I85PREP
⌘ K
IBM Cloud Professional Architect v6 study materials
IBM Cloud Professional Architect v6 study resources

IBM Cloud Professional Architect v6 practice questions

One question at a time. Build your IBM Cloud Professional Architect v6 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Architecture Design

A solution architect is selecting a compute option on IBM Cloud for a stateless REST API that must scale to zero when idle and incur no charges during inactivity. Which IBM Cloud compute service best fits this requirement?

  1. IBM Cloud Virtual Servers for VPC
  2. IBM Cloud VMware Solutions
  3. IBM Cloud Code Engine Correct answer.
  4. IBM Cloud Bare Metal Servers

Explanation

Code Engine is a serverless platform that runs containerized apps and functions, scaling to zero when there is no traffic, so no compute charges accrue while idle. Virtual servers, bare metal, and VMware solutions all provision persistent hosts that bill whether or not requests arrive.

Question 2Cloud Architecture Design

Which IBM Cloud capability provides a single, consistent way to enforce network access policies across VPC resources, Kubernetes clusters, and classic infrastructure from a centralized console?

  1. IBM Cloud Flow Logs for VPC
  2. IBM Cloud Activity Tracker
  3. IBM Cloud Security and Compliance Center Correct answer.
  4. IBM Cloud Internet Services

Explanation

The Security and Compliance Center gives a centralized governance layer where you define and attach security and compliance controls across accounts and resource types. Activity Tracker records audit events, Flow Logs capture VPC traffic metadata, and CIS provides edge security and CDN, none of which centrally govern policy across resource families.

Question 3Cloud Architecture Design

An architect needs object storage for infrequently accessed backups where retrieval must be immediate but the per-gigabyte storage cost should be minimized. Which IBM Cloud Object Storage class is the appropriate choice?

  1. Smart Tier
  2. Vault
  3. Cold Vault Correct answer.
  4. Standard

Explanation

Cold Vault is designed for long-term, infrequently accessed data with lower storage cost while still allowing immediate retrieval, matching the backup requirement. Standard is for frequently accessed hot data, and Smart Tier automatically optimizes cost across access patterns rather than being chosen specifically for cold backups.

Question 4Cloud Architecture Design

Which IBM Cloud resource abstraction groups access to a service instance and is the recommended target for IAM access policies?

  1. Service ID
  2. API key
  3. Resource group Correct answer.
  4. Access group

Explanation

Resource groups organize service instances and are a standard scoping target for IAM policies so that permissions apply to everything inside the group. Access groups bundle identities, service IDs are non-human identities, and API keys are credentials, so none of them serve as a resource-scoping container.

Question 5Cloud Architecture Design

A workload requires a relational database with automatic scaling of storage, point-in-time recovery, and a choice of PostgreSQL or Db2 engines managed by IBM. Which service should the architect select?

  1. IBM Event Streams
  2. IBM Cloud Object Storage
  3. IBM Cloud Databases Correct answer.
  4. IBM Cloudant

Explanation

IBM Cloud Databases is the managed portfolio that offers PostgreSQL, Db2, and other engines with automated backups and scaling. Cloudant is a JSON document store, Object Storage is for objects, and Event Streams is a Kafka-based event platform, so none provide managed relational engines.

Question 6Cloud Architecture Design

An architect is designing a highly available three-tier application across multiple IBM Cloud availability zones. Which design decision best supports zone-level fault tolerance?

  1. Place the database in a single zone and replicate only the web tier
  2. Distribute application instances across zones and place a load balancer in front Correct answer.
  3. Deploy all tiers in one zone and rely on daily backups for recovery
  4. Deploy all tiers in one zone and use a larger instance profile for headroom

Explanation

Spreading instances across availability zones and fronting them with a load balancer lets traffic fail over when one zone is lost, which is the core of zone-level fault tolerance. Single-zone deployments, even with backups or larger profiles, still fail entirely if that zone becomes unavailable.

Question 7Cloud Architecture Design

Which IBM Cloud service provides a private, dedicated network connection from an on-premises data center to IBM Cloud without traversing the public internet?

  1. IBM Cloud VPN for VPC
  2. IBM Cloud Direct Link Correct answer.
  3. IBM Cloud Transit Gateway
  4. IBM Cloud Internet Services

Explanation

Direct Link establishes dedicated private connectivity between on-premises networks and IBM Cloud, avoiding the public internet. VPN for VPC also provides private tunnels but runs over the public internet, Transit Gateway connects IBM Cloud networks to each other, and CIS is an edge service.

