I85PREP
⌘ K
HCIE-Cloud Service study materials
HCIE-Cloud Service study resources

HCIE-Cloud Service practice questions

One question at a time. Build your HCIE-Cloud Service understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Huawei Cloud platform and cloud services

On Huawei Cloud, which service is the primary Infrastructure-as-a-Service compute offering that lets you launch virtual machines with selectable flavors, images, and VPC networking?

  1. FunctionGraph
  2. Object Storage Service (OBS)
  3. Cloud Container Engine (CCE)
  4. Elastic Cloud Server (ECS) Correct answer.

Explanation

ECS is the core IaaS compute service: you choose a flavor (vCPU/memory), an image, and attach the instance to a VPC/subnet with security groups and EIPs. The other services are container orchestration, serverless functions, and object storage, which are different layers of the stack.

Question 2Huawei Cloud platform and cloud services

A team wants block storage that can be attached to ECS instances in the same availability zone and snapshotted for backup. Which Huawei Cloud service fits?

  1. Object Storage Service (OBS)
  2. Elastic Volume Service (EVS) Correct answer.
  3. Cloud Backup and Recovery (CBR) only
  4. Scalable File Service (SFS)

Explanation

EVS provides block-level volumes that attach to ECS in the same AZ and support snapshots. SFS is shared file storage over NFS/CIFS, OBS is object storage, and CBR is a backup service rather than primary block storage.

Question 3Huawei Cloud platform and cloud services

Which Huawei Cloud service provides a fully managed, distributed message queue used to decouple producers and consumers with high throughput?

  1. API Gateway
  2. Distributed Cache Service (DCS)
  3. Distributed Message Service (DMS) Correct answer.
  4. Cloud Eye (CES)

Explanation

DMS offers managed Kafka and RabbitMQ-style messaging for decoupling producers and consumers. DCS is an in-memory cache, API Gateway manages API exposure, and Cloud Eye is monitoring.

Question 4Huawei Cloud platform and cloud services

What is the purpose of a security group on Huawei Cloud?

  1. To define stateful, instance-level allow rules controlling inbound and outbound traffic Correct answer.
  2. To encrypt data at rest in OBS buckets
  3. To assign public IP addresses to subnets
  4. To route traffic between VPCs

Explanation

A security group is a stateful packet filter applied at the instance (ENI) level, with separate inbound and outbound rules referencing protocols, ports, and source/destination. Routing between VPCs is handled by peering or Enterprise Router, and public addressing by EIP/NAT.

Question 5Huawei Cloud platform and cloud services

Which Huawei Cloud service is designed for relational, fully managed databases such as MySQL, PostgreSQL, and SQL Server?

  1. Relational Database Service (RDS) Correct answer.
  2. MapReduce Service (MRS)
  3. Data Warehouse Service (DWS)
  4. GaussDB(for Redis)

Explanation

RDS is the managed relational database service supporting MySQL, PostgreSQL, and SQL Server engines with automated backup, failover, and scaling. DWS is an analytical data warehouse, MRS is big-data processing, and GaussDB(for Redis) is a key-value store.

Question 6Huawei Cloud platform and cloud services

Which statement best describes the Huawei Cloud shared responsibility model?

  1. Huawei Cloud secures the cloud infrastructure while the customer secures what they put in the cloud Correct answer.
  2. The customer is responsible for hypervisor patching
  3. The customer is responsible for physical data-center security
  4. Huawei Cloud is responsible for all customer data classification and access control

Explanation

Under the shared responsibility model, the provider secures the underlying infrastructure (physical facilities, hardware, virtualization) and the customer secures workloads, identities, data, and configurations they control. Responsibilities shift with service type, for example IaaS versus serverless.

Question 7Huawei Cloud platform and cloud services

An application must serve static website assets to global users with low latency and reduce origin load. Which Huawei Cloud service is the standard choice?

  1. Direct Connect
  2. VPN Gateway
  3. Cloud Connect
  4. Content Delivery Network (CDN) Correct answer.

Explanation

CDN caches content at edge nodes close to users, lowering latency and offloading the origin. Direct Connect, VPN Gateway, and Cloud Connect are all connectivity services between networks, not content caching.

Question 8Huawei Cloud platform and cloud services

Which Huawei Cloud identity feature lets you grant fine-grained, least-privilege permissions to users and groups across services?

