CompTIA Cloud+ (CV0-004) — All Questions

A company wants to run a workload where the cloud provider manages the operating system and runtime, but the company still writes and deploys its own application code. Which service model best fits this requirement?

• a.Infrastructure as a Service (IaaS)
• b.Platform as a Service (PaaS)✓
• c.Software as a Service (SaaS)
• d.Bare-metal hosting

PaaS gives developers a managed platform, including the operating system, runtime, and middleware, so they only supply and deploy application code. IaaS would leave the OS to the customer, and SaaS delivers a finished application with no custom code to deploy.

Which characteristic most directly describes elasticity in a cloud environment?

• a.The provider guarantees zero downtime for all services
• b.Data is replicated to at least three geographic regions
• c.Resources automatically expand and contract to match changing demand✓
• d.Billing is a fixed monthly amount regardless of usage

Elasticity is the automatic scaling of resources up or down to match real-time demand, which keeps performance steady while controlling cost. It is distinct from high availability (uptime) and from fixed billing, and it does not require multi-region replication.

An organization keeps sensitive workloads on infrastructure it owns while bursting less-sensitive workloads to a public cloud during peak periods. Which deployment model is this?

• a.Hybrid cloud✓
• b.Community cloud
• c.Public cloud
• d.Private cloud

A hybrid cloud combines private (owned) infrastructure with public cloud, often to keep sensitive data in-house while using public capacity for elastic bursting. A community cloud is shared by organizations with common concerns, and public or private alone would not describe the combination.

In the shared responsibility model for an IaaS deployment, which task is typically the customer's responsibility rather than the provider's?

• a.Maintaining the physical security of the data center
• b.Replacing failed hardware in the host servers
• c.Managing the hypervisor that runs customer VMs
• d.Patching the guest operating system on the customer's VMs✓

Under IaaS, the provider secures the physical facility, hardware, and virtualization layer, while the customer manages everything from the guest OS upward, including OS patching. Confusing these boundaries is a common source of misconfiguration and risk.

A design calls for storing large volumes of unstructured media files that are accessed over HTTP with metadata but rarely modified in place. Which storage type is the best fit?

• a.Block storage
• b.Object storage✓
• c.File storage
• d.Local ephemeral disk

Object storage is ideal for large, unstructured data such as media, storing each item with metadata and a unique identifier accessible over HTTP. Block storage suits databases and boot volumes, and file storage suits shared file systems; neither is optimized for massive web-accessible object retrieval.

A team wants every deployment of its network and compute resources to be reproducible, version-controlled, and auditable. Which approach best achieves this?

• a.Manually configuring resources through the web console each time
• b.Emailing a checklist of steps to the operations team
• c.Defining infrastructure as code in declarative templates✓
• d.Taking screenshots of the settings after each build

Infrastructure as code (IaC) defines resources in declarative, version-controlled templates so environments can be rebuilt identically and reviewed like any other code. Manual console changes and checklists are error-prone and not reliably reproducible or auditable.

A company moves an existing application to the cloud with no changes to its architecture, simply relocating the VMs. Which migration strategy is this?

• a.Lift-and-shift (rehost)✓
• b.Refactor (re-architect)
• c.Replatform
• d.Retire

Lift-and-shift, or rehosting, moves a workload to the cloud as-is with minimal changes, which is fast but does not gain cloud-native benefits. Replatforming makes small optimizations, refactoring redesigns the application, and retiring removes it entirely.

An administrator is subnetting a VPC and must place a database tier where instances have no direct route to the internet. Which design element accomplishes this?

• a.Assigning public IP addresses to each database instance
• b.Placing the databases in a public subnet with an internet gateway route
• c.Opening the security group to 0.0.0.0/0 on all ports
• d.Placing the databases in a private subnet with no internet gateway route✓

A private subnet has no route to an internet gateway, so its instances cannot be reached directly from the internet, which is appropriate for database tiers. Public IPs, public-subnet routing, or wide-open security groups would expose the databases.

During capacity planning for a new deployment, which metric pair is most relevant when choosing an appropriately sized compute instance?

• a.Data center latitude and longitude
• b.Expected vCPU and memory utilization✓
• c.The provider's stock ticker and market cap
• d.The color of the management console theme

Right-sizing an instance requires matching its vCPU and memory to the workload's expected utilization to avoid over-provisioning cost or under-provisioning performance. The other options have no bearing on instance sizing.

A recovery plan states that after a disaster, the application must be restored within four hours. Which metric does the four-hour target represent?

• a.Recovery Point Objective (RPO)
• b.Mean Time Between Failures (MTBF)
• c.Recovery Time Objective (RTO)✓
• d.Service Level Indicator (SLI)

The Recovery Time Objective (RTO) is the maximum acceptable time to restore service after an incident. RPO measures acceptable data loss (time), MTBF measures reliability, and an SLI is a measured performance signal.

An operations team wants to be alerted only when CPU utilization stays above 85 percent for ten consecutive minutes, to avoid noise from brief spikes. Which monitoring concept should they configure?