Question 8Cloud Architecture Design

An application on IBM Cloud must publish events to a Kafka-compatible topic so multiple downstream consumers can process them independently. Which managed service should the architect choose?

  1. IBM Cloud Functions
  2. IBM MQ
  3. IBM API Connect
  4. IBM Event Streams Correct answer.

Explanation

Event Streams is IBM's managed Apache Kafka service, providing topics and consumer groups for event-driven fan-out. MQ is a traditional queue-based messaging system, API Connect manages APIs, and Cloud Functions executes code, so none provide Kafka topic semantics.

Question 9Cloud Architecture Design

A regulated client requires that data at rest in IBM Cloud Object Storage be encrypted with customer-managed keys and that key usage be auditable. Which architecture satisfies this requirement?

  1. Use IBM Key Protect or Hyper Protect Crypto Services to manage keys Correct answer.
  2. Rely on provider-managed encryption keys only
  3. Enable TLS on the bucket endpoint
  4. Store encryption keys in the same bucket as the data

Explanation

Key Protect and Hyper Protect Crypto Services provide customer-managed keys with audit trails of key usage, and Object Storage integrates with them for envelope encryption. Provider-managed keys remove customer control, TLS protects data in transit, and storing keys beside data defeats the purpose of key separation.

Question 10Cloud Architecture Design

An architect must connect several VPCs and a classic infrastructure network so they can route to each other centrally. Which IBM Cloud service is designed for this?

  1. IBM Cloud Transit Gateway Correct answer.
  2. IBM Cloud VPC load balancer
  3. IBM Cloud Direct Link
  4. IBM Cloud Security Groups

Explanation

Transit Gateway provides a central hub to interconnect VPCs and classic infrastructure with a single routing domain. Direct Link is for on-premises connectivity, load balancers distribute traffic to instances, and security groups filter traffic rather than route between networks.

Question 11Cloud Architecture Design

During a design review, an architect proposes using an IBM Cloud IAM trusted profile to let a Virtual Server instance call a Cloud Object Storage bucket without storing long-lived credentials. Why is this approach sound?

  1. Trusted profiles require a shared service ID password
  2. Trusted profiles bypass IAM policies for the instance
  3. Trusted profiles permanently store API keys in instance metadata
  4. Trusted profiles issue short-lived tokens based on the compute identity Correct answer.

Explanation

Trusted profiles bind an IAM identity to a compute resource so the instance obtains short-lived tokens tied to that identity, eliminating embedded long-lived credentials. They still honor IAM policies and do not rely on stored API keys or shared passwords.

Question 12Cloud Architecture Design

A web application experiences unpredictable traffic spikes and the architect wants automatic horizontal scaling based on CPU utilization. Which IBM Cloud capability provides this for Kubernetes workloads?

  1. VPC autoscale groups for virtual servers
  2. Cloud Internet Services caching rules
  3. Object Storage lifecycle policies
  4. Kubernetes Horizontal Pod Autoscaler with metrics Correct answer.

Explanation

The Horizontal Pod Autoscaler adjusts the number of pods based on observed metrics such as CPU, which suits unpredictable load on Kubernetes. VPC autoscale groups scale virtual servers rather than pods, CIS caching reduces origin load but does not scale pods, and lifecycle policies manage object retention.

Question 13Cloud Architecture Design

An architect needs a managed message queue that guarantees exactly-once processing semantics for financial transactions across distributed services. Which design consideration is most accurate?

  1. Exactly-once requires idempotent consumers or transactional messaging support Correct answer.
  2. Exactly-once only applies to file transfers
  3. Exactly-once is impossible with Kafka-based systems
  4. Exactly-once is guaranteed by any queue without configuration

Explanation

Achieving exactly-once behavior generally requires either transactional messaging support or idempotent consumers that safely discard duplicates, because delivery guarantees alone do not prevent reprocessing. No queue provides exactly-once for free, and Kafka-based systems can support it with transactions.

Question 14Cloud Architecture Design

A client wants to expose an internal REST service to external partners with rate limiting, OAuth token validation, and usage analytics. Which IBM Cloud service should anchor the architecture?

