A software engineer needs to transfer data over the internet using programmatic access while also being able to query the data. Which of the following will best help the engineer to complete this task?
A.SQL
B.Web sockets
C.RPC
D.GraphQLCorrect
Explanation
GraphQL is a query language for APIs that runs over HTTP, so a client gets programmatic access across the internet and can ask for exactly the fields it needs. SQL is a database query language, not an internet API transport. WebSockets provide a persistent bidirectional channel but no query capability, and RPC calls remote procedures rather than querying data.
Which of the following is a field of computer science that enables computers to identify and understand objects and people in images and videos?
A.Image reconstruction
B.Facial recognition
C.Natural language processing
D.Computer visionCorrect
Explanation
Computer vision is the field of computer science that trains computers to interpret and understand visual input such as images and video, including identifying objects and people. Facial recognition is one application within computer vision, not the field itself. Image reconstruction rebuilds images, and natural language processing deals with text and speech.
A company needs to deploy its own code directly in the cloud without provisioning additional infrastructure. Which of the following is the best cloud service model for the company to use?
A.PaaSCorrect
B.SaaS
C.IaaS
D.XaaS
Explanation
Platform as a service lets a company deploy its own code onto a managed runtime while the provider handles servers, operating systems and scaling, so no infrastructure has to be provisioned. IaaS requires the customer to provision and manage virtual machines and networks. SaaS delivers a finished application rather than running the customer's code, and XaaS is a general umbrella term.
A company just learned that the data in its object storage was accessed by an unauthorized party. Which of the following should the company have done to make the data unusable?
A.The company should have switched from object storage to file storage.
B.The company should have hashed the data.
C.The company should have changed the file access permissions.
D.The company should have encrypted the data at rest.Correct
Explanation
Encrypting data at rest means stolen or exposed objects are unreadable without the encryption keys, so unauthorized access does not expose usable data. Switching to file storage does not protect the content. Hashing is one-way and would make the data unusable for the company too, and changing permissions helps prevent access but does nothing once the data has been accessed.
A customer relationship management application, which is hosted in a public cloud IaaS network, is vulnerable to a remote command execution vulnerability. Which of the following is the best solution for the security engineer to implement to prevent the application from being exploited by basic attacks?
A.IPS
B.ACL
C.DLP
D.WAFCorrect
Explanation
A web application firewall inspects HTTP(S) requests at layer 7 and blocks common exploit patterns such as command and SQL injection before they reach the application, which suits a web-based CRM in the cloud. An ACL filters by address and port and cannot see malicious payloads in allowed web traffic. DLP prevents data leaving the organization, and a network IPS is less tailored to application-layer web attacks than a WAF.
Which of the following is a difference between a SAN and a NAS?
A.A SAN works only with fiber-based networks.
B.A SAN works with any Ethernet-based network.
C.A NAS uses a faster protocol than a SAN.
D.A NAS uses a slower protocol than a SAN.Correct
Explanation
A NAS shares files over file-level protocols such as NFS or SMB, which add file-system and network overhead compared with the block-level protocols a SAN uses, such as Fibre Channel or iSCSI, so a NAS protocol is generally slower. A SAN is not limited to fiber, since iSCSI and FCoE carry block storage over Ethernet, but it does not work with any Ethernet-based network either, because a Fibre Channel SAN uses its own Fibre Channel fabric rather than Ethernet. A NAS is not faster than a SAN.
A cloud engineer is troubleshooting an application that consumes multiple third-party REST APIs. The application is randomly experiencing high latency. Which of the following would best help determine the source of the latency?
A.Configuring centralized logging to analyze HTTP requests
B.Running a flow log on the network to analyze the packets
C.Configuring an API gateway to track all incoming requests
D.Enabling tracing to detect HTTP response times and codesCorrect
Explanation
Distributed tracing records the timing and status code of each outbound HTTP call, so the engineer can see which third-party API is responding slowly when latency spikes. Centralized logging of requests rarely captures per-call timing across services. Flow logs record packet metadata, not application response times, and an API gateway tracking incoming requests does not measure the outbound calls to third-party APIs.
