I85PREP
⌘ K
CCC-A study materials
CCC-A study resources

CCC-A practice questions

One question at a time. Build your CCC-A understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Computing Fundamentals

In the NIST definition of cloud computing, which characteristic describes a provider's ability to pool and dynamically assign physical and virtual resources to serve multiple consumers?

  1. Measured service
  2. Resource pooling Correct answer.
  3. Rapid elasticity
  4. Broad network access

Explanation

Resource pooling means computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to demand. The consumer generally has no control over the exact location of the provided resources.

Question 2Cloud Computing Fundamentals

A company runs workloads on infrastructure it owns but uses a cloud provider's orchestration and management layer to provision those workloads. Which deployment model does this describe?

  1. Public cloud
  2. Community cloud
  3. Hybrid cloud
  4. Private cloud Correct answer.

Explanation

A private cloud is provisioned for exclusive use by a single organization, and it may be owned, managed, and operated by the organization or a third party, and it may exist on or off premises. The defining element is exclusive use by one organization, not the location of the hardware.

Question 3Cloud Computing Fundamentals

Which service model gives the consumer the greatest amount of control over the operating system and runtime while still abstracting the physical hardware?

  1. Platform as a Service
  2. Software as a Service
  3. Infrastructure as a Service Correct answer.
  4. Function as a Service

Explanation

In IaaS the provider manages the physical infrastructure while the consumer controls the operating system, storage, and deployed applications. That makes IaaS the model with the most consumer control among the fundamental service models.

Question 4Cloud Computing Fundamentals

Which cloud characteristic is most directly supported by the ability to automatically add capacity during a traffic spike and remove it afterward?

  1. Multi-tenancy
  2. Interoperability
  3. Resiliency
  4. Elasticity Correct answer.

Explanation

Elasticity is the ability to scale resources outward and inward automatically to match current demand. Adding capacity during a spike and releasing it afterward is the classic elasticity pattern.

Question 5Cloud Computing Fundamentals

What is the primary purpose of a cloud service level agreement (SLA)?

  1. To list the source code for the provider's platform services
  2. To describe the provider's marketing roadmap for new regions
  3. To define the provider's guaranteed performance and availability commitments and remedies Correct answer.
  4. To certify the provider's staff against security standards

Explanation

An SLA documents the measurable service commitments such as availability and latency, together with the remedies or credits owed if those commitments are missed. It is a contractual instrument that sets expectations between provider and consumer.

Question 6Cloud Computing Fundamentals

Which cloud benefit is described as shifting capital expenditure for servers to predictable operational expenditure?

  1. Cost model transformation Correct answer.
  2. Vendor lock-in reduction
  3. Latency optimization
  4. Data sovereignty

Explanation

Moving from buying hardware up front to paying for consumption converts capital expenditure into operational expenditure. This cost model transformation is a commonly cited economic driver for cloud adoption.

Question 7Cloud Computing Fundamentals

Which statement accurately describes the shared responsibility model in a public cloud?

  1. The consumer is responsible for all controls including the physical datacenter
  2. Responsibility transfers entirely to the consumer when using managed services
  3. The provider is responsible for all security controls once data is uploaded
  4. Responsibility is divided, with the provider securing the cloud and the consumer securing what they put in it Correct answer.

Explanation

The shared responsibility model divides duties: the provider secures the underlying infrastructure, while the consumer secures data, identities, configurations, and workloads they deploy. The exact split shifts with the service model but never disappears for either party.

Question 8Cloud Computing Fundamentals

Which term describes the ability of a workload to continue operating correctly despite the failure of an individual component?

  1. Elasticity
  2. Resiliency Correct answer.
  3. Durability
  4. Scalability

Explanation

Resiliency is the capacity of a system to recover from and continue operating through faults in its components. It is achieved through redundancy, failover, and fault isolation rather than through capacity adjustment.

Question 9Cloud Computing Fundamentals

An application runs its database in a private datacenter and its web tier in a public cloud, with orchestration linking the two. Which deployment model is this?