  1. IBM Cloud Internet Services
  2. IBM Cloud App ID
  3. IBM API Connect Correct answer.
  4. IBM Cloud Code Engine

Explanation

API Connect provides API gateway capabilities including rate limiting, OAuth security enforcement, and analytics, making it the right anchor for partner-facing APIs. CIS is an edge security and CDN service, Code Engine runs workloads, and App ID handles authentication for applications rather than full API management.

Question 15Cloud Architecture Design

An architect is choosing between IBM Cloud VPC and classic infrastructure for a new greenfield deployment that requires software-defined networking and security groups. Which statement is the strongest justification for VPC?

  1. VPC provides native security groups and subnets with software-defined networking Correct answer.
  2. VPC is the only option that supports bare metal servers
  3. VPC does not support private connectivity to on-premises
  4. VPC removes the need for load balancers

Explanation

VPC is built on software-defined networking with subnets, security groups, and network ACLs, which matches the greenfield requirement. Classic infrastructure also offers bare metal and load balancers, and VPC supports private connectivity through Direct Link and VPN.

Question 16Cloud Architecture Design

A disaster recovery plan specifies a recovery point objective of five minutes for a transactional database. Which architectural approach best meets this RPO?

  1. Manual failover with quarterly drills
  2. Weekly snapshot exports to object storage
  3. Nightly full backups shipped to another region
  4. Continuous cross-region replication of the database Correct answer.

Explanation

Continuous cross-region replication keeps a secondary copy within minutes of the primary, satisfying a five-minute RPO. Nightly and weekly backups leave hours or days of potential data loss, and manual failover affects recovery time rather than the recovery point.

Question 17Cloud Architecture Design

An architect must ensure that a multi-tenant SaaS application isolates tenant data in a shared database while keeping operational costs low. Which approach is most appropriate?

  1. Shared schema with tenant identifier and row-level security Correct answer.
  2. Separate region per tenant
  3. Separate database instance per tenant
  4. Dedicated bare metal server per tenant

Explanation

A shared schema with a tenant identifier and row-level security provides logical isolation at low operational cost, which fits a cost-sensitive multi-tenant design. Separate instances, regions, or servers per tenant provide stronger isolation but multiply cost and management overhead.

Question 18Cloud Architecture Design

A solution requires predictable sub-millisecond latency for a caching layer shared by many application instances. Which IBM Cloud service should the architect select?

  1. IBM Cloud Databases for Redis Correct answer.
  2. IBM Cloud Block Storage
  3. IBM Cloudant
  4. IBM Cloud Object Storage

Explanation

Databases for Redis is an in-memory data store that delivers the low-latency caching and shared access across instances that the requirement demands. Object Storage and Block Storage are persistent storage with higher latency, and Cloudant is a document database not optimized as a shared cache.

Question 19Cloud Architecture Design

An architect wants to enforce that no Cloud Object Storage bucket can be created without a specific tag across all accounts in an IBM Cloud enterprise. Which mechanism is appropriate?

  1. Security and Compliance Center controls with enforcement Correct answer.
  2. IAM access policies on each user
  3. VPC network ACLs
  4. Activity Tracker alerts

Explanation

Security and Compliance Center lets you define controls and enforce them across accounts, including rules that require tags on resources. IAM policies govern who can act, Activity Tracker records events, and network ACLs filter traffic, so none enforce tagging requirements.

Question 20Cloud Architecture Design

A global application must serve static assets with low latency to users on multiple continents while protecting against DDoS attacks. Which IBM Cloud service is the best fit?

  1. IBM Cloud Internet Services Correct answer.
  2. IBM Cloud VPN for VPC
  3. IBM Cloud Transit Gateway
  4. IBM Cloud Direct Link

Explanation

Cloud Internet Services provides a global CDN for low-latency static content delivery along with DDoS protection and WAF at the edge. Direct Link and VPN are connectivity services, and Transit Gateway routes between IBM Cloud networks, so none deliver edge caching and DDoS mitigation.

Question 21Cloud Architecture Design

An architect is evaluating IBM Cloud Hyper Protect Crypto Services for a workload requiring the highest level of key protection. Which property distinguishes it from Key Protect?