A cloud engineer is reviewing the following Dockerfile to deploy a Python web application:
```dockerfile
FROM cgr.dev/chainguard/python:latest
WORKDIR /myapp
COPY main.py ./
ENTRYPOINT ["python", "/myapp/main.py"]
```
Which of the following changes should the engineer make to the file to improve container security?
A.Add the instruction USER nonroot.Correct
B.Change the version from latest to 3.11.
C.Remove the ENTRYPOINT instruction.
D.Ensure myapp/main/py is owned by root.
Explanation
Adding a USER instruction so the container runs as a non-root user limits what an attacker can do if the application is compromised, following the principle of least privilege. Pinning the image version improves reproducibility rather than security posture. Removing ENTRYPOINT would stop the application from starting, and making the script owned by root does not reduce the privileges the process runs with.
A group of cloud administrators frequently uses the same deployment template to recreate a cloud-based development environment. The administrators are unable to go back and review the history of changes they have made to the template. Which of the following cloud resource deployment concepts should the administrators start using?
A.Drift detection
B.Repeatability
C.Documentation
D.VersioningCorrect
Explanation
Versioning keeps every revision of the template, typically in a version control system, so the administrators can see who changed what and when and roll back to an earlier revision. Repeatability is what the template already provides by recreating the same environment each time. Drift detection compares deployed resources against the template rather than tracking the template's own history, and documentation describes the environment but does not record each change automatically.
A government agency in the public sector is considering a migration from on premises to the cloud. Which of the following are the most important considerations for this cloud migration? (Choose two.)
A.ComplianceCorrect
B.IaaS vs. SaaS
C.Firewall capabilities
D.RegulatoryCorrect
E.Implementation timeline
F.Service availability
Explanation
Public-sector agencies are bound by laws and regulations on data handling, residency and security, so regulatory requirements and compliance with the frameworks that implement them (such as FedRAMP-authorized services) come first when choosing a provider and design. Service model, firewall features, timeline and availability matter for any migration, but they are not what sets a government migration apart and they cannot override legal obligations.
A company wants to optimize cloud resources and lower the overhead caused by managing multiple operating systems. Which of the following compute resources would be best to help to achieve this goal?
A.VM
B.ContainersCorrect
C.Remote desktops
D.Bare-metal servers
Explanation
Containers share the host operating system kernel, so many workloads run on a few hosts without a separate guest OS for each one to patch and manage, and they use fewer resources than full VMs. Each VM carries its own operating system, which is the overhead the company wants to reduce. Remote desktops deliver user sessions rather than optimize workloads, and bare-metal servers add hardware to manage instead of consolidating it.
A company runs a discussion forum that caters to global users. The company's monitoring system reports that the home page suddenly is seeing elevated response times, even though internal monitoring has reported no issues or changes. Which of the following is the most likely cause of this issue?
A.Cryptojacking
B.Human error
C.DDoSCorrect
D.Phishing
Explanation
A distributed denial-of-service attack floods the public-facing site with traffic from many sources, so external response times rise suddenly while internal systems show no change or fault. Cryptojacking would show up internally as unexplained CPU use, human error would appear as a change, and phishing targets users' credentials rather than the site's response times.
Which of the following migration types is best to use when migrating a highly available application, which is normally hosted on a local VM cluster, for usage with an external user population?
A.Cloud to on-premises
B.Cloud to cloud
C.On-premises to cloudCorrect
D.On-premises to on-premises
Explanation
The application currently runs on a local (on-premises) VM cluster and needs to serve external users, so moving it to the cloud, an on-premises-to-cloud migration, puts it on globally reachable, highly available infrastructure. Cloud-to-cloud and cloud-to-on-premises migrations assume the application already runs in a cloud, and on-premises to on-premises keeps it in a local data center that does not address external access.
A cloud architect attempts to modify a protected branch but is unable to do so. The architect receives an error indicating the action cannot be completed. Which of the following should the architect try instead?
A.Adding a new remote
B.Creating a pull requestCorrect
C.Merging the branch
D.Rebasing the branch
Explanation
Protected branches block direct pushes, so changes must be made on another branch and proposed through a pull request (merge request), where the required reviews and status checks run before the change is merged. Adding a remote does not change the branch's protection, and merging or rebasing directly into the protected branch is exactly the kind of direct change that protection rules reject.