  1. Public cloud
  2. Community cloud
  3. Hybrid cloud Correct answer.
  4. Private cloud

Explanation

A hybrid cloud combines two or more distinct deployment models that remain unique entities but are bound by technology enabling data and application portability. Mixing a private datacenter with a public cloud under common orchestration is the defining pattern.

Question 10Cloud Computing Fundamentals

A team wants to deploy code without managing servers, operating systems, or runtime patches, but still needs full control of the application and its dependencies. Which service model fits best?

  1. Platform as a Service Correct answer.
  2. Colocation
  3. Software as a Service
  4. Infrastructure as a Service

Explanation

PaaS provides a managed runtime and middleware so the consumer deploys application code without patching the OS or runtime. The consumer still controls the application and its dependencies, which is exactly the stated requirement.

Question 11Cloud Computing Fundamentals

Which scenario best demonstrates vertical scaling rather than horizontal scaling?

  1. Adding three more web servers behind a load balancer
  2. Resizing a database instance from four to sixteen virtual CPUs Correct answer.
  3. Sharding a dataset across additional nodes
  4. Deploying the application to a second region

Explanation

Vertical scaling increases the capacity of a single instance, such as adding CPUs or memory to one database node. Horizontal scaling instead adds more instances to distribute load.

Question 12Cloud Computing Fundamentals

What distinguishes a managed database service from a self-managed database running on virtual machines in the cloud?

  1. The provider handles patching, backups, and failover while the consumer manages schema and queries Correct answer.
  2. The managed service removes the need for the consumer to design indexes
  3. The managed service is always cheaper for steady-state workloads
  4. The managed service stores data only in memory

Explanation

A managed database service transfers operational tasks such as patching, backup, and failover to the provider. The consumer still owns schema design, query tuning, and access control.

Question 13Cloud Computing Fundamentals

Which practice most directly reduces the blast radius of a failure in a multi-tier cloud application?

  1. Running all tiers on a single large instance
  2. Disabling logging to reduce overhead
  3. Isolating tiers and using health checks with automatic replacement Correct answer.
  4. Increasing the instance size of the database tier

Explanation

Isolating components and replacing unhealthy instances automatically limits how far a single failure can propagate. This containment is what reduces blast radius rather than raw capacity.

Question 14Cloud Computing Fundamentals

A workload requires strict data residency in a specific country. Which cloud consideration is most relevant?

  1. Spot instance pricing
  2. Region selection and data sovereignty obligations Correct answer.
  3. Content delivery network caching
  4. Instance family selection

Explanation

Data residency requirements are met by choosing regions within the required jurisdiction and confirming the provider's legal and contractual obligations there. Sovereignty concerns where data is stored and which laws apply.

Question 15Cloud Computing Fundamentals

Which statement correctly contrasts object storage with block storage in cloud environments?

  1. Object storage manages data as discrete objects with keys and metadata, while block storage presents volumes for filesystems Correct answer.
  2. Block storage cannot be attached to virtual machines
  3. Block storage is accessed via HTTP using keys and metadata
  4. Object storage presents a raw volume that an operating system formats with a filesystem

Explanation

Object storage stores whole objects addressed by keys with rich metadata and is accessed over HTTP APIs. Block storage presents raw volumes that an operating system formats and mounts as a filesystem.

Question 16Cloud Computing Fundamentals

A team must ensure that a regional outage does not take down its application. Which design choice addresses this requirement most directly?

  1. Enabling verbose logging on all servers
  2. Increasing the size of the primary database instance
  3. Purchasing a higher support tier from the provider
  4. Deploying the application across multiple availability zones or regions with replicated data Correct answer.

Explanation

Spreading the deployment across independent failure domains and replicating data allows traffic to shift when one domain fails. Availability zones and regions are the standard failure domains used for this purpose.

Question 17Cloud Computing Fundamentals

What does a content delivery network primarily improve for a globally distributed web application?

