I85PREP
⌘ K
JNCIA-Cloud study materials
JNCIA-Cloud study resources

JNCIA-Cloud practice questions

One question at a time. Build your JNCIA-Cloud understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Fundamentals

In cloud computing, which characteristic describes a provider automatically adding compute capacity as a customer's workload grows, without manual intervention?

  1. Measured service
  2. Rapid elasticity Correct answer.
  3. Broad network access
  4. Resource pooling

Explanation

Rapid elasticity means resources can be provisioned and released automatically to match demand, so capacity appears near-unlimited to the consumer. The other options describe separate NIST cloud characteristics: metering, multi-tenant pooling, and network reachability.

Question 2Cloud Fundamentals

A company wants to run workloads on shared infrastructure owned by a third party, with no long-term commitment and pay-per-use billing. Which deployment model does this describe?

  1. Community cloud
  2. Public cloud Correct answer.
  3. Private cloud
  4. Hybrid cloud

Explanation

A public cloud is provisioned for open use by the general public and owned by a provider, with on-demand, pay-per-use consumption. Private, community, and hybrid models differ in who owns and shares the infrastructure.

Question 3Cloud Fundamentals

Which service model gives the customer the most control over the operating system and runtime while still offloading physical hardware management?

  1. PaaS
  2. FaaS
  3. SaaS
  4. IaaS Correct answer.

Explanation

In IaaS the provider manages the physical layer and virtualization, while the customer manages the OS, middleware, runtime, and applications. PaaS, SaaS, and FaaS abstract the OS away from the customer entirely.

Question 4Cloud Fundamentals

Which statement best describes the shared responsibility model in a public cloud?

  1. Security duties are divided between provider and customer by service model Correct answer.
  2. Responsibility transfers entirely to the customer for IaaS
  3. The customer remains responsible for physical datacenter security
  4. The provider is responsible for all layers once data is uploaded

Explanation

The shared responsibility model splits duties: the provider secures the physical infrastructure and hypervisor, while the customer secures what it configures, such as identities, data, and guest OS. The exact split shifts with the service model.

Question 5Cloud Fundamentals

A team needs to run a containerized microservice that scales to zero when idle and is billed only for execution time. Which cloud service model fits best?

  1. Managed relational database
  2. Virtual machine instances
  3. Serverless functions Correct answer.
  4. Bare-metal servers

Explanation

Serverless computing, including FaaS, executes code on demand, scales down to zero, and charges per invocation and execution duration. Virtual machines and bare metal run and bill continuously while allocated.

Question 6Cloud Fundamentals

Which benefit is most directly associated with moving from capital expenditure to operational expenditure in cloud adoption?

  1. Guaranteed lower total cost for every workload
  2. Upfront hardware purchase replaced by usage-based recurring cost Correct answer.
  3. Permanent reservation of physical servers
  4. Elimination of all security obligations

Explanation

Cloud shifts spending from large upfront capital purchases to ongoing operational charges tied to consumption. This improves cash-flow flexibility but does not guarantee lower total cost or remove security duties.

Question 7Cloud Fundamentals

What is the primary purpose of a cloud region?

  1. To group users by organizational department
  2. To define a geographic area containing isolated availability zones Correct answer.
  3. To specify the billing currency for a subscription
  4. To host the provider's global identity service

Explanation

A region is a geographic area made up of multiple isolated availability zones connected by low-latency links. Customers choose regions for latency, data residency, and compliance reasons.

Question 8Cloud Fundamentals

An application must survive the failure of a single datacenter within a region. Which design choice addresses this requirement?

  1. Rely on provider backups taken once per month
  2. Place all instances in a single subnet of one zone
  3. Distribute instances across multiple availability zones Correct answer.
  4. Deploy all instances in one availability zone

Explanation

Availability zones are isolated datacenters within a region, so spreading instances across zones lets the application tolerate one zone failing. Single-zone designs share the same failure domain.

Question 9Cloud Fundamentals

Which cloud concept allows multiple customers to share the same physical host while remaining logically isolated from one another?

