Which of the following models will best reduce the cost of running short-term, non-critical workloads?
A. Reserved
B. Spot instance
C. Pay-as-you-go
D. Dedicated host
Show Answer
Correct Answer: B
Explanation: Spot instances use spare cloud capacity and are offered at steep discounts, making them the most cost-effective option for short-term, non-critical, and fault-tolerant workloads. The trade-off is possible interruption, which is acceptable for these use cases.
Question 36
A security engineer recently discovered a vulnerability in the operating system of the company VMs. The operations team reviews the issue and decides all VMs need to be updated from version 3.4.0 to 3.5.0. Which of the following best describes the type of update that will be applied?
A. Consistent
B. Patch
C. Minor
D. Ephemeral
Show Answer
Correct Answer: C
Explanation: Under semantic versioning (MAJOR.MINOR.PATCH), changing from 3.4.0 to 3.5.0 increments the MINOR version. Patch updates would change only the third digit (e.g., 3.4.0 to 3.4.1). Therefore, this is a minor update.
Question 37
A cloud engineer proposes a solution to migrate a finance application to the cloud. The environment can be shared to reduce costs. Which of the following models would best meet this requirement?
A. Private
B. Community
C. Public
D. Hybrid
Show Answer
Correct Answer: B
Explanation: The requirement states that the environment can be shared to reduce costs for a finance application. A community cloud is designed to be shared by multiple organizations with similar regulatory, security, and compliance needs (such as finance), allowing cost savings while maintaining industry-specific controls. Private is not shared, public may not meet finance compliance expectations, and hybrid refers to combining models rather than a shared cost-reduction approach.
Question 37
A system surpasses 75% to 80% of resource consumption. Which of the following scaling approaches is the most appropriate?
A. Trending
B. Manual
C. Load
D. Scheduled
Show Answer
Correct Answer: C
Explanation: When resource utilization reaches a defined threshold (e.g., 75–80%), the most appropriate approach is load-based scaling. This method automatically monitors performance metrics like CPU or memory usage and triggers scaling actions when thresholds are crossed, unlike manual, scheduled, or trend-based approaches.
Question 38
An organization’s large e-commerce website requires high availability and cannot have degraded performance. Which of the following should a cloud administrator do to best meet the requirements?
A. Create a secondary server and load balance the traffic.
B. Upgrade the drives to SSD and change the storage tier.
C. Add a secondary NIC and configure network teaming to the existing server.
D. Change the type of CPU and adjust the RAM size.
Show Answer
Correct Answer: A
Explanation: The requirement is high availability without degraded performance. Deploying a secondary server and placing both behind a load balancer provides redundancy and distributes traffic, eliminating a single point of failure and maintaining performance during failures or traffic spikes. The other options only improve or protect a single server and do not provide true high availability.
Question 38
A cloud engineer is developing an operating expense report that will be used to purchase various cloud billing models for virtual machine instances. The cloud billing model must meet the following requirements:
• The instance cannot be ephemeral.
• The minimum life cycle of the instance is expected to be five years.
• The software license is charged per physical CPU count.
Which of the following best meets these requirements?
A. Dedicated host
B. Spot instance
C. Pay-as-you-go
D. Resource metering
Show Answer
Correct Answer: A
Explanation: A dedicated host provides long-lived, non-ephemeral virtual machine capacity with full control over the underlying physical CPUs. This is essential when software licensing is tied to physical CPU count. It also aligns with a long minimum lifecycle (five years), making it more suitable and cost-effective than ephemeral, usage-based, or metering-only models.
Question 39
Which of the following container commands implements network port mapping?
A. $docker run –it myimage –e /bin/port 8080
B. $docker run myimage:port
C. $docker run –it –p 1-65535 myimage –e netstat 8080
D. $docker run –it –p 80:8080 myimage
Show Answer
Correct Answer: D
Explanation: Docker implements network port mapping using the `-p` (or `--publish`) flag, which maps a host port to a container port in the form `host_port:container_port`. Option D correctly uses `-p 80:8080` to expose container port 8080 on host port 80. The other options misuse flags or contain invalid Docker syntax and do not perform port mapping.
Question 39
Two CVEs are discovered on servers in the company’s public cloud virtual network. The CVEs are listed as having an attack vector value of network and CVSS score of 9.0. Which of the following actions is the best way to mitigate the vulnerabilities?
A. Patching the operating systems
B. Upgrading the operating systems to the latest beta
C. Encrypting the operating system disks
D. Disabling unnecessary open ports
Show Answer
Correct Answer: A
Explanation: CVEs with a network attack vector and a high CVSS score indicate remotely exploitable vulnerabilities. Applying vendor security patches directly remediates the underlying flaws. Upgrading to beta software is risky, disk encryption does not address network exploits, and disabling ports may reduce exposure but does not fix the vulnerability itself.
Question 40
Which of the following facilitates the continuous deployment of cloud applications without performing a clean install on each iteration?
A. Debian package
B. Version management
C. Container image
D. Bare-metal server
Show Answer
Correct Answer: C
Explanation: Container images bundle an application together with its runtime and dependencies, allowing the same image to be redeployed repeatedly across environments. This supports continuous deployment and rapid iteration without requiring a clean install on each update. The other options do not inherently provide this level of deployment consistency or automation.
Question 40
A cloud engineer is concerned about command-and-control (C2) communication out of a cloud network over HTTPS. Which of the following should the cloud engineer implement to most efficiently identify the type of communication?
A. Inline IPS
B. Cloud flow logs
C. Hourly cron listing connections
D. Traffic mirroring
Show Answer
Correct Answer: D
Explanation: The goal is to efficiently identify the *type* of C2 communication hidden over HTTPS. Inline IPS and flow logs mainly provide metadata and signatures, not deep inspection of encrypted traffic. Cron-based connection listings are inefficient and superficial. Traffic mirroring allows full packet capture to external security tools that can perform deep packet inspection and TLS analysis/decryption, which is the most effective way to determine whether HTTPS traffic is C2 in nature.
$19
Get all 179 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.