  1. Cloud Eye dashboards
  2. Virtual Private Cloud
  3. Tag Management
  4. Identity and Access Management (IAM) policies Correct answer.

Explanation

IAM policies define which actions on which resources are allowed, and are attached to users, groups, or agencies to implement least privilege. VPC is networking, Cloud Eye is monitoring, and tags are for organization and cost allocation.

Question 9Huawei Cloud platform and cloud services

A workload must run containers without the team managing worker nodes, while still supporting Kubernetes APIs. Which Huawei Cloud service best matches this requirement?

  1. Elastic Cloud Server with manual kubeadm installation
  2. Cloud Container Engine (CCE) with managed node pools or CCE Autopilot Correct answer.
  3. FunctionGraph
  4. Bare Metal Server (BMS)

Explanation

CCE is Huawei Cloud's managed Kubernetes service; managed node pools and Autopilot reduce or remove node operations while preserving the Kubernetes API. BMS and ECS would require the team to operate the cluster, and FunctionGraph is event-driven serverless code, not a Kubernetes API.

Question 10Huawei Cloud platform and cloud services

You need ECS instances in a private subnet to download software patches from the internet without exposing them to inbound internet traffic. Which design is most appropriate?

  1. Use a NAT Gateway in the VPC for outbound internet access Correct answer.
  2. Assign an EIP to every ECS instance
  3. Attach all instances to a shared public subnet with a security group allowing all inbound
  4. Create a VPC peering connection to the internet

Explanation

A NAT Gateway lets instances in private subnets initiate outbound connections to the internet while preventing unsolicited inbound access. EIPs expose instances directly, opening all inbound is unsafe, and VPC peering does not connect to the public internet.

Question 11Huawei Cloud platform and cloud services

An ECS instance in AZ 1 needs to attach an existing EVS volume created in AZ 2. What is the correct expectation?

  1. The volume cannot be attached across AZs; a volume must be in the same AZ as the instance Correct answer.
  2. The volume attaches after enabling cross-AZ replication on the volume
  3. The volume attaches only if the instance has an EIP
  4. The volume attaches normally because EVS is regional

Explanation

EVS volumes are availability-zone scoped and can only attach to ECS instances in the same AZ. To move data across AZs you snapshot the volume and create a new volume in the target AZ. EIPs and replication settings do not change this attachment constraint.

Question 12Huawei Cloud platform and cloud services

A web tier must scale out automatically when average CPU utilization exceeds 70 percent for five minutes. Which Huawei Cloud capability implements this?

  1. Auto Scaling (AS) with a CPU-based scaling policy Correct answer.
  2. EVS snapshot schedule
  3. Cloud Eye alarm notifications only
  4. Elastic Load Balance health checks

Explanation

Auto Scaling groups can use Cloud Eye metrics such as CPU utilization as triggers for scaling policies, adding or removing instances to match demand. Cloud Eye alarms alone only notify, ELB health checks remove unhealthy backends, and snapshot schedules handle backups.

Question 13Huawei Cloud platform and cloud services

Which Huawei Cloud service provides a private, dedicated network connection between an on-premises data center and a VPC that bypasses the public internet?

  1. Elastic IP
  2. VPN Gateway
  3. NAT Gateway
  4. Direct Connect Correct answer.

Explanation

Direct Connect provisions a dedicated physical circuit into Huawei Cloud for predictable latency and bandwidth. VPN Gateway also connects on-premises but runs encrypted tunnels over the public internet, while EIP and NAT Gateway are public-addressing services.

Question 14Huawei Cloud platform and cloud services

What is the main difference between OBS and EVS on Huawei Cloud?

  1. Both are file systems mounted over NFS
  2. OBS is block storage and EVS is object storage
  3. OBS stores objects accessible via HTTP APIs and is regionally resilient, while EVS provides zonal block volumes attached to servers Correct answer.
  4. OBS can only be used by FunctionGraph

Explanation

OBS is massively scalable object storage accessed through REST/SDK APIs with region-level durability options. EVS is zonal block storage that appears as a disk to an ECS instance. SFS, not either of these, is the shared NFS/CIFS file service.

Question 15Huawei Cloud platform and cloud services

A team needs to run a managed Redis-compatible cache to reduce database load for a session store. Which Huawei Cloud service should they choose?

