CompTIA Cloud+ Certification: Foundations & Core Concepts

Question 1

Which environment is specifically used to validate a deployment under conditions that closely mirror production before it is released to end users?

●        A. Development environment

●        B. Staging environment

●        C. Sandbox environment

●        D. Disaster recovery environment

Explanation: A staging environment closely mirrors production configuration and is used for final validation before release.

Question 2

Which factor should most heavily influence the choice between object storage and block storage when designing a solution for storing millions of unstructured media files accessed via HTTP?

●        A. Need for POSIX file locking

●        B. Access pattern and metadata requirements

●        C. Requirement for raw disk I/O

●        D. Need for a traditional file hierarchy

Explanation: Object storage is optimized for large volumes of unstructured data accessed via APIs/HTTP with rich metadata, unlike block storage which serves low-level disk I/O.

Question 3

After patching an operating system image used for new deployments, several new VMs fail to boot properly. Which troubleshooting approach best isolates the cause?

●        A. Roll back to the previous known-good image and test in isolation

●        B. Immediately deploy the patch to all production systems

●        C. Disable monitoring on the affected VMs

●        D. Increase the storage tier

Explanation: Rolling back to a known-good image and testing in isolation helps confirm whether the recent patch is the root cause before further action.

Question 4

A company's failover process successfully redirects traffic to a secondary site during an outage. What is the process of returning operations to the original primary site called?

●        A. Failback

●        B. Failover

●        C. Cutover

●        D. Rollback

Explanation: Failback is the process of restoring operations to the original primary site after the issue that triggered failover has been resolved.

Question 5

An administrator is configuring least-privilege access for a new automation script that only needs to read data from one storage bucket. Which action best follows the principle of least privilege?

●        A. Grant the script full administrator rights for flexibility

●        B. Grant the script read-only access to that single bucket

●        C. Grant the script write access to all buckets

●        D. Disable authentication for the script

Explanation: Least privilege means granting only the minimum access required for the task, in this case read-only access to a single bucket.

Question 6

An organization is required to prove, during an audit, that only authorized personnel accessed a specific set of encrypted records over the past year. Which control primarily supports this requirement?

●        A. Data masking

●        B. Access logging and audit trails

●        C. Compression

●        D. Load balancing

Explanation: Detailed access logs and audit trails provide the historical record needed to demonstrate who accessed specific data and when.

Question 7

A cloud engineer needs to ensure that a deployment template can be reused to consistently provision the same set of resources in multiple regions. Which approach should be used?

●        A. Manual step-by-step provisioning

●        B. A parameterized IaC template

●        C. Direct console configuration

●        D. One-off shell commands with hardcoded values

Explanation: A parameterized IaC template allows the same deployment logic to be reused across regions or environments by adjusting input parameters.

Question 8

Which type of maintenance is performed in response to an unplanned, critical issue that cannot wait for the next scheduled maintenance window?

●        A. Planned maintenance

●        B. Emergency maintenance

●        C. Preventive maintenance

●        D. Routine maintenance

Explanation: Emergency maintenance addresses urgent, unplanned issues immediately, outside of normal scheduled windows, due to their critical impact.

Question 9

A company is migrating a legacy application that was built for a specific hypervisor to a different hypervisor platform in the cloud. Which migration type does this describe?

●        A. P2V

●        B. V2P

●        C. V2V

●        D. P2P

Explanation: Virtual-to-Virtual (V2V) migration moves a VM from one hypervisor platform to another.

Question 10

Which document formally defines the expected uptime, response times, and performance guarantees a cloud provider commits to for its customers?

●        A. SLA

●        B. MOU

●        C. NDA

●        D. RFP

Explanation: A Service Level Agreement (SLA) formally defines performance and availability commitments between a provider and customer.

Question 11

A retailer's e-commerce site experiences predictable traffic spikes every Friday evening. Which design approach allows capacity to grow and shrink automatically in response to that demand?

●        A. Vertical scaling only

●        B. Manual capacity planning

●        C. Auto-scaling with horizontal scaling

●        D. Overprovisioning a fixed-size cluster

Explanation: Auto-scaling adds or removes instances horizontally based on real-time demand, avoiding both under- and over-provisioning.

