CompTIA Cloud+ Certification: Integration, Automation and Recovery

Question 1

A cloud technician is unsure whether a reported issue is affecting all users or only a specific subset. Which action helps clarify the scope of the problem?

●        A. Gathering details on affected users, locations, and timing to identify patterns

●        B. Immediately assuming the issue affects everyone

●        C. Closing the ticket due to insufficient detail with no follow-up

●        D. Ignoring the report until more complaints arrive

Explanation: Gathering details on who is affected, where, and when helps identify patterns that clarify whether the issue is widespread or isolated, guiding further investigation.

Question 2

Which practice helps an operations team understand the financial impact of downtime, supporting better prioritization of reliability investments?

●        A. Calculating the cost of downtime per hour for critical services

●        B. Ignoring the financial impact of outages entirely

●        C. Only tracking technical metrics with no business context

●        D. Assuming all outages have equal financial impact

Explanation: Calculating downtime cost per hour ties technical reliability to business impact, helping prioritize where reliability investments matter most.

Question 3

Which term describes the shared responsibility boundary in which the cloud provider secures the underlying infrastructure while the customer is responsible for securing their data, configurations, and access controls?

●        A. The shared responsibility model

●        B. The chargeback model

●        C. The elasticity model

●        D. The federation model

Explanation: The shared responsibility model defines which security obligations belong to the cloud provider (infrastructure) versus the customer (data, configuration, access).

Question 4

Which practice ensures that security patches for critical vulnerabilities are prioritized and applied faster than routine, non-critical updates?

●        A. Risk-based patch prioritization

●        B. Applying all patches on a single fixed annual schedule regardless of severity

●        C. Ignoring vulnerability severity ratings

●        D. Disabling patch management entirely

Explanation: Risk-based patch prioritization ensures that critical vulnerabilities are remediated faster than lower-severity issues, reducing exposure time for the most dangerous gaps.

Question 5

An architect must design a solution where compute resources in one cloud provider's network can privately communicate with resources in another provider's network without using public IP addresses. Which concept addresses this?

●        A. VPC/VNet peering or a private interconnect between providers

●        B. A public load balancer

●        C. A single shared public IP

●        D. Disabling all firewalls

Explanation: Private peering or interconnects between cloud networks allow cross-provider or cross-account communication using private addressing, avoiding public exposure.

Question 6

An operations team wants to reduce the total cost of storing years of historical log data while still meeting compliance retention requirements. Which practice addresses this?

●        A. Tiered log storage that moves older logs to lower-cost archive tiers

●        B. Keeping all logs in the most expensive hot storage tier indefinitely

●        C. Deleting all logs immediately to save cost

●        D. Ignoring compliance retention requirements

Explanation: Tiered log storage moves older, less-frequently-accessed logs to cheaper archive tiers, balancing cost with compliance retention needs.

Question 7

Which testing type specifically validates that a cloud application correctly handles unexpected or invalid input without crashing or exposing sensitive information?

●        A. Negative/edge-case testing

●        B. Usability testing

●        C. Load testing

●        D. Documentation review

Explanation: Negative or edge-case testing deliberately provides invalid or unexpected input to confirm the application handles it gracefully rather than failing insecurely.

Question 8

An organization wants to formally define the maximum number of consecutive failed health checks before an instance is considered unhealthy and removed from a load balancer. Which type of configuration does this represent?

●        A. Health check threshold configuration

●        B. Backup retention policy

●        C. IAM role assignment

●        D. DNS TTL setting

Explanation: Health check threshold configuration defines how many consecutive failures trigger an instance being marked unhealthy and removed from rotation.

Question 9

Which deployment metric measures the elapsed time from when code is committed to when it is successfully running in production?

●        A. Lead time for changes

●        B. Mean time between failures

●        C. Recovery point objective

●        D. Service level agreement

Explanation: Lead time for changes measures the time from code commit to successful production deployment, a key DevOps performance indicator.

Question 10

Which encryption approach uses a pair of mathematically related keys, one public and one private, commonly used for securely exchanging a symmetric session key?