  1. Distributed Cache Service (DCS) Correct answer.
  2. Cloud Search Service (CSS)
  3. Relational Database Service (RDS)
  4. Data Warehouse Service (DWS)

Explanation

DCS offers managed Redis and Memcached-compatible instances suitable for caching and session storage with high throughput and low latency. RDS and DWS are disk-based databases, and CSS is a search engine service.

Question 16Huawei Cloud platform and cloud services

Which Huawei Cloud service centralizes metrics, logs, and alarms across ECS, RDS, and network resources?

  1. Identity and Access Management
  2. ConfigMap
  3. Log Tank Service only
  4. Cloud Eye (CES) Correct answer.

Explanation

Cloud Eye (CES) collects metrics and supports alarms and dashboards across many services, and it integrates with Log Tank Service for log management. IAM handles authorization, and ConfigMap is a Kubernetes object, not a cloud monitoring service.

Question 17Huawei Cloud platform and cloud services

An application running on ECS needs temporary, automatically rotated credentials to access an OBS bucket without embedding long-term access keys. Which approach is correct?

  1. Disable IAM and make the bucket public
  2. Share one IAM user's password among all developers
  3. Use IAM agencies (temporary security credentials) assumed by the ECS instance Correct answer.
  4. Store a permanent AK/SK in the application configuration file

Explanation

IAM agencies grant temporary credentials to cloud services and instances so workloads can obtain rotated tokens without embedding long-term keys. Hard-coded AK/SK, public buckets, and shared passwords all increase credential exposure and violate least privilege.

Question 18Huawei Cloud platform and cloud services

Which Huawei Cloud load-balancing option operates at Layer 7 and can route based on URL path or host header?

  1. NAT Gateway
  2. Virtual Private Network
  3. Elastic Load Balance in dedicated mode with an HTTP/HTTPS listener Correct answer.
  4. Direct Connect

Explanation

ELB supports Layer 7 HTTP/HTTPS listeners with forwarding policies based on domain, path, or headers, plus Layer 4 TCP/UDP listeners. NAT Gateway, Direct Connect, and VPN are connectivity services that do not perform application-layer routing.

Question 19Huawei Cloud platform and cloud services

A company wants a managed data warehouse for large-scale OLAP queries over terabytes of structured data. Which Huawei Cloud service is intended for this?

  1. RDS for MySQL
  2. Distributed Cache Service
  3. Scalable File Service
  4. Data Warehouse Service (DWS) Correct answer.

Explanation

DWS is a massively parallel processing (MPP) analytical warehouse designed for large OLAP scans and aggregations. RDS is for OLTP, DCS is a cache, and SFS provides shared file storage.

Question 20Huawei Cloud platform and cloud services

A solution architect must place a stateful database on ECS and guarantee that a single hardware failure does not take the database offline. Which design is most appropriate?

  1. A single ECS instance with a larger flavor
  2. A primary/standby deployment across availability zones with data replication Correct answer.
  3. An ECS instance with an EIP for failover
  4. One ECS instance with daily EVS snapshots

Explanation

Spreading primary and standby nodes across AZs removes the single point of failure for host or AZ incidents, and replication keeps data current. Snapshots help recovery but still involve downtime, and larger flavors or EIPs do not provide redundancy.

Question 21Huawei Cloud platform and cloud services

Traffic between two VPCs must stay on the private backbone, and overlapping CIDR blocks are present. Which approach addresses this?

  1. NAT Gateway, because it translates overlapping addresses
  2. An EIP on each instance to bypass the overlap
  3. VPC peering, because it supports overlapping CIDRs
  4. Enterprise Router with separate route domains, or re-IP one VPC, because peering rejects overlapping CIDRs Correct answer.

Explanation

VPC peering requires non-overlapping CIDR blocks. When overlaps exist, you either re-address one VPC or use Enterprise Router with isolated route domains or NAT to translate addresses. Public EIPs would expose traffic to the internet and not resolve the private routing problem.

Question 22Huawei Cloud platform and cloud services

A workload must survive the loss of an entire region. Which combination best meets this requirement?

