I85PREP
⌘ K
Cloud+ study materials
Cloud+ study resources

Cloud+ practice questions

One question at a time. Build your Cloud+ understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud architecture

Which cloud service model gives the customer the most control over the guest operating system and installed runtime?

  1. PaaS
  2. SaaS
  3. FaaS
  4. IaaS Correct answer.

Explanation

In IaaS the provider manages physical infrastructure while the customer manages the OS, middleware, runtime, and applications. PaaS manages the OS and runtime, SaaS delivers a finished application, and FaaS runs event-driven functions on a managed runtime.

Question 2Cloud architecture

Which deployment model is owned and operated by a third-party provider and shared by multiple unrelated organizations?

  1. Public cloud Correct answer.
  2. Private cloud
  3. Hybrid cloud
  4. Community cloud

Explanation

Public cloud resources are pooled and shared across tenants while owned and operated by a provider. Private cloud is dedicated to one organization, community cloud serves specific organizations with shared concerns, and hybrid cloud combines models.

Question 3Cloud architecture

Which hypervisor type runs directly on the host hardware without a separate host operating system?

  1. Type 2 hosted hypervisor
  2. Container runtime
  3. Paravirtualized guest agent
  4. Type 1 bare-metal Correct answer.

Explanation

Type 1 bare-metal hypervisors install on hardware and manage guest VMs directly. Type 2 hypervisors run as applications atop a host OS, container runtimes share the host kernel and are not hypervisors, and a guest agent supports communication inside a VM.

Question 4Cloud architecture

Adding more vCPUs and memory to an existing virtual machine is an example of which scaling method?

  1. Vertical scaling Correct answer.
  2. Horizontal scaling
  3. Auto-scaling
  4. Diagonal scaling

Explanation

Vertical scaling, or scaling up, increases resources on a single instance. Horizontal scaling adds instances, auto-scaling automates adjustments but is not itself a direction, and diagonal scaling is not a standard cloud term.

Question 5Cloud architecture

Which storage type is designed for unstructured data accessed through HTTP APIs using unique object keys?

  1. File storage
  2. Object storage Correct answer.
  3. Block storage
  4. Archive tape

Explanation

Object storage stores data as objects with metadata and keys, accessed via HTTP APIs, and is well suited to images and backups. Block storage provides raw volumes, file storage provides shared hierarchical file systems, and tape is offline archive media.

Question 6Cloud architecture

What does an Availability Zone provide within a cloud region?

  1. An isolated fault domain with independent power Correct answer.
  2. An edge cache for static content
  3. A logical billing boundary
  4. A shared power, cooling, and networking domain

Explanation

Availability Zones are isolated locations with independent power, cooling, and networking, enabling fault tolerance across zones. A shared power domain is the opposite, edge caches are content delivery points, and billing boundaries are accounts or subscriptions.

Question 7Cloud architecture

In a serverless compute model, which party patches and maintains the underlying servers?

  1. The application developer
  2. A third-party managed service provider
  3. The cloud provider Correct answer.
  4. The customer's operations team

Explanation

Serverless shifts server provisioning, patching, and scaling to the provider. Customers focus on function code and configuration, while operations teams and developers do not access or patch the hosts.

Question 8Cloud architecture

Which statement describes a characteristic of SaaS?

  1. The customer manages the guest operating system and middleware
  2. Provider manages the application and infrastructure Correct answer.
  3. The provider manages only the physical network
  4. The customer manages the application code and runtime

Explanation

In SaaS the provider operates the application, runtime, OS, and infrastructure while the customer uses the service. Managing the guest OS or application code applies to IaaS or PaaS, and managing only the physical network is incomplete.

Question 9Cloud architecture

Under the shared responsibility model for IaaS, which task remains the customer's responsibility?

  1. Maintaining network hardware
  2. Patching the guest operating system Correct answer.
  3. Physical security of the data center
  4. Patching the hypervisor

Explanation

In IaaS the provider secures facilities, hardware, and the hypervisor, while the customer secures and patches the guest OS and everything above it. Physical security, hypervisor patching, and network hardware are provider duties.

Question 10Cloud architecture

What does a recovery point objective (RPO) define?