●        A. Symmetric encryption

●        B. Asymmetric (public-key) encryption

●        C. Hashing

●        D. Data masking

Explanation: Asymmetric encryption uses a public/private key pair, commonly used to securely exchange session keys before switching to faster symmetric encryption.

Question 11

A team is deploying a new application version and wants the ability to route a small percentage of traffic to the new version based on specific criteria, such as user account type, rather than randomly. Which technique supports this?

●        A. Targeted feature flagging/segmented canary release

●        B. Big bang deployment with no segmentation

●        C. Cold site failover

●        D. Manual DNS changes only

Explanation: Targeted feature flagging allows traffic to be routed to a new version based on specific criteria, offering more control than a purely random canary release.

Question 12

A design team is determining the appropriate subnet sizing for a new VPC that will host several hundred instances with room for future growth. Which practice should guide this decision?

●        A. Allocating a CIDR block sized for current needs plus reasonable projected growth

●        B. Using the smallest possible subnet to save cost

●        C. Allocating a single IP address for all instances

●        D. Ignoring future growth entirely

Explanation: Subnet sizing should account for current needs plus reasonable projected growth, since resizing a live subnet later can be disruptive.

Question 13

An organization wants its monitoring system to reduce noise by automatically suppressing known, expected alerts during a planned maintenance window. Which practice supports this?

●        A. Scheduled alert suppression/maintenance mode tied to the change calendar

●        B. Manually ignoring all alerts with no system support

●        C. Disabling monitoring permanently

●        D. Sending all alerts regardless of planned maintenance

Explanation: Scheduled alert suppression tied to the change calendar prevents expected, planned-maintenance-related alerts from creating unnecessary noise.

Question 14

An organization wants its deployment process to automatically halt and alert if a new release causes error rates to exceed a defined threshold, without requiring a human to notice manually. Which practice supports this?

●        A. Automated deployment health gates tied to real-time error rate monitoring

●        B. Manual monitoring only, with no automated thresholds

●        C. Disabling monitoring during deployments to reduce noise

●        D. Deploying without any post-release validation

Explanation: Automated health gates tied to real-time metrics can halt a rollout and alert the team the moment error rates exceed acceptable thresholds.

Question 15

An organization's incident response plan specifies that certain types of breaches must be reported to regulators within a defined timeframe. Which type of requirement does this represent?

●        A. A breach notification/compliance requirement

●        B. A load balancing configuration

●        C. A backup retention schedule

●        D. A capacity planning target

Explanation: Breach notification requirements are compliance obligations mandating that certain incidents be reported to regulators within a specified timeframe.

Question 16

An organization must ensure that data stored in a cloud provider's environment can be permanently and verifiably destroyed when a customer requests deletion, in compliance with privacy regulations. Which capability supports this?

●        A. Verifiable secure data deletion/crypto-shredding

●        B. Standard file deletion with no verification

●        C. Ignoring deletion requests

●        D. Archiving data indefinitely regardless of requests

Explanation: Verifiable secure deletion (including crypto-shredding, where encryption keys are destroyed) ensures data is provably and permanently rendered inaccessible, supporting privacy compliance.

Question 17

Which practice ensures that a scheduled maintenance activity does not unexpectedly conflict with another team's planned change on the same system?

●        A. A centralized change calendar with conflict detection

●        B. No coordination between teams

●        C. Scheduling all changes at the exact same time

●        D. Avoiding any documentation of planned changes

Explanation: A centralized change calendar with conflict detection helps teams coordinate and avoid scheduling overlapping changes to the same systems.

Question 18

An operations team wants to reduce the risk of a single engineer accidentally deleting a critical production resource. Which control most directly addresses this?

●        A. Deletion protection/safeguards requiring explicit confirmation or elevated approval

●        B. Granting every engineer unrestricted delete permissions

●        C. Disabling all resource tagging

●        D. Removing audit logs to reduce noise

Explanation: Deletion protection controls require explicit confirmation or elevated approval before critical resources can be removed, reducing accidental deletion risk.

Question 19

A company wants to deploy updates to a stateful application without losing any in-progress user sessions. Which deployment technique best supports this?

