Cloud+ (CV0-004). Set it up and run it.

1. A software company wants to publish a customer-facing web application without managing operating systems, patching, or runtime installation, but the developers still need to control the application code, its framework version, and its scaling rules. Which service model BEST fits this requirement?

• A. Infrastructure as a Service
• B. Software as a Service
• C. Platform as a Service
• D. Anything as a Service brokerage

Correct answer: C. PaaS hands the provider the operating system, runtime, and patching while leaving the customer in control of application code, configuration, and scaling behavior, which is exactly the split the company asked for.

Why the others are wrong. A: IaaS would still leave the company patching operating systems and installing runtimes, which is the work they specifically want to hand off. B: SaaS delivers a finished application; the company would lose the ability to deploy and control its own application code. D: This is a general marketing umbrella rather than a defined layer of responsibility, so it does not answer where the operating system work lands.

2. A team must provision a new public-facing web tier. Which two provisioning decisions support both security and scalability? (Choose two.)

• A. Assign a public IP address to every instance for direct troubleshooting access
• B. Place the instances in private subnets behind an internet-facing load balancer
• C. Set the group's minimum, desired, and maximum sizes to the same number
• D. Deploy the instances through an auto-scaling group spread across multiple availability zones
• E. Store user session state on each instance's local disk

Correct answer: B. Keeping the instances private with the load balancer as the only public entry point limits exposure, while a multi-zone scaling group supplies both elasticity and resilience.

Why the others are wrong. A: Public addresses on every instance widen exactly the attack surface the design is meant to limit. C: Locking all three values together prevents the group from scaling at all. E: Local session state breaks whenever scaling adds or replaces an instance.

3. An organization moves from an on-premises data center to an IaaS provider. Which responsibility moves to the provider under the shared responsibility model?

• A. Maintaining the physical hosts and the hypervisor
• B. Applying security patches to guest operating systems
• C. Configuring security group and firewall rules for the instances
• D. Encrypting application data before it is written to disk

Correct answer: A. In IaaS the provider owns the physical facility, hardware, and hypervisor layer; everything from the guest operating system upward stays with the customer.

Why the others are wrong. B: Guest OS patching is customer work at the IaaS layer because the customer owns the instance from the OS up. C: Network access control inside the customer's virtual network remains the customer's configuration responsibility. D: Data classification and protection stay with the customer in every service model.

4. An application server must hold a 64 GB in-memory dataset, needs 8 vCPUs, and observed processor use stays near 20 percent. Which instance family is the BEST fit?

• A. A compute-optimized family with a high vCPU-to-memory ratio
• B. A memory-optimized family with a high memory-to-vCPU ratio
• C. A general purpose family sized to the vCPU requirement
• D. A GPU accelerated family sized to the memory requirement

Correct answer: B. The binding constraint is memory rather than processing, so the family with the highest memory per vCPU delivers the required RAM without paying for cores that sit idle.

Why the others are wrong. A: Compute-optimized instances offer the least memory per core, so reaching 64 GB would mean buying far more vCPUs than the workload uses. C: Sizing a balanced family to 8 vCPUs typically yields around 32 GB, which is not enough memory for the dataset. D: There is no parallel math workload here, so GPU capacity adds significant cost for no benefit.

5. A request that passes through nine microservices is intermittently slow, but every individual service reports healthy CPU and memory. An engineer needs to find which hop in the chain adds the delay. Which telemetry type answers this question?

• A. Host-level CPU and memory metrics from each service
• B. Application log lines written by each service
• C. Distributed traces with per-span timing
• D. The load balancer's total request count per minute

Correct answer: C. Distributed traces follow a single request across service boundaries and record the time spent in each span, which is the only signal that shows where in a multi-service call path the latency accumulates.

Why the others are wrong. A: Aggregate host metrics show that resources are fine but cannot attribute the delay of one request to a specific hop. B: Logs record discrete events but without a shared correlation identifier and span timing they cannot be stitched into one request timeline. D: A request counter describes volume, not where time is spent inside a single transaction.

6. A code review finds a long-lived cloud access key ID and secret hard-coded in an application that runs on provider-managed virtual machines. Which change BEST removes the underlying risk?

• A. Make the source repository private and restrict who can clone it
• B. Attach an instance role to the virtual machines and let the SDK obtain temporary credentials automatically
• C. Move the key into an environment variable set on each virtual machine
• D. Rotate the access key every 90 days and update the source file each time

Correct answer: B. An instance or workload role supplies short-lived credentials that the platform rotates automatically, so there is no static secret to leak, commit, or forget to rotate.

Why the others are wrong. A: Repository permissions do not remove the secret, and the key remains valid to anyone who already has a copy or gains read access later. C: This only relocates the same static secret; anyone who can read the process environment or a crash dump still recovers a working credential. D: Rotation shortens the exposure window but the credential is still long-lived and still sitting in source code between rotations.

7. An engineer writes a template that says the environment must contain three web servers, one load balancer, and one database, without specifying the order in which they are created or the commands used to create them. Which approach does this describe?

• A. Imperative infrastructure as code
• B. Manual provisioning through the provider console
• C. Declarative infrastructure as code
• D. Continuous deployment of application binaries

Correct answer: C. A declarative definition states the desired end state and leaves the tool to work out the actions and ordering needed to reach it.

Why the others are wrong. A: An imperative approach spells out the sequence of steps to perform, which is exactly what this template avoids. B: Nothing here is done by hand; the environment is defined in a file that a tool applies. D: Continuous deployment moves application releases into environments and does not describe how infrastructure is expressed.

8. A finance team runs a nightly job that validates a batch of transaction files. The job runs about 40 times a night, takes 20 seconds per run, and has no state between runs. Cost must track actual use. Which compute approach BEST fits?

• A. A dedicated virtual machine sized for peak batch load
• B. A reserved instance purchased for a one-year term
• C. A container cluster with a fixed pool of three worker nodes
• D. Functions as a Service triggered by each file arrival

Correct answer: D. Short, stateless, event-driven work with idle gaps is the classic case for FaaS, because billing follows execution time and no server sits idle between runs.

Why the others are wrong. A: The VM would be billed continuously while sitting idle for most of the night, which fails the cost requirement. B: A reservation buys steady-state capacity at a discount, but the workload is intermittent so most of the committed hours are wasted. C: A fixed node pool is still paid for around the clock, so cost would not track actual use.