  1. The maximum tolerable outage duration for a service
  2. The elapsed time needed to restore from backup
  3. The maximum acceptable data loss in time Correct answer.
  4. The count of backup copies kept in retention

Explanation

RPO is the maximum age of data that can be lost, often expressed as time since the last recoverable copy. RTO is the maximum tolerable downtime, restore time relates to RTO, and retention count is a backup policy setting.

Question 11Cloud architecture

Which load-balancing algorithm sends each new request to the next server in sequence, cycling through the pool?

  1. Weighted random
  2. Least connections
  3. Source IP hash
  4. Round robin Correct answer.

Explanation

Round robin rotates through servers in order. Least connections sends to the server with the fewest active connections, source IP hash maps a client consistently, and weighted random selects probabilistically by weight.

Question 12Cloud architecture

How does a target-tracking auto-scaling policy work?

  1. It requires an administrator to approve each scaling event
  2. It scales based only on the number of deployed instances
  3. It adjusts capacity to hold a metric near a target Correct answer.
  4. It scales only at fixed calendar times

Explanation

Target tracking automatically adjusts capacity to keep a chosen metric near a target value. Scheduled scaling uses fixed times, manual approval is not target tracking, and scaling on instance count alone ignores demand metrics.

Question 13Cloud architecture

What is the primary purpose of a content delivery network (CDN)?

  1. Replacement of regional load balancers
  2. Database backup replication across regions
  3. Encryption of data at rest in cloud storage
  4. Edge caching of content nearer to users Correct answer.

Explanation

CDNs cache and serve content from edge points of presence to reduce latency and origin load. Encryption at rest is a storage or key management function, regional load balancers distribute within a region, and backup replication is a storage or DR function.

Question 14Cloud architecture

Which disaster recovery strategy typically offers the lowest recovery time objective (RTO) at the highest cost?

  1. Cold site
  2. Pilot light
  3. Hot site Correct answer.
  4. Warm site

Explanation

A hot site keeps a fully running duplicate environment ready, giving the lowest RTO but the highest cost. A cold site has infrastructure but no active data or services, a warm site is partially ready, and a pilot light keeps only core services running.

Question 15Cloud architecture

Which backup type copies only data changed since the last full or incremental backup and requires the last full plus all subsequent incremental backups to restore?

  1. Full backup
  2. Incremental backup Correct answer.
  3. Snapshot backup
  4. Differential backup

Explanation

Incremental backups capture changes since the last backup of any type, so restore requires the full plus every subsequent incremental. Differential backups capture changes since the last full, full backups copy all data, and snapshots are point-in-time images.

Question 16Cloud architecture

What makes a subnet public in a cloud virtual private cloud (VPC)?

  1. It uses private IP addresses
  2. It is located in a different region
  3. It routes outbound traffic through a NAT gateway
  4. Its route table points to an internet gateway Correct answer.

Explanation

A public subnet has a route to an internet gateway, and instances need public addresses for direct inbound or outbound internet access. Private IP use is common to all subnets, regions contain VPCs, and NAT gateways let private subnets reach outbound without being publicly reachable.

Question 17Cloud architecture

How do containers differ from virtual machines?

  1. Containers require a Type 1 hypervisor
  2. Containers emulate physical hardware
  3. Containers each run a full guest operating system
  4. Containers share the host kernel Correct answer.

Explanation

Containers package applications with dependencies and share the host operating system kernel, making them lightweight. Virtual machines each run a full guest OS on a hypervisor, and containers do not emulate hardware.

Question 18Cloud architecture

Which architecture decomposes an application into independently deployable services that communicate over APIs?

  1. Client-server architecture
  2. Layered architecture
  3. Microservices architecture Correct answer.
  4. Monolithic architecture

Explanation

Microservices split functionality into small services with independent deployment and API communication. A monolith is a single deployable unit, layered architecture organizes code logically, and client-server is a two-tier interaction model.

Question 19Cloud architecture

What is a primary role of an API gateway in a microservices architecture?

  1. Replacing the need for service discovery across all environments
  2. Storing relational data for every microservice in the system
  3. Compiling service source code into deployable container images
  4. Routing and authenticating requests at a single entry point Correct answer.