  1. It stores keys only in object storage
  2. It offers FIPS 140-2 Level 4 certified hardware security modules Correct answer.
  3. It only supports symmetric keys
  4. It removes the need for IAM policies

Explanation

Hyper Protect Crypto Services is built on FIPS 140-2 Level 4 certified HSMs with dedicated crypto units, exceeding the Level 3 assurance typical of Key Protect. It still requires IAM policies, supports both key types, and does not store keys in object storage.

Question 22Cloud Architecture Design

A team needs to migrate a stateful legacy application to IBM Cloud with minimal refactoring but still wants managed infrastructure patching. Which approach best balances these goals?

  1. Lift and shift onto managed VMware Solutions or VPC virtual servers with patching automation Correct answer.
  2. Rewrite the application as serverless functions
  3. Replace the application with an API gateway
  4. Move the application to Object Storage

Explanation

Lifting the application onto managed infrastructure such as VMware Solutions or VPC virtual servers preserves the application while shifting patching to automation, balancing minimal refactoring with managed operations. Rewriting as serverless is a large refactor, and Object Storage or an API gateway cannot host a stateful application.

Question 23Cloud Architecture Design

An architect must design a solution where an on-premises mainframe publishes transactions to IBM Cloud, and consumers must process each transaction in order per account. Which combination best satisfies this?

  1. Direct Link for connectivity plus Event Streams with a partition key on account ID Correct answer.
  2. VPN for VPC plus Object Storage lifecycle policies
  3. Internet Services plus API Connect rate limits
  4. Transit Gateway plus Cloudant indexes

Explanation

Direct Link provides private, reliable connectivity from the mainframe, and Event Streams preserves ordering within a partition, so keying by account ID keeps each account's transactions ordered. The other combinations lack either private connectivity or per-key ordering guarantees.

Question 24Cloud Architecture Design

A client requires that a workload continue operating in a second IBM Cloud region with an RTO of 15 minutes and automated failover. Which design element is most critical?

  1. A warm standby region with replicated data and automated DNS or global traffic failover Correct answer.
  2. A single region with larger instances
  3. Manual runbooks executed by on-call staff
  4. Cold backups stored in the same region

Explanation

A warm standby in a second region with replicated data and automated traffic failover can achieve a 15-minute RTO without human intervention. Single-region designs fail entirely, same-region backups are lost with the region, and manual runbooks depend on staff availability and exceed the RTO.

Question 25Cloud Architecture Design

An architect must design least-privilege access for a CI/CD pipeline that deploys to multiple resource groups. Which IAM design is most appropriate?

  1. Grant the pipeline a service ID with policies scoped to specific resource groups and services Correct answer.
  2. Use a shared human user account with broad permissions
  3. Assign the pipeline an administrator API key for the entire account
  4. Embed personal user credentials in pipeline scripts

Explanation

A service ID with narrowly scoped policies across the required resource groups and services enforces least privilege for automation. Account-wide administrator keys, shared human accounts, and embedded personal credentials all grant excessive or untraceable access.

Question 26Cloud Architecture Design

An architect is documenting how IBM Cloud IAM authorization decisions are structured. Which statement correctly describes the relationship between subjects, roles, and resources in IBM Cloud IAM policy evaluation?

  1. A policy binds a subject to a role on a target resource, and the role is expanded into a set of actions evaluated against the resource type. Correct answer.
  2. A policy binds a subject to an access group, and the access group inherits the platform roles of every service ID in the account.
  3. A policy binds a resource to a role, and any subject that can read the resource automatically receives the role's actions.
  4. A policy binds a subject to an action list, and the action list is mapped to resources by the resource group name only.

Explanation

IBM Cloud IAM policies have three core parts: a subject (user, service ID, or access group), a role, and a target resource (account, resource group, or specific service instance). The role is defined per service and expands into the concrete actions that can be performed, so authorization is the intersection of subject, role, and resource scope.

Question 27Cloud Architecture Design

A workload must run containers on IBM Cloud with the least operational overhead while remaining portable to other Kubernetes distributions. Which IBM Cloud offering best satisfies this requirement?

  1. IBM Cloud Code Engine, because it abstracts Kubernetes entirely and exposes only a build-and-run function model.
  2. IBM Cloud VPC virtual server instances running a self-managed kubeadm cluster on Ubuntu.
  3. IBM Cloud Foundry, because it runs buildpacks on a shared Kubernetes cluster managed by IBM.
  4. IBM Cloud Kubernetes Service, because it delivers a managed Kubernetes control plane with worker nodes the team operates. Correct answer.