●        A. Session draining combined with a rolling or blue-green deployment

●        B. Immediately terminating all active sessions during deployment

●        C. Big bang deployment with no session handling

●        D. Disabling load balancer health checks during deployment

Explanation: Session draining allows existing connections to complete gracefully while new traffic is routed to updated instances, avoiding disruption to active users.

Question 20

A company is migrating an application and wants to convert its physical database server directly into a physical server in the cloud provider's bare-metal offering. Which migration type does this describe?

●        A. P2V

●        B. P2P

●        C. V2V

●        D. V2P

Explanation: Physical-to-Physical (P2P) migration moves a workload from one physical server to another, such as onto a cloud provider's bare-metal hardware.

Question 21

A cloud technician has implemented a solution to a confirmed root cause. What is the final recommended step in the standard troubleshooting methodology?

●        A. Document findings, actions, and outcomes

●        B. Immediately begin troubleshooting an unrelated issue

●        C. Delete all records of the incident

●        D. Assume no further verification is needed

Explanation: Documenting the findings, actions taken, and outcomes is the final step, preserving knowledge for future reference and compliance.

Question 22

An organization's operations team wants to ensure that critical alerts are not missed due to being buried among many low-priority notifications. Which practice addresses this?

●        A. Alert prioritization/severity tiering with distinct notification channels

●        B. Sending every alert through the exact same channel with no differentiation

●        C. Disabling low-priority alerts entirely with no review

●        D. Removing all alerting

Explanation: Tiering alerts by severity and routing them through distinct channels ensures critical issues stand out rather than being lost among routine notifications.

Question 23

Which practice reduces the risk that a single compromised CI/CD pipeline credential could be used to deploy malicious code to production?

●        A. Scoping pipeline credentials narrowly and requiring approval gates for production deployment

●        B. Granting the pipeline unrestricted production access for convenience

●        C. Disabling all code review

●        D. Using the same credential across all pipelines and environments

Explanation: Narrowly scoped pipeline credentials combined with approval gates limit the damage a compromised pipeline credential could cause to production.

Question 24

Which practice helps an operations team proactively identify a memory leak in a long-running application before it causes an outage?

●        A. Continuous resource utilization monitoring with trend-based alerting

●        B. Waiting for the application to crash before investigating

●        C. Disabling memory monitoring to reduce overhead

●        D. Restarting the application randomly with no monitoring

Explanation: Continuous monitoring with trend-based alerting can detect a gradually increasing memory footprint characteristic of a leak before it causes a crash.

Question 25

Which security testing approach specifically evaluates an organization's people and processes, such as whether staff would allow an unauthorized person to follow them through a secured door, rather than testing technical systems?

●        A. Social engineering assessment

●        B. Automated vulnerability scanning

●        C. Static code analysis

●        D. Load testing

Explanation: Social engineering assessments test human behavior and process adherence, such as susceptibility to tailgating or phishing, rather than technical system weaknesses.

Question 26

Which security practice ensures that a cloud environment's security groups, IAM policies, and encryption settings are automatically validated against a defined security baseline on an ongoing basis?

●        A. Continuous compliance/security posture monitoring

●        B. One-time manual review at initial setup only

●        C. Disabling all automated checks

●        D. Relying solely on annual audits

Explanation: Continuous compliance monitoring automatically and repeatedly validates configurations against a security baseline, catching drift between periodic audits.

Question 27

Which consideration is most important when planning the decommissioning of legacy infrastructure after a successful cloud migration?

●        A. Confirming no remaining dependencies exist before decommissioning to avoid unexpected outages

●        B. Immediately shutting down legacy systems the moment migration begins

●        C. Decommissioning without validating the new environment first

●        D. Ignoring dependency mapping entirely

Explanation: Legacy infrastructure should only be decommissioned after confirming no remaining dependencies exist, preventing unexpected outages from overlooked connections.

Question 28

Which practice ensures that an organization's disaster recovery plan remains accurate as the production environment evolves over time, rather than becoming outdated?

●        A. Regularly reviewing and updating the DR plan alongside infrastructure changes

●        B. Writing the DR plan once and never revisiting it

●        C. Assuming the DR plan is still accurate without verification

●        D. Deleting the DR plan after the first successful test

Explanation: Regularly reviewing and updating the DR plan ensures it stays aligned with the current production environment as infrastructure evolves.