Explanation

An API gateway fronts services and handles routing, authentication, rate limiting, and protocol translation. It does not store relational data, image builds belong to CI/CD, and it may use service discovery rather than replace it.

Question 20Cloud architecture

Which connectivity option provides a private dedicated link from an on-premises data center to a cloud provider, bypassing the public internet?

  1. Client VPN
  2. Site-to-site VPN
  3. Dedicated interconnect Correct answer.
  4. NAT gateway

Explanation

A dedicated interconnect is a private physical circuit to the provider, offering consistent latency and bandwidth. A site-to-site VPN is encrypted over the internet, a client VPN connects individual users, and a NAT gateway translates addresses for outbound traffic.

Question 21Cloud architecture

What characterizes a canary deployment?

  1. A small traffic subset reaches the new version before full rollout Correct answer.
  2. All users are switched to the new version at the same moment
  3. The new version runs only in a disaster recovery region
  4. Two identical production environments are switched by DNS records automatically

Explanation

Canary releases send a limited percentage of traffic to the new version, monitor it, and then ramp up. Switching all users at once is a big-bang release, switching identical environments by DNS is blue-green, and running only in a DR region is not canary testing.

Question 22Cloud architecture

What is the core principle of immutable infrastructure?

  1. Instances are replaced with new builds rather than modified Correct answer.
  2. Configuration drift is corrected by manual changes on running hosts
  3. State is stored only on local instance disks for persistence
  4. Servers are patched in place throughout their entire operational lifetime

Explanation

Immutable infrastructure treats servers as disposable; changes create new images or instances. In-place patching and manual drift correction are mutable practices, and storing state locally conflicts with disposable instances.

Question 23Cloud architecture

How does a message queue improve communication between a producer and a consumer?

  1. It decouples the services and buffers messages during load spikes Correct answer.
  2. It eliminates the need for consumer authentication and authorization
  3. It guarantees the consumer processes every message synchronously
  4. It stores all messages permanently on the producer's local disk

Explanation

A queue lets producers publish without waiting for consumers, and consumers process at their own rate. This decouples availability and buffers bursts, enables asynchronous processing, and does not remove authentication or store messages on producer disk.

Question 24Cloud architecture

Which statement distinguishes fault tolerance from high availability?

  1. Fault tolerance is only multi-region active-active; high availability uses one server
  2. Fault tolerance provides continuous operation; high availability minimizes downtime Correct answer.
  3. Fault tolerance depends on nightly backups; high availability depends on DNS round robin
  4. High availability demands zero downtime; fault tolerance permits scheduled outages

Explanation

Fault tolerance masks component failures with redundancy so processing continues without interruption. High availability aims to minimize downtime, often through failover that may cause a brief gap. Backups and DNS are tools, not defining distinctions, and fault tolerance is not limited to multi-region designs.

Question 25Cloud architecture

Why is stateless application design important for horizontal scaling?

  1. It prevents the use of load balancers in the architecture
  2. Any instance can serve any request, so capacity can scale freely Correct answer.
  3. It guarantees strong data consistency across all databases
  4. All sessions must be stored on every local instance

Explanation

Stateless instances keep no client session data locally, so any instance can serve any request. A load balancer can distribute freely and instances can be added or removed without session loss. Storing sessions locally creates stickiness, and database consistency is handled separately.

Question 26Cloud architecture

What distinguishes a private cloud deployment model from a public cloud?

  1. Resources are always hosted by a hyperscale provider.
  2. Resources must run inside the customer's own building.
  3. Resources are dedicated to a single organization. Correct answer.
  4. Resources are shared by many unrelated tenants.

Explanation

A private cloud is provisioned for exclusive use by one organization, whether it is operated on-premises or by a third party on the organization's behalf. Exclusivity of use, not location or ownership, is the defining trait. Sharing among unrelated tenants is the hallmark of a public cloud.

Question 27Cloud architecture

Which action is an example of vertical scaling (scaling up)?

  1. Adding more web server instances behind a load balancer.
  2. Resizing a database server from 8 vCPUs to 32 vCPUs. Correct answer.
  3. Adding a read replica to distribute query traffic.
  4. Partitioning a table across multiple database nodes.

