CompTIA Cloud+ (CV0-004) Practice Questions with Explanations

Correct answer: B

Ephemeral storage describes temporary storage that exists only for the duration needed and is deleted afterward. The surveillance system uses local storage as a temporary holding area before uploading to the cloud and then deleting the videos, which is the definition of ephemeral storage-data that is not meant to persist long-term.

Why the other options are wrong:

• A. Persistent storage would remain intact and not be deleted, which contradicts the described workflow.
• C. Differential storage refers to backup and recovery techniques, not the temporary nature of this storage.
• D. Incremental storage refers to backup methodologies involving incremental changes, not applicable to this scenario.

Correct answer: D

Identification is the vulnerability management concept that specifically refers to the discovery phase-finding and detecting vulnerabilities in systems and applications. While scanning is a technique used during identification, the process itself is called identification. This is the initial phase of the vulnerability management lifecycle.

Why the other options are wrong:

• A. Scanning is a technique or tool used during identification, not the overall concept of discovering vulnerabilities.
• B. Assessment is the evaluation and prioritization phase that occurs after vulnerabilities are identified.
• C. Remediation is the correction and patching phase that follows assessment and prioritization.

Correct answer: B

Microservices architecture best meets all three requirements: it minimizes services running on each layer by using small, focused services; it is vendor-agnostic as microservices can be deployed across any cloud platform or on-premises; and services can run on virtual machines or containerized environments. Microservices embody cloud-native design principles where minimal, specialized services are deployed independently. Virtual machines alone don't ensure minimal service deployment. Fan-out is a messaging pattern, not an architectural approach. Cloud-provided managed services create vendor lock-in, violating the vendor-agnostic requirement.

Why the other options are wrong:

• A. Virtual machines alone do not ensure minimal services or vendor agnosticism; they are simply infrastructure.
• C. Fan-out is a messaging pattern for event distribution, not a system design pattern addressing the stated requirements.
• D. Cloud-provided managed services create vendor lock-in and dependency, directly conflicting with the vendor-agnostic requirement.

Correct answer: C

Off-site storage refers to cold storage solutions designed for infrequently accessed data, providing the lowest cost per gigabyte. Cold storage tiers are optimized for archival and long-term retention with minimal retrieval frequency, offering significant cost savings compared to hot or warm storage options that maintain higher availability and performance.

Why the other options are wrong:

• A. Cold site refers to disaster recovery infrastructure, not data storage cost optimization.
• B. Hot site is a fully operational backup facility, relevant to business continuity but not data storage cost reduction.
• D. Warm site is a partially provisioned DR facility, more costly than cold storage for infrequently accessed data.

Correct answer: D

Computer vision is the field of computer science that enables machines to identify and understand objects and people in images and videos. It encompasses image recognition, object detection, and related tasks. Image reconstruction refers to rebuilding images from data, facial recognition is a specific application of computer vision, and natural language processing deals with text, not images.

Why the other options are wrong:

• A. Image reconstruction is a technique within computer vision, not the broader field definition.
• B. Facial recognition is a specific application of computer vision, not the entire field.
• C. Natural language processing focuses on text and language, not visual understanding.

Correct answer: A

Blue-green deployment is the ideal strategy meeting both requirements. It involves two identical production environments (blue and green), with traffic switched from one to the other after deployment. This approach is simple, fast (the switch is instantaneous), and perfectly suited for two identical platforms. It allows quick rollback if needed and minimizes downtime.

Why the other options are wrong:

• B. Canary deployment gradually rolls out changes to a subset of users, which is more complex and slower than the requirements specify.
• C. Rolling deployment updates instances incrementally, which is slower and doesn't align with the requirement for simple and fast deployment.
• D. In-place deployment modifies the existing environment directly, which carries higher risk and doesn't leverage having two identical platforms.

Correct answer: D

NAS (Network Attached Storage) uses file-based protocols like NFS or SMB which operate at a higher abstraction layer and are inherently slower, while SAN (Storage Area Network) uses block-level protocols like Fibre Channel or iSCSI that provide direct block access with lower latency. This makes SAN faster than NAS. The other options contain false claims about SAN and NAS capabilities.