Explanation

IBM Cloud Kubernetes Service provides a managed Kubernetes control plane while keeping the cluster API standard, so manifests and tooling remain portable to other conformant Kubernetes distributions. The team still manages worker node configuration and workloads, which is the expected trade-off for portability.

Question 28Cloud Architecture Design

An architect is designing a VPC with three subnets across three zones. Which statement about IBM Cloud VPC routing and security constructs is accurate?

  1. Both security groups and network ACLs are stateful and are evaluated only on inbound traffic to the VPC.
  2. Security groups are stateful and attach to network interfaces, while network ACLs are stateless and attach to subnets. Correct answer.
  3. A network ACL applies statefully to a single virtual server instance, while security groups apply statelessly to a subnet.
  4. Security groups are stateless and attach to subnets, while network ACLs are stateful and attach to individual floating IPs.

Explanation

In IBM Cloud VPC, security groups are stateful filters bound to network interfaces, so return traffic for an allowed flow is automatically permitted. Network ACLs are stateless filters bound to subnets, so both inbound and outbound rules must be defined explicitly for each direction.

Question 29Cloud Architecture Design

A client wants a single pane of glass to observe logs, metrics, and traces from workloads running in IBM Cloud and on-premises. Which IBM Cloud capability should the architect propose as the central aggregation layer?

  1. IBM Cloud Monitoring alone, because it stores metrics and also ingests structured application log lines.
  2. IBM Cloud Flow Logs for VPC, because it records every packet accepted or rejected by a network interface.
  3. IBM Cloud Activity Tracker Event Routing, because it captures platform audit events for account-level actions.
  4. IBM Cloud Logs, because it provides a managed observability pipeline for logs, metrics, and traces with routing to destinations. Correct answer.

Explanation

IBM Cloud Logs is the managed observability service that ingests and routes logs, metrics, and traces from cloud and hybrid sources to a central destination. It is designed as the aggregation tier rather than a single-signal tool.

Question 30Cloud Architecture Design

An architect must give a batch job running on IBM Cloud Code Engine read-only access to one Object Storage bucket without storing long-lived credentials. Which design is most appropriate?

  1. Grant the account Owner role to a service ID and pass its key to the job through an environment variable.
  2. Create a service ID API key, store it as a Code Engine secret, and rotate it every 90 days.
  3. Create a trusted profile scoped to the Code Engine project and grant it a Reader policy on the specific bucket. Correct answer.
  4. Embed a user's personal IBM Cloud API key in the container image so the job can call the Object Storage API.

Explanation

A trusted profile lets a compute identity such as a Code Engine project obtain short-lived IAM tokens through compute resource tokens, so no long-lived secret is stored in the workload. Scoping the profile's policy to the single bucket enforces least privilege.

Question 31Cloud Architecture Design

A solution requires a managed relational database on IBM Cloud that must survive the loss of an entire availability zone within a region with automatic failover and no application changes. Which design decision should the architect make?

  1. Deploy PostgreSQL on a single virtual server instance with a floating IP that is reassigned on failure.
  2. Deploy a single-instance PostgreSQL deployment and add a read replica in the same zone to absorb failover.
  3. Deploy IBM Cloud Databases for PostgreSQL with an HA deployment that places a standby member in a different zone of the same region. Correct answer.
  4. Deploy a single-instance PostgreSQL deployment and rely on nightly logical backups restored into a new instance.

Explanation

An HA deployment of IBM Cloud Databases for PostgreSQL provisions a standby member in a separate zone, and the managed service promotes it automatically when the primary zone fails. The connection endpoint remains stable, so applications need no changes.

Question 32Cloud Architecture Design

An architect must let workloads in two separate VPCs in the same region communicate privately without traversing the public internet and without a transit gateway. Which IBM Cloud capability fits?

  1. A VPC connection between the two VPCs, which establishes private connectivity between their address spaces. Correct answer.
  2. A public floating IP on each virtual server instance with security group rules allowing the peer CIDR.
  3. A VPC routing table entry pointing each VPC's CIDR to the other VPC's default gateway.
  4. A classic infrastructure VLAN that is attached to both VPCs through a gateway appliance.