Explanation

Vertical scaling increases the capacity of a single resource, such as adding CPU, memory, or storage to one server. Adding instances, replicas, or partitions increases the number of units and is horizontal scaling.

Question 28Cloud architecture

What is the purpose of a bastion host in a cloud network?

  1. To distribute incoming requests across a pool of application servers.
  2. To cache static content at locations close to end users.
  3. To provide one controlled entry point for administrative access. Correct answer.
  4. To translate private IP addresses into public addresses for outbound traffic.

Explanation

A bastion host is a hardened, tightly controlled machine that administrators connect through to reach instances in private subnets. It reduces the number of publicly reachable entry points that must be secured and audited. Content caching, address translation, and request distribution are handled by other services.

Question 29Cloud architecture

Which storage type is designed to be attached as a boot volume to a cloud virtual machine?

  1. An archive tier intended for long-term retention.
  2. A managed relational database service.
  3. Object storage accessed through an HTTP API.
  4. Block storage presented as a virtual disk. Correct answer.

Explanation

Virtual machines boot from a disk device presented to the operating system, which is block storage. Block storage offers the low-latency, random-access reads and writes an operating system requires. Object storage and archive tiers are accessed through APIs and cannot serve as a boot device.

Question 30Cloud architecture

What is the main benefit of consistently tagging cloud resources?

  1. It encrypts data at rest within each resource.
  2. It enables cost allocation, automation, and ownership reporting. Correct answer.
  3. It guarantees that resources are deployed in multiple regions.
  4. It removes the need for identity and access management policies.

Explanation

Tags are key-value metadata that let teams attribute spend, drive automation, and identify owners. They do not change the security or placement of a resource. Encryption and access control are configured through separate mechanisms.

Question 31Cloud architecture

A company must keep customer data physically within a specific country. Which cloud design decision addresses this requirement most directly?

  1. Placing all workloads in a single availability zone.
  2. Deploying resources in a region located in that country. Correct answer.
  3. Enabling cross-region replication to every available region.
  4. Choosing a content delivery network with global points of presence.

Explanation

Data residency is satisfied by controlling where data is stored and processed, which is determined by region selection. Regions are geographic areas tied to specific jurisdictions. Availability zone choices and replication settings are separate concerns.

Question 32Cloud architecture

Which statement best describes a hybrid cloud?

  1. It relies solely on community-owned shared infrastructure.
  2. It runs entirely on infrastructure owned by a single provider.
  3. It uses two or more public cloud providers for the same workload.
  4. It connects private infrastructure with public cloud services. Correct answer.

Explanation

A hybrid cloud combines a private environment with public cloud services that interoperate, with data and workloads moving between them. The defining element is the connection between the two environments. Using several public providers is a different model.

Question 33Cloud architecture

Which concept describes a system automatically adding and removing resources to match current demand?

  1. Durability
  2. Elasticity Correct answer.
  3. Fault tolerance
  4. Loose coupling

Explanation

Elasticity is the ability to acquire and release capacity automatically as demand rises and falls. It differs from scalability, which is the ability to handle growth, because elasticity includes shrinking back down. Durability, loose coupling, and fault tolerance describe other qualities entirely.

Question 34Cloud architecture

In a platform as a service (PaaS) offering, which task is typically the provider's responsibility?

  1. Patching the runtime and underlying operating system. Correct answer.
  2. Writing, testing, and maintaining the application code.
  3. Managing user identities and permissions inside the application.
  4. Configuring application-specific environment variables and secrets.

Explanation

In PaaS the provider manages the platform layer, including the operating system, runtime, and middleware, plus the infrastructure beneath it. The customer remains responsible for the application, its configuration, and its data. Application code and its settings always stay with the customer.

Question 35Cloud architecture

A private subnet needs to download software updates from the internet while remaining unreachable from inbound internet traffic. What should be deployed?

  1. A virtual private network gateway connecting to the corporate data center.
  2. An internet gateway attached directly to the private subnet's route table.
  3. A NAT gateway in a public subnet, with the private route table pointing to it. Correct answer.
  4. A public IP address assigned to each instance in the private subnet.

