CompTIA Cloud+ Certification – Identity, Deployment, Scaling Strategies

Question 1

Scenario: A financial services firm is expanding its remote workforce and has a very low tolerance for unauthorized access. The cloud engineer is designing an identity solution for the company cloud that includes the following:

•          A single set of credentials for accessing multiple cloud applications.

•          A way to verify a user's identity using more than one factor.

•          Centralized visibility into failed login attempts and unusual access patterns.

Answer Choices:

•          SSO (for a single set of credentials across applications)

•          MFA (for verifying identity using more than one factor)

•          SIEM (for centralized visibility into login attempts and anomalies)

Explanation:

•          Single Sign-On (SSO) allows users to authenticate once and access multiple applications without repeated logins.

•          Multi-Factor Authentication (MFA) requires a secondary verification method beyond a password.

•          Security Information and Event Management (SIEM) aggregates and correlates login and access events for centralized monitoring.

Question 2

Question: A business is rolling out updates to a mission-critical application and requires that only a small percentage of users receive the new version initially, with the ability to monitor for errors before a full rollout. Which of the following deployment strategies best meets this requirement?

•          A. In-place

•          B. Blue-green

•          C. Rolling

•          D. Canary

Explanation: A canary deployment releases a new version to a small subset of users or servers first, allowing the team to monitor for errors and performance issues before gradually expanding the rollout to the full user base, minimizing the blast radius of any defects.

Question 3

Question: A company runs a containerized web farm behind an application load balancer. During scaling events, newly launched containers begin receiving traffic before their application dependencies have finished loading, causing intermittent request failures. Which of the following should the cloud engineer implement to address this issue?

•          A. Health check grace period

•          B. Scheduled scaling

•          C. Event-based scaling

•          D. Load balancer passthrough

Explanation: A health check grace period allows newly launched instances or containers time to complete initialization before the load balancer begins routing production traffic to them, and before failed health checks can cause the instance to be terminated prematurely.

Question 4

Question: An engineer reviews monitoring data and observes that a database server's memory utilization consistently averages 85% and spikes to 98% during peak hours. Which of the following actions would most likely explain the engineer's decision to scale the server vertically?

•          A. The database reached its maximum number of open connections.

•          B. Disk I/O latency increased due to network congestion.

•          C. A memory leak was identified in a third-party plugin.

•          D. The server's memory utilization is consistently near capacity.

Explanation: Vertical scaling adds more resources, such as memory or CPU, to an existing instance. Consistently high memory utilization that spikes near capacity indicates the current instance size is insufficient, making a memory upgrade the most direct remedy.

Question 5

Question: An engineer is building infrastructure to process healthcare patient records. The infrastructure must be efficient and align with globally recognized security configuration standards. Which of the following should the engineer use?

•          A. CIS Benchmarks

•          B. HIPAA guidelines

•          C. Disk encryption

•          D. Secrets management

Explanation: CIS (Center for Internet Security) Benchmarks provide globally recognized, consensus-driven, prescriptive configuration guidelines for securely and efficiently hardening IT systems and cloud infrastructure.

Question 6

Question: A batch process generates temporary calculation files while producing a final report. Once the report is generated, the temporary files serve no further purpose. Which of the following is the best way to treat this temporary data?

•          A. As ephemeral data

•          B. As persistent data

•          C. As archival data

•          D. As replicated data

Explanation: Ephemeral data is short-lived and automatically discarded once its immediate processing purpose is complete, making it the appropriate classification for intermediate files with no lasting value.

Question 7

Question: Which of the following is a constraint that applies to private container image repositories?

•          A. Images cannot be tagged with version numbers

•          B. Only publicly routable IP addresses can pull images

•          C. Images must be scanned before every pull

•          D. Authentication is required to push or pull images

Explanation: Private image repositories restrict access to authorized users or systems only, meaning credentials or another form of authentication must always be presented before images can be pushed to or pulled from the repository.

Question 8

Question: Which of the following is the most likely reason an organization would repatriate workloads from a public cloud provider back to an on-premises data center?

•          A. To increase elasticity during demand spikes

•          B. To reduce predictable, high-volume compute costs

•          C. To eliminate the need for network security controls

•          D. To avoid the use of infrastructure as code

Explanation: Organizations with stable, predictable, high-volume compute workloads sometimes find that the recurring cost of public cloud consumption exceeds the cost of owning and operating equivalent on-premises infrastructure, prompting a repatriation decision.

Question 9

Question: A cloud engineer is updating a company's CI/CD runner currently on version 4.2 of a container image. To avoid potential breaking changes, only the latest patch updates are allowed. Which of the following versions should the engineer update to?

•          A. 3.9

•          B. 4.2.7

•          C. 5.0

•          D. 4.9

Explanation: In Semantic Versioning (MAJOR.MINOR.PATCH), a patch-level update addresses bug fixes without introducing new features or breaking changes. Updating from 4.2 to 4.2.7 represents a safe patch-only upgrade.