Explanation

IBM Cloud VPC supports direct VPC connections that join two VPCs privately within the account, avoiding public exposure and the cost of a transit gateway for simple two-VPC topologies. Routes are created automatically for the connected address prefixes.

Question 33Cloud Architecture Design

A client needs a managed secrets store for application credentials with automatic rotation of database credentials and auditability of secret access. Which IBM Cloud service should the architect select?

  1. IBM Cloud Object Storage with bucket-level IAM policies, because object versioning provides secret rotation.
  2. IBM Cloud Hyper Protect Crypto Services, because it exposes a secrets engine for application credentials.
  3. IBM Cloud Key Protect, because it stores arbitrary secrets in a standard key ring alongside root keys.
  4. IBM Cloud Secrets Manager, because it stores secrets centrally, supports rotation, and records access through Activity Tracker. Correct answer.

Explanation

Secrets Manager is the purpose-built service for storing and retrieving application secrets, with support for rotation and integration with Activity Tracker for auditing access. Key management services are designed for cryptographic keys rather than general secret storage.

Question 34Cloud Architecture Design

An architect is designing a multi-account landing zone on IBM Cloud. Which combination best isolates environments while keeping centralized governance?

  1. A single account with a single resource group, relying on tags to distinguish production from development.
  2. One account containing all environments, separated by resource groups with per-environment IAM policies.
  3. Separate accounts per environment, linked to a central enterprise account through account groups and centralized IAM and billing. Correct answer.
  4. One account per developer, with production resources placed in the developer's default resource group.

Explanation

An enterprise account hierarchy with account groups provides hard isolation boundaries between environments while enabling centralized IAM, billing, and policy enforcement from the parent. This is the recommended pattern for governed landing zones.

Question 35Cloud Architecture Design

An architect must design a network in IBM Cloud VPC where a load balancer accepts public traffic while application servers have no public IP addresses. Which configuration achieves this?

  1. Attach a public floating IP to each application server and use a security group that allows only the load balancer's private IP.
  2. Place the load balancer and the application servers in a public subnet and use network ACLs to block inbound traffic to the servers.
  3. Use a public gateway on the private subnet so the application servers can accept inbound connections from the internet.
  4. Place the application servers in private subnets and use an application load balancer in public subnets that forwards to the private subnet. Correct answer.

Explanation

A public application load balancer in public subnets can forward traffic to backend pool members in private subnets, so the servers need no public addresses. This keeps the attack surface limited to the load balancer.

Question 36Cloud Architecture Design

A team wants to deploy a containerized application to IBM Cloud with automatic scaling to zero when idle, while retaining the ability to run the same image on Kubernetes elsewhere. Which approach best meets both goals?

  1. Deploy the image to IBM Cloud Kubernetes Service with a Horizontal Pod Autoscaler minimum of one replica.
  2. Deploy the image to IBM Cloud Code Engine as an application, because it scales to zero and consumes standard OCI images. Correct answer.
  3. Deploy the image to IBM Cloud Foundry using a buildpack that wraps the container.
  4. Deploy the image to a VPC virtual server instance group with an autoscale policy based on CPU.

Explanation

Code Engine runs standard OCI container images and can scale applications to zero when there is no traffic, satisfying both the cost goal and the portability goal since the same image runs on other container platforms.

Question 37Cloud Architecture Design

An architect must ensure that an application's outbound traffic to third-party APIs is logged for compliance with source IP attribution, while the application servers remain private. Which design satisfies this?

  1. Attach floating IPs to the application servers and enable VPC Flow Logs on their network interfaces.
  2. Route outbound traffic through a public gateway and enable flow logs on the private subnet to capture the source addresses.
  3. Route outbound traffic through a VPC VPN gateway and inspect packets with a network ACL.
  4. Route outbound traffic through a NAT gateway that uses a reserved static IP, and enable flow logs on the gateway's subnet. Correct answer.

Explanation

A NAT gateway provides outbound internet access for private instances and can use a reserved static IP, giving third parties a predictable source address for allowlisting. Flow logs on the relevant subnet capture the traffic metadata needed for compliance evidence.

Question 38Cloud Architecture Design

A client requires that a single IBM Cloud Object Storage bucket be readable only by workloads in a specific VPC and not by other VPCs in the same account. Which mechanism should the architect use?