Question 12

Which backup strategy combines a full backup with all subsequent incremental backups into a single new full backup, reducing the number of backup sets needed for a future restore?

●        A. Differential backup

●        B. Synthetic full backup

●        C. Snapshot backup

●        D. Mirror backup

Explanation: A synthetic full backup merges a prior full backup with incremental backups to create a new full backup without re-reading all source data.

Question 13

Which storage type presents data to an application as discrete volumes with no built-in file system, making it suitable for database workloads that manage their own file structures?

●        A. Object storage

●        B. File storage

●        C. Block storage

●        D. Archive storage

Explanation: Block storage exposes raw volumes that the OS or application formats and manages directly, giving the low-latency access databases need.

Question 14

A cloud operations team wants to automatically remediate a common, well-understood issue (such as restarting a hung service) without human intervention. Which capability supports this?

●        A. Manual runbooks only

●        B. Automated orchestration/self-healing scripts

●        C. Cold site failover

●        D. Data masking

Explanation: Automated orchestration or self-healing scripts can detect known issues and apply predefined remediation without waiting for manual action.

Question 15

Which approach allows a team to gradually replace instances of an older application version with a new version, a few at a time, minimizing downtime?

●        A. Rolling deployment

●        B. Big bang deployment

●        C. Cold standby deployment

●        D. Manual bulk cutover

Explanation: A rolling deployment incrementally updates instances in batches, keeping the application available throughout the process.

Question 16

Which type of testing specifically verifies that recent code changes have not broken previously working functionality?

●        A. Regression testing

●        B. Penetration testing

●        C. Usability testing

●        D. Compatibility testing

Explanation: Regression testing re-runs existing test cases after changes to confirm that previously working features still function correctly.

Question 17

A cloud design calls for compute resources that automatically terminate after completing a discrete task, with the customer never managing the underlying server. Which model does this describe?

●        A. Serverless computing

●        B. IaaS

●        C. Bare-metal hosting

●        D. Reserved instances

Explanation: Serverless computing (functions as a service) runs code in response to events without the customer provisioning or managing servers.

Question 18

Which process ensures that all cloud resources are configured according to an approved, documented baseline, and that deviations are detected and corrected?

●        A. Configuration management

●        B. Data classification

●        C. Load testing

●        D. Federation

Explanation: Configuration management maintains systems in a known, approved state and identifies/corrects configuration drift.

Question 19

An organization wants to ensure that any change to production infrastructure is documented, reviewed, and approved before implementation. Which process supports this goal?

●        A. Change management

●        B. Capacity planning

●        C. Incident response

●        D. Data classification

Explanation: Change management provides a formal process for proposing, reviewing, approving, and documenting changes to reduce risk of unplanned outages.

Question 20

An organization wants to forecast when additional storage capacity will be needed based on current growth trends, to avoid last-minute emergency purchases. Which practice supports this?

●        A. Capacity planning

●        B. Penetration testing

●        C. Data masking

●        D. Change freeze

Explanation: Capacity planning uses current utilization trends to forecast future resource needs, enabling proactive rather than reactive scaling.

Question 21

Before rolling a new application version out to all users, a team releases it to a small percentage of production traffic to monitor for issues. Which deployment strategy is being used?

●        A. Blue-green deployment

●        B. Canary deployment

●        C. Big bang deployment

●        D. Rolling back deployment

Explanation: A canary deployment exposes a new version to a small subset of users first, limiting the blast radius of any issues before a full rollout.

Question 22

Which access control model assigns permissions to users based on their job function rather than granting permissions to each user individually?

●        A. Discretionary access control

●        B. Role-based access control

●        C. Mandatory access control

●        D. Attribute-based access control

Explanation: RBAC groups permissions into roles tied to job functions, simplifying management compared to per-user permission assignment.

Question 23

A cloud architect is designing a solution for a healthcare provider that must keep patient data within national borders due to regulatory requirements. Which consideration is most directly addressed by choosing a specific cloud provider region?