  1. Federation
  2. Fault tolerance
  3. Multi-tenancy Correct answer.
  4. Orchestration

Explanation

Multi-tenancy is the sharing of physical resources among customers with logical separation enforced by the platform. Federation, orchestration, and fault tolerance describe identity, automation, and resilience concepts.

Question 10Cloud Fundamentals

A workload has highly predictable, steady utilization for three years and strict data residency requirements. Which approach is most appropriate to evaluate first?

  1. Serverless functions with per-invocation billing
  2. Reserved capacity in a chosen region Correct answer.
  3. Multi-region active-active deployment
  4. Spot or preemptible instances

Explanation

Steady long-term demand suits reserved or committed capacity, which discounts predictable usage, and a fixed region satisfies residency. Spot instances risk interruption, and per-invocation billing is inefficient for constant load.

Question 11Cloud Fundamentals

Which statement accurately distinguishes virtualization from containerization?

  1. Containers each include a full guest operating system
  2. Virtual machines share a single kernel across tenants
  3. Containers share the host kernel while virtual machines run separate kernels Correct answer.
  4. Virtual machines cannot be run in public cloud environments

Explanation

Containers package applications with dependencies but share the host OS kernel, making them lightweight. Virtual machines include a full guest OS with its own kernel, which increases isolation and overhead.

Question 12Cloud Fundamentals

What is the main role of a hypervisor in a cloud provider's infrastructure?

  1. To balance incoming traffic across web servers
  2. To create and run virtual machines on physical hosts Correct answer.
  3. To route packets between virtual networks
  4. To encrypt data at rest in object storage

Explanation

A hypervisor abstracts physical hardware and creates, schedules, and isolates virtual machines. Routing, storage encryption, and load balancing are separate platform functions.

Question 13Cloud Fundamentals

Which cloud capability best supports automated recovery when a monitored instance becomes unhealthy?

  1. Manual snapshot scheduling
  2. Static IP reservation
  3. DNS zone transfer
  4. Auto-scaling with health checks Correct answer.

Explanation

Auto-scaling groups combined with health checks detect unhealthy instances and replace them automatically, maintaining the desired capacity. The other options do not provide automated remediation.

Question 14Cloud Fundamentals

Which characteristic of cloud networking allows a customer to define isolated virtual networks with their own address ranges?

  1. Software-defined networking Correct answer.
  2. Network address translation
  3. Anycast routing
  4. Quality of service

Explanation

Software-defined networking lets customers define virtual networks, subnets, and routing policies in software independent of physical topology. NAT, anycast, and QoS are traffic-handling techniques, not the basis for isolated virtual networks.

Question 15Cloud Fundamentals

A company wants to connect its on-premises datacenter to a cloud VPC over a private, dedicated link rather than the public internet. Which option meets this requirement?

  1. Site-to-site VPN over the internet
  2. Content delivery network
  3. Dedicated interconnection service Correct answer.
  4. Public internet gateway

Explanation

A dedicated interconnection provides private connectivity between on-premises networks and the cloud, bypassing the public internet. A VPN is encrypted but still traverses the internet, and a CDN caches content.

Question 16Cloud Fundamentals

Which storage type is best suited for storing millions of unstructured objects such as images and backups accessed by HTTP APIs?

  1. Object storage Correct answer.
  2. Local instance SSD
  3. Shared file system
  4. Block storage volumes

Explanation

Object storage manages data as objects with metadata and keys, scales to very large volumes, and is accessed through APIs. Block and local storage attach to compute instances, and file systems suit shared directory semantics.

Question 17Cloud Fundamentals

What does the principle of least privilege require when granting cloud IAM permissions?

  1. Granting administrator rights to simplify troubleshooting
  2. Sharing one credential across all automated jobs
  3. Granting each identity only the permissions needed for its tasks Correct answer.
  4. Disabling multi-factor authentication for service accounts

Explanation

Least privilege means identities receive only the permissions required to perform their function, limiting the blast radius of misuse or compromise. Broad admin rights and shared credentials expand risk.

