CompTIA Cloud+ Certification– Privileged Access, Resilience, and Compliance

Question 1

Scenario: A university is redesigning access to its cloud-hosted research systems for faculty working from multiple campuses. The cloud engineer is designing an identity solution for the company cloud that includes the following:

•          A way to grant temporary elevated access only when needed for a specific task.

•          A record of every command executed during a privileged session.

•          Automatic expiration of elevated access after a set period.

Answer Choices:

•          Just-in-time access (for granting temporary elevated access only when needed)

•          Session recording (for logging every command executed during a privileged session)

•          Privileged access management (PAM) (for automatic expiration of elevated access)

Explanation:

•          Just-in-time access grants elevated privileges only for the duration a task actually requires, rather than persistently.

•          Session recording captures the commands and actions taken during a privileged session for later review.

•          Privileged access management (PAM) platforms enforce automatic expiration of elevated permissions after a defined window.

Question 2

Question: A team is releasing a new version of an internal analytics platform and wants to gradually shift traffic from the old version to the new one, monitoring error rates at each increment before proceeding further. Which of the following deployment strategies best meets this requirement?

•          A. Rolling

•          B. In-place

•          C. Blue-green

•          D. Recreate

Explanation: A rolling deployment gradually replaces instances of the old version with the new version in increments, allowing the team to monitor for issues at each stage before continuing, without requiring a full duplicate environment.

Question 3

Question: A company runs a fleet of virtual machines behind a network load balancer. During scaling events, new VMs begin failing connections because their application services have not fully started before the load balancer marks them healthy. Which of the following should the cloud engineer implement to address this issue?

•          A. Reduce the number of maximum instances

•          B. Configure a longer health check interval and startup grace period

•          C. Switch from a network load balancer to DNS round robin

•          D. Disable auto-scaling entirely

Explanation: Configuring a longer health check interval and startup grace period gives new virtual machines sufficient time to fully start their application services before the load balancer begins routing production traffic to them.

Question 4

Question: An engineer reviews performance data and finds that an application server's disk I/O queue depth has grown steadily and response times have degraded, while CPU and memory usage remain low. Which of the following actions would most likely explain the engineer's decision to migrate the workload to faster storage rather than scale horizontally?

•          A. The bottleneck is specific to storage I/O rather than compute capacity.

•          B. The application server's CPU utilization spiked to 95%.

•          C. The server ran out of available memory.

•          D. The load balancer reported unhealthy targets.

Explanation: When CPU and memory remain low but disk queue depth and response times worsen, the bottleneck lies specifically with storage I/O performance. Since horizontal scaling adds compute capacity rather than storage speed, upgrading to faster storage directly addresses the actual constraint.

Question 5

Question: An engineer is building infrastructure for an internal analytics platform and wants to apply globally recognized, vendor-neutral security hardening guidelines rather than a specific industry regulation. Which of the following should the engineer use?

•          A. SOC 2 guidelines

•          B. CIS Benchmarks

•          C. Object storage lifecycle policies

•          D. A hardware security module

Explanation: CIS (Center for Internet Security) Benchmarks provide globally recognized, vendor-neutral, consensus-driven configuration guidelines for hardening systems, distinct from regulatory frameworks tied to a specific industry.

Question 6

Question: A video transcoding job produces several intermediate resolution files before generating the final output video. Once the final video is delivered, the intermediate files are no longer needed. Which of the following is the best way to treat this intermediate data?

•          A. As persistent data

•          B. As ephemeral data

•          C. As backup data

•          D. As cold archival data

Explanation: Ephemeral data is short-lived and meant to be discarded automatically once its immediate processing purpose is complete, which accurately describes intermediate transcoding files with no value after final output generation.

Question 7

Question: Which of the following is a constraint that applies to private container image repositories that does not apply to public repositories?

•          A. Images must be smaller than a fixed size limit

•          B. A valid authentication token or credential must be presented for access

•          C. Only one image can be stored per repository

•          D. Images cannot be referenced by a digest

Explanation: Private image repositories require a valid authentication token or credential before any push or pull operation can succeed, unlike public repositories which typically allow anonymous read access.

Question 8

Question: Which of the following is the most likely reason a company would move a data-intensive, steady-state batch processing workload from the public cloud back to owned data center hardware?

•          A. To gain the ability to rapidly provision temporary capacity

•          B. To reduce ongoing costs for a workload with predictable, constant resource needs

•          C. To eliminate the need for monitoring and alerting

•          D. To avoid version control for infrastructure code

Explanation: For workloads with constant, predictable resource requirements, the recurring cost of cloud consumption can exceed the cost of owning equivalent hardware over its useful life, making repatriation a financially sound choice.

Question 9

Question: A cloud engineer is updating a logging agent currently at version 5.3 deployed across a VM fleet. Policy allows only the latest minor version to be applied to avoid breaking changes. Which of the following versions should the engineer update to?