●        A. Elasticity

●        B. Data sovereignty

●        C. Multi-tenancy

●        D. Chargeback

Explanation: Data sovereignty concerns require data to remain within specific legal jurisdictions, which is controlled by selecting the physical region where resources are hosted.

Question 24

An application's response times degrade significantly during month-end batch processing. Monitoring shows storage IOPS consistently maxed out during this period. Which category of issue does this represent?

●        A. Capacity/performance bottleneck

●        B. Security misconfiguration

●        C. Licensing violation

●        D. DNS resolution failure

Explanation: Consistently maxed-out IOPS during peak processing indicates a storage performance/capacity bottleneck rather than a security or licensing issue.

Question 25

Which troubleshooting step should be performed immediately after implementing a fix for a production issue?

●        A. Close the ticket without further action

●        B. Verify full system functionality and monitor for recurrence

●        C. Delete all related logs

●        D. Disable the affected system

Explanation: After applying a fix, verifying that the system is fully functional and monitoring for recurrence confirms the issue is truly resolved.

Question 26

Which licensing consideration is most important when migrating a commercial database engine to a cloud provider that charges based on virtual CPU count?

●        A. Storage tiering

●        B. Per-core or per-vCPU licensing terms

●        C. Network latency

●        D. Data masking requirements

Explanation: Per-core/per-vCPU licensing models can significantly change cost when the underlying vCPU count differs from the original on-premises deployment.

Question 27

A company wants to pay only for the compute resources it consumes, with no upfront hardware investment, while retaining full control over the operating system and installed applications. Which cloud service model best fits this requirement?

●        A. SaaS

●        B. PaaS

●        C. IaaS

●        D. DBaaS

Explanation: IaaS provides virtualized compute, storage, and networking on a consumption basis while leaving OS and application management to the customer.

Question 28

Which factor determines whether an application should be scaled vertically (adding resources to an existing instance) versus horizontally (adding more instances)?

●        A. Whether the application is stateless and can distribute load across instances

●        B. The color scheme of the user interface

●        C. The physical location of the data center

●        D. The vendor's marketing materials

Explanation: Stateless applications that can distribute requests across multiple instances are well suited to horizontal scaling, while stateful, single-instance-bound apps often require vertical scaling.

Question 29

Which of the following is the primary purpose of a sandbox environment during application deployment?

●        A. To host production traffic during peak hours

●        B. To provide an isolated space for testing without affecting other systems

●        C. To serve as the long-term disaster recovery site

●        D. To store compliance archives

Explanation: A sandbox is an isolated environment used to test code or configurations safely without impacting production or other systems.

Question 30

Which practice involves periodically testing backup files to confirm they can actually be restored successfully, rather than assuming backups are valid?

●        A. Backup verification/restore testing

●        B. Capacity planning

●        C. Patch management

●        D. Log rotation

Explanation: Restore testing validates that backups are complete and usable, since an untested backup cannot be assumed to be reliable.

Question 31

An organization's DR plan specifies a warm site for its secondary data center. What best describes the state of that site under normal operations?

●        A. Fully active and continuously synced with production

●        B. Partially configured with some systems running, requiring some setup to become fully operational

●        C. Empty facility with no pre-installed equipment

●        D. Decommissioned and repurposed for storage

Explanation: A warm site has some infrastructure and data pre-configured but requires additional steps to become fully operational, balancing cost and recovery speed.

Question 32

Which metric defines the maximum acceptable amount of data loss, measured in time, that an organization can tolerate after a disruptive event?

●        A. RTO

●        B. RPO

●        C. SLA

●        D. MTTR

Explanation: Recovery Point Objective (RPO) defines the maximum tolerable data loss window, dictating how frequently backups must occur.

Question 33

A backup administrator wants to capture only the data that changed since the last full backup, minimizing backup time each night while accepting a longer restore process. Which backup type should be scheduled nightly?

●        A. Full backup

●        B. Incremental backup

●        C. Synthetic full backup

●        D. Snapshot mirroring

Explanation: Incremental backups capture only changes since the last backup (full or incremental), reducing backup time but requiring the full chain for restore.