• a.An alert threshold with a sustained duration condition✓
• b.A one-time snapshot of the current CPU value
• c.A static inventory report generated monthly
• d.A billing alarm on total account spend

Configuring an alert threshold combined with a duration (evaluation period) ensures notifications fire only when a condition persists, reducing false alarms from transient spikes. Snapshots, inventory reports, and billing alarms do not address sustained performance alerting.

Which practice best supports a reliable backup strategy in the cloud?

• a.Storing backups only on the same volume as the production data
• b.Never testing restores to save time
• c.Keeping a single backup copy indefinitely
• d.Periodically testing restores to verify backups are usable✓

A backup is only valuable if it can be restored, so periodic restore testing verifies integrity and process. Co-locating backups with production data, skipping tests, or relying on a single copy all undermine recoverability.

A workload experiences predictable traffic surges every weekday at 9 a.m. Which automation approach most efficiently prepares capacity ahead of the surge?

• a.Reactive scaling only after latency alarms trigger
• b.Scheduled (predictive) scaling that adds capacity before 9 a.m.✓
• c.Manually launching instances each morning
• d.Disabling autoscaling to keep the environment simple

Scheduled scaling adds capacity in advance of known, recurring demand so users do not experience the lag of purely reactive scaling. Reactive-only scaling responds after degradation begins, and manual launches are error-prone and slow.

Which principle states that a user or service should be granted only the permissions required to perform its function and nothing more?

• a.Defense in depth
• b.Separation of duties
• c.Least privilege✓
• d.Non-repudiation

Least privilege limits each identity to the minimum access needed, shrinking the attack surface if credentials are compromised. Defense in depth layers controls, separation of duties splits responsibilities, and non-repudiation ensures actions cannot be denied.

To protect data as it travels between a client and a cloud API endpoint, which control is most appropriate?

• a.Transport Layer Security (TLS) encryption in transit✓
• b.Full-disk encryption on the storage array
• c.A longer object retention policy
• d.Enabling verbose application logging

TLS encrypts data in transit so it cannot be read or tampered with as it crosses the network. Full-disk encryption protects data at rest, not in transit, and retention policies and logging do not provide confidentiality on the wire.

A cloud security team wants to require a second authentication factor for all administrative logins. Which control should they implement?

• a.Single sign-on with no additional factors
• b.Multi-factor authentication (MFA)✓
• c.A shared administrator password
• d.IP allow-listing only

Multi-factor authentication requires an additional factor beyond the password, greatly reducing the impact of stolen credentials. Shared passwords remove accountability, and IP allow-listing alone does not verify the identity of the person logging in.

Which service concept lets an organization centrally create, rotate, and control access to the cryptographic keys used to encrypt cloud data?

• a.A content delivery network
• b.A load balancer
• c.An object lifecycle policy
• d.A key management service (KMS)✓

A key management service centralizes creation, rotation, and access control for encryption keys, supporting compliance and separation of duties. CDNs, load balancers, and lifecycle policies serve delivery, distribution, and retention purposes, not key management.

In a CI/CD pipeline, what is the primary purpose of the continuous integration stage?

• a.To automatically build and test code changes as they are merged✓
• b.To provision the production database for the first time
• c.To manually approve every line of code by email
• d.To archive old log files from production servers

Continuous integration automatically builds and runs tests against changes as they are merged, catching defects early and keeping the mainline healthy. It is distinct from provisioning, manual approvals, or log archival.

A team deploys a new version alongside the current one and shifts a small percentage of live traffic to it to observe behavior before a full rollout. Which deployment strategy is this?

• a.Blue-green deployment
• b.Big-bang deployment
• c.Canary deployment✓
• d.Rollback-only deployment

A canary deployment routes a small slice of traffic to the new version to detect problems before exposing all users. Blue-green switches all traffic between two full environments at once, and a big-bang replaces everything simultaneously with higher risk.

Which technology packages an application with its dependencies into a lightweight, portable unit that shares the host operating system kernel?

• a.A traditional virtual machine
• b.A container✓
• c.A dedicated bare-metal server
• d.A SAN volume

Containers package an application and its dependencies into a portable unit that shares the host kernel, making them lighter and faster to start than full virtual machines. VMs virtualize entire operating systems, and bare-metal and SAN concepts are unrelated to this packaging model.

What is the main role of a container orchestration platform such as Kubernetes?

• a.To compile source code into machine binaries
• b.To act as a relational database engine
• c.To encrypt data at rest on object storage
• d.To automate deployment, scaling, and self-healing of containerized workloads✓

Orchestration platforms automate scheduling, scaling, health checks, and recovery of containers across a cluster. They are not compilers, databases, or encryption engines; those are separate concerns.

Why is storing infrastructure code and application code in a version control system considered a DevOps best practice?

• a.It permanently prevents any bugs from being written
• b.It provides history, collaboration, and the ability to roll back changes✓
• c.It eliminates the need for testing entirely
• d.It automatically doubles compute performance

Version control provides a change history, enables collaboration through review, and allows teams to roll back to a known-good state. It does not eliminate bugs or testing, nor does it affect raw compute performance.