I85PREP
⌘ K
HCIE-Cloud study materials
HCIE-Cloud study resources

HCIE-Cloud practice questions

One question at a time. Build your HCIE-Cloud understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Platform & Cloud Services

In Huawei Cloud Stack, which component is responsible for unified management of compute, storage, and network resources across multiple availability zones?

  1. Service OM
  2. ManageOne Correct answer.
  3. OceanStor DeviceManager
  4. FusionSphere OpenStack

Explanation

ManageOne is the operations and management plane of Huawei Cloud Stack and provides centralized, multi-AZ resource and tenant management. It sits above the resource pools and offers unified monitoring, provisioning, and self-service portals.

Question 2Cloud Platform & Cloud Services

A tenant needs an isolated virtual network segment inside Huawei Cloud Stack that can host subnets and be attached to a router. Which resource should be created first?

  1. A security group
  2. An elastic IP address
  3. A virtual private cloud Correct answer.
  4. A load balancer

Explanation

A virtual private cloud provides the isolated Layer 3 address space from which subnets are carved and to which routers and gateways attach. Security groups, EIPs, and load balancers are all applied on top of an existing VPC network.

Question 3Cloud Platform & Cloud Services

Which Huawei Cloud Stack service provides block-level storage that can be attached to and detached from an ECS instance on demand?

  1. Scalable File Service
  2. Cloud Backup and Recovery
  3. Elastic Volume Service Correct answer.
  4. Object Storage Service

Explanation

Elastic Volume Service delivers block devices that attach to a single ECS instance and can be resized or snapshotted independently. Object storage is accessed over HTTP APIs and file service offers shared NFS/CIFS semantics, so neither provides attachable block devices.

Question 4Cloud Platform & Cloud Services

An administrator wants an ECS instance to receive a fixed public address that survives instance stop and start operations. Which Huawei Cloud Stack capability should be used?

  1. A dynamic host configuration protocol lease
  2. An elastic IP address bound to the instance's private NIC Correct answer.
  3. A virtual router with source NAT
  4. A floating private address inside the subnet

Explanation

An elastic IP is a static public address allocated independently of the instance and bound to its private NIC, so it persists across stop and start cycles. Private addressing, DHCP leases, and SNAT do not supply a stable inbound public endpoint.

Question 5Cloud Platform & Cloud Services

Which statement correctly describes the relationship between a region and an availability zone in Huawei Cloud Stack?

  1. An availability zone must contain exactly one region with a single host aggregate.
  2. An availability zone spans multiple regions and shares one power domain.
  3. A region and an availability zone are synonyms for the same fault domain.
  4. A region contains one or more availability zones that are physically isolated from each other. Correct answer.

Explanation

A region is a geographic area containing multiple availability zones, and each AZ is a physically isolated fault domain with independent power and network. Deploying across AZs therefore protects workloads from a single-AZ failure.

Question 6Cloud Platform & Cloud Services

Which Huawei Cloud Stack service is designed to automatically adjust the number of ECS instances in a group based on monitored metrics?

  1. Distributed Message Service
  2. Auto Scaling Correct answer.
  3. Cloud Eye
  4. Identity and Access Management

Explanation

Auto Scaling creates and removes instances in a scaling group according to configured policies and scheduled or metric-based triggers. Cloud Eye only monitors and alarms, while IAM controls permissions and DMS handles messaging.

Question 7Cloud Platform & Cloud Services

A customer requires that object data stored in Huawei Cloud Stack be readable even after a single disk failure without application-level retry. Which OBS feature addresses this requirement?

  1. Multi-AZ redundancy Correct answer.
  2. Lifecycle transition to infrequent access
  3. Cross-origin resource sharing
  4. Bucket tagging

Explanation

Multi-AZ redundancy replicates object data across availability zones so that a single disk or AZ failure does not interrupt reads. Tagging, lifecycle rules, and CORS configuration affect classification, cost, and browser access rather than durability.

Question 8Cloud Platform & Cloud Services

Which IAM construct in Huawei Cloud Stack is used to grant a set of permissions to users within a single account?