Question 34

An organization wants visibility and policy enforcement over data moving to sanctioned and unsanctioned cloud services used by employees. Which tool provides this capability?

●        A. CASB

●        B. SIEM

●        C. HSM

●        D. IPS

Explanation: A Cloud Access Security Broker (CASB) sits between users and cloud services to enforce security policies and provide visibility into cloud usage.

Question 35

A hybrid cloud connection between an on-premises data center and a public cloud provider intermittently drops. Bandwidth utilization graphs show no congestion. Which area should be investigated next?

●        A. VPN tunnel stability and routing configuration

●        B. Storage tier pricing

●        C. User password complexity requirements

●        D. Backup retention schedule

Explanation: With bandwidth ruled out, an intermittently dropping hybrid connection points toward VPN tunnel stability or routing configuration issues.

Question 36

Which type of maintenance is scheduled and communicated in advance, typically during a predefined maintenance window, to minimize business impact?

●        A. Emergency maintenance

●        B. Planned maintenance

●        C. Unscheduled maintenance

●        D. Reactive maintenance

Explanation: Planned maintenance is scheduled in advance and communicated to stakeholders, typically performed during low-impact windows.

Question 37

Which practice reduces risk by ensuring that a compromised application container cannot access resources or containers outside its intended segment?

●        A. Microsegmentation

●        B. Data masking

●        C. Federation

●        D. Vertical scaling

Explanation: Microsegmentation creates granular network zones so that a breach in one segment is contained and cannot move laterally to others.

Question 38

A security team discovers that a storage bucket containing sensitive files was configured with public read access. Which category of issue does this represent?

●        A. Performance bottleneck

●        B. Security misconfiguration

●        C. Licensing issue

●        D. Capacity exhaustion

Explanation: Publicly accessible storage containing sensitive data is a security misconfiguration, exposing data to unauthorized access.

Question 39

Which network virtualization technology allows a single physical network to support more than 4,094 logically isolated segments, addressing a key VLAN limitation in large cloud environments?

●        A. 802.1Q trunking

●        B. VXLAN

●        C. NAT

●        D. BGP

Explanation: VXLAN uses a 24-bit segment ID, supporting over 16 million logical networks and overcoming the 4,094 VLAN limit.

Question 40

Which metric defines how quickly a system must be restored to operation after an outage to meet business requirements?

●        A. RPO

●        B. RTO

●        C. MTBF

●        D. ALE

Explanation: Recovery Time Objective (RTO) defines the maximum acceptable duration of downtime before the business impact becomes unacceptable.

Question 41

Which of the following is the primary purpose of implementing multifactor authentication for cloud administrator accounts?

●        A. To reduce storage costs

●        B. To reduce the risk of unauthorized access if a password is compromised

●        C. To increase network throughput

●        D. To simplify patch management

Explanation: MFA requires an additional verification factor beyond a password, significantly reducing the risk that a stolen password alone grants access.

Question 42

Which deployment strategy involves running two identical production environments, with live traffic switched from the old version to the new version once testing is complete?

●        A. Canary deployment

●        B. Rolling deployment

●        C. Blue-green deployment

●        D. A/B testing

Explanation: Blue-green deployment maintains two parallel environments and switches traffic to the new (green) environment only after it is validated.

Question 43

A cloud administrator notices that costs have unexpectedly spiked. Investigation shows an auto-scaling group repeatedly launching and terminating instances in a loop. What is the most likely underlying cause?

●        A. A misconfigured scaling policy or faulty health check triggering repeated scaling actions

●        B. A DNS misconfiguration

●        C. An expired TLS certificate

●        D. Insufficient IAM permissions

Explanation: A flapping scaling loop is commonly caused by scaling policies or health checks that are misconfigured, causing repeated unnecessary launch/terminate cycles.

Question 44

A cloud technician is troubleshooting an outage. After identifying the problem, which step should occur next according to standard troubleshooting methodology?