  1. A single ECS instance with an EIP and daily backups
  2. Auto Scaling across AZs in the primary region
  3. Cross-region replication of data and standby resources in a second region, with DNS or GSLB failover Correct answer.
  4. Multi-AZ deployment within one region plus EVS snapshots

Explanation

Region-level disasters require a second region with replicated data and standby compute, plus a failover mechanism such as DNS or Global Server Load Balance. Multi-AZ and Auto Scaling protect against AZ or instance failures but remain inside the affected region.

Question 23Huawei Cloud platform and cloud services

An auditor asks how to prove that only approved administrators changed security-group rules. Which Huawei Cloud capability should be enabled?

  1. Cloud Eye metric alarms on security groups
  2. Cloud Trace Service (CTS) audit trails with long-term retention Correct answer.
  3. EVS snapshot policies
  4. OBS lifecycle rules on a log bucket

Explanation

CTS records management-plane API operations, including who changed security-group rules and when, and trails can deliver records to OBS for retention. Metric alarms, lifecycle rules, and snapshot policies do not provide an audit trail of configuration changes.

Question 24Huawei Cloud platform and cloud services

A batch job processes millions of objects in OBS and must minimize cost while tolerating retrieval latency of minutes. Which storage class strategy fits?

  1. Store objects on EVS volumes attached to ECS
  2. Store all objects in Standard and never transition them
  3. Enable CDN caching for the batch job
  4. Transition objects to an infrequent-access or archive class via OBS lifecycle rules after a defined age Correct answer.

Explanation

OBS lifecycle rules can move objects to infrequent-access or archive tiers based on age, trading retrieval latency for lower storage cost. Standard-only storage is more expensive, EVS is block storage unsuited to millions of objects, and CDN does not reduce object storage cost for a batch reader.

Question 25Huawei Cloud platform and cloud services

Which Huawei Cloud service provides managed API publishing, throttling, and access control for backend services?

  1. Cloud Container Engine
  2. API Gateway (APIG) Correct answer.
  3. Distributed Message Service
  4. Cloud Eye

Explanation

API Gateway publishes APIs, applies request throttling and authentication, and routes requests to backends. CCE runs containers, DMS handles messaging, and Cloud Eye monitors resources.

Question 26Huawei Cloud platform and cloud services

A Huawei Cloud VPC is created with CIDR block 192.168.0.0/16. A subnet inside it is created with CIDR block 192.168.1.0/24. Which statement about the relationship between the VPC and its subnets is correct?

  1. Subnets must use exactly the same CIDR block as the VPC.
  2. A VPC can contain only one subnet, whose size equals the VPC size.
  3. Each subnet's CIDR block must fall within the VPC CIDR block and must not overlap another subnet in the same VPC. Correct answer.
  4. Subnets may use any private CIDR block regardless of the VPC CIDR block.

Explanation

Subnets partition the VPC address space, so every subnet range must be contained in the VPC CIDR and must be disjoint from other subnets in that VPC. Overlapping subnet ranges would make routing within the VPC ambiguous.

Question 27Huawei Cloud platform and cloud services

An ECS instance must be reachable from the internet on port 443, and the security group currently has no inbound rules. What is the minimal change required?

  1. Add an inbound rule allowing TCP 443 from the required source range. Correct answer.
  2. Add an outbound rule allowing TCP 443 to 0.0.0.0/0.
  3. Disable the security group entirely so all traffic is permitted.
  4. Attach an EIP only, because an EIP automatically opens all ports.

Explanation

Security groups are stateful allow-lists, so inbound traffic on 443 needs an explicit inbound rule permitting TCP 443 from the intended source. Response traffic is then allowed automatically by the stateful behavior.

Question 28Huawei Cloud platform and cloud services

Which Huawei Cloud service is designed to deliver on-demand computing capacity as virtual machines with selectable flavors, images, and disks?

  1. IMS
  2. OBS
  3. VPC
  4. ECS Correct answer.

Explanation

Elastic Cloud Server (ECS) is the IaaS compute service that provisions virtual machines from flavors and images with attached disks. The other services provide storage, networking, or image management rather than running compute instances.

Question 29Huawei Cloud platform and cloud services

A team wants block storage that can be attached to an ECS instance and formatted with a file system for a transactional database. Which Huawei Cloud service fits?