  1. The security of the provider's physical facilities
  2. Latency for end users by caching content at edge locations Correct answer.
  3. The durability of object storage
  4. Database write throughput

Explanation

A CDN caches content at edge locations closer to users, reducing round-trip latency and origin load. It does not change database write capacity or storage durability guarantees.

Question 18Cloud Computing Fundamentals

Which identity practice best applies least privilege in a cloud environment?

  1. Sharing a single root account among the operations team
  2. Assigning roles scoped to specific resources and actions needed for each job function Correct answer.
  3. Storing long-lived access keys in application source code
  4. Granting all developers administrator rights to simplify operations

Explanation

Least privilege means granting only the permissions required for a role, scoped to the resources and actions needed. Role-based scoping limits the damage from misuse or compromise.

Question 19Cloud Computing Fundamentals

Which characteristic of cloud networking allows private subnets to reach external services without exposing instances to inbound internet traffic?

  1. An open security group allowing all inbound traffic
  2. A NAT gateway or managed egress proxy Correct answer.
  3. Direct peering of every subnet to the internet
  4. A public IP address on each instance

Explanation

A NAT gateway or managed egress proxy lets instances in private subnets initiate outbound connections while remaining unreachable from the internet. This preserves isolation while permitting necessary updates and API calls.

Question 20Cloud Computing Fundamentals

A team is choosing between provisioned virtual machines and serverless functions for an event-driven image processing task with unpredictable bursts. Which reasoning is soundest?

  1. Serverless functions are unsuitable because they cannot access object storage
  2. Provisioned VMs are required because event triggers are unavailable in cloud platforms
  3. Serverless functions fit because they scale per event and bill for execution time Correct answer.
  4. Provisioned VMs are better because they avoid cold starts entirely in all cases

Explanation

Event-driven, bursty workloads align well with serverless functions, which scale per event and charge for execution duration rather than idle capacity. Cold starts are a tradeoff to evaluate but do not make provisioned VMs universally superior.

Question 21Cloud Computing Fundamentals

Which statement best explains why multi-tenant public cloud providers can achieve high utilization of physical hardware?

  1. Tenants are required to reserve capacity for one another
  2. Each tenant receives dedicated physical servers
  3. Workloads from many tenants are statistically multiplexed onto shared resources Correct answer.
  4. Hardware is replaced before it reaches full load

Explanation

Statistical multiplexing lets a provider overlay many tenants' demand patterns on shared hardware, so peaks and troughs offset each other. Higher utilization lowers unit cost, which is a core economic advantage of multi-tenancy.

Question 22Cloud Computing Fundamentals

A regulated firm must prove that encryption keys for cloud-stored data never leave its own hardware security modules, even though the data resides in the provider's object storage. Which approach satisfies this requirement?

  1. Storing keys in the same object storage bucket as the data
  2. Customer-managed keys held in the firm's own HSM or external key store Correct answer.
  3. Provider-managed keys with default rotation
  4. Disabling encryption at rest to avoid key custody

Explanation

Holding keys in customer-controlled hardware security modules or an external key store keeps key material outside the provider's custody while still enabling encryption at rest. This arrangement supports the firm's ability to demonstrate exclusive key control.

Question 23Cloud Computing Fundamentals

An architect must compare the total cost of ownership of a steady-state workload that runs continuously against a bursty workload. Which analysis is most defensible?

  1. Reserved or committed-use pricing for the steady workload and on-demand or spot pricing for the bursty workload Correct answer.
  2. Spot pricing for the steady workload despite its interruption tolerance being low
  3. Reserved pricing for the bursty workload to cover unpredictable peaks
  4. On-demand pricing for both workloads because it is always cheapest

Explanation

Steady, predictable usage benefits from committed-use discounts, while intermittent or interruption-tolerant workloads suit on-demand or spot capacity. Matching pricing model to workload profile is the defensible approach.

Question 24Cloud Computing Fundamentals

A company wants to avoid provider lock-in for a containerized application. Which combination of choices most reduces switching risk?