Question 29

An organization is deploying a new application and needs to determine the correct order for provisioning networking, security groups, and compute resources. Which principle should guide this sequencing?

●        A. Provisioning dependencies (like networking and security) before the resources that rely on them

●        B. Provisioning compute resources first with no networking in place

●        C. Random ordering with no dependency consideration

●        D. Provisioning everything simultaneously with no sequencing

Explanation: Foundational dependencies such as networking and security groups should typically be provisioned before the compute resources that rely on them.

Question 30

A cloud technician notices that a fix which resolved an issue in the staging environment did not resolve the same issue in production. Which factor should be investigated first?

●        A. Configuration or data differences between the staging and production environments

●        B. The technician's typing speed

●        C. The office Wi-Fi password

●        D. The vendor's stock price

Explanation: When a fix works in staging but not production, configuration or data differences between the two environments are the most likely explanation.

Question 31

Which practice ensures that infrastructure as code templates are tested for syntax and policy compliance before being applied to any real environment?

●        A. Automated template linting and policy-as-code validation in the pipeline

●        B. Manually eyeballing the template with no automated checks

●        C. Applying templates directly to production without review

●        D. Disabling all pre-deployment checks

Explanation: Automated linting and policy-as-code validation catch syntax errors and policy violations in IaC templates before they are ever applied to a live environment.

Question 32

Which practice involves an independent third party formally verifying that a cloud provider's security controls meet a specific industry standard, providing assurance to customers?

●        A. Third-party security certification/audit (e.g., ISO 27001)

●        B. Internal-only self-assessment with no external review

●        C. Marketing claims with no verification

●        D. Ignoring compliance requirements entirely

Explanation: Third-party certifications such as ISO 27001 involve independent verification of security controls, providing external assurance beyond a provider's own claims.

Question 33

An organization wants new deployments to automatically comply with tagging standards used for cost allocation and ownership tracking. Which approach best ensures this?

●        A. Enforcing mandatory tagging policies within the deployment pipeline/IaC templates

●        B. Relying on individual engineers to remember to tag resources manually

●        C. Disabling cost allocation reporting

●        D. Allowing resources to be deployed without any tags

Explanation: Enforcing tagging policies directly in the deployment pipeline or IaC templates guarantees compliance rather than relying on manual, inconsistent effort.

Question 34

Which deployment risk is most directly reduced by maintaining a documented, tested rollback procedure for every production release?

●        A. Extended downtime if a new release introduces a critical defect

●        B. Increased storage costs

●        C. Reduced network bandwidth

●        D. Higher licensing fees

Explanation: A documented, tested rollback procedure allows a team to quickly revert a problematic release, minimizing downtime if a critical defect is discovered.

Question 35

A team is validating that a new cloud deployment meets specific numeric performance targets, such as maximum response time under a defined load, before sign-off. Which testing type does this represent?

●        A. Performance/benchmark testing against defined SLAs or targets

●        B. Usability testing

●        C. Static code review

●        D. Documentation review

Explanation: Performance/benchmark testing measures a system against specific numeric targets, such as response time or throughput requirements, before formal sign-off.

Question 36

Which architecture decision most directly affects an organization's ability to avoid being dependent on a single cloud provider's proprietary services?

●        A. Using cloud-agnostic, open-standard tools and architectures where feasible

●        B. Exclusively using one provider's proprietary managed services for everything

●        C. Ignoring portability considerations entirely

●        D. Hardcoding provider-specific APIs throughout the application

Explanation: Favoring cloud-agnostic, open-standard tools reduces dependency on any single provider's proprietary services, improving portability.

Question 37

Which practice ensures that operational knowledge is not lost when a key team member leaves, by maintaining up-to-date runbooks, architecture diagrams, and process documentation?

●        A. Comprehensive operational documentation and knowledge management

●        B. Relying solely on one person's memory

●        C. Avoiding documentation to save time

●        D. Deleting documentation after each project closes

Explanation: Maintaining comprehensive, current documentation ensures operational knowledge persists even when individual team members leave.

Question 38

A company wants its cloud architecture to automatically detect and route around a failed network path without manual intervention. Which capability supports this?