Why the other options are wrong:

• A. SANs can use Fibre Channel, iSCSI over Ethernet, or other protocols-not exclusively fiber.
• B. SANs use block-level protocols (Fibre Channel, iSCSI), not standard Ethernet-based file protocols.
• C. NAS is slower than SAN due to its file-level protocol overhead, not faster.

Correct answer: D

Serverless functions are optimal for running single scripted tasks on a schedule. They eliminate infrastructure management overhead, charge only for execution time, scale automatically, and integrate seamlessly with scheduling services. This model provides cost efficiency and simplicity for short-duration, scheduled workloads.

Why the other options are wrong:

• A. Bare-metal servers require significant operational overhead and are overkill for simple scripted tasks.
• B. Managed containers add unnecessary complexity for a single scheduled script compared to serverless functions.
• C. Virtual machines require continuous management, patching, and incur costs even when idle between scheduled executions.

Correct answer: C

A DDoS (Distributed Denial of Service) attack is the most likely cause. Elevated response times on the home page with no internal system changes, combined with the fact that it affects external users globally, is characteristic of a DDoS attack overwhelming network capacity or application resources. Internal monitoring wouldn't detect external attack patterns targeting the application from many distributed sources.

Why the other options are wrong:

• A. Cryptojacking would consume system resources but wouldn't specifically cause sudden elevated response times on the home page without other symptoms.
• B. Human error would likely be detected by internal monitoring systems or show other correlated issues.
• D. Phishing is a social engineering attack targeting users, not something that causes application response time degradation.

Correct answer: B

API rate limiting is the protection mechanism that restricts the number of requests a client can make in a given time period. When a developer exceeds this limit by sending many requests rapidly, the server blocks all further requests-affecting both the developer and other users. This is the intended behavior of rate limiting to prevent server overload. A full outage (C) would prevent all access regardless of request volume, service quotas (A) are broader resource limitations, and regional availability (D) relates to geographic service distribution.

Why the other options are wrong:

• A. Service quotas typically limit total resource consumption over time rather than immediately blocking all server access due to rapid requests.
• C. A full outage would indicate complete system failure, not a responsive mechanism triggered by request volume.
• D. Regional service availability concerns geographic distribution of services, not request throttling mechanisms.

Correct answer: A

A /29 subnet provides only 6 usable IP addresses (8 total minus network and broadcast addresses). With eight individuals each needing a dedicated VM, there are insufficient addresses available. The network 10.1.10.0/29 cannot accommodate eight separate VMs, which is why several users cannot access their VMs.

Why the other options are wrong:

• B. Routes misconfiguration would affect connectivity but not prevent address assignment for a smaller subset of users.
• C. Traffic congestion on a 1Gbps link would not prevent users from connecting; it would cause slowness, not connection failures.
• D. DHCP functionality issues would affect all users equally, not just several, and the core problem is insufficient address space.

Correct answer: A

PaaS (Platform as a Service) is the ideal model for deploying code directly without provisioning infrastructure. The platform provider manages servers, storage, and networking while developers focus on application code. SaaS is for end-user applications, IaaS requires infrastructure provisioning, and XaaS is a generic term.

Why the other options are wrong:

• B. SaaS provides finished applications to end-users, not a development deployment platform.
• C. IaaS requires the company to provision and manage infrastructure, defeating the purpose.
• D. XaaS is too generic and does not specifically address code deployment without infrastructure.

Correct answer: C

Live replication (C) meets all three requirements: it maintains continuous real-time synchronization between at least two data centers, keeps replication latency under one second through active mirroring, and enables immediate failover because the secondary VM is constantly updated and ready to assume traffic instantly. This is the only method that guarantees sub-second latency with zero-downtime failover.

Why the other options are wrong:

• A. Snapshots are point-in-time copies, not continuous replication, and do not support immediate failover.
• B. Transactional replication ensures data consistency but typically has higher latency than live replication.
• D. Point-in-time recovery creates backups at specific intervals, not continuous real-time synchronization needed for immediate failover.