  1. A virtual private cloud peering
  2. An access key pair
  3. A user group with attached policies Correct answer.
  4. A project quota

Explanation

A user group collects users and receives policies that define allowed actions, which is the standard way to manage permissions at scale. Access keys are credentials, quotas limit resource consumption, and peering connects networks.

Question 9Cloud Platform & Cloud Services

An application running on ECS instances in a private subnet must download patches from the internet, and the security team forbids assigning public addresses to those instances. Which design satisfies the requirement?

  1. Bind an elastic IP to every instance in the subnet.
  2. Create a NAT gateway in the VPC and route the subnet's default route to it. Correct answer.
  3. Attach a load balancer to the subnet and forward outbound traffic.
  4. Enable a security group rule that permits all outbound traffic.

Explanation

A NAT gateway provides source address translation so private instances can initiate outbound connections without owning public addresses. The subnet route table must point the default route at the NAT gateway for this to work.

Question 10Cloud Platform & Cloud Services

A database ECS instance requires storage that delivers the lowest latency for its redo logs. Which EVS disk type should be selected?

  1. Standard IO disk
  2. Ultra-high I/O disk Correct answer.
  3. Object storage bucket mounted over NFS
  4. High I/O disk

Explanation

Ultra-high I/O volumes are backed by high-performance media and deliver the lowest latency and highest IOPS among EVS types, which suits latency-sensitive redo logs. Standard and high I/O disks trade performance for cost, and object storage is unsuitable for database log writes.

Question 11Cloud Platform & Cloud Services

A web tier must remain available when one availability zone fails, and the instances must not all be replaced during a rolling update. Which combination achieves this?

  1. A scaling group spanning multiple AZs with a rolling upgrade policy Correct answer.
  2. A single instance with an elastic IP
  3. A dedicated host in a single AZ with local disks
  4. An anti-affinity group with all instances in one AZ

Explanation

Spreading a scaling group across AZs ensures capacity survives an AZ outage, and the rolling upgrade policy replaces instances in batches to preserve service. Anti-affinity within one AZ does not protect against AZ failure.

Question 12Cloud Platform & Cloud Services

An administrator must ensure that a security group allows inbound HTTPS but blocks all other inbound traffic while permitting all outbound traffic. Which rule set is correct?

  1. Inbound deny all, outbound allow TCP 443
  2. Inbound allow TCP 443 only, outbound allow all Correct answer.
  3. Inbound allow TCP 443, inbound deny all, outbound allow all
  4. Inbound allow TCP 443 and 80, outbound deny all

Explanation

Security groups are default-deny, so permitting only TCP 443 inbound already blocks everything else, and an outbound allow-all rule preserves egress. Adding an explicit deny is unnecessary and outbound restriction is not requested.

Question 13Cloud Platform & Cloud Services

A team needs shared storage that several ECS instances across different AZs can mount simultaneously for a content repository. Which service fits?

  1. Elastic Volume Service with a single volume attached to all instances
  2. Local disk on a dedicated host
  3. Object Storage Service accessed through a bucket policy
  4. Scalable File Service with an NFS share Correct answer.

Explanation

Scalable File Service provides a shared NFS or CIFS file system that multiple instances can mount concurrently, including across AZs within a region. A block volume cannot be safely multi-attached, while object storage uses API access rather than a mounted file system.

Question 14Cloud Platform & Cloud Services

A monitoring requirement states that an alarm must trigger when average CPU utilization across a scaling group exceeds 70 percent for five consecutive minutes. Which configuration element enforces the duration condition?

  1. The alarm period and consecutive occurrence count Correct answer.
  2. The instance flavor and vCPU count
  3. The scaling group maximum instance count
  4. The VPC subnet size

Explanation

Cloud Eye alarm rules combine a metric period with a consecutive occurrence count, so five consecutive one-minute periods above the threshold satisfy the condition. Instance count, flavor, and subnet size affect capacity but not alarm evaluation timing.

Question 15Cloud Platform & Cloud Services

A tenant wants to restore an ECS instance to a state captured before a failed application upgrade, with minimal recovery time. Which approach is most appropriate?