  1. A single monolithic deployment tied to one provider's serverless runtime
  2. Proprietary managed services for every tier and provider-specific configuration formats
  3. Hard-coded credentials and region names embedded in application binaries
  4. Portable container images, infrastructure as code, and open data formats with abstraction layers Correct answer.

Explanation

Portable images, declarative infrastructure as code, and open data formats let a workload move between providers with limited rework. Abstraction layers further isolate application code from provider-specific APIs.

Question 25Cloud Computing Fundamentals

Which failure mode most threatens a system that relies on a single availability zone for both its application tier and its database?

  1. Increased latency for users in distant regions
  2. Higher cost from cross-zone data transfer
  3. Reduced encryption strength for data at rest
  4. Loss of the zone causing simultaneous loss of compute and data availability Correct answer.

Explanation

Placing compute and data in one availability zone means a zone-level failure removes both at once, leaving no failover target. Correlated failure domains are the central risk this design ignores.

Question 26Cloud Computing Fundamentals

Which cloud service model gives the customer the greatest amount of operational responsibility for the software stack running above the provider's infrastructure?

  1. Software as a Service
  2. Platform as a Service
  3. Function as a Service
  4. Infrastructure as a Service Correct answer.

Explanation

In IaaS the provider manages physical hosts, virtualization, and sometimes networking, while the customer patches operating systems, runtimes, middleware, and applications. PaaS, SaaS, and FaaS each shift more of that stack to the provider, so they leave the customer with less operational responsibility.

Question 27Cloud Computing Fundamentals

A startup needs to launch quickly with minimal upfront hardware purchase and pay only for what it consumes. Which cloud characteristic most directly supports this?

  1. Provider-managed encryption of data at rest
  2. Geographic redundancy across multiple regions
  3. On-demand self-service with measured pay-per-use billing Correct answer.
  4. Mandatory long-term reserved capacity contracts

Explanation

On-demand self-service lets customers provision resources without human interaction from the provider, and metered billing charges only for consumption. Together these remove the need for upfront capital purchases and long procurement cycles. Regional redundancy, reserved contracts, and encryption are valuable but do not by themselves deliver this launch-speed and cost flexibility.

Question 28Cloud Computing Fundamentals

Which statement best describes a cloud region?

  1. A logical grouping of accounts used only for billing
  2. A geographic area containing multiple isolated availability zones Correct answer.
  3. A caching layer placed close to end users
  4. A single physical server rack within a datacenter

Explanation

A region is a geographic area that contains several availability zones, each isolated from failures in the others. Customers choose regions for latency, compliance, and service availability, then distribute workloads across the zones within them.

Question 29Cloud Computing Fundamentals

Which cloud storage type is the most appropriate default for storing millions of unstructured image files accessed by URL?

  1. Object storage Correct answer.
  2. File storage shared over NFS
  3. Local instance ephemeral disk
  4. Block storage

Explanation

Object storage keeps data as objects in a flat namespace with metadata and is designed for massive scale, HTTP access, and durability. It suits unstructured artifacts such as images served to web clients. Block and file storage are better for attached volumes and shared filesystems, and ephemeral disk is lost when the instance stops.

Question 30Cloud Computing Fundamentals

What is the primary purpose of a virtual private cloud network boundary?

  1. To guarantee a fixed monthly price for compute instances
  2. To isolate cloud resources in a logically defined network with controlled routing and access Correct answer.
  3. To encrypt all traffic between the customer and the provider's public API endpoints
  4. To replicate data automatically across every region worldwide

Explanation

A virtual private cloud defines a logically isolated network in which subnets, route tables, gateways, and security controls decide what can communicate with what. It is a network isolation and routing construct, not an encryption, pricing, or global replication feature.

Question 31Cloud Computing Fundamentals

Which statement accurately describes elasticity in cloud computing?

  1. Resources are billed at a fixed rate regardless of usage
  2. Resources are permanently sized for the highest possible peak load
  3. Resources can be added or removed automatically to match current demand Correct answer.
  4. Resources are distributed across several providers at all times

Explanation

Elasticity is the ability to scale resources out and back in automatically as demand changes, so capacity tracks actual load. It differs from simply over-provisioning for peak demand, from multi-cloud distribution, and from flat-rate billing.