●        A. Document the resolution

●        B. Establish a theory of probable cause

●        C. Close the ticket

●        D. Notify the vendor

Explanation: Standard methodology moves from identifying the problem to establishing a theory of probable cause before testing that theory.

Question 45

Which security appliance is specifically designed to inspect and filter HTTP/HTTPS traffic to protect web applications from attacks such as SQL injection and cross-site scripting?

●        A. Network firewall

●        B. Web application firewall

●        C. Intrusion detection system

●        D. Load balancer

Explanation: A WAF operates at the application layer, inspecting HTTP traffic for patterns associated with web-specific attacks like SQLi and XSS.

Question 46

After a cloud migration, an application throws licensing errors even though the license was valid on-premises. What is the most likely cause?

●        A. The license is tied to hardware identifiers that changed during migration

●        B. The application code was corrupted

●        C. The network firewall is blocking all traffic

●        D. The storage tier was downgraded

Explanation: Many licenses are bound to hardware fingerprints (MAC address, CPU ID); migrating to new virtual hardware can invalidate them.

Question 47

A company is moving an application from a physical server to a virtual machine in the cloud. Which migration type does this describe?

●        A. V2V

●        B. P2V

●        C. P2P

●        D. V2P

Explanation: Physical-to-Virtual (P2V) migration converts a workload running on physical hardware into a virtual machine.

Question 48

During a deployment, a team discovers that a required firmware-level feature is unavailable on the target cloud platform. Which phase of deployment planning should have identified this issue earlier?

●        A. User acceptance testing

●        B. Target platform capability assessment

●        C. Post-deployment monitoring

●        D. Change management review

Explanation: Assessing the target platform's capabilities before migration identifies feature or hardware gaps that could block a successful deployment.

Question 49

Which of the following best describes the purpose of a hardware security module (HSM) in a cloud environment?

●        A. Aggregating log data for correlation

●        B. Generating and storing cryptographic keys in tamper-resistant hardware

●        C. Filtering malicious inbound network traffic

●        D. Enforcing role-based access to virtual machines

Explanation: An HSM is dedicated hardware that securely generates, stores, and manages cryptographic keys, resisting physical and logical tampering.

Question 50

A company must ensure that credit card numbers stored in a non-production test database cannot be tied back to real customers while still preserving the data format for testing. Which technique should be used?

●        A. Encryption at rest

●        B. Tokenization or data masking

●        C. Federation

●        D. Load balancing

Explanation: Tokenization/masking replaces sensitive values with realistic but non-sensitive substitutes, preserving format for testing without exposing real data.

Question 51

An organization is sizing a new cloud database instance and must decide between provisioning for peak load immediately or scaling up as demand grows. Which factor most directly favors starting with a smaller baseline and scaling later?

●        A. Regulatory compliance

●        B. Cost efficiency

●        C. Data sovereignty

●        D. Vendor lock-in

Explanation: Starting with a smaller baseline and scaling as needed avoids paying for unused capacity, improving cost efficiency.

Question 52

Which log management practice helps control storage costs while preserving the ability to investigate incidents that occurred several months prior?

●        A. Immediately deleting all logs after 24 hours

●        B. Log retention policies with tiered archiving

●        C. Disabling logging entirely

●        D. Storing all logs only in memory

Explanation: Log retention policies with tiered archiving balance cost by moving older logs to cheaper storage while still preserving them for later investigation.

Question 53

Which regulation primarily governs the protection of personal data for individuals within the European Union and imposes requirements on organizations handling that data, regardless of where the organization is based?

●        A. HIPAA

●        B. GDPR

●        C. PCI DSS

●        D. SOX

Explanation: The General Data Protection Regulation (GDPR) governs personal data protection for EU residents and applies to any organization processing that data.

Question 54

A DevOps team wants new application builds to automatically move through testing and into production once they pass all quality gates. Which practice enables this?

●        A. Manual change approval

●        B. CI/CD pipeline automation

●        C. Cold site failover

●        D. Data masking

Explanation: Continuous Integration/Continuous Deployment (CI/CD) pipelines automate the build, test, and release process with minimal manual intervention.