  1. Restore the instance from a full-ECS backup taken before the upgrade Correct answer.
  2. Reinstall the operating system and redeploy the application manually
  3. Detach and reattach the system disk
  4. Create a new VPC and migrate the instance

Explanation

A full-ECS backup captures the system and data disks together, so restoring it returns the instance to the pre-upgrade state quickly. Manual redeployment is slow and error-prone, and disk or network operations do not roll back application changes.

Question 16Cloud Platform & Cloud Services

Which Huawei Cloud Stack service should be used to place a shared, highly available relational database behind an application without managing the underlying ECS instances?

  1. Data Warehouse Service
  2. Distributed Cache Service
  3. Relational Database Service Correct answer.
  4. Cloud Container Engine

Explanation

Relational Database Service is a managed database offering that handles provisioning, patching, and high availability of the database engine. Cache, container, and warehouse services serve different workload types.

Question 17Cloud Platform & Cloud Services

A company needs to connect its on-premises data center to a VPC in Huawei Cloud Stack with predictable latency and without traversing the public internet. Which service should be used?

  1. VPC peering
  2. Elastic load balancing
  3. Direct Connect Correct answer.
  4. Virtual Private Network gateway over the internet

Explanation

Direct Connect provides a dedicated private link between the customer premises and the cloud, giving predictable latency and bypassing the public internet. A VPN still traverses the internet, and peering only connects VPCs within the cloud.

Question 18Cloud Platform & Cloud Services

An operator observes that a scaling group repeatedly adds and removes instances every few minutes as CPU hovers near the threshold. Which change best stabilizes the behavior?

  1. Switch the scaling policy to a scheduled policy only
  2. Increase the maximum instance count of the group
  3. Add a cooldown period and require consecutive threshold breaches Correct answer.
  4. Lower the alarm threshold and shorten the period

Explanation

A cooldown prevents further scaling actions immediately after one completes, and requiring consecutive breaches filters transient spikes, together damping oscillation. Lowering the threshold or shortening the period makes flapping worse.

Question 19Cloud Platform & Cloud Services

A tenant requires that only requests from a specific corporate CIDR block reach an ECS web server, while other internet clients are rejected. Which control point is most appropriate?

  1. A security group rule allowing the CIDR on port 443 Correct answer.
  2. An OBS bucket ACL
  3. A VPC route table entry pointing to the CIDR
  4. An IAM policy restricting the user's source IP

Explanation

Security group rules filter traffic by source CIDR and port at the instance's virtual NIC, which directly enforces the network-level restriction. IAM policies govern API permissions, route tables direct traffic, and bucket ACLs apply to object storage.

Question 20Cloud Platform & Cloud Services

A containerized microservice platform must provide self-healing, service discovery, and horizontal scaling of pods across nodes. Which Huawei Cloud Stack service meets this need?

  1. Relational Database Service
  2. Function Graph
  3. Bare Metal Server
  4. Cloud Container Engine Correct answer.

Explanation

Cloud Container Engine is a managed Kubernetes service that supplies self-healing, service discovery, and horizontal pod autoscaling across a node pool. Bare metal, serverless functions, and managed databases do not provide Kubernetes orchestration.

Question 21Cloud Platform & Cloud Services

An architect must design a two-tier application so that a failure of any single physical server does not take down both the web and database tiers. Which placement strategy is most sound?

  1. Use anti-affinity groups to separate tiers and spread instances across hosts and AZs Correct answer.
  2. Rely on snapshots taken every hour for availability
  3. Place all instances in one host aggregate to simplify management
  4. Place web and database instances on the same dedicated host for low latency

Explanation

Anti-affinity rules keep instances of different tiers on separate hosts, and spreading across AZs removes host and zone as single points of failure. Co-location or single-aggregate designs concentrate risk, and snapshots address recovery rather than availability.

Question 22Cloud Platform & Cloud Services

A tenant reports that instances in subnet A cannot reach instances in subnet B within the same VPC, although both subnets exist and security groups allow all traffic. Which cause should be investigated first?

  1. The DNS server is unreachable
  2. The OBS bucket policy denies access
  3. The elastic IP pool is exhausted
  4. The VPC lacks a router connecting the two subnets Correct answer.

Explanation

Subnets in a VPC communicate through the VPC router, so if the subnets are not associated with a common router their traffic has no Layer 3 path. Security groups are already permissive, and the other options affect unrelated services.