Question 32Cloud Computing Fundamentals

A team wants to run containerized workloads without provisioning or patching the underlying cluster nodes. Which approach fits best?

  1. A single virtual machine running Docker Engine
  2. Bare-metal servers managed in-house
  3. Self-managed Kubernetes on raw virtual machines
  4. A managed container orchestration service Correct answer.

Explanation

A managed orchestration service operates the control plane and often the worker nodes, so the team deploys containers without patching cluster infrastructure. Self-managed Kubernetes, bare metal, and a lone Docker host all leave node provisioning and maintenance with the customer.

Question 33Cloud Computing Fundamentals

Which practice supports cost governance across multiple cloud accounts in an organization?

  1. Granting every engineer full administrative rights
  2. Tagging resources by owner, project, and environment, then reporting on those tags Correct answer.
  3. Running every workload in the most expensive region by default
  4. Disabling all billing alerts to avoid notification noise

Explanation

Consistent tagging creates the dimensions needed to attribute spend to owners, projects, and environments, which enables chargeback and anomaly detection. Billing alerts, least privilege, and deliberate region selection are complementary controls that tagging-based reporting depends on rather than replaces.

Question 34Cloud Computing Fundamentals

A web application must tolerate the loss of an entire datacenter facility without data loss. Which combination of design choices addresses this requirement?

  1. Deploy into one zone and rely on the provider's hardware redundancy
  2. Deploy all tiers into one availability zone and take nightly backups
  3. Deploy into one zone and enable autoscaling within that zone
  4. Deploy across multiple availability zones and replicate data synchronously between them Correct answer.

Explanation

Availability zones are engineered so that a failure in one does not affect the others, so spreading tiers across zones removes the single-facility dependency. Synchronous replication keeps a current copy of data in the second zone so a facility loss does not lose committed writes. Backups, hardware redundancy, and autoscaling within one zone all retain that single-facility dependency.

Question 35Cloud Computing Fundamentals

An application's traffic is highly variable, with long idle periods between short bursts. Which compute purchasing approach usually minimizes cost while preserving the ability to scale?

  1. A multi-year reserved commitment sized for peak load
  2. A fixed fleet of the largest available instance type
  3. Dedicated hosts reserved for the full year
  4. On-demand instances combined with autoscaling Correct answer.

Explanation

On-demand pricing charges only while capacity exists, and autoscaling removes capacity during idle periods, so spend follows the bursty profile. Reserved commitments and fixed large fleets pay for capacity whether or not it is used, which is wasteful for intermittent demand.

Question 36Cloud Computing Fundamentals

A company must keep its database engine and version fully under its own control while still gaining cloud resilience. Which deployment choice meets this?

  1. A managed data warehouse with provider-controlled patching
  2. A fully managed database service with automatic minor version upgrades
  3. A serverless key-value store with provider-selected engine versions
  4. Self-managed database on cloud virtual machines with cross-zone replication Correct answer.

Explanation

Running the database on virtual machines leaves engine choice, version pinning, and patch timing with the customer, while cross-zone replication supplies resilience. Managed services take over version management, which conflicts with keeping the engine and version fully under customer control.

Question 37Cloud Computing Fundamentals

An application tier in a private subnet must download patches from the internet without being reachable from the internet. Which component enables this?

  1. A NAT gateway attached to the private subnet's route table Correct answer.
  2. An internet gateway with a route directly to the private subnet
  3. A security group rule allowing inbound traffic from all addresses
  4. A public load balancer in front of the private subnet

Explanation

A NAT gateway performs outbound translation so instances with private addresses can initiate connections to the internet while remaining unreachable inbound. Routing the private subnet straight to an internet gateway would require public addresses and expose the instances.

Question 38Cloud Computing Fundamentals

A team needs to grant a batch job read access to exactly one storage bucket and nothing else. Which identity mechanism is most appropriate?