Correct answer: C

Block storage provides the greatest performance advantage for relational databases because it offers low-latency, high-throughput direct access with support for random I/O operations and ACID compliance. Block storage can be formatted with filesystems and connected directly to instances, providing the performance characteristics required for transactional database workloads.

Why the other options are wrong:

• A. File storage is optimized for shared access and sequential operations, not the random I/O patterns of relational databases.
• B. Object storage is designed for unstructured data with higher latency and throughput characteristics unsuitable for database operations.
• D. Ephemeral storage is temporary and typically smaller capacity, unsuitable for persistent database storage requirements.

Correct answer: C

The best action before any production update is to read the release notes for version 4.1 (C). Release notes contain critical information about breaking changes, compatibility issues, known bugs, migration requirements, and feature differences that inform whether the 4.1 major version upgrade or the 3.7 minor version update is appropriate. This research is the essential first step to make an informed decision about which path to take and how to proceed safely.

Why the other options are wrong:

• A. Testing 3.7 in development is prudent but comes after understanding the release notes to determine the optimal target version.
• B. Rolling production upgrades to 4.1 without understanding the release notes risks deployment issues.
• D. Scheduling maintenance for 3.7 without reviewing 4.1 release notes misses critical information needed to choose the right version.

Correct answer: C

Cloud solutions will require less resources than on- premises installations. Cloud migration directly reduces resource consumption because cloud providers leverage economies of scale, shared infrastructure, and pay-as-you-go models. Organizations no longer need to maintain physical servers, cooling systems, or dedicated IT staff for infrastructure management on premises. While option D mentions reduced utility costs on premises, this is indirect and assumes the organization maintains redundant on-premises infrastructure after migration. Option C represents the most direct effect: cloud solutions inherently require fewer resources than traditional on-premises installations due to their shared, optimized nature.

Why the other options are wrong:

• A. Reorganizing reporting structure is a business decision, not a direct technical effect of cloud migration.
• B. Compatibility issues are typically addressed before migration, and post-migration issues would indicate incomplete planning.
• D. Utility cost reduction on premises is only realized if on-premises infrastructure is decommissioned, which is not a direct effect of migration itself.

Correct answer: C

Archive storage is the most cost-effective option for data that must be retained for compliance but is accessed infrequently or not at all. It offers the lowest storage costs among tiered options, making it ideal for long-term retention requirements where immediate access is not needed. Hot storage is expensive for retention-only needs, while warm and cold are middle-ground options that don't optimize for compliance retention as well as archive does.

Why the other options are wrong:

• A. Warm storage has higher costs than archive and is designed for moderate access patterns, not retention-only scenarios.
• B. Hot storage is the most expensive option and is meant for frequently accessed data, not compliance retention.
• D. Cold storage is cheaper than warm but more expensive than archive; archive is specifically designed for compliance retention.

Correct answer: B

Remediation is the step in vulnerability management where vulnerabilities are actually fixed or mitigated. Blocking incoming connections and outgoing responses to a specific IP address is a concrete action taken to eliminate or reduce a vulnerability's impact. This is active remediation of a threat source, not identification (finding it), assessment (measuring it), or scanning scope (defining what to scan).

Why the other options are wrong:

• A. Scanning scope refers to defining what systems and assets will be included in vulnerability scans, not the actual blocking of traffic.
• C. Identification is the step where vulnerabilities are discovered and cataloged, which would have occurred before the blocking action.
• D. Assessment involves analyzing and prioritizing vulnerabilities, not implementing technical controls to block them.

Correct answer: B

Since 5,000 employees access the application during the same time frame daily, this is a predictable, recurring pattern. Scheduled horizontal scaling is optimal-resources can be scaled out before the predictable peak time and scaled back after, minimizing costs while ensuring capacity. Vertical scaling (A, C) has limitations and higher costs; event-based scaling (D) reacts too late to predictable patterns. Schedule-based horizontal scaling (B) proactively addresses known demand.

Why the other options are wrong:

• A. Vertical scaling has limits and higher per-unit costs; it's also reactive rather than proactive for predictable patterns.
• C. Vertical scaling is expensive, has hardware limits, and is reactive to load rather than proactive for predictable patterns.
• D. Event-based scaling reacts after load appears, causing temporary performance issues; scheduled scaling prevents this for predictable patterns.