Question 23Cloud Platform & Cloud Services

A security review finds that an application's access keys are embedded in source code. Which remediation best follows least-privilege and credential-hygiene principles?

  1. Replace the keys with a permanent administrator account for simplicity
  2. Keep the keys but restrict source code repository access
  3. Encrypt the source file containing the keys with a password
  4. Rotate the keys and store them in a secrets manager with a narrowly scoped IAM policy Correct answer.

Explanation

Rotating compromised keys removes the exposure, and storing new credentials in a secrets manager with a minimal policy enforces least privilege. Repository restrictions or file encryption leave the long-lived secret recoverable.

Question 24Cloud Platform & Cloud Services

An application writes to OBS and the team wants older objects moved to a cheaper storage class after 90 days while retaining immediate access. Which mechanism should be configured?

  1. Cross-region replication of the bucket
  2. A versioning suspension on the bucket
  3. A bucket ACL granting public read
  4. A lifecycle rule transitioning objects to an infrequent access class Correct answer.

Explanation

Lifecycle rules automatically transition objects to a lower-cost class after a defined age while keeping them retrievable. ACLs, replication, and versioning affect access control, redundancy, and object history rather than storage tiering.

Question 25Cloud Platform & Cloud Services

A workload must survive the loss of an entire availability zone with a recovery point objective of near zero and a recovery time objective of minutes. Which design satisfies both objectives?

  1. A single instance with a scheduled restart policy
  2. Nightly backups to a bucket in the same AZ
  3. Weekly snapshots replicated to another region
  4. Synchronous replication to a standby site in another AZ with automated failover Correct answer.

Explanation

Synchronous replication keeps the standby site current so the recovery point is near zero, and automated failover brings it online within minutes. Backup and snapshot schemes leave a data gap and require manual recovery.

Question 26Cloud Platform & Cloud Services

In Huawei Cloud Stack, which component provides a unified management portal for provisioning compute, storage, and network resources across multiple resource pools?

  1. ManageOne Correct answer.
  2. OceanStor DeviceManager
  3. eSight
  4. FusionInsight Manager

Explanation

ManageOne is the operations and management platform in Huawei Cloud Stack, offering a self-service portal, service catalog, and multi-level tenant resource management across resource pools. The other tools address storage devices, big data clusters, or general network/IT element monitoring rather than cloud service provisioning.

Question 27Cloud Platform & Cloud Services

Which Huawei Cloud Stack networking service provides a logically isolated virtual network where tenants define subnets, route tables, and security groups?

  1. Direct Connect
  2. NAT Gateway
  3. ELB
  4. VPC Correct answer.

Explanation

A Virtual Private Cloud (VPC) is the tenant-scoped isolated network boundary inside which subnets, route tables, and security groups are defined. ELB distributes traffic, Direct Connect links on-premises networks, and NAT Gateway translates addresses for outbound access; none of them creates the isolated network itself.

Question 28Cloud Platform & Cloud Services

A tenant needs block storage for an ECS instance that must persist independently of the instance lifecycle and be attachable to another instance later. Which Huawei Cloud Stack service meets this requirement?

  1. OBS
  2. EVS Correct answer.
  3. CSBS
  4. SFS

Explanation

Elastic Volume Service provides block-level disks that exist independently of an ECS instance and can be detached and reattached. SFS is shared file storage, OBS is object storage, and CSBS provides backup rather than primary block devices.

Question 29Cloud Platform & Cloud Services

Which Huawei Cloud Stack service is the correct choice for storing unstructured files such as images and videos that are accessed over HTTP/HTTPS by many concurrent clients?

  1. SFS Turbo
  2. OBS Correct answer.
  3. EVS
  4. BMS

Explanation

Object Storage Service is designed for massively scalable, HTTP-accessible storage of unstructured objects such as media files. EVS is per-instance block storage, SFS Turbo is a high-performance shared file system for mounted workloads, and BMS is bare metal compute.

Question 30Cloud Platform & Cloud Services

In Huawei Cloud Stack IAM, which entity represents a person or application that authenticates and is granted permissions?