Which of the following container storage types loses data after a restart?
A.Object
B.Persistent volume
C.EphemeralCorrect
D.Block
Explanation
Ephemeral storage, such as a container's writable layer or a Kubernetes emptyDir volume, exists only for the life of the container or pod, so its data is lost when the container is restarted or recreated. Persistent volumes are designed to outlive pods, and object and block storage are durable back-end storage that keeps data independently of the container's lifecycle.
A developer is testing code that will be used to deploy a web farm in a public cloud. The main code block is a function to create a load balancer and a loop to create 1,000 web servers, as shown below:
```python
my_load_balancer()
for x in range(1000):
my_web_server()
```
The developer runs the code against the company's cloud account and observes that the load balancer is successfully created, but only 100 web servers have been created. Which of the following should the developer do to fix this issue?
A.Request an increase of instance quota.Correct
B.Run the code multiple times until all servers are created.
C.Check the my_web_server() function to ensure it is using the right credentials.
D.Place the my_load_balancer() function after the loop.
Explanation
Cloud providers enforce per-account service quotas on resources such as instances or vCPUs, and once the limit is reached further create requests fail, which explains why creation stopped at exactly 100 servers. Requesting a quota increase lets the loop complete. Rerunning the code hits the same limit, wrong credentials would have stopped every server from being created, and moving the load balancer call does not affect how many servers can be launched.
Following a ransomware attack, the legal department at a company instructs the IT administrator to store the data from the affected virtual machines for a minimum of one year.
Which of the following is this an example of?
A.Recoverability
B.RetentionCorrect
C.Encryption
D.Integrity
Explanation
Keeping data for a defined minimum period because of a legal or regulatory instruction is a data retention requirement, often called a legal hold. Recoverability is about being able to restore data after a loss, encryption protects confidentiality, and integrity ensures data has not been altered; none of these defines how long data must be kept.
An engineer made a change to an application and needs to select a deployment strategy that meets the following requirements:
- Is simple and fast
- Can be performed on two identical platforms
Which of the following strategies should the engineer use?
A.Blue-greenCorrect
B.Canary
C.Rolling
D.In-place
Explanation
A blue-green deployment runs two identical environments: the new version is deployed to the idle one and traffic is switched over in a single step, which is simple, fast and easy to roll back. Canary and rolling deployments shift traffic or instances gradually, so they take longer and are more involved. An in-place deployment updates the existing platform and does not use a second identical environment.
An organization needs to retain its data for compliance reasons but only when required. Which of the following would be the most cost-effective type of tiered storage?
A.Warm
B.Hot
C.ArchiveCorrect
D.Cold
Explanation
Archive storage has the lowest storage cost and is designed for data that must be kept for long periods, such as for compliance, but is accessed rarely and can tolerate long retrieval times. Hot and warm tiers cost more because they are optimized for frequent or regular access, and cold storage is cheaper than those but still more expensive than archive.
An e-commerce store is preparing for an annual holiday sale. Previously, this sale has increased the number of transactions between two and ten times the normal level of transactions. A cloud administrator wants to implement a process to scale the web server seamlessly. The goal is to automate changes only when necessary and with minimal cost.
Which of the following scaling approaches should the administrator use?
A.Scale horizontally with additional web servers to provide redundancy.
B.Allow the load to trigger adjustments to the resources.Correct
C.When traffic increases, adjust the resources using the cloud portal.
D.Schedule the environment to scale resources before the sale begins.
Explanation
Load-triggered (dynamic) autoscaling adds resources only when demand actually rises and removes them when it falls, so it is automated and keeps cost to a minimum even though the increase varies between two and ten times. Adding servers up front or scheduling scaling before the sale provisions capacity that may not be needed, and adjusting resources manually in the portal is not automated or seamless.
Verifying access...
Access Required
You need to purchase this exam to access practice mode
Unlock a few more questions every day for 300 points you earn free on
Godlike Academy. Everything you unlock with the Daily Climb stays open for 7 days after your last unlock.