Correct answer: C

Using the cloud provider command line interface with tag-based filters requires the least effort because it automates the stopping process based on existing tags. This approach can target all instances with the 'noncritical application' tag in a single command, making it the most efficient and scalable solution compared to manual intervention, audit log analysis, or custom scripting.

Why the other options are wrong:

• A. Audit logs are for tracking events that have already occurred; they don't directly stop instances and require manual analysis to identify which instances to stop.
• B. Using the web console requires manually identifying and checking each instance, which is tedious and inefficient at scale.
• D. Writing a Bash script requires more effort and setup time compared to using built-in CLI commands with tag filtering.

Correct answer: B

Replatforming (B) is the most cost-effective and efficient strategy for migrating containers to the cloud. It involves moving containerized applications to cloud-native container services (like managed Kubernetes or container registries) with minimal code changes, preserving existing investments while gaining cloud benefits and managed service advantages. This balances cost efficiency against the high expense of full refactoring and achieves faster time-to-value compared to other strategies.

Why the other options are wrong:

• A. Retiring containers means abandoning working applications, which is not a migration strategy.
• C. Retaining containers on-premises does not migrate them to the cloud.
• D. Refactoring for cloud-native architecture is more expensive and time-consuming than replatforming.

Correct answer: B

Retention refers to the requirement to keep data for a specified period of time. The legal department instructing that data be stored for a minimum of one year is establishing a retention policy. This is a compliance and governance requirement that specifies how long data must be preserved, regardless of other security or operational concerns.

Why the other options are wrong:

• A. Recoverability refers to the ability to restore data after loss or corruption, not the requirement to store data for a specific duration.
• C. Encryption is a security control for protecting data confidentiality, not related to how long data is stored.
• D. Integrity refers to ensuring data hasn't been altered or corrupted, not the storage duration requirement.

Correct answer: C

Hybrid cloud deployment is the best fit because it combines public cloud resources (for geographic dispersion) with on-premises or private infrastructure (for local data access and legacy application support). This model allows the organization to keep sensitive or legacy systems on-premises while leveraging the scalability and geographic distribution of public cloud services, meeting all three stated requirements.

Why the other options are wrong:

• A. On-premises only doesn't provide geographic dispersion or the benefits of cloud scalability.
• B. Private cloud alone cannot easily achieve geographic dispersion across multiple regions as efficiently as hybrid or public cloud models.
• D. Public cloud alone would not support local data access requirements or legacy application accessibility requirements that typically need on-premises resources.

Correct answer: C

The script successfully created five virtual machines but returned empty tags `{tags: []}`, indicating the tagging operation failed silently or was not executed. This is the classic symptom of command deprecation: the old tagging syntax or API endpoint the script uses has been deprecated in favor of a newer method. The VMs were created because that part of the API is still functional, but the tagging command is no longer supported or functional. API throttling would cause creation failures, service quotas would prevent VM creation entirely, and compatibility issues would typically produce errors rather than silent failures.

Why the other options are wrong:

• A. API throttling would cause request failures or timeouts, not selective silent failures of only the tagging operation.
• B. Service quotas would prevent VM creation altogether, not allow creation while only tagging fails.
• D. Compatibility issues would typically generate error messages, not produce silently empty tag results.

Correct answer: D

Versioning enables administrators to track, review, and revert changes to deployment templates over time. It maintains a complete history of modifications, allowing teams to understand what changed and when. Drift detection identifies configuration differences, repeatability ensures consistent deployments, and documentation provides manual notes -none of these provide automatic historical change tracking like versioning does.

Why the other options are wrong:

• A. Drift detection identifies configuration divergence but does not provide change history.
• B. Repeatability ensures consistent redeployment but does not track historical changes.
• C. Documentation requires manual effort and does not provide systematic change history tracking.

Correct answer: B

Spot instances offer the lowest cost compute resources by allowing organizations to bid on unused cloud capacity at significantly discounted rates (up to 90% off on-demand pricing). They are ideal for short-term, non-critical workloads that can tolerate interruptions, making them the most cost-effective option for this use case.

