QUESTION 21
A company has solid, validated border protection including a next-generation firewall and IPS. However, compromises and breaches continue. Which of the following is the best way to improve the company’s security controls and reduce the number of incidents?
A. Assess the border protection assets against a CIS benchmark and apply recommendations.
B. Execute a network scan on the border protection and close ports that can be used by attackers.
C. Shift the focus from border protection to a Zero Trust architecture focused on identities.
D. Include a WAF on the network border, increasing protection and adopting security in layers.
Correct Answer: C
QUESTION 22
Which of the following types of storage is read-only and is accessed only when needed?
A. Cold
B. Hot
C. Warm
D. Archive
Correct Answer: D
QUESTION 23
An on-call cloud engineer receives a critical alert about an e-commerce web server being unresponsive. Which of the following steps should the engineer take first?
A. Triage
B. Remediation
C. Escalation
D. Monitoring
Correct Answer: A
QUESTION 24
Which of the following is the best tool to deploy template-based, containerized workloads on premises and on the cloud?
A. Docker
B. Terraform
C. Jenkins
D. Git
Correct Answer: B
QUESTION 25
Which of the following reduces the chance of introducing a misconfiguration into cloud deployment templates?
A. Performing a git fetch after every commit
B. Opening pull requests for changes
C. Using the web interface to update files
D. Committing updates to the main branch
Correct Answer: B
QUESTION 26
Two CVEs are discovered on servers in the company’s public cloud virtual network. The CVEs are listed as having an attack vector value of network and CVSS score of 9.0. Which of the following actions is the best way to mitigate the vulnerabilities?
A. Patching the operating systems
B. Upgrading the operating systems to the latest beta
C. Encrypting the operating system disks
D. Disabling unnecessary open ports
Correct Answer: A
QUESTION 27
A cloud administrator must increase the performance of an application by modifying the server disks from HDD to SSD. In which of the following ways will the server most benefit from this change?
A. Smaller storage footprint
B. Increase in IOPS
C. More memory throughput
D. Fewer CPU cycles
Correct Answer: B
QUESTION 28
A company is running a set of replica containers with image version 1. The company updates the image to version 2 and would like to replace some of the version 1 images with version 2. During the replacement process, a minimum percentage of version 1 replicas need to be kept running while starting image version 2 containers alongside them. Which of the following deployment methods is best given the company’s requirements?
A. ln-place
B. Rolling
C. Upgrading
D. Patching
Correct Answer: B
QUESTION 29
Which of the following interfaces is most commonly used for SSDs but not for HDDs?
A. NVMe
B. Serial-attached SCSI
C. SATA
D. iSCSI
Correct Answer: A
QUESTION 30
A web server hosted in a PaaS public cloud platform has been the target of DDoS attacks. A cloud engineer needs to protect the server from future volumetric DDoS attacks. Which of the following are the best actions for the engineer to take? (Select two).
A. Add a CDN to front the web server.
B. Add a DLP on the PaaS platform.
C. Add a hardened web server instance.
D. Add an ACL to the web server network.
E. Add an IDS in-line on the web server network.
F. Add a WAF in front of the web server.
Correct Answer: AF
QUESTION 31
A company’s VMs that are created using the noncritical application tag are automatically shut down at 5.00 p.m. using a cronjob. Which of the following actions allows a cloud engineer to stop all unresponsive instances with the least effort in case the automation fails?
A. Using the cloud audit logs for tagging and stopping events
B. Using the cloud provider web console to check and stop the instances
C. Using the cloud provider command line to stop the instances based on tags
D. Using a Bash script to shut down all instances
Correct Answer: C
QUESTION 32
A cloud engineer must find the root cause of a recent performance issue. Logs and metrics have been collected and are available. Which of the following is the best way to determine the source of the issue?
A. Aggregating logs
B. Enabling tracing
C. Performing code review
D. Enabling verbose logging
Correct Answer: B
QUESTION 33
Which of the following compliance solution features is necessary for locating and retrieving relevant records in order to be prepared for potential legal proceedings?
A. Data retention
B. Data locality
C. Data classification
D. Data sovereignty
Correct Answer: A
QUESTION 34
Which of the following has the most influence when determining the maximum data loss in the event of a disaster?
A. Recovery point objective
B. Business continuity and disaster recovery
C. Mean time to recover
D. Recovery time objective
Correct Answer: A
QUESTION 35
Which of the following effects would a modification to the host affinity configuration in the cloud console have?
A. Hosts in a multicloud environment will run on the same host.
B. A VM will run only on a particular underlying host or group of hosts.
C. Host affinity configuration will have no effect in the cloud environment.
D. An affinity rule will not disqualify hosts from being eligible to start.
Correct Answer: B
QUESTION 36
A public cloud environment customer wants to encrypt the data it puts in the cloud. However, the CSP prohibits customer encryption keys. Which of the following principles is the CSP violating?
A. Data ownership
B. Data sovereignty
C. Data classification
D. Data retention
Correct Answer: A
QUESTION 37
A cloud vendor notifies an administrator that the router version currently in use will no longer be made. Which of the following describes the stage the router has reached and what needs to be done?
A. The router has reached end of support. The router’s software should be updated.
B. The router has reached end of support. The router should be replaced.
C. The router has reached end of life. The router’s software should be updated.
D. The router has reached end of life. The router should be replaced.
Correct Answer: D
QUESTION 38
A software development team must manage changes to source code for different clients who utilize the same product with different features. Which of the following meets this requirement?
A. Branch
B. Commit
C. Push
D. Merge
Correct Answer: A
QUESTION 39
A cloud resource increases its capacity based on seasonal activity. Which of the following best describes this type of cloud instance and the scaling approach?
A. Fixed; triggered by load
B. Permanent; triggered manually
C. Elastic; triggered by trend
D. Ephemeral; triggered by event
Correct Answer: C
QUESTION 40
Which of the following cloud services has the highest level of vendor lock-in?
A. Object storage
B. PaaS database
C. Virtual machine
D. File server
Correct Answer: B