  1. Project
  2. Policy
  3. User Correct answer.
  4. Agency

Explanation

A user is the identity that authenticates with credentials and receives permissions. Policies are permission documents, projects are resource-isolation containers within an account, and agencies are delegation identities assumed by services or accounts rather than the primary human identity.

Question 31Cloud Platform & Cloud Services

Which Huawei Cloud Stack service provides managed monitoring of ECS CPU, memory, and disk metrics with configurable alarms?

  1. IAM
  2. LTS
  3. CTS
  4. CES Correct answer.

Explanation

Cloud Eye Service collects time-series metrics from cloud resources and evaluates alarm rules against them. CTS records API audit trails, LTS centralizes log data, and IAM handles identity and permissions.

Question 32Cloud Platform & Cloud Services

Which Huawei Cloud Stack capability lets an administrator automate the creation of a repeatable set of cloud resources, such as a VPC plus subnets plus ECS instances, from a declarative template?

  1. Resource Formation Service (RFS) Correct answer.
  2. Tag Management
  3. Auto Scaling
  4. Cloud Backup and Recovery

Explanation

Resource Formation Service provisions and manages groups of resources from declarative templates, enabling repeatable infrastructure deployment. Auto Scaling adjusts instance counts, CBR handles backups, and tag management organizes resources.

Question 33Cloud Platform & Cloud Services

What is the primary purpose of an Elastic IP address in Huawei Cloud Stack?

  1. To give a resource in a VPC a public address reachable from outside the VPC Correct answer.
  2. To balance inbound requests across multiple backend servers
  3. To encrypt traffic between two VPCs
  4. To reserve a fixed private address inside a subnet

Explanation

An EIP is a public IP that can be bound to an ECS instance, NAT Gateway, or load balancer to make it reachable from outside the VPC. Private addresses are allocated from subnets, load balancing is an ELB function, and inter-VPC encryption is handled by VPN or similar services.

Question 34Cloud Platform & Cloud Services

An application team wants to deploy a relational database in Huawei Cloud Stack without operating the underlying servers, and needs automated backups and failover. Which service should the architect select?

  1. RDS Correct answer.
  2. DCS
  3. ECS with a self-installed database
  4. DWS

Explanation

Relational Database Service delivers managed database engines with automated backup, patching, and high-availability failover, removing server administration. DCS is an in-memory cache service and DWS is a data warehouse, while self-managed ECS shifts operational responsibility to the tenant.

Question 35Cloud Platform & Cloud Services

A tenant must keep an ECS instance reachable at the same private IP address even after the instance is stopped and restarted. Which design satisfies this?

  1. Assign a static private IP from the subnet to the instance's primary NIC Correct answer.
  2. Place the instance behind an ELB and use the ELB address
  3. Bind an EIP and rely on it for private addressing
  4. Enable auto scaling for the instance

Explanation

Private addresses come from the subnet and can be assigned statically to a network interface so the address persists across stop/start cycles. EIPs are public addresses, ELB provides a virtual service address, and auto scaling changes instance membership rather than fixing an address.

Question 36Cloud Platform & Cloud Services

A security policy states that ECS instances in a production subnet must never have direct public IP addresses and may only be reached from the internet through a load balancer. Which configuration enforces this?

  1. Bind EIPs to all instances and restrict traffic with a security group
  2. Attach a NAT Gateway to the subnet and add a default route
  3. Do not bind EIPs to the instances and expose only the ELB listener Correct answer.
  4. Create a peering connection to another VPC

Explanation

Public reachability in a VPC requires an EIP or a public-facing service such as an ELB. Withholding EIPs from the instances and publishing only the ELB listener ensures inbound internet traffic terminates at the load balancer.

Question 37Cloud Platform & Cloud Services

An administrator needs to permit SSH (TCP 22) from a single management subnet to a group of ECS instances and deny all other inbound traffic. Which mechanism applies the rule at the instance NIC level?

  1. VPC route table entry pointing to the management subnet
  2. ELB health check configuration
  3. Network ACL applied to the entire VPC
  4. Security group rule with source set to the management subnet CIDR Correct answer.