Why the other options are wrong:

• A. Reserved instances require upfront commitment for longer periods and are better for predictable, long-term workloads.
• C. Pay-as-you-go pricing is more expensive than spot instances for the same computational resources.
• D. Dedicated hosts are significantly more expensive and designed for licensing or performance requirements, not cost optimization.

Correct answer: C

REST API over HTTPS is the industry-standard technology for integrating third-party payment processors with web applications. It provides secure (HTTPS encryption), scalable, and standardized communication that most modern payment processors expose. REST is stateless and well-suited for transactional payment integration. RPC over SSL (A) is outdated; Transactional SQL (B) is a database concept not relevant to external integrations; Secure WebSocket (D) is for persistent bidirectional communication, not the request-response pattern of payment processing.

Why the other options are wrong:

• A. RPC over SSL is an older protocol not commonly used for modern payment processor integrations.
• B. Transactional SQL is a database query language, not an integration technology for external payment processors.
• D. Secure WebSocket is designed for persistent connections and real-time communication, not the typical request-response pattern of payment transactions.

Correct answer: D

The key diagnostic clue is that traffic reaches the development network (firewall logs confirm this) but office users cannot connect while client VPN users can. This indicates the tunnel and routing are working, but the development network's resources are rejecting the office traffic. ACLs on development workloads (D) would be the next logical check to verify that inbound traffic from the office subnet is actually permitted to reach the application resources. The asymmetric behavior between office and client VPN users strongly suggests a security policy issue at the destination.

Why the other options are wrong:

• A. Routing is confirmed working since firewall logs show traffic reaching the development network.
• B. Cipher changes would affect tunnel establishment itself, not selective connectivity after the tunnel is established.
• C. The tunnel is already established and passing traffic; restarting would not resolve selective access denial.

Correct answer: A

Scheduled scaling is the correct approach because the organization knows in advance when traffic bursts will occur (when new videos are launched). The poor performance in the middle of the month indicates predictable, recurring patterns. Scheduled scaling allows the infrastructure to proactively scale up before the anticipated traffic spike, ensuring adequate resources are available without manual intervention during the event.

Why the other options are wrong:

• B. Manual scaling requires human intervention at the time of the surge, which is reactive rather than proactive and doesn't address the predictable nature of the traffic pattern.
• C. Event-based scaling responds to specific triggering events but doesn't leverage the organization's knowledge of when video launches occur.
• D. Load-based scaling reacts to current traffic levels after the fact, which would still result in performance issues during the initial burst.

Correct answer: D

A hot site is a fully operational disaster recovery site where all servers are continuously replicated and maintained in an online, ready-to-use state. This means data and system state are actively synchronized from the main site, allowing immediate failover with minimal or no downtime. The defining characteristic is that servers are already running and up-to-date, not offline or partially configured like warm or cold sites.

Why the other options are wrong:

• A. Clustering is a local redundancy technique, not a characteristic that defines a hot site's geographic separation.
• B. Load balancing between main and hot site is an operational decision, not a defining characteristic of what makes a site "hot."
• C. Hourly offline backups describe a backup strategy, not a hot site, which maintains online replication.

Correct answer: A

Network flow logs capture traffic patterns and volumes at the network layer, making them ideal for identifying DDoS attacks which are characterized by abnormal traffic spikes and patterns. Flow logs show source IPs, destination IPs, ports, and traffic volume-all critical indicators of DDoS activity. This is the standard monitoring approach for detecting volumetric attacks at the infrastructure level.

Why the other options are wrong:

• B. Endpoint detection and response logs focus on host-level threats and malware, not network-level DDoS attacks.
• C. Cloud provider event logs track API calls and account activities, not the actual network traffic that constitutes a DDoS attack.
• D. Instance syslog records system events on individual servers but does not provide network-wide traffic analysis needed to detect DDoS patterns.

Correct answer: B

Cloud providers offer services on a regional basis, and not all services are available in all regions. When VDI creation succeeds in some locations but fails in others, the most likely cause is that the required VDI service is not available in the regions where it failed. Regional service availability is a fundamental constraint of cloud infrastructure. While service quotas could cause failures, they would typically fail consistently rather than in some regions only. Partial outages would be temporary and unpredictable, and deprecation would affect all regions equally.