  1. A network ACL on the bucket subnet that denies traffic from other VPC CIDR ranges.
  2. A service ID per VPC with a Reader policy on the bucket, with the API key shared across all VPCs.
  3. A bucket IAM policy that grants the Reader role to the account's public access group.
  4. A context-based restriction on the bucket policy that limits access to the specified VPC's network zone. Correct answer.

Explanation

Context-based restrictions let an architect constrain access to a resource based on network context, such as the VPC or network zone from which the request originates. Applying a rule scoped to the target VPC blocks requests originating from other VPCs even when the identity has the role.

Question 39Cloud Architecture Design

An architect is comparing IBM Cloud VPC VPN gateway options for a site-to-site link to an on-premises data center that must carry up to 1 Gbps with policy-based and route-based modes. Which statement should guide the choice?

  1. The VPN gateway supports only policy-based connections and is limited to a single zone per gateway.
  2. Site-to-site connectivity requires IBM Cloud Transit Gateway because VPC VPN cannot terminate IPsec tunnels.
  3. The VPN gateway supports only route-based connections and cannot peer with a non-IBM IPsec device.
  4. The VPN gateway for VPC supports both policy-based and route-based connections and can be deployed in high availability across zones. Correct answer.

Explanation

The IBM Cloud VPN for VPC service supports policy-based and route-based connections and offers high-availability deployment modes that place gateways in multiple zones. This makes it suitable for resilient site-to-site connectivity to on-premises IPsec devices.

Question 40Cloud Architecture Design

A regulated workload requires that an architect prove that only approved container images from a private registry can be deployed to a Kubernetes cluster, and that unsigned images are rejected. Which combination should the architect design?

  1. Enable image vulnerability scanning in the registry and rely on operators to review scan results before deployment.
  2. Configure network policies in the cluster to allow egress only to the private registry endpoint.
  3. Restrict registry access with IAM policies so only the CI pipeline can push images to the registry.
  4. Use an admission controller with a signed-image policy that verifies image signatures from the trusted registry before admitting pods. Correct answer.

Explanation

Enforcing that only signed images from an approved registry are admitted requires an admission control policy that verifies signatures at deploy time, which blocks unsigned or untrusted images regardless of who submits the manifest. Registry IAM and network controls govern who can push or pull but do not validate image provenance at admission.

Question 41Cloud Solution Design and Implementation

An architect needs a managed, single-tenant dedicated network connection between an on-premises data center and an IBM Cloud VPC. Which IBM Cloud offering should be selected?

  1. IBM Cloud Internet Services (CIS)
  2. IBM Cloud Transit Gateway
  3. IBM Cloud Direct Link Dedicated Correct answer.
  4. IBM Cloud VPN for VPC

Explanation

Direct Link Dedicated provides a single-tenant, private fiber connection into IBM Cloud from a customer's premises or colocation facility, bypassing the public internet. It is the standard choice when predictable latency and private bandwidth are required between a data center and VPC resources.

Question 42Cloud Solution Design and Implementation

A solution must span three VPCs in the same region and allow all of them to reach a shared services VPC. Which IBM Cloud construct is designed to centralize this connectivity?

  1. Transit Gateway with each VPC attached as a connection Correct answer.
  2. A public floating IP on every instance in each VPC
  3. Direct Link Dedicated to each VPC separately
  4. A VPC routing table with a default route to the shared VPC

Explanation

Transit Gateway is a regional hub that connects VPCs, classic infrastructure, and Direct Link attachments into a single routing domain. Attaching each VPC as a connection lets traffic flow to the shared services VPC without full-mesh peering.

Question 43Cloud Solution Design and Implementation

An application running in a VPC must read objects from an IBM Cloud Object Storage bucket without embedding HMAC credentials in the code. Which approach best meets the requirement?

  1. Store the HMAC keys in a VPC security group rule
  2. Enable public access on the bucket and rely on network ACLs
  3. Use IAM service-to-service authorization with a trusted profile bound to the compute resource Correct answer.
  4. Generate a presigned URL for every object and hardcode it

Explanation

Trusted profiles let IAM bind a compute identity (for example a VPC instance or a Kubernetes service account) to a service ID without distributing long-lived keys. Service-to-service authorization then grants the workload scoped access to Object Storage.

Question 44Cloud Solution Design and Implementation

A workload must survive the loss of an entire IBM Cloud data center within a region. Which design attribute is required?