  1. A shared administrator account whose credentials are stored in the job's code
  2. A workload identity role scoped to that bucket with a least-privilege policy Correct answer.
  3. A long-lived access key belonging to a human operator
  4. An account-wide policy granting storage read to every principal

Explanation

A scoped workload identity lets the job obtain short-lived credentials tied to its own identity, and the policy limits access to the single bucket. Embedded administrator credentials, human keys, and account-wide grants all exceed the required permission and increase blast radius.

Question 39Cloud Computing Fundamentals

What is the main effect of placing a managed message queue between a web tier and a worker tier?

  1. It encrypts all messages so the workers no longer need authorization
  2. It guarantees that each message is processed exactly once by the workers
  3. It removes the need for the workers to be idempotent
  4. It decouples the tiers so each can scale and fail independently while absorbing bursts Correct answer.

Explanation

A queue buffers work so the web tier can enqueue quickly and workers consume at their own rate, which decouples scaling and isolates failures between tiers. Queues do not by themselves provide encryption, exactly-once processing, or exemption from idempotent handling.

Question 40Cloud Computing Fundamentals

A team must demonstrate that only approved, hardened machine images can launch in production. Which control achieves this?

  1. A tag applied to instances after they launch
  2. A monthly manual review of running instances
  3. An organization policy that denies launches from images not on an approved list Correct answer.
  4. A billing alert that fires when instance count rises

Explanation

A preventive organization policy evaluates launch requests and blocks any image outside the approved list, which enforces the standard at the moment of creation. Manual review, billing alerts, and post-launch tagging are detective or reactive and allow unapproved images to run.

Question 41Cloud Computing Fundamentals

Which statement correctly distinguishes horizontal scaling from vertical scaling?

  1. Horizontal scaling requires downtime, while vertical scaling never does
  2. Horizontal scaling adds more instances to a pool, while vertical scaling changes the size of one instance Correct answer.
  3. Horizontal scaling increases the CPU and memory of a single instance, while vertical scaling adds instances
  4. Horizontal scaling applies only to databases, while vertical scaling applies only to web servers

Explanation

Horizontal scaling, or scaling out, increases the count of identical instances behind a distribution layer. Vertical scaling, or scaling up, resizes a single instance. The other statements invert the definitions or impose restrictions that do not exist.

Question 42Cloud Computing Fundamentals

An application stores session state on the local disk of each web server. Users are randomly routed across several servers. What problem will users most likely experience?

  1. Network latency increases because sessions are replicated
  2. Sessions are lost or inconsistent when requests reach a different server Correct answer.
  3. The load balancer stops distributing traffic
  4. Storage costs rise because each server keeps a full copy

Explanation

Local session state ties a user to one server, so when the load balancer sends the next request elsewhere the new server has no matching session. The fix is to externalize sessions to a shared store or use sticky routing deliberately. The other options describe effects that do not follow from local session storage.

Question 43Cloud Computing Fundamentals

A company wants its encryption keys to remain under its own control while using a provider's managed storage. Which capability should it adopt?

  1. Customer-managed keys held in a key management service the customer administers Correct answer.
  2. Client-side compression before upload
  3. Server-side encryption with keys generated per object by the provider
  4. Provider-managed keys with default rotation

Explanation

Customer-managed keys let the organization control key material, rotation, and revocation through a key management service it administers, while the provider still stores the data. Provider-managed and per-object provider keys leave key custody with the provider, and compression does not address key control.

Question 44Cloud Computing Fundamentals

An architect must choose between two instance families for a CPU-bound batch job that runs nightly and can be interrupted. Which factor most strongly favors interruptible or spot capacity?

  1. The workload tolerates interruption and can checkpoint its progress Correct answer.
  2. The workload requires the lowest possible network latency
  3. The workload needs a guaranteed capacity reservation
  4. The workload must run continuously for the entire year

Explanation

Interruptible capacity is discounted because the provider may reclaim it, so it fits workloads that can checkpoint and resume. Continuous year-long operation and guaranteed reservations conflict with that reclaimable nature, and latency requirements are unrelated to the purchasing model.