Why the other options are wrong:

• A. Partial outages would be temporary and would show inconsistent behavior across multiple attempts, not consistent regional failures.
• C. Service quotas would apply to the account globally or consistently per region, not show success in some regions and failure in others.
• D. Deprecation of functionality would affect all regions equally, not just selected geographic locations.

Correct answer: A

Terraform templates with environment variables provide consistent infrastructure definitions across production, staging, and development environments. The same template can be used for all environments with only variables changed (e.g., instance count, size), ensuring consistency in architecture and configuration. This is the foundational Infrastructure as Code approach that guarantees identical deployments. Grafana is monitoring visualization and doesn't ensure infrastructure consistency. The ELK stack is for logging and doesn't manage infrastructure provisioning. Jenkins agents facilitate CI/CD pipelines but don't ensure environment consistency.

Why the other options are wrong:

• B. Grafana is a monitoring and visualization tool, not an infrastructure provisioning solution; it does not ensure consistency between environments.
• C. The ELK stack (Elasticsearch, Logstash, Kibana) is for centralized logging and observability, not infrastructure definition or consistency.
• D. Jenkins agents support CI/CD pipelines and automation but do not directly manage infrastructure consistency across environments.

Correct answer: D

Distributed tracing is the best tool for identifying latency sources in applications using multiple APIs. It tracks requests across services and shows HTTP response times and status codes, allowing engineers to pinpoint which third-party API call or service is causing delays. Centralized logging shows request data but not response timing details, flow logs capture packets but lack HTTP-level insight, and API gateways track requests but not end- to-end latency across third-party services.

Why the other options are wrong:

• A. Centralized logging records requests but does not effectively measure response times and latency sources.
• B. Flow logs operate at the network packet level and lack application-layer HTTP timing information.
• C. API gateways track requests but cannot trace through third-party APIs to identify their latency contribution.

Correct answer: B

When unable to directly modify a protected branch, the standard approach is to create a pull request. Protected branches are intentionally restricted to prevent direct modifications, requiring changes to go through a formal review process. A pull request initiates this review workflow, allowing the proposed changes to be evaluated and merged through the protection mechanisms.

Why the other options are wrong:

• A. Adding a new remote doesn't address the protected branch restriction and wouldn't enable modification.
• C. Merging a branch still requires the same protections to be satisfied as direct modification.
• D. Rebasing a branch is a technical operation that doesn't bypass branch protection rules and would face the same restrictions.

Correct answer: C

Since the data is mirrored on another system and the proof of concept has been completed, deleting the storage on the decommissioned server is the appropriate action. The data is safely retained elsewhere, and there is no ongoing business need for this copy. Keeping temporary copies, archiving, or retaining permanently would waste storage resources and violate the principle of least data retention.

Why the other options are wrong:

• A. Temporary retention adds cost and risk without business justification when data exists elsewhere.
• B. Archiving would preserve unnecessary data and incur ongoing costs.
• D. Permanent retention is wasteful and unnecessary for a decommissioned POC system when data is mirrored.

Correct answer: B

Data Loss Prevention (DLP) is specifically designed to detect, monitor, and prevent the transmission of sensitive data like Personally Identifiable Information (PII). DLP solutions scan outgoing communications, including email, to identify sensitive data patterns and either block or redact them before transmission. This directly addresses the compliance requirement to ensure PII is not leaked through email systems. IPS provides intrusion detection but not data leakage prevention. ACLs control access to resources but don't monitor data content. WAF protects web applications from attacks but does not prevent sensitive data transmission.

Why the other options are wrong:

• A. An Intrusion Prevention System (IPS) detects and blocks network attacks, not data leakage of sensitive content.
• C. Access Control Lists (ACLs) restrict who can access resources but do not monitor or prevent sensitive data transmission.
• D. A Web Application Firewall (WAF) protects web applications from attacks but does not detect or prevent PII from being transmitted.