Question 18Cloud Fundamentals

Which mechanism lets a company use its existing on-premises identity provider to authenticate users into cloud services without creating separate cloud passwords?

  1. Local database authentication
  2. IP allowlisting
  3. Static access keys
  4. Identity federation Correct answer.

Explanation

Federation trusts the on-premises identity provider to assert user identity, so users sign in with existing credentials and receive cloud roles. Static keys and IP allowlists are not identity mechanisms for user sign-in.

Question 19Cloud Fundamentals

Why is enabling multi-factor authentication on cloud administrator accounts a recommended control?

  1. It eliminates the need for audit logging
  2. It encrypts all data stored in the account
  3. It removes the need for role-based access control
  4. It adds a second factor so a stolen password alone is insufficient Correct answer.

Explanation

MFA requires an additional factor beyond the password, so credential theft alone does not grant access. It complements, but does not replace, authorization controls, encryption, or logging.

Question 20Cloud Fundamentals

What is the primary purpose of infrastructure as code in cloud operations?

  1. Encrypting traffic between microservices
  2. Replacing all monitoring with manual inspections
  3. Reducing the number of cloud regions used
  4. Defining and provisioning infrastructure through versioned machine-readable files Correct answer.

Explanation

Infrastructure as code expresses desired infrastructure in version-controlled files that tools apply consistently and repeatably. It improves reproducibility and review, but does not replace monitoring or encryption.

Question 21Cloud Fundamentals

An organization needs to enforce that no storage bucket can be made public in any account. Which cloud governance approach is most appropriate?

  1. Reviewing buckets manually each quarter
  2. Relying on developer documentation and training
  3. Enabling billing alerts on each account
  4. Applying an organization-wide policy that denies public bucket settings Correct answer.

Explanation

Organization-level policies enforce guardrails centrally and prevent noncompliant configurations regardless of individual account settings. Documentation, periodic manual review, and billing alerts do not prevent the misconfiguration.

Question 22Cloud Fundamentals

Which practice best reduces the risk of a single availability zone outage causing data loss for a production database?

  1. Running the database on one large instance
  2. Taking snapshots only after an outage occurs
  3. Replicating data synchronously to another availability zone Correct answer.
  4. Storing the database on instance-local ephemeral disk

Explanation

Synchronous replication to a second availability zone maintains an up-to-date copy that can take over if one zone fails. Ephemeral local disks and single-instance designs concentrate risk.

Question 23Cloud Fundamentals

What distinguishes a hybrid cloud from a multi-cloud architecture?

  1. Hybrid and multi-cloud are identical terms for the same design
  2. Hybrid requires on-premises hardware only; multi-cloud forbids virtualization
  3. Hybrid uses only one provider; multi-cloud uses only private infrastructure
  4. Hybrid combines private and public models; multi-cloud uses several public providers Correct answer.

Explanation

Hybrid cloud integrates a private environment with public cloud services, while multi-cloud uses services from more than one public provider. The two can overlap but describe different aspects of architecture.

Question 24Cloud Fundamentals

Which metric is most relevant when deciding whether to place a latency-sensitive application in a particular cloud region?

  1. Round-trip time from the primary user population Correct answer.
  2. The size of the region's marketing documentation
  3. The provider's total number of global customers
  4. The number of available instance types

Explanation

Network round-trip time between users and the region directly affects perceived latency, so it is the key placement metric. Instance variety and provider size do not determine user-experienced delay.

Question 25Cloud Fundamentals

Which statement about cloud service level agreements is accurate?

  1. An SLA guarantees zero downtime for all services
  2. An SLA transfers all security responsibility to the provider
  3. An SLA removes the need for customer backups
  4. An SLA defines committed availability and remedies such as service credits Correct answer.

Explanation

An SLA states measurable commitments, commonly availability targets, and the remedies if they are missed, such as credits. It does not promise zero downtime or shift security and data protection duties to the provider.

Question 26Cloud Fundamentals

Which cloud deployment model places infrastructure exclusively on the provider's premises and serves multiple unrelated tenants over the public internet?