●        A. Dynamic routing with automatic failover

●        B. Static routing with manual updates

●        C. A single fixed network path with no redundancy

●        D. Disabling all routing protocols

Explanation: Dynamic routing protocols can automatically detect path failures and reroute traffic, unlike static routes that require manual updates.

Question 39

Which cloud architecture concept refers to designing systems so that the failure of any individual component does not cause a cascading failure across the entire system?

●        A. Fault isolation/graceful degradation

●        B. Vendor lock-in

●        C. Chargeback

●        D. Data sovereignty

Explanation: Fault isolation and graceful degradation design principles contain the impact of a single component's failure, preventing it from cascading across the system.

Question 40

A company must ensure that a third-party vendor with access to its cloud environment only has the minimum access necessary and that this access is reviewed regularly. Which practice addresses this?

●        A. Third-party/vendor access governance with periodic review

●        B. Granting the vendor full administrator access indefinitely

●        C. Ignoring vendor access after initial setup

●        D. Disabling logging for vendor accounts

Explanation: Vendor access governance with periodic review ensures third parties retain only necessary access and that this is re-evaluated over time.

Question 41

Which practice ensures that critical operational knowledge captured during an incident response is reviewed and incorporated into future training and runbooks?

●        A. Post-incident review with documented action items and follow-through

●        B. Discussing the incident informally with no documentation

●        C. Skipping any review once the incident is resolved

●        D. Deleting incident-related communication immediately

Explanation: A structured post-incident review with tracked action items ensures lessons learned are captured and actually incorporated into future practice.

Question 42

An application deployed via infrastructure as code fails during provisioning with an error indicating a resource limit was exceeded. Which cause is most likely?

●        A. The cloud account has hit a service quota/limit for that resource type

●        B. The application's source code has a syntax error

●        C. The end user's browser is outdated

●        D. The DNS provider is experiencing a global outage

Explanation: Provisioning failures citing a resource limit typically indicate the account has reached a service quota for that resource type, which usually requires a limit increase request.

Question 43

A cloud security architect wants to ensure that data remains encrypted throughout its entire lifecycle, including while it is actively being processed in memory, not just at rest or in transit. Which emerging approach addresses this specific gap?

●        A. Confidential computing

●        B. Standard disk encryption only

●        C. TLS for network traffic only

●        D. Data masking in test environments only

Explanation: Confidential computing uses hardware-based trusted execution environments to keep data encrypted even while actively being processed in memory.

Question 44

A cloud technician needs to determine whether an intermittent issue is caused by the application, the network, or the underlying infrastructure. Which approach helps isolate the layer responsible?

●        A. Systematically testing and eliminating each layer (application, network, infrastructure) individually

●        B. Assuming the application is always at fault without investigation

●        C. Restarting all systems simultaneously with no isolation

●        D. Ignoring the issue since it is intermittent

Explanation: Systematically isolating and testing each layer individually helps pinpoint which specific layer is responsible for an intermittent issue.

Question 45

A cloud technician identifies multiple possible causes for an outage and is unsure which to test first. Which approach best follows troubleshooting best practices?

●        A. Test the most likely and least disruptive cause first

●        B. Test all causes simultaneously with no order

●        C. Randomly select a cause without considering likelihood or impact

●        D. Skip testing and implement a fix based on a guess

Explanation: Testing the most probable and least disruptive cause first minimizes risk while efficiently narrowing down the actual root cause.

Question 46

A team wants to validate a disaster recovery deployment procedure without impacting the live production environment. Which environment should be used for this test?

●        A. An isolated DR test environment or sandbox that mirrors production

●        B. The live production environment during peak hours

●        C. No testing at all, relying on documentation alone

●        D. The developer's local laptop

Explanation: An isolated DR test environment that mirrors production allows safe validation of recovery procedures without risking the live production system.

Question 47

A cloud technician resolves an incident but does not verify that the underlying monitoring alert has cleared. What risk does this create?

●        A. The issue could still be present or recur without being detected

●        B. The fix will automatically become permanent

●        C. Documentation will be automatically generated

●        D. No risk, since the ticket was closed

Explanation: Failing to verify that the monitoring alert cleared risks missing a still-present or recurring issue, since ticket closure alone does not confirm resolution.

