches changes from a remote repository and immediately merges them into the current local working branch.

Question 22

Question: A cloud engineer is investigating why peering the following networks is failing:

• Network 1: 172.0.1.0/27
• Network 2: 172.0.1.1628 (Note: CIDR overlap/subnet conflict context)

Which of the following is causing the issue?

• A. DHCP misconfiguration
• B. Subnet overlap
• C. IP address exhaustion
• D. Missing DNS A record

Explanation:
VPC peering requires that peer networks do not have overlapping IP address ranges. Subnet ranges that conflict or overlap cause routing and peering establishments to fail.

Question 23

Question: A security engineer is writing a business continuity plan document. Which of the following should the engineer include to address the disaster recovery strategy?

• A. Jitter
• B. Latency
• C. IOPS
• D. RTO
• E. MTU

Explanation:
Recovery Time Objective (RTO) defines the maximum acceptable duration of time that an application can be offline during a disaster, making it a critical metric in disaster recovery planning.

Question 24

Question: A web application is hosted on a cloud-based, low-end VM that uses spinning disk hard drives. End users report that the web application is extremely slow. Which of the following would an administrator most likely consider for optimization?

• A. Resource orchestration
• B. Storage throughput
• C. Architecture workflow
• D. Network latency

Explanation:
Spinning hard drives (HDDs) have low IOPS and throughput capabilities compared to solid-state drives (SSDs). Upgrading or optimizing storage performance removes disk bottlenecks for data-heavy web application workloads.

Question 25

Question: A cloud engineer must improve the availability of a database for an application. The database must meet the following requirements:

• Failover capability in case of a data center outage
• Point-in-time data restoration capabilities

Which of the following best meets these requirements?

• A. Clustered database instance
• B. Cached Redis cluster
• C. Database instance replica
• D. Multi-availability zone database instance

Explanation:
A Multi-AZ (Availability Zone) database deployment automatically provisions and maintains a synchronous standby replica in a different AZ, ensuring high availability, automated failover during data center outages, and reliable backup/restore functionality.

Question 26

Question: An online retailer is going through an audit for its credit card transaction process. Which of the following compliance standards is the most relevant in this scenario?

• A. CIS
• B. ITIL
• C. PCI DSS
• D. SOC 2

Explanation:
Payment Card Industry Data Security Standard (PCI DSS) is the mandatory security standard designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment.

Question 27

Question: A cloud engineer is setting up a new Linux VM instance as part of a cluster of web servers. During the process, the engineer notices the following error:
Unable to resolve domain updateserver.com
Further investigation reveals that the /etc/resolv.conf file on the VM is empty. Which of the following lines should the engineer add to the file to fix the issue?

• A. nameserver 1.1.1.1
• B. dig 127.0.0.1
• C. nslookup 192.168.1.1
• D. netstat 0.0.0.0

Explanation:
An empty /etc/resolv.conf file means the Linux instance has no DNS server configured to resolve hostnames. Adding nameserver 1.1.1.1 provides a valid upstream DNS server IP address so domain name lookups can succeed.