  1. Community cloud
  2. Private cloud
  3. Public cloud Correct answer.
  4. Hybrid cloud

Explanation

A public cloud is owned and operated by a service provider and its resources are shared across many customers, who reach them over the internet. Private, community, and hybrid models all involve either dedicated infrastructure or a defined mix of environments.

Question 27Cloud Fundamentals

Which cloud characteristic describes a customer's ability to add or remove resources programmatically without human intervention from the provider?

  1. Broad network access
  2. Measured service
  3. Resource pooling
  4. Rapid elasticity Correct answer.

Explanation

Rapid elasticity means capacity can be scaled out or in automatically and quickly in response to demand. Broad network access, measured service, and resource pooling describe reachability, metering, and sharing respectively, not on-demand scaling.

Question 28Cloud Fundamentals

Which model describes a company that keeps its regulated customer database in its own datacenter while running its web front end in a public cloud?

  1. Public cloud only
  2. Multi-cloud
  3. Community cloud
  4. Hybrid cloud Correct answer.

Explanation

Hybrid cloud combines private or on-premises infrastructure with public cloud services, with some orchestration between them. Here the datacenter hosts the sensitive data and the public cloud hosts the front end, which is the defining hybrid pattern.

Question 29Cloud Fundamentals

What is the primary function of a cloud region's control plane relative to its data plane?

  1. It stores customer payload data and forwards it between tenants.
  2. It encrypts all traffic that crosses the provider backbone.
  3. It carries production traffic between availability zones.
  4. It provides the APIs used to create and manage resources, separate from the path that carries workload traffic. Correct answer.

Explanation

The control plane exposes management APIs and orchestration logic for provisioning and configuring resources. The data plane is the path that actually carries workload traffic, so the two are logically separated to limit blast radius and improve resilience.

Question 30Cloud Fundamentals

Which statement best describes the shared responsibility model for a managed database service?

  1. The provider is responsible for all layers once the service is provisioned.
  2. The customer patches the database engine while the provider manages the physical hosts.
  3. The provider secures the physical hosts and managed engine, while the customer controls data, access, and schema. Correct answer.
  4. The customer is responsible for the physical security of the datacenter hosting the database.

Explanation

Under the shared responsibility model the provider secures the underlying infrastructure and the managed service software. The customer retains responsibility for its own data, identity and access configuration, and logical schema.

Question 31Cloud Fundamentals

A team needs a cloud environment for a proof of concept that will be destroyed after two weeks. Which purchasing approach matches this requirement?

  1. On-demand instances Correct answer.
  2. Reserved instances with a three-year term
  3. Savings plans with a committed spend
  4. Dedicated hosts

Explanation

On-demand pricing has no commitment and can be terminated at any time, which suits short-lived experiments. Reserved instances, savings plans, and dedicated hosts all involve commitments or long-term allocation better suited to steady workloads.

Question 32Cloud Fundamentals

Which capability allows a cloud provider to allocate fractional CPU time from a shared physical server to many virtual machines?

  1. Live migration
  2. Overcommitment of CPU scheduling Correct answer.
  3. Direct memory access
  4. Nested virtualization

Explanation

The hypervisor scheduler time-slices physical CPU cores and can overcommit them across virtual machines, giving each guest a fraction of a core. Live migration, direct memory access, and nested virtualization do not describe CPU time sharing.

Question 33Cloud Fundamentals

Which workload characteristic makes a serverless function a better fit than a continuously running virtual machine?

  1. The workload runs a licensed agent that requires kernel-level access.
  2. The workload executes briefly and sporadically in response to events. Correct answer.
  3. The workload must keep a large dataset in local memory between requests.
  4. The workload must maintain a long-lived TCP session with a legacy mainframe.

Explanation

Serverless functions are invoked on events and billed per execution, so they suit short, intermittent work. Long-lived sessions, kernel-level requirements, and persistent in-memory state conflict with the ephemeral execution model.

Question 34Cloud Fundamentals

What is the main purpose of a content delivery network in a cloud architecture?

