A cloud engineer is concerned about command-and-control (C2) communication out of a cloud network over HTTPS. Which of the following should the cloud engineer implement to most efficiently identify the type of communication?
A. Inline IPS
B. Cloud flow logs
C. Hourly cron listing connections
D. Traffic mirroring
Show Answer
Correct Answer: D
Explanation: Traffic mirroring provides a copy of network packets to security analysis tools for deep inspection, making it the most effective way to identify HTTPS-based command-and-control communication. Inline IPS may detect known threats but is not primarily for analyzing communication type, flow logs contain metadata rather than payload details, and a cron job listing connections provides only basic connection information.
Question 62
Users report that in-house developed software has performance issues and behaves in unexpected ways following a recent update. The developers investigate and find buffer overflows and broken authentications. Which of the following best describes what caused this issue?
A. Leaked credentials
B. Poor coding practices
C. Cipher suite depreciation
D. Incompatible hardware
Show Answer
Correct Answer: B
Explanation: Buffer overflows and broken authentication are software vulnerabilities that typically arise from insecure or poor coding practices introduced during development or updates. They are not primarily caused by leaked credentials, deprecated cipher suites, or incompatible hardware.
Question 63
Which of the following cloud services has the highest level of vendor lock-in?
A. Object storage
B. PaaS database
C. Virtual machine
D. File server
Show Answer
Correct Answer: B
Explanation: PaaS databases typically have the highest vendor lock-in because they often rely on provider-specific managed services, APIs, operational features, backup/replication mechanisms, and integrations that make migration more complex than moving virtual machines, files, or object data. Virtual machines are relatively portable, object storage is often accessible through broadly supported APIs despite some differences, and file servers generally use standard protocols.
Question 64
A company’s cybersecurity team receives the following alert that a production VM was deleted from the virtual network:
21 September 09:19:08 (GMT-5)
Resource with ID: PROD-WEB001 was deleted by User: Logging
Service -
The console to manage virtual network resources uses directory authentication. Only users in a particular directory group can interactively access the virtual network management console. The logging service account is not part of this group and requires some local administration privileges to aggregate logs from various resources. The cybersecurity team discovers that the logging service account was previously given full directory administration privileges and they see the following entry:
21 September 09:10:55 (GMT-5)
User with ID: Logging Service was added to the Group: VNet
Console Administrators by actor: Logging Service.
The cybersecurity team removes the compromised service account from the directory group. Which of the following should the cybersecurity team do next to prevent repeat instances of this issue?
A. Enable two-factor authentication on the virtual network console.
B. Reset the logging service account to use a long and complex password.
C. Disable RDP on the production virtual machines.
D. Create a scoped administrative role for the logging service account.
Show Answer
Correct Answer: D
Explanation: The incident was enabled by excessive privileges on the logging service account. Because it had full directory administration rights, it could add itself to the virtual network console administrators group and then delete the VM. Removing it from the group addresses the immediate access, but preventing recurrence requires applying least privilege by replacing broad administrative rights with a narrowly scoped role that grants only the permissions needed for log aggregation. Two-factor authentication, a stronger password, or disabling RDP do not address the root cause of excessive authorization.
Question 65
An administrator attempts to use a script to deploy a cloud-based virtual machine with five data disks. After running the script, the administrator sees the following message:
ERROR: Response 403 storage API provisioning error
Which of the following is the reason the deployment failed?
A. Permission issues
B. Partial outage
C. Functionality deprecation
D. Sizing issues
Show Answer
Correct Answer: A
Explanation: An HTTP 403 'Forbidden' response indicates the request was understood but the caller is not authorized to perform the requested action. A storage API provisioning error with status 403 most commonly reflects insufficient permissions (such as missing RBAC roles or access policies), not an outage, deprecation, or VM sizing limitation.
Question 66
A software development team must manage changes to source code for different clients who utilize the same product with different features. Which of the following meets this requirement?
A. Branch
B. Commit
C. Push
D. Merge
Show Answer
Correct Answer: A
Explanation: A branch is used to maintain separate lines of development, allowing client-specific features or versions to be managed independently while sharing the same codebase. Commits record changes, pushes upload commits to a remote repository, and merges integrate changes between branches.
Question 67
Which of the following costs would increase significantly for data transfer when comparing a multiregion to a single-region cloud platform design?
A. Storage
B. Power and cooling
C. Network
D. Compliance and regulation
Show Answer
Correct Answer: C
Explanation: Network data transfer costs increase significantly in a multi-region architecture because traffic between regions is typically billed at higher rates than traffic within a single region or within availability zones. Storage, power/cooling, and compliance are not the primary data transfer cost drivers in this comparison.
Question 68
Which of the following should be used on containers to process data and keep the output in files for later review?
A. Standard output
B. Optical disk mount
C. Ephemeral storage
D. Persistent volumes
Show Answer
Correct Answer: D
Explanation: Persistent volumes provide durable storage that persists beyond the lifecycle of individual containers, making them appropriate for storing processed output files that need to be reviewed later. Standard output is for logs/streaming output, ephemeral storage is temporary and tied to the container or pod lifecycle, and an optical disk mount is not a standard container storage mechanism.
Question 69
A developer is sending requests to a SaaS application. The developer becomes unable to send anymore requests after sending a number of them, but other developers can still send requests. Which of the following is most likely causing the issue?
A. Partial outage
B. API throttling
C. Rate limiting
D. Service quota
Show Answer
Correct Answer: C
Explanation: Rate limiting is the most likely cause because the restriction applies to a single developer after they have sent many requests, while other developers can still make requests. A partial outage would affect broader availability. API throttling is a general mechanism for controlling request rates, but the condition described—an individual client hitting its allowed request rate—is typically referred to as rate limiting. A service quota is usually a longer-term allocation limit rather than a temporary per-client request cap.
Question 70
A company has solid, validated border protection including a next-generation firewall and IPS. However, compromises and breaches continue. Which of the following is the best way to improve the company’s security controls and reduce the number of incidents?
A. Assess the border protection assets against a CIS benchmark and apply recommendations.
B. Execute a network scan on the border protection and close ports that can be used by attackers.
C. Shift the focus from border protection to a Zero Trust architecture focused on identities.
D. Include a WAF on the network border, increasing protection and adopting security in layers.
Show Answer
Correct Answer: C
Explanation: If an organization already has effective, validated perimeter controls (NGFW and IPS) yet continues to suffer compromises, the problem is likely not insufficient border security but attacks that exploit identities, endpoints, cloud services, or lateral movement after initial access. A Zero Trust architecture emphasizes continuous verification, least privilege, strong identity controls, and limiting lateral movement, addressing these common modern attack paths more effectively than further hardening the perimeter. The other options primarily add or tune perimeter defenses, which are less likely to resolve the stated issue.
$19
Get all 180 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.