Question 48

Which deployment practice involves defining infrastructure changes in a pull request that must be reviewed and approved before being applied, similar to application code review?

●        A. GitOps-style infrastructure change review

●        B. Direct unreviewed console changes

●        C. Emailing configuration files to the team

●        D. Disabling version control for infrastructure

Explanation: GitOps applies the same review and approval workflow used for application code to infrastructure changes, improving traceability and reducing errors.

Question 49

An organization wants to detect when a user account begins behaving in a way that deviates significantly from its historical access patterns, such as logging in from an unusual location at an unusual time. Which capability supports this?

●        A. User and entity behavior analytics (UEBA)

●        B. Static firewall rules only

●        C. Manual quarterly access reviews only

●        D. Disabling login notifications

Explanation: UEBA analyzes historical behavior patterns to flag anomalies, such as unusual login times or locations, that may indicate account compromise.

Question 50

Which cloud design pattern uses a message queue to temporarily hold requests during a traffic spike, allowing backend services to process them at a sustainable rate rather than being overwhelmed?

●        A. Queue-based load leveling

●        B. Direct synchronous coupling

●        C. Static IP assignment

●        D. Manual traffic throttling by support staff

Explanation: Queue-based load leveling buffers incoming requests during spikes, allowing backend services to process them at a sustainable rate instead of being overwhelmed.

Question 51

An organization's operations team wants to ensure that database backups are automatically tested by restoring them to an isolated environment on a regular schedule. What does this practice validate?

●        A. That backups are actually usable and restorable, not just successfully created

●        B. That backups take up the least possible storage space

●        C. That backups are encrypted with the fastest algorithm

●        D. That backup schedules never change

Explanation: Automated restore testing validates that backups are truly usable and complete, since a backup that completes 'successfully' is not guaranteed to be restorable.

Question 52

Which factor is most important when deciding the appropriate instance family (general purpose, compute-optimized, memory-optimized) for a new workload?

●        A. The workload's specific resource consumption profile (CPU, memory, I/O balance)

●        B. The instance family's marketing name

●        C. The number of available color themes in the console

●        D. The vendor's headquarters location

Explanation: Selecting an instance family should be driven by the workload's actual resource consumption profile, matching CPU, memory, and I/O needs appropriately.

Question 53

An organization wants its architecture to support seamlessly adding new geographic regions in the future with minimal redesign. Which design principle supports this goal?

●        A. Designing with modular, region-agnostic infrastructure templates

●        B. Hardcoding region-specific values throughout the application

●        C. Building a single-region-only architecture with no abstraction

●        D. Avoiding any use of infrastructure as code

Explanation: Modular, region-agnostic templates allow new regions to be added by changing parameters rather than redesigning the architecture from scratch.

Question 54

Following a cloud provider's API version deprecation, an automation script begins failing. Which troubleshooting step is most appropriate first?

●        A. Review the deprecation notice and update the script to use the current API version

●        B. Immediately disable all automation permanently

●        C. Ignore the failures since the API change was outside the team's control

●        D. Rebuild the entire environment from scratch

Explanation: Reviewing the deprecation notice and updating the script to the current API version directly addresses the root cause of the failure.

Question 55

Which practice ensures that an organization's operational metrics (uptime, response time, error rates) are visible to relevant stakeholders in near real time rather than only in periodic reports?

●        A. Live operational dashboards

●        B. Only generating a printed report once per quarter

●        C. Keeping all metrics private to a single engineer

●        D. Disabling metric collection between reports

Explanation: Live operational dashboards provide near real-time visibility into key metrics, rather than stakeholders waiting for periodic reports.

Question 56

An organization wants to ensure that its most critical services are prioritized for resource allocation and support attention over lower-priority internal tools. Which practice supports this?

●        A. Service tiering based on business criticality

●        B. Treating every service with identical priority regardless of impact

●        C. Ignoring business impact when allocating support resources

●        D. Randomly assigning priority levels

Explanation: Service tiering based on business criticality ensures the most important services receive appropriate resource allocation and support priority.

Question 57

Which operational metric would be most useful for determining whether an organization needs to hire additional on-call staff or improve automation to reduce responder burnout?