Question 55

A monitoring system is configured to alert only when CPU usage exceeds 90% for more than five consecutive minutes. What is the primary purpose of requiring the sustained duration before alerting?

●        A. To reduce storage costs

●        B. To reduce false-positive alerts from brief, normal spikes

●        C. To increase encryption strength

●        D. To disable logging

Explanation: Requiring a sustained threshold reduces alert fatigue caused by brief, normal usage spikes that do not indicate a real problem.

Question 56

Users report that a web application is intermittently slow, but server CPU, memory, and disk metrics all appear normal. Which resource should be investigated next?

●        A. Network bandwidth/latency

●        B. Physical rack temperature

●        C. User interface color scheme

●        D. License expiration date

Explanation: When compute resources appear normal but users experience slowness, network latency or bandwidth constraints are a common next area to investigate.

Question 57

An organization needs several unrelated business units to share the same cloud infrastructure while keeping each unit's costs, resources, and data logically separated. Which characteristic of cloud computing enables this?

●        A. Multi-tenancy

●        B. Federation

●        C. Bursting

●        D. Orchestration

Explanation: Multi-tenancy allows multiple independent customers or business units to share underlying infrastructure while their resources remain logically isolated.

Question 58

An administrator wants to ensure users authenticate once and gain access to multiple independent cloud applications without re-entering credentials. Which technology should be implemented?

●        A. Multifactor authentication

●        B. Single sign-on

●        C. Role-based access control

●        D. Data loss prevention

Explanation: Single sign-on (SSO) lets a user authenticate once and access multiple connected applications without repeated logins.

Question 59

A company must guarantee that sensitive files remain unreadable if intercepted while moving between the on-premises data center and a cloud storage bucket. Which control addresses this requirement?

●        A. Encryption in transit

●        B. Encryption at rest

●        C. Data masking

●        D. Tokenization

Explanation: Encryption in transit (e.g., TLS) protects data while it moves across networks, preventing exposure if intercepted.

Question 60

A security team needs a centralized platform to aggregate logs from multiple cloud services and correlate events to detect potential incidents. Which tool should they deploy?

●        A. SIEM

●        B. CASB

●        C. DLP

●        D. IDS

Explanation: A Security Information and Event Management (SIEM) platform aggregates and correlates log data across systems to support detection and response.

Question 61

Which cloud deployment model combines on-premises infrastructure with a public cloud provider, allowing workloads to move between the two as needed?

●        A. Community cloud

●        B. Hybrid cloud

●        C. Private cloud

●        D. Multi-cloud

Explanation: Hybrid cloud integrates private/on-premises infrastructure with public cloud resources, enabling workload portability between environments.

Question 62

A user reports being unable to access an internal application by its friendly hostname, though the application is reachable by its IP address. What is the most likely cause?

●        A. DNS resolution failure

●        B. Storage capacity exhaustion

●        C. CPU throttling

●        D. Expired SSL certificate on the load balancer

Explanation: If a resource is reachable by IP but not by hostname, the issue points to DNS resolution rather than the application or network path itself.

Question 63

Which type of security scan is specifically designed to identify known weaknesses in systems, such as missing patches or misconfigurations, before they can be exploited?

●        A. Penetration test

●        B. Vulnerability scan

●        C. Load test

●        D. Regression test

Explanation: A vulnerability scan systematically checks systems against a database of known weaknesses, such as unpatched software or misconfigurations.

Question 64

Following a scaling event, some new instances are not receiving traffic from the load balancer. Which configuration should be checked first?

●        A. Health check settings on the load balancer

●        B. Physical server firmware version

●        C. Backup retention policy

●        D. User training documentation

Explanation: Load balancers route traffic only to instances that pass configured health checks; misconfigured or failing health checks would explain traffic not reaching new instances.

Question 65

A newly deployed virtual machine cannot reach the internet, but it can communicate with other VMs on the same subnet. Which configuration is most likely misconfigured?

●        A. Default gateway or route table

●        B. CPU allocation

●        C. Disk IOPS

●        D. RAM allocation

Explanation: The ability to reach local subnet peers but not external destinations points to a missing or incorrect default gateway/route configuration rather than a resource issue.