  1. Spread instances across multiple zones in the region and front them with a multi-zone load balancer Correct answer.
  2. Enable a single floating IP and rely on DNS round robin
  3. Deploy all instances in one zone with a load balancer
  4. Use a single bare metal server in a dedicated data center

Explanation

Zones within an IBM Cloud region are independent failure domains with separate power and network. Distributing instances across zones and using a load balancer that spans zones allows traffic to shift away from a failed data center.

Question 45Cloud Solution Design and Implementation

An architect is choosing between a public and a private catalog listing for an internal application template in IBM Cloud. Which statement correctly distinguishes the two?

  1. A private catalog is visible only to accounts in the owning enterprise, while a public catalog is available to all IBM Cloud users Correct answer.
  2. A public catalog restricts access by IAM policy, while a private catalog has no access control
  3. A private catalog can only contain Terraform modules, while a public catalog can only contain Helm charts
  4. A public catalog requires IBM approval per account, while a private catalog is open to everyone

Explanation

IBM Cloud catalogs control who can discover and deploy offerings. Private catalogs are scoped to an account or enterprise, while public catalogs publish offerings to the broader IBM Cloud user base.

Question 46Cloud Solution Design and Implementation

A team wants to provision a VPC, subnets, and a load balancer reproducibly across dev, staging, and production accounts. Which IBM Cloud capability best fits?

  1. Using IBM Cloud Schematics with a Terraform template stored in Git Correct answer.
  2. Requesting IBM Support to provision the resources
  3. Manually creating resources in the console and exporting a screenshot
  4. Using the CLI with ad hoc commands recorded in a wiki

Explanation

Schematics is IBM Cloud's managed Terraform service, so infrastructure can be defined as code in Git and applied consistently per environment. This gives version control, repeatability, and drift detection across accounts.

Question 47Cloud Solution Design and Implementation

A regulated customer requires that encryption keys for data at rest remain under their control and be stored in a hardware security module. Which IBM Cloud service should the architect specify?

  1. IBM Cloud Object Storage with default provider-managed encryption
  2. IBM Cloud Hyper Protect Crypto Services Correct answer.
  3. IBM Cloud Secrets Manager
  4. IBM Cloud Key Protect with a customer-managed root key in an HSM

Explanation

Hyper Protect Crypto Services provides a dedicated, FIPS 140-2 Level 4 validated HSM where the customer retains exclusive control of the master key. That is the requirement for customers who cannot accept provider-held root keys.

Question 48Cloud Solution Design and Implementation

An architect must ensure that a VPC instance can reach the internet for software updates but must not be directly reachable from the internet. Which configuration achieves this?

  1. Attach a floating IP to the instance and allow inbound on all ports
  2. Attach a public load balancer directly to the instance's private IP
  3. Place the instance in a private subnet and route egress through a public gateway Correct answer.
  4. Place the instance in a public subnet with no security group

Explanation

A public gateway provides outbound-only connectivity for instances in a private subnet, so they can fetch updates while remaining unreachable from inbound internet traffic. No floating IP is attached, so there is no inbound path.

Question 49Cloud Solution Design and Implementation

A containerized workload on IBM Cloud Kubernetes Service must be reachable from the internet with TLS termination handled by IBM. Which component should the architect use?

  1. A NodePort service on each worker node
  2. A ClusterIP service with a manually managed certificate
  3. A hostPath volume mounted into the pod
  4. An Ingress resource backed by the IBM-managed ALB Correct answer.

Explanation

IBM Cloud Kubernetes Service provides managed application load balancers that implement Ingress and can terminate TLS using IBM-managed or custom certificates. Exposing an Ingress resource is the supported pattern for HTTP(S) ingress.

Question 50Cloud Solution Design and Implementation

An architect is designing for a workload that needs sub-millisecond latency between tightly coupled compute nodes. Which IBM Cloud compute option is most appropriate?

  1. Bare metal servers in the same rack with high-speed networking Correct answer.
  2. Serverless Cloud Functions
  3. Virtual server instances in different zones
  4. A single virtual server with additional vCPUs

Explanation

Bare metal servers avoid virtualization overhead and can be placed for low-latency, high-bandwidth interconnect, which suits tightly coupled HPC-style workloads. Spreading across zones adds network distance and latency.