●        A. Number and frequency of after-hours incident pages per on-call engineer

●        B. Total number of servers deployed

●        C. Total storage capacity used

●        D. Number of DNS records configured

Explanation: Tracking after-hours page frequency per engineer directly indicates on-call burden and burnout risk, informing staffing or automation decisions.

Question 58

An organization is deploying a new application across three environments (dev, staging, production) and wants configuration differences between environments to be explicit and centrally managed. Which approach supports this?

●        A. A centralized configuration management system with environment-specific parameter files

●        B. Hardcoding all values directly into application code for each environment

●        C. Manually editing configuration on each server after deployment

●        D. Using identical configuration values across all environments regardless of purpose

Explanation: Centralized configuration management with environment-specific parameters keeps differences explicit, auditable, and easy to manage across environments.

Question 59

An application intermittently fails to write data to a cloud database, with errors referencing 'quota exceeded' during peak hours only. Which cause is most likely?

●        A. The database's provisioned throughput/capacity limit is being reached during peak load

●        B. A DNS misconfiguration

●        C. An expired TLS certificate

●        D. A missing software license

Explanation: Errors tied specifically to peak hours and referencing quota limits point directly to the database's provisioned throughput or capacity being exceeded under load.

Question 60

Following a recent auto-scaling policy change, instances are being terminated more aggressively than expected, causing brief service disruptions. Which configuration should be reviewed first?

●        A. The scale-in cooldown period and termination policy thresholds

●        B. The DNS zone file

●        C. The office network firewall

●        D. The vendor's support contract terms

Explanation: Aggressive, unexpected termination after a scaling policy change points directly to the scale-in cooldown period or termination thresholds being misconfigured.

Question 61

An organization's automated alerting system failed to notify the on-call engineer during a recent outage, delaying response time significantly. Which area should be reviewed first?

●        A. The alerting system's notification routing and escalation configuration

●        B. The physical color of the server chassis

●        C. The vendor's marketing materials

●        D. The end user's monitor resolution

Explanation: A failure to notify the on-call engineer points directly to the alerting system's notification routing or escalation configuration as the area to review first.

Question 62

Which deployment consideration addresses ensuring that a database schema migration can run safely alongside the previous application version during a phased rollout, without breaking either version?

●        A. Designing schema migrations to be backward and forward compatible

●        B. Deploying schema changes and application code simultaneously with no compatibility plan

●        C. Ignoring schema versioning entirely

●        D. Applying breaking schema changes before any application code is updated

Explanation: Backward- and forward-compatible schema migrations allow both old and new application versions to function correctly during a phased rollout.

Question 63

An organization is deciding on an appropriate data replication strategy between two regions. Which replication approach guarantees zero data loss but requires higher latency tolerance since writes must be confirmed in both locations?

●        A. Asynchronous replication

●        B. Synchronous replication

●        C. No replication

●        D. One-time manual copy

Explanation: Synchronous replication confirms writes in both locations before acknowledging success, guaranteeing zero data loss at the cost of added write latency.

Question 64

Two applications sharing the same virtual network suddenly cannot communicate, though both were working the previous day and no application changes were made. Which area should be investigated first?

●        A. Recent changes to network security group or routing configuration

●        B. The applications' source code

●        C. The end users' local antivirus software

●        D. The vendor's quarterly financial results

Explanation: Since no application changes occurred, a recent network-level configuration change (security groups, routing) is the most likely cause of a sudden communication failure.

Question 65

Which storage performance consideration becomes most critical when supporting a high-transaction database workload requiring consistent low-latency responses?

●        A. Storage capacity in terabytes alone

●        B. IOPS and latency characteristics of the storage tier

●        C. The storage vendor's brand recognition

●        D. The color-coding of the storage dashboard

Explanation: High-transaction database workloads are most sensitive to IOPS and latency, making these the critical performance factors rather than raw capacity alone.

Question 66

A cloud technician wants to confirm that a proposed fix will not introduce new problems before applying it to production. Which practice supports this?