Explanation

A NAT gateway lets instances in a private subnet initiate outbound connections while blocking unsolicited inbound connections. The private subnet's route table directs internet-bound traffic to the NAT gateway in a public subnet. Direct internet gateway routes or public IP addresses would make the instances reachable from the internet.

Question 36Cloud architecture

VPC A is peered with VPC B, and VPC B is peered with VPC C. Which statement about connectivity is correct?

  1. Peering requires all three VPCs to use identical CIDR ranges.
  2. Peering routes traffic over the public internet by default.
  3. VPC A cannot reach VPC C without additional peering or transit. Correct answer.
  4. Instances in VPC A can reach VPC C through VPC B without extra configuration.

Explanation

VPC peering is non-transitive: a peering between A and B plus one between B and C does not create a path from A to C. Reaching C requires a direct peering or a transit solution such as a hub network. Peering traffic also stays on the provider's private backbone.

Question 37Cloud architecture

A read-heavy application is overloading its primary database. Which change most directly offloads read traffic?

  1. Moving the application to a different region.
  2. Adding read replicas and routing SELECT queries to them. Correct answer.
  3. Enabling multi-factor authentication on the database.
  4. Increasing the size of the primary instance's storage volume.

Explanation

Read replicas maintain copies of the primary database and serve read queries, which removes that load from the primary. The primary then handles mostly writes. Storage size, authentication, and region placement do not distribute query load.

Question 38Cloud architecture

Why does an auto-scaling group use a cooldown period after launching an instance?

  1. To encrypt attached volumes while the instance boots.
  2. To send all traffic to one instance during a deployment.
  3. To let a new instance start before more scaling actions run. Correct answer.
  4. To reduce the number of availability zones the group uses.

Explanation

A new instance needs time to boot and begin serving traffic, and metrics that reflect its contribution arrive only after that. The cooldown pauses further scaling actions so the group does not over-provision based on stale data. Encryption, traffic routing, and zone placement are unrelated to cooldown.

Question 39Cloud architecture

A load balancer's health check marks a target as unhealthy. What is the expected behavior?

  1. The load balancer restarts the target's operating system.
  2. The load balancer deletes the target from the account.
  3. The load balancer stops routing new requests to that target. Correct answer.
  4. The load balancer forwards requests to the target twice as often.

Explanation

Health checks determine target eligibility for traffic. When a target fails its check, the load balancer removes it from rotation so requests go only to healthy targets. It resumes sending traffic once the target passes the check again.

Question 40Cloud architecture

An application stores session state only in the memory of each web server. Which load balancer feature keeps a user's requests on the same server?

  1. Health-check failover
  2. Connection draining
  3. Cross-zone load balancing
  4. Session affinity (sticky sessions) Correct answer.

Explanation

Session affinity binds a client to a specific backend for the life of the session, often through a cookie, so in-memory state remains usable. Without it, requests could land on a server that has no record of the user. The more scalable long-term fix is usually to externalize the session state.

Question 41Cloud architecture

Log files are read heavily for 30 days and rarely afterward but must be retained for seven years. Which approach is most cost-effective?

  1. Keep the logs on the fastest block storage for the full period.
  2. Delete the logs after 30 days and regenerate them on demand.
  3. Apply a lifecycle policy that transitions logs to colder tiers. Correct answer.
  4. Store the logs in a container registry with cross-region replication.

Explanation

Lifecycle policies move objects between storage tiers automatically as they age, matching cost to access frequency. Data that is rarely read belongs in infrequent-access or archive tiers rather than premium storage. Deletion is not viable when retention is mandated.

Question 42Cloud architecture

An order service must notify a billing service, an inventory service, and an email service without knowing how many subscribers exist. Which design fits best?

  1. Store the event in a block volume mounted by all three services.
  2. Have the order service call each downstream service directly in sequence.
  3. Publish each order event to a topic that all three services subscribe to. Correct answer.
  4. Write the order to a shared database that each service polls every second.

Explanation

A publish-subscribe topic decouples the producer from its consumers: the order service emits an event once and any current or future subscriber receives it. This supports adding consumers without changing the producer. Direct calls and polling create tight coupling, and a shared block volume is not a messaging mechanism.

Question 43Cloud architecture

A security group is described as stateful while a network ACL is stateless. What does this mean in practice?