•          A. 4.8

•          B. 5.3.2

•          C. 5.9

•          D. 6.0

Explanation: In Semantic Versioning (MAJOR.MINOR.PATCH), a minor version update introduces backward-compatible improvements and fixes. Updating from 5.3 to 5.9 represents a safe minor version upgrade that avoids breaking changes.

Question 10

Question: A newly migrated inventory management application is inaccessible to warehouse staff, while corporate office staff can access it without any issue. Which of the following actions should the administrator take first to resolve the issue?

•          A. Increase the application's subscription quota.

•          B. Investigate and correct the warehouse staff group's access permissions.

•          C. Disable API throttling for the application.

•          D. Increase the size of the underlying VM.

Explanation: Since corporate office staff can access the application normally, the infrastructure and network paths are functioning correctly. An access failure limited to one specific user group strongly suggests a permissions or access-control issue affecting only that group.

Question 11

Question: Which of the following can serve as a scalable, centralized hub connecting numerous VPCs across regions along with several on-premises office locations?

•          A. Transit gateway

•          B. Subnet

•          C. Elastic IP

•          D. Content delivery network

Explanation: A transit gateway functions as a scalable, centralized hub for connecting numerous VPCs across regions and multiple on-premises locations, avoiding the operational overhead of managing a full mesh of individual peering connections.

Question 12

Question: A cloud application intermittently fails to process payment requests through a third-party gateway. A cloud engineer reviews the following log entries: [ERROR] HTTP 429 - Too Many Requests / [INFO] Rate limit exceeded / [WARNING] Request queued. Which of the following is the best resolution?

•          A. Increase the payment gateway's allotted storage.

•          B. Implement exponential backoff and retry logic.

•          C. Restart the payment processing service.

•          D. Increase the size of the application server.

Explanation: The HTTP 429 error indicates the application is exceeding the payment gateway's allowed request rate. Implementing exponential backoff causes the client to wait progressively longer between retry attempts, easing pressure on the gateway until requests can succeed.

Question 13

Question: A cloud engineer must determine why a distributed order-processing system is experiencing intermittent slowdowns across several interconnected services. Logs exist separately for each service. Which of the following is the best way to determine the source of the issue?

•          A. Enabling distributed tracing across all services

•          B. Reviewing logs from only the database service

•          C. Increasing memory allocation for every service

•          D. Restarting all services simultaneously

Explanation: Distributed tracing tracks a single request as it moves through multiple interconnected services, recording the time spent at each stage. This makes it possible to pinpoint exactly which service is responsible for the slowdown.

Question 14

Question: A company is onboarding several external client organizations into a shared cloud environment and must attribute costs accurately back to each client. Which of the following enables consumption tracking with the most efficiency?

•          A. Requiring each client to submit their own manual usage reports

•          B. Automatically tagging all resources with client identifier metadata

•          C. Creating a separate cloud provider account for each client

•          D. Limiting each client to a single fixed-size VM

Explanation: Automated resource tagging attaches client-specific metadata to every deployed resource, enabling accurate, granular cost-allocation reporting without the overhead of separate accounts or manual reporting from each client.

Question 15

Question: Which of the following tools is specifically designed to define cloud infrastructure using declarative configuration files that can be version-controlled and applied repeatably across environments?

•          A. Terraform

•          B. Docker Compose

•          C. Kubernetes

•          D. Jenkins

Explanation: Terraform is an Infrastructure as Code tool built specifically to define cloud infrastructure using declarative configuration files, which can be version-controlled and applied consistently and repeatably across multiple environments.

Question 16

Question: A video-sharing application allows users to upload large video files. The design includes an API credential for cloud object storage and a backend server with a public IP. A security audit finds a large number of end-user IP addresses connecting directly to object storage using the backend's API credential. Which of the following is the most likely explanation?

•          A. A content delivery network is caching video content close to users.

•          B. The application generates temporary credentials for direct client uploads to storage.

•          C. The backend server load-balances across multiple availability zones.

•          D. A separate internal application shares the same storage bucket.

Explanation: When many end-user IP addresses connect directly to object storage using the same API credential, it typically indicates the application issues temporary, scoped credentials so large uploads bypass the backend server and go straight to storage.

Question 17

Question: Which of the following services is most appropriate for routing HTTPS requests to different backend pools depending on the specific URL path being requested, such as /api/ versus /images/?

•          A. Layer 4 load balancer

•          B. Web application firewall

•          C. Layer 7 load balancer

•          D. DNS-based failover

Explanation: A Layer 7 (application layer) load balancer can inspect the content of an HTTP/HTTPS request, including the URL path, allowing it to intelligently route traffic to different backend pools based on that path.

