CompTIA Cloud+ (CV0-004) — All Questions

A company wants to run a workload where the cloud provider manages the operating system and runtime, but the company still writes and deploys its own application code. Which service model best fits this requirement?

• a.Software as a Service (SaaS)
• b.Platform as a Service (PaaS)✓
• c.Bare-metal hosting
• d.Infrastructure as a Service (IaaS)

PaaS gives developers a managed platform, including the operating system, runtime, and middleware, so they only supply and deploy application code. IaaS would leave the OS to the customer, and SaaS delivers a finished application with no custom code to deploy.

Which characteristic most directly describes elasticity in a cloud environment?

• a.Billing is a fixed monthly amount regardless of usage
• b.The provider guarantees zero downtime for all services
• c.Data is replicated to at least three geographic regions
• d.Resources automatically expand and contract to match changing demand✓

Elasticity is the automatic scaling of resources up or down to match real-time demand, which keeps performance steady while controlling cost. It is distinct from high availability (uptime) and from fixed billing, and it does not require multi-region replication.

An organization keeps sensitive workloads on infrastructure it owns while bursting less-sensitive workloads to a public cloud during peak periods. Which deployment model is this?

• a.Private cloud
• b.Public cloud
• c.Hybrid cloud✓
• d.Community cloud

A hybrid cloud combines private (owned) infrastructure with public cloud, often to keep sensitive data in-house while using public capacity for elastic bursting. A community cloud is shared by organizations with common concerns, and public or private alone would not describe the combination.

In the shared responsibility model for an IaaS deployment, which task is typically the customer's responsibility rather than the provider's?

• a.Patching the guest operating system on the customer's VMs✓
• b.Managing the hypervisor that runs customer VMs
• c.Replacing failed hardware in the host servers
• d.Maintaining the physical security of the data center

Under IaaS, the provider secures the physical facility, hardware, and virtualization layer, while the customer manages everything from the guest OS upward, including OS patching. Confusing these boundaries is a common source of misconfiguration and risk.

A design calls for storing large volumes of unstructured media files that are accessed over HTTP with metadata but rarely modified in place. Which storage type is the best fit?

• a.File storage
• b.Object storage✓
• c.Local ephemeral disk
• d.Block storage

Object storage is ideal for large, unstructured data such as media, storing each item with metadata and a unique identifier accessible over HTTP. Block storage suits databases and boot volumes, and file storage suits shared file systems; neither is optimized for massive web-accessible object retrieval.

A team wants every deployment of its network and compute resources to be reproducible, version-controlled, and auditable. Which approach best achieves this?

• a.Emailing a checklist of steps to the operations team
• b.Manually configuring resources through the web console each time
• c.Defining infrastructure as code in declarative templates✓
• d.Taking screenshots of the settings after each build

Infrastructure as code (IaC) defines resources in declarative, version-controlled templates so environments can be rebuilt identically and reviewed like any other code. Manual console changes and checklists are error-prone and not reliably reproducible or auditable.

A company moves an existing application to the cloud with no changes to its architecture, simply relocating the VMs. Which migration strategy is this?

• a.Retire
• b.Lift-and-shift (rehost)✓
• c.Replatform
• d.Refactor (re-architect)

Lift-and-shift, or rehosting, moves a workload to the cloud as-is with minimal changes, which is fast but does not gain cloud-native benefits. Replatforming makes small optimizations, refactoring redesigns the application, and retiring removes it entirely.

An administrator is subnetting a VPC and must place a database tier where instances have no direct route to the internet. Which design element accomplishes this?

• a.Opening the security group to 0.0.0.0/0 on all ports
• b.Placing the databases in a private subnet with no internet gateway route✓
• c.Assigning public IP addresses to each database instance
• d.Placing the databases in a public subnet with an internet gateway route

A private subnet has no route to an internet gateway, so its instances cannot be reached directly from the internet, which is appropriate for database tiers. Public IPs, public-subnet routing, or wide-open security groups would expose the databases.

During capacity planning for a new deployment, which metric pair is most relevant when choosing an appropriately sized compute instance?

• a.The provider's stock ticker and market cap
• b.Expected vCPU and memory utilization✓
• c.The color of the management console theme
• d.Data center latitude and longitude

Right-sizing an instance requires matching its vCPU and memory to the workload's expected utilization to avoid over-provisioning cost or under-provisioning performance. The other options have no bearing on instance sizing.

A recovery plan states that after a disaster, the application must be restored within four hours. Which metric does the four-hour target represent?

• a.Mean Time Between Failures (MTBF)
• b.Recovery Point Objective (RPO)
• c.Recovery Time Objective (RTO)✓
• d.Service Level Indicator (SLI)

The Recovery Time Objective (RTO) is the maximum acceptable time to restore service after an incident. RPO measures acceptable data loss (time), MTBF measures reliability, and an SLI is a measured performance signal.

An operations team wants to be alerted only when CPU utilization stays above 85 percent for ten consecutive minutes, to avoid noise from brief spikes. Which monitoring concept should they configure?