  1. SFS
  2. OBS
  3. CDN
  4. EVS Correct answer.

Explanation

Elastic Volume Service provides block devices that attach to ECS instances and are formatted by the guest OS, which is what databases require. OBS is object storage and SFS is a shared file service, so neither provides a dedicated block device.

Question 30Huawei Cloud platform and cloud services

Which Huawei Cloud component resolves domain names to IP addresses for resources inside a VPC and can also forward queries to external DNS servers?

  1. ELB
  2. EIP
  3. NAT Gateway
  4. DNS (Cloud DNS) and the VPC DNS resolver Correct answer.

Explanation

Huawei Cloud DNS provides hosted zones and record sets, while the VPC resolver answers internal name queries and forwards external lookups. Address translation and load distribution are handled by other services.

Question 31Huawei Cloud platform and cloud services

An administrator wants a managed relational database with automated backups and failover, and does not want to patch the database engine manually. Which Huawei Cloud service should be chosen?

  1. DCS
  2. ECS with a self-installed database
  3. DWS
  4. RDS Correct answer.

Explanation

Relational Database Service is the managed offering that handles engine patching, backups, and high-availability failover for MySQL, PostgreSQL, and SQL Server. Self-managed databases on ECS and other data services do not provide that managed relational model.

Question 32Huawei Cloud platform and cloud services

Which statement accurately describes the purpose of an Elastic IP address on Huawei Cloud?

  1. It reserves a CIDR block for a new VPC.
  2. It assigns a private address inside a subnet.
  3. It provides a public IP that can be detached from one resource and rebound to another. Correct answer.
  4. It encrypts traffic between two VPCs.

Explanation

An EIP is a public IP address that is decoupled from a specific instance and can be reassociated, which supports failover and maintenance. Private addressing, encryption, and CIDR planning are handled by other features.

Question 33Huawei Cloud platform and cloud services

Which Huawei Cloud service provides a fully managed, Kafka-compatible message queue for decoupling producers and consumers?

  1. DMS Kafka Correct answer.
  2. FunctionGraph
  3. APIG
  4. SMN

Explanation

Distributed Message Service for Kafka offers a managed Kafka-compatible cluster for high-throughput publish/subscribe decoupling. SMN is notification-oriented, APIG is API management, and FunctionGraph is serverless compute.

Question 34Huawei Cloud platform and cloud services

A solutions architect is designing an application that must keep working if one availability zone fails. Which design choice best supports this goal?

  1. Deploy all ECS instances in a single AZ to reduce latency.
  2. Use a single ECS instance with a large flavor.
  3. Distribute instances and the database standby across at least two AZs in the same region. Correct answer.
  4. Place all resources in one subnet of one AZ and rely on snapshots.

Explanation

Spreading compute and database replicas across multiple AZs in one region removes a single point of failure at the data-center level. Snapshots and larger flavors do not provide continuous availability during an AZ outage.

Question 35Huawei Cloud platform and cloud services

An ECS instance must reach an OBS bucket over the internal network without traversing the internet. The bucket and instance are in the same region. What should the architect verify?

  1. That the instance resolves the OBS endpoint to the public internet address.
  2. That the bucket is configured as public-read.
  3. That the instance uses the region-specific OBS endpoint reachable over the cloud backbone and that security-group and network ACL rules permit it. Correct answer.
  4. That a VPN connection to the region is established.

Explanation

OBS exposes region-specific endpoints that are reachable over the internal backbone from resources in the same region, so using that endpoint plus correct filtering keeps traffic private. Public endpoints, VPNs, and public-read ACLs are unnecessary and weaken security.

Question 36Huawei Cloud platform and cloud services

A company needs to give a third-party auditor read-only access to a specific OBS bucket for 30 days without creating long-term credentials for the auditor's users. Which approach is most appropriate?

  1. Use a temporary security credential or pre-signed URL with a bounded validity period scoped to the bucket. Correct answer.
  2. Add the auditor to the admin group.
  3. Create an IAM user with permanent AK/SK and share the keys.
  4. Make the bucket public for 30 days.

Explanation

Temporary credentials and pre-signed URLs grant time-limited, scoped access without distributing permanent secrets. Permanent keys, public buckets, and admin membership all exceed the required scope or duration.

Question 37Huawei Cloud platform and cloud services

An application writes logs to OBS and older logs are rarely read but must be retained for seven years at minimum cost. Which storage class or lifecycle action best fits?

