Q1. A company is migrating its on-premises email server to a cloud-based solution. They want to ensure that sensitive customer emails stored in the cloud are protected from unauthorized access and data breaches. Which of the following cloud security concepts is MOST critical for safeguarding this data in transit and at rest?
-
Identity and Access Management (IAM)
-
Shared Responsibility Model
-
Data Encryption ✓ Correct
-
Network Segmentation
Why: Data Encryption is paramount for protecting sensitive data both while it is being transferred over networks (in transit) and while it is stored on cloud servers (at rest). This ensures that even if unauthorized access occurs, the data remains unreadable. While IAM is important for controlling who can access the data, it doesn't protect the data itself if an authenticated user with malicious intent gains access or if the storage medium is compromised. The Shared Responsibility Model defines who is responsible for what security aspects, but it doesn't directly provide the technical protection. Network Segmentation can limit the blast radius of a breach but does not inherently protect the data within the segmented network.
Q2. A small business is looking to improve its IT infrastructure by leveraging cloud services for scalability and cost-efficiency. They primarily need to host a custom-built web application that experiences fluctuating user traffic. Which cloud deployment model would BEST suit this scenario, allowing for rapid scaling up and down based on demand?
-
Private Cloud
-
Hybrid Cloud
-
Community Cloud
-
Public Cloud ✓ Correct
Why: The Public Cloud model is ideal for applications with fluctuating demand and the need for rapid scalability. Providers offer resources on a pay-as-you-go basis, allowing businesses to easily scale resources up during peak times and down during off-peak times, thus optimizing costs. A Private Cloud offers dedicated resources but lacks the same elasticity and is often more expensive to scale. A Hybrid Cloud combines public and private resources, which could be an option, but the primary driver here is the elastic scaling for the web application, which is a core strength of the Public Cloud. A Community Cloud is shared among organizations with common concerns, which is not specified as a requirement.
Q3. A company is looking to deploy a new application that requires significant processing power and large amounts of RAM, but they want to minimize upfront hardware costs and ensure scalability. They need a solution where the computing resources are delivered over the network and are billed on a pay-as-you-go basis. Which of the following cloud service models BEST fits these requirements?
-
Infrastructure as a Service (IaaS) ✓ Correct
-
Platform as a Service (PaaS)
-
Software as a Service (SaaS)
-
Function as a Service (FaaS)
Why: Infrastructure as a Service (IaaS) provides virtualized computing resources over the internet, including servers, storage, and networking. This model directly addresses the need for scalable computing power and RAM while minimizing upfront hardware investment and offering a pay-as-you-go pricing structure. Platform as a Service (PaaS) offers a platform for developing, running, and managing applications but abstracts away the underlying infrastructure management, which may not give the company the granular control needed for specific resource allocation. Software as a Service (SaaS) delivers ready-to-use software applications over the internet, which is not suitable for deploying a custom application requiring significant resource control. Function as a Service (FaaS) is event-driven and executes code in response to events, which is too granular for managing overall application infrastructure needs.
Q4. A managed service provider needs to run 12 isolated customer web servers on a single physical host, and each customer requires guaranteed control over the operating system, kernel modules, and dedicated virtual disks. Density and maximum isolation between tenants are the top priorities, with no host operating system consuming resources. Which virtualization approach BEST meets these requirements?
-
Deploy a Type 1 (bare-metal) hypervisor and provision each customer as a separate virtual machine ✓ Correct
-
Deploy a Type 2 (hosted) hypervisor on top of a Windows Server installation and create the VMs there
-
Run each customer's web server in an application container sharing the host kernel
-
Configure a single VM with 12 network-isolated virtual NICs for the customers
Why: A Type 1 hypervisor runs directly on the hardware without a host OS, giving each VM its own full OS and kernel while maximizing density and isolation—exactly what multi-tenant hosting demands. A Type 2 hypervisor loses resources to the underlying Windows Server host OS and adds an extra failure/attack layer, reducing density and isolation. Containers share a single host kernel, so customers could not independently control kernel modules and isolation is weaker than full VMs. A single VM with multiple virtual NICs would place all tenants in the same OS, providing no meaningful isolation at all.
Q5. A company wants to move its email and productivity suite to a provider-managed offering where the vendor maintains the application, patches it, and the users simply log in through a browser. The IT team explicitly wants zero responsibility for the underlying OS, runtime, or the application code itself. Which cloud service model BEST fits this requirement?