  1. To cache content at edge locations close to users and reduce origin latency Correct answer.
  2. To replace the origin servers with stateless compute
  3. To terminate all identity federation requests
  4. To provide persistent block storage for databases

Explanation

A CDN caches content at edge points of presence near end users, reducing round-trip time and origin load. It does not replace origin compute, provide block storage, or handle identity federation.

Question 35Cloud Fundamentals

Which cloud storage characteristic allows capacity to grow without pre-provisioning a fixed volume size?

  1. Elasticity of object storage Correct answer.
  2. Block replication
  3. Snapshot retention
  4. Provisioned IOPS

Explanation

Object storage is effectively unbounded and grows as objects are written, so no capacity must be reserved up front. Provisioned IOPS, snapshots, and block replication describe performance or durability features rather than elastic capacity.

Question 36Cloud Fundamentals

A team must keep an application running across two availability zones with automatic failover. Which design element is most directly required?

  1. A single instance with a static public IP address
  2. A larger instance type in one zone
  3. A load balancer with health checks spanning both zones Correct answer.
  4. Weekly full backups of the database

Explanation

A load balancer that checks instance health and spans multiple zones can route traffic away from a failed zone automatically. A single instance, larger sizing, or periodic backups do not provide automatic cross-zone failover.

Question 37Cloud Fundamentals

Which statement about a cloud virtual private network is accurate?

  1. It provides a logically isolated network with customer-defined subnets and routing. Correct answer.
  2. It exposes all instances directly to the public internet by default.
  3. It requires a dedicated physical switch for each tenant.
  4. It removes the need for security groups and network ACLs.

Explanation

A virtual private network in the cloud is a software-defined, isolated address space in which the customer defines subnets, route tables, and gateways. Physical switches are not dedicated per tenant, and isolation does not eliminate the need for security controls.

Question 38Cloud Fundamentals

Which approach most directly limits the impact of a compromised cloud access key?

  1. Sharing one key across all development teams
  2. Storing the key in a public repository for easy retrieval
  3. Assigning a role to the workload instead of distributing long-lived keys Correct answer.
  4. Rotating the key once every two years

Explanation

Roles issue short-lived credentials to workloads through an instance or service identity, so no long-lived secret exists to leak. Public storage, shared keys, and infrequent rotation all increase exposure.

Question 39Cloud Fundamentals

What is the main benefit of a cloud provider's managed key management service for encryption at rest?

  1. It guarantees that data never leaves the region.
  2. It replaces the need for identity and access management.
  3. It centralizes key creation, rotation, and access auditing. Correct answer.
  4. It removes the need to encrypt data at all.

Explanation

A key management service centralizes the lifecycle of cryptographic keys, including rotation and audit logging of key usage. It does not eliminate encryption requirements, guarantee data residency by itself, or replace IAM.

Question 40Cloud Fundamentals

Which observability signal is most useful for detecting that a service is degrading before users report errors?

  1. Monthly billing statements
  2. Source code commit history
  3. Latency percentiles on request traces Correct answer.
  4. Static IP address inventory

Explanation

Latency percentiles from traces reveal rising response times that precede user-visible failures. Billing, commit history, and an IP inventory do not measure runtime service health.

Question 41Cloud Fundamentals

Which cloud concept describes the ability to define infrastructure in version-controlled templates and recreate it consistently?

  1. Declarative infrastructure as code Correct answer.
  2. Manual console provisioning
  3. Configuration drift
  4. Snowflake servers

Explanation

Declarative infrastructure as code describes the desired end state in templates that are version controlled and applied repeatably. Manual provisioning, drift, and snowflake servers all produce inconsistent, hard-to-reproduce environments.

Question 42Cloud Fundamentals

A company wants to ensure that any new cloud account automatically has logging enabled and a budget alert configured. Which mechanism best enforces this?

  1. A monthly manual audit of all accounts
  2. An organization-level policy applied to newly created accounts Correct answer.
  3. Relying on each team to follow a wiki checklist
  4. A shared spreadsheet of account owners

Explanation

Organization-level policies and account baselines apply controls automatically at creation, so compliance does not depend on individual teams. Manual checklists, periodic audits, and spreadsheets are detective or voluntary and allow gaps.

