A company’s cybersecurity team receives the following alert that a production VM was deleted from the virtual network:
21 September 09:19:08 (GMT-5)
Resource with ID: PROD-WEB001 was deleted by User: Logging
Service -
The console to manage virtual network resources uses directory authentication. Only users in a particular directory group can interactively access the virtual network management console. The logging service account is not part of this group and requires some local administration privileges to aggregate logs from various resources. The cybersecurity team discovers that the logging service account was previously given full directory administration privileges and they see the following entry:
21 September 09:10:55 (GMT-5)
User with ID: Logging Service was added to the Group: VNet
Console Administrators by actor: Logging Service.
The cybersecurity team removes the compromised service account from the directory group. Which of the following should the cybersecurity team do next to prevent repeat instances of this issue?
A. Enable two-factor authentication on the virtual network console.
B. Reset the logging service account to use a long and complex password.
C. Disable RDP on the production virtual machines.
D. Create a scoped administrative role for the logging service account.
Show Answer
Correct Answer: D
Explanation: The incident was caused by excessive privileges on a service account, which allowed it to add itself to an administrative group and delete production resources. To prevent recurrence, the team should enforce the principle of least privilege by removing broad directory admin rights and creating a tightly scoped administrative role that grants only the permissions required for log aggregation. This directly addresses the root cause, unlike MFA, password changes, or VM access controls.
Question 21
A cloud developer receives a security vulnerability scan report and needs to analyze and record the true positives. Which of the following vulnerability management steps is this an example of?
A. Assessment
B. Identification
C. Scanning scope
D. Remediation
Show Answer
Correct Answer: A
Explanation: Analyzing a vulnerability scan report to validate findings and record true positives is part of the assessment phase. This step evaluates scan results, distinguishes true positives from false positives, and determines severity and impact, which occurs after identification/scanning and before remediation.
Question 22
Which of the following should be used on containers to process data and keep the output in files for later review?
A. Standard output
B. Optical disk mount
C. Ephemeral storage
D. Persistent volumes
Show Answer
Correct Answer: D
Explanation: Containers often have ephemeral filesystems that are lost when the container stops or is recreated. If processed data must be written to files and retained for later review, the storage must persist beyond the container lifecycle. Persistent volumes are specifically designed to provide durable, reusable storage independent of container restarts or redeployments, making them the correct choice.
Question 22
A cloud engineer is receiving multiple alerts from the infrastructure monitoring agent. The alerts state that all the VMs in the public subnet are at 100% CPU utilization. However, when the engineer checks the network utilization of the VMs, the network throughput is at normal levels. Which of the following is the most likely cause of this issue?
A. Ransomware
B. Cryptojacking
C. DDoS
D. Zombie instances
Show Answer
Correct Answer: B
Explanation: The symptoms show 100% CPU utilization across multiple VMs while network throughput remains normal. Cryptojacking malware consumes large amounts of CPU to mine cryptocurrency but typically generates minimal network traffic once running. DDoS would primarily increase network usage, ransomware would focus on disk/file activity, and zombie instances are usually associated with outbound traffic for attacks. Therefore, cryptojacking is the most likely cause.
Question 23
A developer is sending requests to a SaaS application. The developer becomes unable to send anymore requests after sending a number of them, but other developers can still send requests. Which of the following is most likely causing the issue?
A. Partial outage
B. API throttling
C. Rate limiting
D. Service quota
Show Answer
Correct Answer: C
Explanation: The issue affects only one developer after sending a certain number of requests, while others can continue normally. This pattern is characteristic of per-client rate limiting, where requests are capped over a time window based on an API key, user, or IP. A partial outage would impact multiple users, API throttling is often a general term but rate limiting is the specific mechanism described, and service quotas are typically broader or account-wide limits rather than individual developer behavior.
Question 23
An on-call cloud engineer receives a critical alert about an e-commerce web server being unresponsive. Which of the following steps should the engineer take first?
A. Triage
B. Remediation
C. Escalation
D. Monitoring
Show Answer
Correct Answer: A
Explanation: The first step after receiving a critical alert is triage. Triage involves validating the alert, confirming the issue is real, determining severity and scope, and gathering initial information. Only after triage should the engineer proceed to remediation, escalation, or ongoing monitoring.
Question 24
A cloud solutions architect needs to deploy a simple, public-facing website with the following requirements:
• Cost-effective
• Highly available
• Self-healing
• Secure
Which of the following will be the most appropriate template to use?
A.
B.
C.
D.
Show Answer
Correct Answer: C
Explanation: A spot-instance–based template is not appropriate for a highly available, self-healing public website because spot instances can be interrupted at any time. The option that typically uses managed services such as an Auto Scaling group across multiple Availability Zones (often behind a load balancer, or a managed static/managed hosting approach) better meets the requirements of high availability, self-healing, security, and cost-effectiveness. Therefore, option C best fits the stated requirements.
Question 24
Which of the following is the best type of database for storing different types of unstructured data that may change frequently?
A. Vector
B. Relational
C. Non-relational
D. Graph
Show Answer
Correct Answer: C
Explanation: Non-relational (NoSQL) databases are designed to handle unstructured and semi-structured data without a fixed schema, making them well-suited for storing diverse data types that change frequently. Relational databases require rigid schemas, graph databases focus on relationships, and vector databases are specialized for embeddings rather than general unstructured storage.
Question 25
Which of the following is the correct order of the steps to take when a system is suspected of being vulnerable?
A. Scanning scope, identification, assessment, and remediation
B. Assessment, identification, scanning scope, and remediation
C. Identification, scanning scope, assessment, and remediation
D. Assessment, scanning scope, identification, and remediation
Show Answer
Correct Answer: A
Explanation: The correct sequence follows standard vulnerability management practice. First, the scanning scope must be defined to establish clear boundaries (systems, networks, environments) and avoid unauthorized or incomplete scanning. Next comes identification, where assets and potential vulnerabilities are discovered within that scope. Then assessment evaluates the severity and risk of the identified vulnerabilities. Finally, remediation addresses and fixes the validated issues. This aligns with disciplined security workflows and avoids scanning or assessing without a defined scope.
Question 25
Which of the following best explains the concept of migrating from on premises to the cloud?
A. The configuration of a dedicated pipeline to transfer content to a remote location
B. The creation of virtual instances in an external provider to transfer operations of selected servers into a new, remotely managed environment
C. The physical transportation installation and configuration of company IT equipment in a cloud services provider’s facility
D. The extension of company IT infrastructure to a managed service provider
Show Answer
Correct Answer: B
Explanation: Migrating from on premises to the cloud means moving workloads, applications, and servers from a local data center into a cloud provider’s environment, typically by recreating them as virtual instances managed remotely. Option B accurately captures this concept, whereas the other options describe data transfer, physical relocation of hardware, or general outsourcing rather than true cloud migration.
$19
Get all 179 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.