-
Software as a Service (SaaS) ✓ Correct
-
Platform as a Service (PaaS)
-
Infrastructure as a Service (IaaS)
-
A private cloud built on internal hypervisors
Why: SaaS delivers a fully managed application over the web where the provider handles everything from hardware to the application itself, matching the requirement for zero OS, runtime, and code responsibility. PaaS still requires the customer to deploy and manage their own application code on the provider's runtime. IaaS leaves the customer responsible for the guest OS, patching, and applications on rented virtual infrastructure. A private cloud on internal hypervisors would place the entire maintenance burden—OS, patching, and app—back on the internal IT team, the opposite of what they want.
Q6. A retailer runs its baseline workload in a public cloud but experiences massive, unpredictable traffic spikes during seasonal sales that briefly exceed its normal capacity. Management wants to keep sensitive customer records on-premises for compliance while automatically bursting only the extra compute demand into the public cloud during peaks. Which deployment strategy BEST satisfies these needs?
-
Implement a hybrid cloud with cloud bursting configured for peak demand ✓ Correct
-
Migrate the entire environment to a single public cloud region with reserved instances
-
Consolidate everything into a fully on-premises private cloud sized for peak load
-
Adopt a community cloud shared with other retailers in the same sector
Why: A hybrid cloud keeps regulated data on-premises while cloud bursting elastically shifts only the overflow workload to the public cloud during spikes, meeting both the compliance and rapid-scaling goals. Moving entirely to public cloud with reserved instances contradicts the requirement to keep sensitive records on-premises and reserved capacity is poorly suited to bursty, unpredictable demand. Sizing an on-premises private cloud for peak load wastes resources that sit idle most of the year and cannot scale beyond its fixed hardware. A community cloud is designed for shared governance among like organizations and does not provide the on-premises data residency plus elastic burst capability described here.
Q7. An application developer is configuring a Type 2 hypervisor on their local enterprise workstation to test a multi-tier application. The environment consists of a database VM, a web server VM, and a client VM. The developer needs these three VMs to communicate with each other, and they also need all three VMs to pull configuration files from a shared folder hosted on the physical workstation's operating system. To satisfy strict corporate data-loss prevention (DLP) policies, under no circumstances should any of these virtual machines be able to send packets to or receive packets from the external corporate LAN or the public Internet. Which virtual network connection type should the developer assign to the virtual network interface cards (vNICs) of these VMs?
-
Host-only ✓ Correct
-
Bridged
-
NAT (Network Address Translation)
-
Private / Internal
Why: Host-only networking is the correct choice because it restricts all virtual machine network traffic to a private, isolated network segment shared exclusively between the virtual machines and the host operating system. This allows VM-to-VM communication and VM-to-Host communication (to access the shared folder) while completely preventing any access to the host's physical network adapter, the corporate LAN, or the Internet. Bridged networking is incorrect because it binds the vNICs directly to the physical network adapter, placing the VMs on the corporate LAN and violating DLP policies. NAT is incorrect because, while it prevents inbound connections, it still permits outbound access from the VMs to the local network and the Internet using the host's IP address. Private/Internal networking is incorrect because it restricts communication strictly to VM-to-VM traffic, preventing the VMs from communicating with the host OS to access the required shared folder.
Q8. Which cloud computing model provides virtualized hardware, storage, and networking over the internet?
-
Infrastructure as a Service (IaaS) ✓ Correct
-
Platform as a Service (PaaS)
-
Software as a Service (SaaS)
-
Desktop as a Service (DaaS)
Why: IaaS provides fundamental compute, storage, and network resources, allowing users to deploy and run arbitrary software. PaaS provides a platform for software development, whereas SaaS provides ready-to-use software applications over the internet. DaaS is a specific service model delivering virtual desktops rather than raw infrastructure resources.
Q9. Which virtual machine component translates guest OS hardware requests into commands for the physical host?
-
Hypervisor ✓ Correct
-
Virtual Switch
-
Virtual NIC
-
Cloud Orchestrator
Why: The hypervisor manages physical resources and allocates them to virtual machines, acting as an abstraction layer between the guest OS and hardware. A virtual switch manages network traffic between virtual machines, not hardware translation. A virtual NIC serves as the interface for guest network connectivity. A cloud orchestrator manages the automated deployment of services across cloud environments.
Q10. A small business requires a private cloud solution that allows them to maintain full control over data security and hardware. Which implementation should they choose?
-
On-premises private cloud ✓ Correct
-
Public cloud multitenancy
-
Community cloud infrastructure
-
Hybrid cloud deployment
Why: An on-premises private cloud keeps all hardware and data within the organization's control, fulfilling the requirement for full data sovereignty. Public cloud multitenancy involves sharing resources with other customers, which may violate security policies. Community clouds share resources among organizations with common concerns, and hybrid clouds mix public and private resources, both of which reduce total control compared to an on-premises solution.