• a.A one-time snapshot of the current CPU value
• b.A static inventory report generated monthly
• c.An alert threshold with a sustained duration condition✓
• d.A billing alarm on total account spend

Configuring an alert threshold combined with a duration (evaluation period) ensures notifications fire only when a condition persists, reducing false alarms from transient spikes. Snapshots, inventory reports, and billing alarms do not address sustained performance alerting.

Which practice best supports a reliable backup strategy in the cloud?

• a.Storing backups only on the same volume as the production data
• b.Periodically testing restores to verify backups are usable✓
• c.Keeping a single backup copy indefinitely
• d.Never testing restores to save time

A backup is only valuable if it can be restored, so periodic restore testing verifies integrity and process. Co-locating backups with production data, skipping tests, or relying on a single copy all undermine recoverability.

A workload experiences predictable traffic surges every weekday at 9 a.m. Which automation approach most efficiently prepares capacity ahead of the surge?

• a.Scheduled (predictive) scaling that adds capacity before 9 a.m.✓
• b.Reactive scaling only after latency alarms trigger
• c.Disabling autoscaling to keep the environment simple
• d.Manually launching instances each morning

Scheduled scaling adds capacity in advance of known, recurring demand so users do not experience the lag of purely reactive scaling. Reactive-only scaling responds after degradation begins, and manual launches are error-prone and slow.

Which principle states that a user or service should be granted only the permissions required to perform its function and nothing more?

• a.Separation of duties
• b.Non-repudiation
• c.Defense in depth
• d.Least privilege✓

Least privilege limits each identity to the minimum access needed, shrinking the attack surface if credentials are compromised. Defense in depth layers controls, separation of duties splits responsibilities, and non-repudiation ensures actions cannot be denied.

To protect data as it travels between a client and a cloud API endpoint, which control is most appropriate?

• a.Enabling verbose application logging
• b.A longer object retention policy
• c.Full-disk encryption on the storage array
• d.Transport Layer Security (TLS) encryption in transit✓

TLS encrypts data in transit so it cannot be read or tampered with as it crosses the network. Full-disk encryption protects data at rest, not in transit, and retention policies and logging do not provide confidentiality on the wire.

A cloud security team wants to require a second authentication factor for all administrative logins. Which control should they implement?

• a.IP allow-listing only
• b.Multi-factor authentication (MFA)✓
• c.Single sign-on with no additional factors
• d.A shared administrator password

Multi-factor authentication requires an additional factor beyond the password, greatly reducing the impact of stolen credentials. Shared passwords remove accountability, and IP allow-listing alone does not verify the identity of the person logging in.

Which service concept lets an organization centrally create, rotate, and control access to the cryptographic keys used to encrypt cloud data?

• a.A key management service (KMS)✓
• b.An object lifecycle policy
• c.A load balancer
• d.A content delivery network

A key management service centralizes creation, rotation, and access control for encryption keys, supporting compliance and separation of duties. CDNs, load balancers, and lifecycle policies serve delivery, distribution, and retention purposes, not key management.

In a CI/CD pipeline, what is the primary purpose of the continuous integration stage?

• a.To manually approve every line of code by email
• b.To archive old log files from production servers
• c.To provision the production database for the first time
• d.To automatically build and test code changes as they are merged✓

Continuous integration automatically builds and runs tests against changes as they are merged, catching defects early and keeping the mainline healthy. It is distinct from provisioning, manual approvals, or log archival.

A team deploys a new version alongside the current one and shifts a small percentage of live traffic to it to observe behavior before a full rollout. Which deployment strategy is this?

• a.Big-bang deployment
• b.Rollback-only deployment
• c.Blue-green deployment
• d.Canary deployment✓

A canary deployment routes a small slice of traffic to the new version to detect problems before exposing all users. Blue-green switches all traffic between two full environments at once, and a big-bang replaces everything simultaneously with higher risk.

Which technology packages an application with its dependencies into a lightweight, portable unit that shares the host operating system kernel?

• a.A container✓
• b.A traditional virtual machine
• c.A SAN volume
• d.A dedicated bare-metal server

Containers package an application and its dependencies into a portable unit that shares the host kernel, making them lighter and faster to start than full virtual machines. VMs virtualize entire operating systems, and bare-metal and SAN concepts are unrelated to this packaging model.

What is the main role of a container orchestration platform such as Kubernetes?

• a.To act as a relational database engine
• b.To encrypt data at rest on object storage
• c.To automate deployment, scaling, and self-healing of containerized workloads✓
• d.To compile source code into machine binaries

Orchestration platforms automate scheduling, scaling, health checks, and recovery of containers across a cluster. They are not compilers, databases, or encryption engines; those are separate concerns.

Why is storing infrastructure code and application code in a version control system considered a DevOps best practice?

• a.It permanently prevents any bugs from being written
• b.It automatically doubles compute performance
• c.It eliminates the need for testing entirely
• d.It provides history, collaboration, and the ability to roll back changes✓

Version control provides a change history, enables collaboration through review, and allows teams to roll back to a known-good state. It does not eliminate bugs or testing, nor does it affect raw compute performance.