Correct answer: D

A WAF (Web Application Firewall) is specifically designed to protect web applications from exploits including remote command execution vulnerabilities by filtering malicious HTTP requests. It operates at the application layer and can detect and block attack patterns. IPS works at network level, ACLs control access but not application attacks, and DLP prevents data loss rather than stopping attacks.

Why the other options are wrong:

• A. IPS (Intrusion Prevention System) operates at the network layer and is less effective against application-layer exploits.
• B. ACLs control network traffic access but cannot specifically prevent remote command execution attacks.
• C. DLP (Data Loss Prevention) focuses on preventing unauthorized data movement, not stopping application attacks.

Correct answer: A

Scanning is the phase where security vulnerabilities are actively discovered and identified through automated tools that probe systems for known vulnerabilities. While Identification (B) is a related term, Scanning specifically describes the technical discovery process. Reporting comes after findings are analyzed, and Remediation addresses fixing the vulnerabilities. The question asks which phase includes the discovery process, making Scanning the most precise answer.

Why the other options are wrong:

• B. Identification is more about classifying and documenting discovered vulnerabilities rather than the discovery process itself.
• C. Reporting occurs after vulnerabilities are found and analyzed, not during the discovery phase.
• D. Remediation is the phase where vulnerabilities are fixed, which comes after discovery.

Correct answer: A

As the website expands globally, data sovereignty (A) becomes the critical factor affecting image ownership. Different countries have varying laws regarding data residency, ownership rights, data protection, and privacy regulations. Where customer data is physically stored and processed determines which jurisdictions' laws apply, which can directly impact the company's and customers' legal rights and ownership claims over the photographs.

Why the other options are wrong:

• B. Data classification organizes data by sensitivity level but does not affect ownership rights.
• C. Litigation holds preserve data during legal proceedings but do not affect underlying ownership.
• D. Retention policies define how long data is kept but do not determine who owns the data.

Correct answer: D

Encryption at rest ensures that even if data is accessed by unauthorized parties, it remains unreadable and unusable without the decryption key. This is the fundamental protection mechanism that makes stolen data worthless. Switching storage types does not protect data, hashing is for verification not protection, and changing permissions after a breach does nothing to secure already-accessed data.

Why the other options are wrong:

• A. Storage type does not prevent unauthorized access or make data unusable if accessed.
• B. Hashing is a one-way function for verification, not encryption for making data unreadable.
• C. Changing permissions after unauthorized access has already occurred provides no retroactive protection.

Correct answer: C

On-premises to cloud migration is the correct choice for this scenario. The application is currently on a local VM cluster (on-premises) and needs to be moved for usage by an external global user population. Cloud platforms provide the global reach, scalability, and distributed infrastructure necessary to support external users worldwide while maintaining high availability.

Why the other options are wrong:

• A. Cloud to on-premises is the reverse direction and wouldn't meet the requirement of serving an external global user population.
• B. Cloud to cloud applies when already in a cloud environment, not when starting from on-premises.
• D. On-premises to on-premises wouldn't address the need to serve external global users or leverage cloud benefits.

Correct answer: D

GraphQL is a query language and runtime that allows programmatic access to data over the internet while enabling flexible data querying. It specifically addresses the need to both transfer data and query it efficiently. SQL is for databases only, Web sockets are for real- time communication, and RPC is for remote procedure calls without query capabilities.

Why the other options are wrong:

• A. SQL operates on databases, not for general internet data transfer and querying.
• B. Web sockets provide bidirectional communication but lack query capabilities.
• C. RPC enables remote function calls but does not provide query language functionality.

Correct answer: C

The WAF at the CDN was deployed but the application was still exploited, indicating traffic is bypassing the WAF. This occurs when users or attackers can access the application directly without routing through the CDN/WAF. Adding an ACL to the VM subnet (C) to restrict inbound traffic to only the CDN's IP ranges ensures that all traffic to the application must pass through the WAF first, preventing direct access that circumvents the security control.

Why the other options are wrong:

• A. DDoS protection addresses volumetric attacks, not CSRF vulnerabilities or WAF bypass issues.
• B. Endpoint protection on VMs does not address CSRF vulnerabilities or WAF bypass at the network perimeter.
• D. An IDS detects intrusions but does not prevent the bypass of the WAF security control.