Question 43Cloud Fundamentals

Which statement describes the difference between vertical and horizontal scaling in cloud compute?

  1. Both terms require downtime and cannot be automated.
  2. Vertical scaling adds capacity to a single instance; horizontal scaling adds more instances. Correct answer.
  3. Both terms describe adding storage capacity only.
  4. Vertical scaling adds more instances; horizontal scaling adds more CPU to one instance.

Explanation

Vertical scaling increases the size of a single instance, such as more CPU or memory, while horizontal scaling adds more instances behind a load balancer. The two directions are distinct, and horizontal scaling is commonly automated.

Question 44Cloud Fundamentals

Which factor most strongly justifies choosing a cloud region close to a user population for a real-time trading application?

  1. Lower storage cost per gigabyte
  2. Larger instance type availability
  3. Reduced network round-trip latency Correct answer.
  4. Longer backup retention periods

Explanation

Physical distance determines network round-trip time, which dominates responsiveness for latency-sensitive workloads. Storage price, instance variety, and backup retention do not address latency for end users.

Question 45Cloud Fundamentals

What is the purpose of an availability zone within a cloud region?

  1. To offer a cheaper pricing tier for archived data
  2. To host the provider's billing systems
  3. To provide a separate fault domain with independent power and cooling Correct answer.
  4. To store encryption keys for the entire region

Explanation

An availability zone is an isolated fault domain with independent power, cooling, and networking, so a failure in one zone need not affect others. Pricing tiers, billing systems, and key storage are unrelated to the zone concept.

Question 46Cloud Fundamentals

A team deploys a stateless web tier behind a load balancer and wants it to scale automatically with traffic. Which configuration element is essential?

  1. An autoscaling policy tied to a metric such as average CPU utilization Correct answer.
  2. A single large instance with a static address
  3. A fixed number of instances pinned to one zone
  4. A manual approval step for every instance launch

Explanation

Autoscaling requires a target metric and policy that adds or removes instances as demand changes. Pinning instances, using a single instance, or requiring manual approval defeats automatic scaling.

Question 47Cloud Fundamentals

Which statement accurately describes a cloud marketplace image?

  1. It is a preconfigured template that can include an operating system and third-party software. Correct answer.
  2. It is a physical server reserved for one customer.
  3. It is a billing report generated monthly.
  4. It is a network ACL applied to a subnet.

Explanation

A marketplace image packages an operating system and often licensed third-party software into a ready-to-launch template. It is not a physical host, a billing report, or a network access control list.

Question 48Cloud Fundamentals

Which practice best protects a production database from accidental deletion by an administrator?

  1. Disabling backups to save cost
  2. Relying on the provider to prevent all deletions
  3. Granting all administrators full delete rights for convenience
  4. Enabling deletion protection and requiring multi-party approval for destructive changes Correct answer.

Explanation

Deletion protection plus approval workflows create a technical and procedural barrier against accidental removal. Broad delete rights, reliance on the provider, and disabled backups all increase the risk of data loss.

Question 49Cloud Fundamentals

A workload runs in a single region but regulations require that data be recoverable after a regional outage. Which approach addresses this requirement?

  1. Increasing instance size in the same region
  2. Replicating backups or data to a second region Correct answer.
  3. Enabling a CDN for static assets
  4. Adding more availability zones in the same region

Explanation

Only cross-region replication or backup copies survive the loss of an entire region. Larger instances, additional zones in the same region, and a CDN all remain dependent on the original region.

Question 50Cloud Fundamentals

Which statement best explains why a cloud provider can offer lower unit costs than a small company's own datacenter?

  1. The provider avoids all hardware and energy costs.
  2. The provider does not need to secure its facilities.
  3. The provider passes regulatory costs to customers only.
  4. The provider achieves economies of scale across many customers and high utilization. Correct answer.

Explanation

Large providers purchase hardware and energy at scale and keep utilization high across many tenants, spreading fixed costs. They still incur hardware, energy, and security costs, so those claims are false.