  1. Copy every object to a second bucket in the standard class.
  2. Store the logs on EVS volumes attached to a single ECS instance.
  3. Keep all objects in the standard storage class indefinitely.
  4. Transition objects to an archive storage class after a defined age using a lifecycle rule. Correct answer.

Explanation

Lifecycle rules can move aging objects to a lower-cost archive class while preserving durability for the retention period. Keeping everything in standard storage or duplicating it pays for performance the workload no longer needs.

Question 38Huawei Cloud platform and cloud services

A VPC contains a subnet 10.0.1.0/24 with an ECS instance at 10.0.1.10. A route table entry sends 0.0.0.0/0 to a NAT Gateway. What is the effect for outbound traffic from the instance?

  1. The instance's private IP is replaced permanently by the NAT address.
  2. Traffic is dropped because NAT Gateways only handle inbound flows.
  3. Traffic to the internet is translated to the NAT Gateway's EIP and the instance remains unreachable from inbound internet connections. Correct answer.
  4. The instance receives a public IP and becomes directly reachable from the internet.

Explanation

A NAT Gateway performs source NAT for outbound flows using its EIP, so responses return to the gateway and then to the instance. Because no inbound mapping exists, external hosts cannot initiate connections to the instance.

Question 39Huawei Cloud platform and cloud services

A team needs to run a containerized microservice that scales to zero when idle and is billed only for actual execution time. Which Huawei Cloud service best matches this requirement?

  1. ECS with a fixed flavor
  2. FunctionGraph Correct answer.
  3. CCE cluster with dedicated nodes
  4. BMS

Explanation

FunctionGraph is a serverless compute service that runs code on events and scales down when there is no traffic, with billing based on invocations and execution duration. Node-based container and server offerings keep capacity provisioned.

Question 40Huawei Cloud platform and cloud services

An architect must choose a load balancer for a gRPC service that requires very high throughput and low latency at Layer 4. Which Huawei Cloud ELB option is appropriate?

  1. A dedicated Layer 4 (TCP/UDP) load balancer Correct answer.
  2. A NAT Gateway
  3. A shared Layer 7 HTTP load balancer
  4. A CDN distribution

Explanation

Layer 4 load balancers forward TCP or UDP flows without inspecting application payloads, which suits high-throughput, low-latency protocols such as gRPC over TCP. Layer 7 balancers parse HTTP and add processing overhead, while CDN and NAT serve different purposes.

Question 41Huawei Cloud platform and cloud services

A customer wants to connect two VPCs in the same region so that instances communicate using private IP addresses, with no overlapping CIDR blocks. Which Huawei Cloud feature is intended for this?

  1. A VPN Gateway to the internet
  2. A VPC peering connection Correct answer.
  3. An EIP on each instance
  4. A CDN acceleration domain

Explanation

VPC peering establishes a private connection between two VPCs so that resources communicate over private addresses without traversing the internet. EIPs, internet VPNs, and CDNs either expose traffic publicly or do not provide VPC-to-VPC routing.

Question 42Huawei Cloud platform and cloud services

An organization wants a single place to view recommended security practices, detected risks, and compliance posture across its Huawei Cloud resources. Which service should be enabled?

  1. LTS
  2. CTS
  3. CES
  4. SecMaster Correct answer.

Explanation

SecMaster aggregates security posture management, threat detection, and compliance checks across cloud assets. CTS records API operations, CES collects metrics, and LTS centralizes logs, but none of them provides consolidated security posture assessment.

Question 43Huawei Cloud platform and cloud services

A batch workload runs on ECS instances that can be interrupted and restarted, and the team wants the lowest compute cost. Which purchasing option is most suitable?

  1. Pay-per-use instances
  2. Spot or bidding instances Correct answer.
  3. Reserved instances for one year
  4. Dedicated host instances

Explanation

Spot instances use spare capacity at a discount and can be reclaimed, which is acceptable for interruptible batch work. Reserved and dedicated options cost more and are intended for steady or isolation-sensitive workloads.

Question 44Huawei Cloud platform and cloud services

A security team must ensure that an OBS bucket can only be read by members of a specific IAM user group and by no one else, including anonymous users. Which configuration achieves this?