Question 10

Question: A file-sharing application was recently migrated to the cloud. Users in the finance department report they cannot access the application, while users in the marketing department can access it without issue. Which of the following actions should the administrator take first to resolve the issue?

•          A. Increase the subscription quota.

•          B. Review and update the IAM role permissions.

•          C. Disable API throttling.

•          D. Increase the VM instance size.

Explanation: Since one group of users can access the application successfully, the underlying infrastructure and network paths are functioning correctly. A department-specific access failure points directly to an access-control or permissions misconfiguration for that group.

Question 11

Question: Which of the following can be used to connect multiple VPCs across different regions and an on-premises data center through a single, scalable hub?

•          A. Subnet

•          B. Content delivery network

•          C. VPC peering

•          D. Transit gateway

Explanation: A cloud transit gateway acts as a central hub that simplifies and scales connectivity between multiple VPCs, across regions, and on-premises networks, avoiding the complexity of managing numerous individual peering connections.

Question 12

Question: A cloud application fails to retrieve data from a third-party API. A cloud engineer reviews the following log entries: [ERROR] HTTP 429 - Too Many Requests / [INFO] Rate limit exceeded / [WARNING] Request throttled. Which of the following is the best resolution?

•          A. Upgrade the network bandwidth.

•          B. Increase the application's memory allocation.

•          C. Implement exponential backoff and retry logic.

•          D. Restart the application server.

Explanation: An HTTP 429 error indicates the application is exceeding the API's allowed request rate. Implementing exponential backoff causes the client to wait progressively longer between retries, reducing pressure on the API and allowing requests to eventually succeed.

Question 13

Question: A cloud engineer must determine the root cause of an intermittent application outage that spans multiple microservices. Logs and metrics from each service are available separately. Which of the following is the best way to determine the source of the issue?

•          A. Aggregating logs into a centralized platform

•          B. Increasing the retention period for each service's logs

•          C. Performing a manual code review of each service

•          D. Enabling verbose logging on a single service

Explanation: Aggregating logs from multiple microservices into a centralized platform allows engineers to correlate events across services by timestamp and request ID, making it far easier to trace an issue as it propagates through a distributed system.

Question 14

Question: A company is migrating workloads from multiple departments to a shared cloud environment and needs to track spending per department. Which of the following enables consumption tracking with the most efficiency?

•          A. Assigning each department a separate cloud account

•          B. Requiring manual monthly expense reports from each department

•          C. Automatically tagging all resources with department metadata

•          D. Instructing each department to use a different cloud provider

Explanation: Automated resource tagging attaches metadata labels, such as a department or cost-center identifier, to every deployed resource. This enables efficient, granular cost-allocation reporting without requiring isolated accounts or manual processes.

Question 15

Question: Which of the following tools can be used to provision and manage cloud infrastructure resources across multiple providers in a standardized, repeatable, declarative way?

•          A. Ansible playbooks only

•          B. Terraform

•          C. Kubernetes

•          D. Jenkins

Explanation: Terraform is an Infrastructure as Code (IaC) tool designed to provision and manage cloud infrastructure resources across multiple providers using a declarative configuration language, enabling repeatable and version-controlled deployments.

Question 16

Question: A mobile application allows end users to upload photos directly. The design includes an API credential for cloud object storage and a backend API server with a public IP. During a security audit, the team finds many end-user IP addresses connecting directly to the object storage service using the backend's API credential. Which of the following is the most likely explanation?

•          A. The backend API server is load balanced across multiple regions.

•          B. The application issues temporary credentials so clients upload directly to storage.

•          C. A different application is also using the same storage bucket.

•          D. The backend server is deployed behind a NAT gateway.

Explanation: When end-user devices connect directly to object storage using shared API credentials, this typically indicates the application design generates temporary, scoped credentials so uploads bypass the backend server entirely and go straight to storage.

Question 17

Question: Which of the following services is most appropriate for routing incoming HTTPS requests to different backend server pools based on the URL path requested?

•          A. Forward proxy

•          B. Content delivery network

•          C. Layer 7 load balancer

•          D. Network access control list

Explanation: A Layer 7 (application layer) load balancer inspects the content of HTTP/HTTPS requests, such as the URL path or host header, allowing it to intelligently route traffic to different backend server pools based on that content.

Question 18

Question: Which of the following are typically the customer's responsibility in a provider-managed Platform as a Service (PaaS) database offering? (Select two)

•          A. Applying operating system security patches

•          B. Configuring table-level and row-level access permissions

•          C. Applying minor database engine version updates

•          D. Provisioning the underlying physical hardware

•          E. Managing data encryption keys and access policies

•          F. Maintaining the hypervisor

Explanation: In a fully managed PaaS database offering, the cloud provider is responsible for the underlying infrastructure, hardware, hypervisor, and engine patching. The customer retains responsibility for data-layer security, including access permissions and the management of encryption keys applied to their own data.

