An organization has been using an old version of an Apache Log4j software component in its critical software application. Which of the following should the organization use to calculate the severity of the risk from using this component?
A. CWE
B. CVSS
C. CWSS
D. CVE
Show Answer
Correct Answer: B
Explanation: CVSS (Common Vulnerability Scoring System) is specifically designed to calculate and communicate the severity of software vulnerabilities using a standardized numeric score based on impact and exploitability. CWE and CVE classify or identify weaknesses and vulnerabilities, while CWSS scores weaknesses rather than deployed vulnerability risk.
Question 16
A company operates a website that allows customers to upload, share, and retain full ownership of their photographs. Which of the following could affect image ownership as the website usage expands globally?
A. Sovereignty
B. Data classification
C. Litigation holds
D. Retention
Show Answer
Correct Answer: A
Explanation: As the website expands globally, uploaded images may be stored or processed in different countries. Data sovereignty means that data is subject to the laws and regulations of the country where it resides, including intellectual property and privacy laws. These varying national laws can directly affect image ownership rights and how photographs may be used or protected across regions.
Question 17
A cloud service provider requires users to migrate to a new type of VM within three months. Which of the following is the best justification for this requirement?
A. Security flaws need to be patched
B. Updates could affect the current state of the VMs
C. The cloud provider will be performing infrastructure maintenance
D. The equipment is reaching end of life and end of support
Show Answer
Correct Answer: D
Explanation: A forced migration to a new VM type is most commonly driven by the old VM platform reaching end of life (EOL) and end of support (EOS). Once EOL/EOS is reached, the provider can no longer guarantee security patches, updates, hardware availability, or support, making continued operation risky and unsustainable. While security patching, maintenance, or state changes can occur, they do not typically require mandatory migration of all customers. Therefore, end of life and end of support is the best justification.
Question 17
Which of the following compute resources is the most optimal for running a single scripted task on a schedule?
A. Bare-metal server
B. Managed container
C. Virtual machine
D. Serverless function
Show Answer
Correct Answer: D
Explanation: For a single scripted task that runs on a schedule, a serverless function is optimal because it is designed for short-lived, event-driven workloads, integrates easily with schedulers, requires no infrastructure management, and is cost-efficient by charging only for execution time. Bare-metal servers, VMs, and managed containers incur unnecessary overhead and ongoing costs for such a simple, periodic task.
Question 18
Users report being unable to access an application that uses TLS 1.1. The users are able to access other applications on the internet. Which of the following is the most likely reason for this issue?
A. The security team modified user permissions.
B. Changes were made to address vulnerabilities.
C. Privileged access was implemented.
D. The network ACL was modified.
Show Answer
Correct Answer: B
Explanation: TLS 1.1 is deprecated and commonly disabled during security hardening to remediate vulnerabilities. If an application still relies on TLS 1.1, users will be unable to connect after such changes, while access to other applications remains unaffected.
Question 18
A healthcare organization must follow strict compliance requirements to ensure that PII is not leaked. The cloud administrator needs to ensure the cloud email system can support this requirement. Which of the following should the organization enable?
A. IPS
B. DLP
C. ACL
D. WAF
Show Answer
Correct Answer: B
Explanation: Data Loss Prevention (DLP) is designed to identify, monitor, and prevent the unauthorized transmission of sensitive data such as PII. In a cloud email system, DLP can inspect email content and attachments and enforce policies to block or quarantine messages that violate compliance requirements (e.g., HIPAA). IPS, ACLs, and WAFs focus on network or application security, not content-level data leakage prevention.
Question 19
A junior cloud administrator was recently promoted to cloud administrator and has been added to the cloud administrator group. The cloud administrator group is the only one that can access the engineering VM. The new administrator unsuccessfully attempts to access the engineering VM. However, the other administrators can access it without issue. Which of the following is the best way to identify the root cause?
A. Rebooting the engineering VM
B. Reviewing the administrator’s permissions to access the engineering VM
C. Allowing connections from 0.0.0.0/0 to the engineering VM
D. Performing a packet capture on the engineering VM
Show Answer
Correct Answer: B
Explanation: Only the newly promoted administrator is affected while other members of the same group can access the VM, indicating an individual IAM or role-assignment issue. Reviewing the administrator’s permissions is the most direct way to identify misconfigurations such as missing role propagation, conditional access, or explicit deny rules. Rebooting, opening network access, or packet captures would not explain a user-specific access failure.
Question 19
A cloud solutions architect needs to have consistency between production, staging, and development environments. Which of the following options will best achieve this goal?
A. Using Terraform templates with environment variables
B. Using Grafana in each environment
C. Using the ELK stack in each environment
D. Using Jenkins agents in different environments
Show Answer
Correct Answer: A
Explanation: Consistency across environments is best achieved through Infrastructure as Code. Terraform templates define the same infrastructure declaratively for all environments, and environment variables allow controlled differences (such as sizing or endpoints) without changing the core configuration. The other options are monitoring, logging, or CI/CD tools and do not ensure infrastructure or configuration consistency.
Question 20
A cloud engineer tries to deploy five new cloud instances using code. An error occurs, and the instances are not created. The configuration fails to run. The engineer then receives the following error message:
ERROR:Parse error on json line x in config
Given the following snippet from the config.json file:
{ "instance_count": 5,
"ssd_options" : ["100GB","200GB","300GB"],
"instance_region": apac,
"instance_code": 255,
"start_instance" : true
}
Which of the following oversights created the error in the configuration file?
A. Incorrect instance_count
B. Incorrect ssd_options
C. Missing quotations on instance_region
D. Missing trailing comma on start_instance
Show Answer
Correct Answer: C
Explanation: The JSON parse error is caused by `instance_region` having an unquoted string value. In JSON, all string values must be enclosed in double quotes, so `apac` should be written as "apac". The other fields are valid JSON syntax.
Question 20
A software development team would like to test a new feature that was added to the company’s production website. The team would like to allow access to only a small number of users and then, in a controlled way, slowly increase the number of users who have access to the feature. Which of the following best describes the deployment strategy the software development team should use?
A. In-place
B. Blue-green
C. Canary
D. Rolling
Show Answer
Correct Answer: C
Explanation: A canary deployment releases a new feature to a small subset of users first and then gradually increases exposure while monitoring for issues. This matches the requirement to allow limited initial access and slowly expand it in a controlled manner.
$19
Get all 179 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.