●        A. Testing the fix in a staging or isolated environment first

●        B. Applying the fix directly to production with no testing

●        C. Skipping validation to save time

●        D. Assuming the fix is safe without any testing

Explanation: Testing a proposed fix in a staging or isolated environment first validates that it resolves the issue without introducing new problems in production.

Question 67

An operations team notices that a particular type of incident recurs every few months despite being 'resolved' each time. Which practice would help address the true root cause rather than just symptoms?

●        A. A formal root cause analysis (RCA) process

●        B. Applying the same temporary workaround each time without investigation

●        C. Ignoring the recurring pattern

●        D. Assigning a different engineer each time with no continuity

Explanation: A formal root cause analysis process digs into the underlying cause of recurring incidents, rather than repeatedly applying temporary workarounds.

Question 68

A company wants to prevent a former employee's credentials, if somehow still active, from being used to access cloud resources. Which control provides the strongest immediate protection beyond timely deprovisioning?

●        A. Requiring MFA on all accounts

●        B. Disabling all logging

●        C. Removing all firewalls

●        D. Granting broader access to compensate

Explanation: MFA provides an additional layer of protection even if a password remains valid, reducing the risk from any account that was not promptly deprovisioned.

Question 69

An organization wants to test its full disaster recovery process, including actually failing over live traffic to the secondary site and back, rather than just reviewing documentation. Which type of DR test does this describe?

●        A. A full interruption/live failover test

●        B. A tabletop discussion only

●        C. A checklist review with no system interaction

●        D. A documentation audit only

Explanation: A full interruption test actually executes failover with live systems, providing the highest confidence that the DR plan works, unlike tabletop or documentation-only reviews.

Question 70

Which security concept describes limiting a user's access rights to expire automatically after a defined period unless explicitly renewed, reducing the risk of forgotten, stale permissions?

●        A. Time-bound/just-in-time access

●        B. Permanent standing access with no review

●        C. Shared credentials with no expiration

●        D. Disabling access reviews entirely

Explanation: Time-bound or just-in-time access automatically expires unless renewed, reducing the risk of forgotten permissions accumulating over time.

Question 71

Which final validation step confirms that a resolved incident has not introduced any new, unrelated issues elsewhere in the environment?

●        A. Broader regression monitoring across dependent systems after the fix

●        B. Closing the ticket immediately with no further checks

●        C. Assuming no other systems could be affected

●        D. Disabling monitoring on dependent systems

Explanation: Broader regression monitoring across dependent systems after applying a fix confirms the resolution did not introduce new, unrelated issues elsewhere.

Question 72

Users report that a cloud application works correctly over Wi-Fi but fails when accessed via a specific corporate VPN. Which area should be investigated first?

●        A. VPN routing, split-tunneling, or firewall rules specific to that VPN path

●        B. The application's database schema

●        C. The end users' monitor brightness settings

●        D. The vendor's office location

Explanation: Since the issue is isolated to a specific VPN path, VPN-specific routing, split-tunneling, or firewall configuration is the most likely cause.

Question 73

Which cloud networking component allows private connectivity between a customer's on-premises network and their cloud VPC without traversing the public internet?

●        A. A public internet gateway

●        B. A dedicated/private connection (e.g., direct connect link)

●        C. A public DNS resolver

●        D. A content delivery network

Explanation: A dedicated private connection links on-premises infrastructure directly to a cloud VPC, avoiding the public internet for improved security and consistent latency.

Question 74

Which backup approach creates a point-in-time, space-efficient copy of a volume by only recording changes since the last snapshot, commonly used for quick recovery points in cloud environments?

●        A. Snapshot-based backup

●        B. Tape-based backup

●        C. Manual file copy

●        D. Cold archive-only backup

Explanation: Snapshot-based backups efficiently capture point-in-time states by recording only changed blocks, enabling fast, space-efficient recovery points.

Question 75

An organization wants to ensure that administrative actions taken through the cloud provider's management console are individually attributable to a specific person, not a shared account. Which practice addresses this?

●        A. Enforcing individual, named user accounts instead of shared credentials

●        B. Sharing one administrator account among the entire team

●        C. Disabling audit logging

●        D. Removing MFA requirements

Explanation: Individual named accounts ensure administrative actions can be traced back to a specific person, unlike shared credentials which obscure accountability.