Correct answer: B

Cloud-native monitoring services require specialized agents deployed within the virtual machines to collect detailed process-level and memory-usage metrics. A monitoring agent is the industry-standard, cloud-native approach that integrates with autoscaling groups and provides comprehensive telemetry. The agent automatically scales with the autoscaling group and provides the granular, real-time monitoring required. Page file/swap metrics are low-level and insufficient for process tracking. Scheduling scripts is not cloud-native and won't scale automatically with the autoscaling group. VM configuration settings typically only provide basic metrics, not process-level details.

Why the other options are wrong:

• A. Page file/swap metrics provide only OS-level paging data, not process-level or detailed memory tracking.
• C. Scripted collection is not cloud-native, doesn't scale automatically with autoscaling groups, and is labor-intensive to maintain.
• D. VM configuration settings provide basic metrics only, not granular process-level memory usage required for this use case.

Correct answer: B

Load-based auto-scaling automatically adjusts resources in response to actual demand, minimizing costs by only scaling when necessary and keeping the system responsive. This approach handles the unpredictable spike (two to ten times normal) without manual intervention. Scheduled scaling (option D) would work but is less flexible if the sale timing changes; manual portal adjustments (C) lack automation; horizontal scaling alone (A) doesn't address the automation requirement.

Why the other options are wrong:

• A. While horizontal scaling is necessary, this option alone doesn't automate the process or explain when to scale based on demand.
• C. Manual adjustment via cloud portal defeats the automation requirement and increases operational overhead.
• D. Scheduled scaling requires predetermined timing and lacks flexibility if the sale parameters change or demand patterns vary.

Correct answer: D

For the first week of executing a new backup plan, a full backup must be performed. Full backups capture the entire system state, files, and configurations, creating a complete baseline. Subsequent weekly backups could use incremental or differential methods, but the initial backup must be comprehensive. This establishes the foundation from which all future incremental backups will be based.

Why the other options are wrong:

• A. Differential backups capture changes since the last full backup; they cannot be used as the initial backup without a baseline.
• B. Incremental backups only capture changes since the last backup of any type; they require a full backup baseline to be effective.
• C. Snapshots capture point-in-time system state but are not the conventional method for initial comprehensive backup plans requiring weekly execution.

Correct answer: C

A Content Delivery Network (CDN) is specifically designed to reduce latency for global users by caching content at geographically distributed edge locations. When users request content, it is served from the nearest edge location rather than from the origin server, dramatically reducing latency. This is particularly important for static websites with global audiences. VPCs provide network isolation but don't improve global latency. Application load balancers distribute traffic but don't reduce geographic latency. API gateways manage API traffic but are not designed for static content distribution or latency reduction.

Why the other options are wrong:

• A. A VPC provides network segmentation and isolation, not geographic content distribution or latency reduction.
• B. An application load balancer distributes traffic across instances but does not reduce latency for geographically distant users.
• D. An API gateway manages API traffic routing and policies but is not designed for static website delivery or latency optimization.

Correct answer: C

Ephemeral storage is temporary and designed to be lost after a container restart or termination. It provides fast, temporary workspace for running containers but is not persisted. When a container is restarted or removed, any data stored in ephemeral storage is deleted, making it unsuitable for data that must survive container lifecycle events.

Why the other options are wrong:

• A. Object storage is persistent cloud storage designed to retain data long-term.
• B. Persistent volumes are specifically designed to retain data across container restarts and terminations.
• D. Block storage provides persistent storage at the block level and retains data after restarts.

Correct answer: B

Containers are the best choice for optimizing cloud resources and reducing OS management overhead. Containers allow multiple applications to run on a single OS kernel, eliminating the need to manage separate operating systems for each workload. This significantly reduces resource consumption, simplifies management, and lowers operational overhead compared to running multiple VMs with their own OS instances.

Why the other options are wrong:

• A. VMs require managing individual operating systems for each instance, directly contradicting the goal of reducing OS management overhead.
• C. Remote desktops do not reduce OS management overhead; they typically increase complexity and administrative burden.
• D. Bare-metal servers still require OS installation and management with no abstraction layer, failing to address the overhead reduction goal.