Question 66

An architect is determining the appropriate storage tier for infrequently accessed compliance archives that must still be retrievable within hours if requested. Which storage tier fits this requirement?

●        A. Hot tier

●        B. Cool/archive tier

●        C. In-memory cache

●        D. Ephemeral storage

Explanation: A cool or archive storage tier offers lower cost for infrequently accessed data while still allowing retrieval, unlike hot tiers optimized for frequent access.

Question 67

A team wants to deploy identical infrastructure across development, staging, and production environments consistently and repeatably. Which approach should they adopt?

●        A. Manual configuration via a GUI console

●        B. Infrastructure as Code

●        C. Ad hoc scripting per environment

●        D. Physical server imaging

Explanation: Infrastructure as Code (IaC) defines environments in version-controlled templates, ensuring consistent, repeatable deployments across environments.

Question 68

Which testing type validates that a newly deployed cloud application can properly exchange data with existing systems it must integrate with?

●        A. Regression testing

●        B. Interoperability testing

●        C. Usability testing

●        D. Load testing

Explanation: Interoperability testing confirms that a system correctly exchanges data and functions with other systems it depends on.

Question 69

A team notices that automated deployments have started failing with permission-denied errors after a recent IAM policy update. Which troubleshooting step should be performed first?

●        A. Rebuild the entire environment from scratch

●        B. Review the recent IAM policy changes for overly restrictive permissions

●        C. Increase compute capacity

●        D. Disable all logging

Explanation: Since the failures began after an IAM policy update, reviewing that specific change for overly restrictive permissions is the logical first step.

Question 70

A company is designing a disaster recovery solution and wants the lowest possible recovery time, accepting the higher ongoing cost of maintaining a fully running duplicate environment. Which DR site type should be selected?

●        A. Cold site

●        B. Warm site

●        C. Hot site

●        D. Cloud burst site

Explanation: A hot site is a fully operational duplicate environment kept in sync with production, minimizing recovery time at the cost of higher expense.

Question 71

An operations team is defining thresholds for a new alerting system. Setting thresholds too low (overly sensitive) primarily results in which problem?

●        A. Missed critical incidents

●        B. Alert fatigue from excessive false positives

●        C. Reduced storage costs

●        D. Improved system performance

Explanation: Overly sensitive thresholds generate excessive alerts for normal variations, leading to alert fatigue where real issues may be overlooked.

Question 72

A cloud operations team notices CPU utilization steadily climbing over several weeks on a critical application server. Which practice would have identified this trend early enough to act proactively?

●        A. Baseline monitoring with trend analysis

●        B. One-time vulnerability scan

●        C. Ad hoc manual checks

●        D. Disabling alerts to reduce noise

Explanation: Establishing baselines and analyzing trends over time allows gradual resource degradation to be detected before it causes an outage.

Question 73

An automation script that provisions new environments begins failing intermittently with timeout errors when calling a cloud provider's API. Which troubleshooting step is most appropriate first?

●        A. Immediately rewrite the script from scratch

●        B. Check for API rate limiting or throttling by the provider

●        C. Disable the automation permanently

●        D. Increase the VM's RAM

Explanation: Intermittent timeouts calling a provider API are often caused by rate limiting/throttling; checking for these limits is a logical first diagnostic step.

Question 74

A cloud security engineer needs to ensure that expired TLS certificates are automatically identified and renewed before they cause a service outage. Which practice addresses this?

●        A. Certificate lifecycle management

●        B. Data masking

●        C. Load balancing

●        D. Horizontal scaling

Explanation: Certificate lifecycle management automates tracking, renewal, and replacement of certificates to prevent expiration-related outages.

Question 75

An application deployed via a container orchestration platform keeps restarting shortly after starting. Which log source should be examined first to diagnose the cause?

●        A. Container/application logs and exit codes

●        B. Physical hardware inventory records

●        C. DNS zone transfer logs

●        D. Backup completion reports

Explanation: Container restart loops are best diagnosed by examining the container's application logs and exit codes, which typically reveal the crash cause.