A customer relationship management application, which is hosted in a public cloud IaaS network, is vulnerable to a remote command execution vulnerability. Which of the following is the best solution for the security engineer to implement to prevent the application from being exploited by basic attacks?
A. IPS
B. ACL
C. DLP
D. WAF
Show Answer
Correct Answer: D
Explanation: A Web Application Firewall (WAF) is the best choice because it is specifically designed to inspect and filter HTTP/HTTPS traffic to web applications, blocking common application-layer attacks such as remote command execution attempts, SQL injection, and XSS through signatures and rules. An IPS provides broader network intrusion detection/prevention but is less specialized for protecting web applications from application-layer exploits. ACLs only filter network traffic based on addresses, ports, and protocols, and DLP focuses on preventing data exfiltration rather than stopping exploitation.
Question 82
An organization’s web application experiences periodic bursts of traffic when a new video is launched. Users are reporting poor performance in the middle of the month. Which of the following scaling approaches should the organization use to scale based on forecasted traffic?
A. Scheduled
B. Manual
C. Event
D. Load
Show Answer
Correct Answer: A
Explanation: Scheduled scaling is appropriate when traffic patterns are predictable based on known times or forecasts, such as recurring video launches in the middle of the month. Event-based and load-based scaling react to conditions after they occur, while manual scaling requires human intervention and is not suited for recurring predictable demand.
Question 83
A cloud engineer is provisioning a new application that requires access to the organization’s public cloud resources. Which of the following is the best way for the cloud engineer to authenticate the application?
A. API key
B. Cookie
C. MFA
D. Username and password
Show Answer
Correct Answer: A
Explanation: Applications typically use non-interactive credentials to access cloud APIs. Among the options, an API key is the appropriate mechanism for programmatic authentication. Cookies are for web session state, MFA is intended for interactive user authentication, and usernames/passwords are not the preferred method for application-to-cloud authentication.
Question 84
Which of the following is the best tool to deploy template-based, containerized workloads on premises and on the cloud?
A. Docker
B. Terraform
C. Jenkins
D. Git
Show Answer
Correct Answer: B
Explanation: Terraform is an infrastructure-as-code tool that uses declarative templates to deploy and manage infrastructure consistently across on-premises and cloud environments, including infrastructure supporting containerized workloads. Docker is for building/running containers, Jenkins is CI/CD, and Git is version control.
Question 85
A company experienced a data leak through its website. A security engineer, who is investigating the issue, runs a vulnerability scan against the website and receives the following output:
Which of the following is the most likely cause of this leak?
A. RTMP port open
B. SQL injection
C. Privilege escalation
D. Insecure protocol
Show Answer
Correct Answer: D
Explanation: The vulnerability scan output is not shown, but this question commonly refers to detection of an insecure service such as FTP being used. FTP transmits credentials and data in plaintext, allowing interception and resulting in data leakage. That aligns with an insecure protocol rather than SQL injection, privilege escalation, or an open RTMP port.
Question 86
Which of the following models will best reduce the cost of running short-term, non-critical workloads?
A. Reserved
B. Spot instance
C. Pay-as-you-go
D. Dedicated host
Show Answer
Correct Answer: B
Explanation: Spot instances are designed for interruptible workloads and offer substantial discounts by using spare cloud capacity. They are the most cost-effective option for short-term, non-critical, fault-tolerant workloads. Reserved instances are for predictable long-term usage, pay-as-you-go (on-demand) costs more, and dedicated hosts are the most expensive due to dedicated physical hardware.
Question 87
A cloud engineer proposes a solution to migrate a finance application to the cloud. The environment can be shared to reduce costs. Which of the following models would best meet this requirement?
A. Private
B. Community
C. Public
D. Hybrid
Show Answer
Correct Answer: B
Explanation: A community cloud is shared by organizations with common requirements, such as regulatory, security, or compliance needs in sectors like finance. It allows infrastructure sharing to reduce costs while providing governance tailored to the community. A private cloud is dedicated to one organization, a public cloud is shared broadly without industry-specific governance, and a hybrid cloud is a deployment combination rather than a sharing model.
Question 88
An organization’s large e-commerce website requires high availability and cannot have degraded performance. Which of the following should a cloud administrator do to best meet the requirements?
A. Create a secondary server and load balance the traffic.
B. Upgrade the drives to SSD and change the storage tier.
C. Add a secondary NIC and configure network teaming to the existing server.
D. Change the type of CPU and adjust the RAM size.
Show Answer
Correct Answer: A
Explanation: Creating a secondary server behind a load balancer provides redundancy and distributes traffic, meeting both high availability and performance requirements. Upgrading storage, adding NIC teaming, or increasing CPU/RAM can improve aspects of performance or network resilience but do not eliminate the single-server point of failure or provide horizontal scaling.
Question 89
Which of the following container commands implements network port mapping?
A. $docker run –it myimage –e /bin/port 8080
B. $docker run myimage:port
C. $docker run –it –p 1-65535 myimage –e netstat 8080
D. $docker run –it –p 80:8080 myimage
Show Answer
Correct Answer: D
Explanation: Docker uses the -p (or --publish) flag to map a host port to a container port in the form hostPort:containerPort. The command '-p 80:8080' maps host port 80 to port 8080 inside the container. The other options use invalid Docker syntax or misuse unrelated flags such as -e.
Question 90
Which of the following facilitates the continuous deployment of cloud applications without performing a clean install on each iteration?
A. Debian package
B. Version management
C. Container image
D. Bare-metal server
Show Answer
Correct Answer: C
Explanation: Container images package an application together with its runtime and dependencies into an immutable artifact. Continuous deployment pipelines can build and distribute updated images without performing a traditional clean install on each iteration, enabling consistent, repeatable deployments. Debian packages install software onto the host, version management tracks code or dependency versions rather than deployment artifacts, and bare-metal servers are infrastructure rather than a deployment mechanism.
$19
Get all 180 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.