  1. Both allow all traffic by default and can only be used to record packet logs for auditing.
  2. The security group evaluates rules for inbound traffic only, while the ACL evaluates outbound traffic only.
  3. Return traffic is allowed automatically by the security group but not by the ACL. Correct answer.
  4. The ACL applies to individual instances, while the security group applies to an entire subnet.

Explanation

A stateful filter remembers established connections, so the reply to an allowed request is permitted without a matching rule. A stateless filter evaluates every packet independently, so both directions need explicit rules. Security groups also attach to resource interfaces while ACLs attach to subnets.

Question 44Cloud architecture

A service calls a downstream API that has started timing out. Requests pile up and exhaust the caller's connection pool. Which pattern limits the damage?

  1. Sharding the caller's database to spread the load.
  2. Retry with exponential backoff on every failed call.
  3. A content delivery network placed in front of the downstream API.
  4. A circuit breaker that opens after an error threshold. Correct answer.

Explanation

A circuit breaker stops sending requests once failures exceed a threshold, failing fast and giving the downstream dependency room to recover. This prevents resource exhaustion in the caller while the dependency is degraded. Retries without a breaker amplify the load on an already failing service.

Question 45Cloud architecture

An architect spreads an application across three availability zones and uses small, independent cells per tenant group. What property is being improved?

  1. Limiting the blast radius of a failure Correct answer.
  2. Compliance with data residency rules
  3. Network throughput between tenants
  4. Data durability through additional copies

Explanation

Isolating workloads into independent failure domains keeps a fault in one zone or one tenant cell from affecting the others, which limits the blast radius. Availability zones protect against zone-level failures, and cells protect against localized application failures. The goal is containment rather than added copies or bandwidth.

Question 46Cloud architecture

Why can a Layer 4 load balancer not route requests based on URL path?

  1. It forwards packets using IP and port without inspecting HTTP content. Correct answer.
  2. It terminates TLS before forwarding, which removes the request headers.
  3. It can only balance traffic that uses the UDP transport protocol.
  4. It requires a separate DNS record for each application URL path.

Explanation

Layer 4 load balancers operate on transport-layer information such as source and destination IP and port, so the HTTP request line and headers are never examined. Path- and header-based routing requires a Layer 7 load balancer that understands the application protocol. TLS termination and DNS records are separate mechanisms.

Question 47Deployment

An organization runs its customer-facing web tier in a public cloud while keeping its patient-records database in its own data center. Which cloud deployment model does this describe?

  1. Hybrid cloud Correct answer.
  2. Community cloud
  3. Private cloud
  4. Public cloud

Explanation

A hybrid model combines two or more distinct deployment models, typically private infrastructure for sensitive workloads and public cloud for others, joined by secure connectivity. The workloads remain in the environments that best meet their cost, control, and compliance needs.

Question 48Deployment

A company moves an application from its data center to cloud virtual machines without changing the code or architecture. Which migration strategy is this?

  1. Refactor
  2. Rehost Correct answer.
  3. Replatform
  4. Repurchase

Explanation

Rehosting, often called lift-and-shift, moves a workload to cloud infrastructure with little or no modification to code or design. It is the fastest migration path but does not take full advantage of cloud-native features.

Question 49Deployment

What is the primary benefit of a blue-green deployment?

  1. It removes the need for a load balancer in front of the app.
  2. It removes the need for pre-release automated testing.
  3. It enables a fast switch back to the prior version. Correct answer.
  4. It halves the total infrastructure cost of the release.

Explanation

Blue-green keeps two identical environments and shifts traffic from the live one to the new one only after validation. Because the old environment is still intact, reverting is a matter of routing traffic back rather than redeploying.

Question 50Deployment

Which statement accurately describes infrastructure as code (IaC)?

  1. Servers are configured by hand following a written runbook.
  2. Infrastructure changes are made only through the provider's web console by an operator.
  3. Capacity is added by installing additional physical hardware.
  4. Infrastructure is defined in versioned code and provisioned repeatably. Correct answer.

Explanation

IaC stores infrastructure definitions in version-controlled files that a tool executes, so environments can be rebuilt identically and changes are reviewable. This removes manual configuration differences between environments.