Explanation

Security groups are stateful, instance-level virtual firewalls whose rules match on protocol, port, and source CIDR. Route tables direct traffic, network ACLs operate at subnet boundaries with broader scope, and health checks test backend availability rather than authorizing clients.

Question 38Cloud Platform & Cloud Services

A tenant wants read traffic to an RDS for MySQL instance offloaded to replicas while writes continue to the primary node. Which deployment should be chosen?

  1. Primary/standby RDS accessed only through the primary endpoint
  2. Primary/standby RDS with read replicas and a read/write splitting proxy address Correct answer.
  3. Single-node RDS with a larger instance flavor
  4. DCS Redis cluster with persistence enabled

Explanation

RDS supports read replicas plus a read/write splitting address that routes writes to the primary and reads to replicas. A single node offers no redundancy, using only the primary endpoint sends all reads to the primary, and DCS is a cache rather than the relational database.

Question 39Cloud Platform & Cloud Services

A company needs to place a shared, highly available file system that multiple Linux ECS instances can mount concurrently for a build artifact directory. Which service fits?

  1. EVS
  2. CSBS
  3. SFS Correct answer.
  4. OBS

Explanation

Scalable File Service provides NFS/CIFS file systems that many compute instances mount at the same time, which suits shared build directories. EVS volumes are typically attached to one instance, OBS is object-based via APIs, and CSBS is a backup service.

Question 40Cloud Platform & Cloud Services

An operator must ensure that deleting an ECS instance does not destroy the data disk attached to it. What should be configured?

  1. Enable deletion protection on the security group
  2. Attach the disk as the system disk
  3. Enable auto renewal on the instance
  4. Set the data disk to be retained when the instance is deleted Correct answer.

Explanation

EVS disks have a delete-with-instance attribute; clearing it keeps the data disk after the server is removed so it can be reattached. Auto renewal concerns billing, a system disk is tied to the boot image, and security-group protection is unrelated to disk lifecycle.

Question 41Cloud Platform & Cloud Services

A tenant requires that object data in OBS be protected against accidental overwrite or deletion for a fixed retention period, even by account administrators. Which feature provides this?

  1. WORM retention policy Correct answer.
  2. Bucket versioning alone
  3. Lifecycle transition to Archive
  4. Cross-region replication

Explanation

A WORM (write once, read many) retention policy locks objects for a defined period so they cannot be altered or removed, including by privileged users. Versioning preserves prior versions but still allows deletion, replication copies data elsewhere, and lifecycle rules move objects between storage classes.

Question 42Cloud Platform & Cloud Services

An administrator must audit who deleted a VPC last week. Which Huawei Cloud Stack service records these management-plane operations?

  1. LTS
  2. AOM
  3. CES
  4. CTS Correct answer.

Explanation

Cloud Trace Service records API calls on cloud resources, including the identity, time, and result, which supports auditing of configuration changes such as VPC deletion. CES handles metrics, LTS handles application and system logs, and AOM covers application operations.

Question 43Cloud Platform & Cloud Services

A workload in a private subnet must reach an external package repository over the internet, but the instances must not be directly addressable from the internet. Which configuration achieves this?

  1. Add an inbound security group rule allowing all traffic
  2. Bind an EIP to each instance
  3. Attach a NAT Gateway to the subnet and route 0.0.0.0/0 to it Correct answer.
  4. Create a VPC peering connection to the provider's VPC

Explanation

A NAT Gateway performs source address translation for outbound flows, letting private instances reach the internet without holding public addresses. EIPs make instances publicly reachable, peering requires a cooperating peer VPC, and inbound rules do not create outbound connectivity.

Question 44Cloud Platform & Cloud Services

A tenant's compliance team requires that access keys for an application running on ECS be rotated automatically and never stored in code. Which approach best meets this?

  1. Share a single long-term access key among all team members
  2. Store the access key in an environment variable on the instance
  3. Embed the access key in the container image
  4. Use an IAM agency attached to the ECS instance so temporary credentials are obtained from the metadata service Correct answer.

Explanation

An IAM agency grants permissions to the instance itself, and the instance obtains short-lived credentials from the metadata service, eliminating long-term keys in code. Environment variables, images, and shared keys all persist static secrets that must be manually rotated.