  1. A security group rule allowing port 443 inbound.
  2. An EIP attached to the bucket.
  3. Bucket ACL set to public-read with an IAM policy attached to the group.
  4. Bucket policy granting read to the group's identity and denying anonymous access, with public access blocked. Correct answer.

Explanation

A bucket policy scoped to the IAM group plus anonymous-access blocking enforces that only those identities can read the objects. Public ACLs, EIPs, and security groups do not control object-level authorization for OBS.

Question 45Huawei Cloud platform and cloud services

An application's ECS instances must be replaced automatically when the health check of a load balancer marks them unhealthy. Which combination implements this behavior?

  1. A single ECS instance with a manual restart script
  2. AS (Auto Scaling) group with a health-check policy bound to the ELB backend group Correct answer.
  3. An OBS lifecycle rule
  4. A VPC route table change

Explanation

An Auto Scaling group can use ELB health checks so that unhealthy instances are removed and replaced by new ones automatically. Manual scripts, object lifecycle rules, and route changes do not provide automated instance replacement.

Question 46Huawei Cloud platform and cloud services

A company must prove that a deleted EVS volume cannot be recovered by an attacker and that data remnants do not leak when the underlying storage is reused. Which Huawei Cloud capability addresses this concern?

  1. OBS versioning
  2. EVS encryption with customer-managed keys and secure deletion of volumes and snapshots Correct answer.
  3. Security-group egress rules
  4. ELB connection draining

Explanation

Encrypting volumes with customer-managed KMS keys protects data at rest, and deleting volumes and snapshots ensures the ciphertext is no longer retained. Versioning, egress rules, and connection draining do not address data remnants on block storage.

Question 47Huawei Cloud platform and cloud services

An enterprise runs a three-tier application across two VPCs connected by a peering connection. The database tier must accept traffic only from the application tier's subnet, and both VPCs use non-overlapping ranges. Which mechanism most directly enforces this at the instance level?

  1. A NAT Gateway in the database VPC
  2. A security group on the database instances that allows the database port only from the application subnet CIDR Correct answer.
  3. A CDN domain in front of the database
  4. An EIP on each database instance

Explanation

Security groups apply stateful, instance-level filtering, so restricting the database port to the application subnet CIDR enforces tier isolation precisely. NAT, EIPs, and CDNs either expose the database or do not restrict source ranges.

Question 48Huawei Cloud platform and cloud services

A team is designing a disaster recovery plan with an RPO of minutes and an RTO of under one hour for a stateful application. Which combination best meets these targets?

  1. Manual re-creation of all resources from documentation after an outage
  2. Cross-region asynchronous replication of the database plus pre-built infrastructure and automated failover runbooks Correct answer.
  3. A single-region deployment with weekly snapshots
  4. Nightly OBS backups restored manually after a failure

Explanation

Asynchronous cross-region replication keeps the replica close to the primary in time, satisfying a minutes-level RPO, while pre-built infrastructure and automated runbooks keep recovery within the RTO. Nightly or weekly backups and manual rebuilds cannot meet those targets.

Question 49Huawei Cloud platform and cloud services

An architect must allow an on-premises data center to reach several VPCs in the same region over a single private connection, while keeping each VPC's routing isolated. Which design is most appropriate?

  1. One VPC peering connection per VPC to the data center
  2. A separate EIP per VPC shared with the data center
  3. A public OBS bucket used as the transfer channel
  4. A Cloud Connect or VPN gateway attached to a transit hub, with each VPC connected and route tables controlling propagation Correct answer.

Explanation

A hub such as an Enterprise Router or transit VPC centralizes the private connection and uses per-VPC route tables to control which prefixes are exchanged, preserving isolation. Peering and EIP approaches either multiply connections or expose traffic publicly.

Question 50Huawei Cloud platform and cloud services

A platform team wants to enforce that no OBS bucket in the organization can be created without server-side encryption, across all accounts in the organization. Which Huawei Cloud mechanism is designed for this?

  1. A manual review performed quarterly
  2. An ELB listener rule
  3. An Organization service policy or SCP applied at the organization or account level Correct answer.
  4. A security group attached to each bucket

Explanation

Organizations service control policies set guardrails that apply across member accounts and can deny bucket creation without encryption. Security groups, periodic reviews, and load-balancer rules do not enforce preventive controls on OBS configuration.