Question 45Cloud Computing Fundamentals

A team wants to reduce the time to recover a database after corruption while keeping costs moderate. Which backup strategy best balances these goals?

  1. A manual full export taken once per quarter
  2. No backups, relying on storage durability alone
  3. Weekly snapshots stored only in the same zone as the database
  4. Automated daily snapshots plus continuous transaction log shipping to another zone Correct answer.

Explanation

Daily snapshots bound the recovery point, and continuous log shipping allows replay to a point just before corruption, shortening recovery time. Quarterly exports, no backups, and same-zone weekly snapshots all leave large recovery point or recovery time gaps.

Question 46Cloud Computing Fundamentals

An organization operates workloads in two public clouds and wants to avoid rewriting its application for each provider. Which approach best reduces switching cost?

  1. Package the application in containers and depend on portable open interfaces for storage and messaging Correct answer.
  2. Rely on provider-specific managed services for every tier
  3. Store data in a proprietary format unique to each provider
  4. Use each provider's proprietary serverless platform for all business logic

Explanation

Containers plus open, portable interfaces keep the application's dependencies abstract enough to move between providers. Proprietary serverless platforms, provider-specific managed services for every tier, and unique data formats each deepen dependence on one provider.

Question 47Cloud Computing Fundamentals

A service's monthly bill shows steady compute charges but unexpectedly high data transfer charges. Which analysis is most likely to explain this?

  1. The storage buckets have versioning enabled
  2. The identity provider is issuing too many short-lived tokens
  3. The instances are running an outdated operating system
  4. Large volumes of traffic are crossing regions or leaving the provider network Correct answer.

Explanation

Providers typically charge little or nothing for ingress but bill egress and cross-region or cross-zone transfer, so chatty architectures or public downloads can dominate cost. Operating system versions, bucket versioning, and token issuance affect other cost or security dimensions rather than egress volume.

Question 48Cloud Computing Fundamentals

A regulated workload requires that data be readable only inside a specific country, yet the provider replicates storage automatically. Which design decision most directly satisfies the requirement?

  1. Use a global content delivery network to cache the data
  2. Store data in the nearest region regardless of national borders
  3. Enable default multi-region replication and rely on encryption at rest
  4. Pin the workload and its replication to a region inside that country and disable cross-region replication Correct answer.

Explanation

Data residency is governed by where data is stored and replicated, so choosing an in-country region and preventing replication beyond it keeps copies within the jurisdiction. Encryption, proximity-based placement, and global caching can all move or expose data outside the required boundary.

Question 49Cloud Computing Fundamentals

A team observes that a single overloaded component causes cascading timeouts across an otherwise healthy system. Which pattern most directly limits this propagation?

  1. Removing health checks so failing nodes stay in rotation
  2. Increasing the retry count without limit on every call
  3. Circuit breakers with bounded timeouts and retries between components Correct answer.
  4. Co-locating all components on one large instance

Explanation

Circuit breakers stop calls to a failing dependency once errors cross a threshold, and bounded timeouts and retries prevent threads from piling up on slow calls. Unlimited retries amplify load, removing health checks keeps bad nodes serving traffic, and co-location enlarges the shared failure domain.

Question 50Cloud Computing Fundamentals

An auditor asks how the team can prove that a deleted storage object cannot be recovered by an attacker who later compromises an administrator account. Which control best supports this?

  1. Enabling versioning alone so deleted objects remain restorable
  2. Restricting console access to a single administrator
  3. Object lock or a retention policy that prevents deletion during the retention period, with deletion events logged Correct answer.
  4. Encrypting objects with a key the administrator also holds

Explanation

Immutability controls such as object lock or retention policies prevent deletion or alteration for a defined period even by privileged users, and audit logs record attempts. Versioning alone allows a privileged user to delete all versions, shared key custody leaves recovery possible, and a single administrator concentrates rather than removes risk.