Question 45Cloud Platform & Cloud Services

A tenant wants a single alarm that fires when the average CPU utilization of all instances in an auto scaling group stays above 80 percent for five consecutive minutes. Which configuration is correct?

  1. Create a bandwidth alarm on the ELB
  2. Create a log alarm on the system log stream
  3. Create an alarm on the auto scaling group metric with a five-minute aggregation period and a threshold of 80 percent Correct answer.
  4. Create one alarm per instance with a one-minute period

Explanation

CES can monitor the scaling group as a monitored object, aggregating member metrics over the chosen period so a sustained breach triggers one alarm. Per-instance alarms multiply notifications, log alarms evaluate log content, and bandwidth alarms measure a different metric entirely.

Question 46Cloud Platform & Cloud Services

A two-tier application has web servers in one subnet and database servers in another within the same VPC. The database subnet must accept connections only from the web subnet. Which control is most precise?

  1. A NAT Gateway in the database subnet
  2. A route table entry in the database subnet pointing to the web subnet
  3. A security group rule on the database instances whose source is the web subnet CIDR and port is the database port Correct answer.
  4. An internet gateway attached to the VPC

Explanation

Security group rules match source CIDR and destination port, so allowing only the web subnet CIDR on the database port precisely limits access. Route tables control forwarding rather than authorization, an internet gateway enables public access, and a NAT Gateway affects outbound traffic.

Question 47Cloud Platform & Cloud Services

An architect must design a database tier that tolerates the failure of one availability zone with no manual intervention and no data loss for committed transactions. Which RDS deployment meets this?

  1. Primary/standby deployment with the standby node in a different availability zone and synchronous replication Correct answer.
  2. Primary/standby deployment with both nodes in the same availability zone
  3. Single-node deployment with daily automated backups
  4. Single-node deployment with a read replica in another availability zone

Explanation

Cross-AZ primary/standby with synchronous replication keeps a zero-loss copy and enables automatic failover when the primary AZ fails. Same-AZ standby shares the failure domain, single-node designs have no failover target, and an asynchronous read replica can lose recent commits.

Question 48Cloud Platform & Cloud Services

A tenant reports intermittent packet loss between two ECS instances in different subnets of the same VPC. Both security groups allow all traffic. Which area should be investigated first?

  1. The network ACLs associated with the two subnets Correct answer.
  2. The EIP bandwidth of the instances
  3. The OBS bucket policy
  4. The RDS parameter group

Explanation

With security groups permissive, the next stateful/stateless filtering layer is the network ACL applied at the subnet boundary, which can drop traffic in either direction. EIP bandwidth affects public traffic, bucket policies govern object storage, and parameter groups affect database behavior.

Question 49Cloud Platform & Cloud Services

A tenant needs a disaster recovery design in which the standby site can take over within minutes and the acceptable data loss is limited to a few seconds of transactions. Which combination is most appropriate?

  1. Asynchronous cross-region replication of storage and databases with automated DNS or ELB failover runbooks Correct answer.
  2. Synchronous replication to a standby site in the same city with manual switchover
  3. Nightly backups restored manually at the standby site
  4. A single-region deployment with three availability zones

Explanation

A few seconds of tolerable loss fits asynchronous cross-region replication, and minutes-scale takeover requires prebuilt failover automation for DNS or traffic management. Nightly backups cannot meet seconds of loss, a single region offers no regional DR, and same-city synchronous replication protects against local failure but not regional disaster.

Question 50Cloud Platform & Cloud Services

An enterprise plans a multi-tenant private cloud on Huawei Cloud Stack and must guarantee that each department's resource consumption is capped and separately billed. Which design element is essential?

  1. Create separate VDCs or projects per department with quotas and chargeback configured in ManageOne Correct answer.
  2. Place all departments in one project and rely on tags for billing
  3. Disable quotas so departments can burst freely
  4. Assign every user the administrator role to simplify operations

Explanation

ManageOne supports virtual data centers and projects as isolation and quota boundaries, with metering and chargeback per tenant. Tags alone do not enforce caps, broad administrator rights break least privilege, and removing quotas eliminates the consumption ceiling the requirement demands.