A cloud solutions architect needs to deploy a simple, public-facing website with the following requirements:
• Cost-effective
• Highly available
• Self-healing
• Secure
Which of the following will be the most appropriate template to use?
A.
B.
C.
D.
Show Answer
Correct Answer: A
Explanation: For a simple public-facing website, the best architecture is typically one that uses standard (non-Spot) instances behind a load balancer with Auto Scaling across multiple availability zones, providing high availability and self-healing while remaining cost-effective. Spot instances do not satisfy high-availability requirements for a production public-facing site. Between remaining choices, the template with Auto Scaling best meets the stated requirements.
Question 72
A company’s website suddenly crashed. A cloud engineer investigates the following logs:
Which of the following is the most likely cause of the issue?
A. SQL injection
B. Cross-site scripting
C. Leaked credentials
D. DDoS
Show Answer
Correct Answer: D
Explanation: A sudden website crash accompanied by logs indicating a massive spike in requests overwhelming the service is most consistent with a distributed denial-of-service (DDoS) attack. SQL injection, cross-site scripting, and leaked credentials can compromise systems or data but do not typically cause an immediate crash through request saturation alone.
Question 73
Which of the following is the correct order of the steps to take when a system is suspected of being vulnerable?
A. Scanning scope, identification, assessment, and remediation
B. Assessment, identification, scanning scope, and remediation
C. Identification, scanning scope, assessment, and remediation
D. Assessment, scanning scope, identification, and remediation
Show Answer
Correct Answer: A
Explanation: The typical vulnerability management workflow is to first define the scanning scope (what systems and assets are in scope), then identify vulnerabilities through scanning/discovery, assess the findings to determine risk and impact, and finally remediate the confirmed issues. Defining scope before scanning helps ensure the assessment targets the correct systems and avoids unintended scanning.
Question 74
A cloud security analyst is investigating the impact of a recent cyberattack. The analyst is reviewing the following information:
Which of the following has occurred?
A. The corporate administration page was defaced by the attacker
B. A denial-of-service attack was successfully performed on the web server
C. A new user was created on the web server by the attacker
D. Sensitive information from the corporate web server was leaked
Show Answer
Correct Answer: D
Explanation: Based on the available information, the most likely conclusion is that sensitive information from the corporate web server was leaked. However, the prompt appears to omit the referenced logs or evidence, so this answer is necessarily tentative without the missing information.
Question 75
An administrator is creating a cron job that shuts down the virtual machines at night to save on costs. Which of the following is the best way to achieve this task?
A.
B.
C.
D.
Show Answer
Correct Answer: C
Explanation: Based on the limited information available, the only substantive clue indicates option C performs a status check and shuts down running virtual machines, which matches the requirement for a scheduled cron job. However, the actual answer choices are missing, so this cannot be verified definitively.
Question 76
A cloud engineer is reviewing the following Dockerfile to deploy a Python web application:
Which of the following changes should the engineer make to the file to improve container security?
A. Add the instruction USER nonroot.
B. Change the version from latest to 3.11.
C. Remove the ENTRYPOINT instruction.
D. Ensure myapp/main/py is owned by root.
Show Answer
Correct Answer: A
Explanation: Running containers as a non-root user is a key container security best practice because it limits the impact of a compromise. Pinning an image version (e.g. 3.11 instead of latest) improves reproducibility but is not the primary security improvement asked here. Removing ENTRYPOINT does not inherently improve security, and ensuring the application file is owned by root is not a general requirement for container security.
Question 77
A company uses containers to implement a web application. The development team completed internal testing of a new feature and is ready to move the feature to the production environment. Which of the following deployment models would best meet the company’s needs while minimizing cost and targeting a specific subset of its users?
A. Canary
B. Blue-green
C. Rolling
D. In-place
Show Answer
Correct Answer: A
Explanation: A canary deployment releases the new version to a small subset of production users first, allowing validation with limited exposure. This targets a specific subset of users while minimizing risk and avoiding the extra infrastructure typically required for blue-green deployments, making it a cost-effective choice.
Question 78
Which of the following best describes a characteristic of a hot site?
A. Servers in the hot site are clustered with the main site.
B. Network traffic is balanced between the main site and hot site servers
C. Offline server backups are replicated hourly from the main site
D. All servers are replicated from the main site in an online status.
Show Answer
Correct Answer: D
Explanation: A hot site is a fully equipped, operational disaster recovery site that maintains systems in a ready-to-run state, typically with online replication or synchronization from the primary site to enable rapid recovery. The other options describe clustering, load balancing, or periodic offline backups, which are not defining characteristics of a hot site.
Question 79
A company just learned that the data in its object storage was accessed by an unauthorized party. Which of the following should the company have done to make the data unusable?
A. The company should have switched from object storage to file storage.
B. The company should have hashed the data.
C. The company should have changed the file access permissions.
D. The company should have encrypted the data at rest.
Show Answer
Correct Answer: D
Explanation: Encrypting data at rest ensures that if an unauthorized party accesses the stored objects, the data remains unreadable without the appropriate decryption keys. Hashing is for integrity verification, not confidentiality; changing file permissions helps prevent access but does not protect data after unauthorized access; and switching storage types does not inherently improve data confidentiality.
Question 80
Which of the following provides secure, private communication between cloud environments without provisioning additional hardware or appliances?
A. VPN
B. VPC peering
C. BGP
D. Transit gateway
Show Answer
Correct Answer: B
Explanation: VPC peering provides private, secure connectivity between VPCs over the cloud provider's internal network without requiring VPN appliances or other additional hardware. VPN requires VPN endpoints, BGP is a routing protocol rather than a connectivity service, and a transit gateway is a centralized routing hub rather than the basic point-to-point private communication mechanism described.
$19
Get all 180 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.