Question 19

Question: A company recently experienced a ransomware attack that encrypted its on-site backup files, forcing a slow recovery from older off-site backups. Which of the following backup features would enable a faster, cleaner recovery if a similar attack occurred again?

•          A. Compression

•          B. Deduplication

•          C. Immutability

•          D. Incremental backups

Explanation: Immutable backups, often implemented with Write Once, Read Many (WORM) storage policies, ensure that once data is written it cannot be modified, deleted, or encrypted by ransomware for a defined retention period, enabling a clean and rapid recovery.

Question 20

Question: A cloud engineer has an IaC repository that deploys an application to a single region. The engineer receives a request to deploy the same application to eight additional regions with minimal code duplication. Which of the following options best fulfills this request?

•          A. Create a separate Git branch for each region and manually deploy from each branch.

•          B. Create a new Git repository for each region with its own pipeline.

•          C. Hard-code each region's values directly into the existing templates.

•          D. Create a variables file for each region and reuse the existing IaC templates.

Explanation: Infrastructure as Code is designed to be reusable. Parameterizing deployments with per-region variable files allows the same templates to be reused across many regions, avoiding code duplication and supporting scalable, consistent deployments from a single repository.

Question 21

Question: Which of the following Git commands allows a developer to upload local commits to a remote repository?

•          A. git clone

•          B. git fetch

•          C. git push

•          D. git checkout

Explanation: The git push command uploads local commits from a developer's working branch to the corresponding branch on a remote repository, making those changes available to other collaborators.

Question 22

Question: A cloud engineer is troubleshooting a failed VPC peering connection between the following networks: Network 1: 10.0.0.0/24, Network 2: 10.0.0.128/25. Which of the following is causing the issue?

•          A. DHCP misconfiguration

•          B. Overlapping subnet ranges

•          C. IP address exhaustion

•          D. Missing DNS PTR record

Explanation: VPC peering requires that the two networks being peered do not have overlapping IP address ranges. Because 10.0.0.128/25 falls entirely within 10.0.0.0/24, the ranges overlap, which prevents the peering connection from being established.

Question 23

Question: A security engineer is writing a business continuity plan and needs to document the maximum acceptable amount of data loss, measured in time, that the organization can tolerate during a disaster. Which of the following metrics should the engineer include?

•          A. Jitter

•          B. RPO

•          C. IOPS

•          D. MTU

Explanation: Recovery Point Objective (RPO) defines the maximum acceptable amount of data loss, measured as a period of time, that an organization can tolerate between the last backup and a disruptive event, making it a key metric for disaster recovery planning.

Question 24

Question: A web application hosted on a cloud VM using standard hard disk drives (HDDs) is experiencing slow response times when reading and writing large files. Which of the following would an administrator most likely consider for optimization?

•          A. Resource orchestration

•          B. Storage throughput and IOPS

•          C. DNS resolution time

•          D. Application code refactoring

Explanation: Standard spinning hard disk drives have significantly lower IOPS and throughput compared to solid-state drives. Upgrading to higher-performance storage removes the disk bottleneck for workloads with heavy read/write demands.

Question 25

Question: A cloud engineer must improve the availability of a production database. The solution must provide automatic failover if an entire availability zone becomes unavailable, along with the ability to restore data to a specific point in time. Which of the following best meets these requirements?

•          A. A single-instance database with nightly snapshots

•          B. A read replica in the same availability zone

•          C. A cached in-memory data store

•          D. A Multi-AZ database deployment with automated backups

Explanation: A Multi-AZ database deployment automatically maintains a synchronous standby replica in a separate availability zone, providing automated failover during an outage, while automated backups enable point-in-time restoration.

Question 26

Question: A healthcare technology company is undergoing an audit related to the storage and transmission of patient health information in the cloud. Which of the following compliance standards is most relevant in this scenario?

•          A. PCI DSS

•          B. HIPAA

•          C. ITIL

•          D. CIS

Explanation: The Health Insurance Portability and Accountability Act (HIPAA) establishes the regulatory requirements for protecting the privacy and security of patient health information, making it the most relevant standard for this audit.

Question 27

Question: A cloud engineer is configuring a new Linux VM and notices the following error: Unable to resolve domain repo.internal.company.com. Further investigation shows the /etc/resolv.conf file is empty. Which of the following lines should the engineer add to the file to fix the issue?

•          A. nameserver 10.0.0.2

•          B. dig repo.internal.company.com

•          C. route add default gw 10.0.0.1

•          D. ifconfig eth0 up

Explanation: An empty /etc/resolv.conf file means the Linux instance has no DNS server configured to resolve hostnames. Adding a nameserver entry pointing to a valid DNS server IP address allows domain name lookups to succeed.