Question 18

Question: Which of the following are typically the customer's responsibility when using a provider-managed Software as a Service (SaaS) application? (Select two)

•          A. Patching the underlying operating system

•          B. Managing which users and groups have access to the application

•          C. Maintaining the physical data center infrastructure

•          D. Classifying and protecting the data entered into the application

•          E. Updating the SaaS application's codebase

•          F. Managing the network backbone connecting data centers

Explanation: In a Software as a Service model, the provider manages the infrastructure, application code, and underlying platform. The customer remains responsible for managing user access to the application and for classifying and protecting the data they choose to store within it.

Question 19

Question: A company's backup snapshots were deleted by an attacker who gained administrative access following a ransomware attack, forcing recovery from a much older archive. Which of the following backup features would most directly prevent this outcome from recurring?

•          A. Compression

•          B. Immutability with retention locks

•          C. Encryption in transit

•          D. Deduplication

Explanation: Immutable backups with retention locks prevent snapshots from being modified or deleted, even by an account with administrative privileges, for a defined retention period, ensuring recent backups remain available after a compromise.

Question 20

Question: A cloud engineer maintains an IaC configuration that provisions a service in one cloud region. The team now needs the same service deployed to twelve additional regions with minimal duplicated code. Which of the following options best fulfills this requirement?

•          A. Manually replicate the configuration through the cloud console for each region.

•          B. Create a separate repository per region with copied configuration files.

•          C. Create region-specific variable files and reuse the existing IaC templates.

•          D. Create a new Git branch per region and cherry-pick changes as needed.

Explanation: Infrastructure as Code is meant to be reusable across environments. Creating region-specific variable files allows a single set of templates to be reused for every region, avoiding duplicated configuration and enabling scalable, consistent multi-region deployments.

Question 21

Question: Which of the following Git commands creates a new branch and immediately switches the working directory to that branch in a single step?

•          A. git branch

•          B. git checkout -b

•          C. git merge

•          D. git status

Explanation: The git checkout -b command creates a new branch and switches the current working directory to it in a single operation, combining branch creation and checkout.

Question 22

Question: A cloud engineer is troubleshooting a failed VPC peering request between the following networks: Network 1: 10.1.0.0/16, Network 2: 10.1.5.0/24. Which of the following is causing the issue?

•          A. Overlapping subnet ranges

•          B. A missing peering acceptance

•          C. An expired route table entry

•          D. A security group misconfiguration

Explanation: VPC peering requires that the two networks being peered have no overlapping IP address ranges. Because 10.1.5.0/24 falls entirely within 10.1.0.0/16, the ranges overlap, which prevents the peering connection from succeeding.

Question 23

Question: A security engineer is finalizing a disaster recovery plan and needs to document the metric that defines how many transactions per second the storage system must sustain during recovery to meet performance expectations. Which of the following metrics should the engineer include?

•          A. IOPS

•          B. RTO

•          C. Jitter

•          D. MTU

Explanation: Input/Output Operations Per Second (IOPS) measures the number of read and write operations a storage system can sustain per second, making it the relevant metric for ensuring adequate storage performance during a recovery scenario.

Question 24

Question: A media streaming backend hosted on cloud VMs using standard hard disk drives is experiencing buffering issues during periods of high concurrent viewership. Which of the following would an administrator most likely consider for optimization?

•          A. DNS time-to-live settings

•          B. Storage throughput and IOPS

•          C. Application session timeout values

•          D. Load balancer health check frequency

Explanation: Standard spinning hard disk drives provide much lower IOPS and throughput than solid-state drives. Upgrading storage performance removes the disk bottleneck limiting the system's ability to serve concurrent streaming requests.

Question 25

Question: A cloud engineer must redesign a production database currently running as a single instance to withstand a full availability zone outage while also supporting restoration to a precise moment before a data corruption event. Which of the following best meets these requirements?

•          A. A larger single-instance database

•          B. A Multi-AZ database deployment with automated backups

•          C. A manually triggered weekly export

•          D. A read-only replica in the same zone

Explanation: A Multi-AZ database deployment automatically maintains a synchronous standby replica in a separate availability zone for automated failover, while automated backups provide the ability to restore data to a specific point in time before a corruption event.

Question 26

Question: A publicly traded technology company is preparing for an annual audit of its internal controls over financial reporting systems hosted in the cloud. Which of the following compliance standards is most relevant to this audit?

•          A. PCI DSS

•          B. SOC 2

•          C. CIS

•          D. GDPR

Explanation: SOC 2 reports evaluate an organization's controls related to security, availability, and processing integrity of systems, making it the most relevant standard for an audit of internal controls over cloud-hosted financial reporting systems.

Question 27

Question: A cloud engineer configures a new Linux VM and encounters the error: Could not resolve host: packages.company.com. Investigation shows the /etc/resolv.conf file has no entries. Which of the following lines should the engineer add to the file to fix the issue?

•          A. nameserver 9.9.9.9

•          B. ping packages.company.com

•          C. iptables -F

•          D. systemctl restart network

Explanation: An empty /etc/resolv.conf file means the Linux instance has no configured DNS server for name resolution. Adding a nameserver entry with a valid DNS server IP address resolves the hostname lookup failure.