Your Answer : (Not Answered)

Correct Answer : A

Correct answer: encrypting the instance's disks at rest

Encryption at rest does not limit the blast radius, because an attacker who controls the instance has whatever access the instance itself has - the volumes are decrypted transparently for it. What it defends against is the disk being read outside that context. The other three genuinely contain a compromise: a narrow security group limits what the instance can reach, a minimal role limits what it can call, and a private subnet removes the direct route in and out.

Your Answer : (Not Answered)

Correct Answer : B

Both are true and the reason gives the mechanism, and the remedy lies in the shared resource rather than in adding yet more instances, which only increase the contention for it. Sharding, caching or a read replica addresses the cause where more instances cannot.

Your Answer : (Not Answered)

Correct Answer : D

Files on a local disk are visible to one instance only and lost when it is replaced. The other three all remove state from the instance where it would prevent scaling. Object storage is the usual destination for the uploads in the fourth option.

Your Answer : (Not Answered)

Correct Answer : B

Both are true and the reason gives the timing problem, and queue depth or request rate often lead processor saturation by exactly the interval needed. Choosing the metric well matters more than tuning the thresholds around it.

Your Answer : (Not Answered)

Correct Answer : B

It allows a backend to hold session state in memory but undermines even load distribution. Moving the state to a shared store removes the need for it entirely. Affinity should be treated as a temporary accommodation, not a permanent design.

Your Answer : (Not Answered)

Correct Answer : C

The address range is hardest to change later, so it comes first and should leave room. Security rules come last because they depend on what has been placed where. Growth room is worth planning for. The range is the hardest thing to change.

Your Answer : (Not Answered)

Correct Answer : C

Correct answer: Both A and R are true, and R is the correct explanation of A

Both are true and the reason names the two charges that catch people out. Archive classes bill for retrieval, sometimes substantially, and impose a minimum storage duration so that an object deleted early is billed as though it had stayed. Data read or churned frequently can therefore cost more in an archive class than in a standard one, which is why lifecycle rules must be set from the actual access pattern.

Your Answer : (Not Answered)

Correct Answer : B

Correct answer: protects the media but not a valid credential

Encryption at rest defends against the physical layer - a stolen or decommissioned disk, a mislaid backup. It does nothing against a request bearing valid credentials, because the service decrypts on the way out as a matter of course. Access control, key management and audit are what defend against that, which is why encryption at rest is a compliance baseline rather than a security strategy.

Your Answer : (Not Answered)

Correct Answer : D

Both are true and the reason gives both objections, and losing the underlying storage loses the snapshot along with the machine it was meant to protect. Growth is the other objection. Dependence on the same storage is fatal.

Your Answer : (Not Answered)

Correct Answer : B

Correct answer: A-2, B-4, C-1, D-3

The two hypervisor types differ in what lies beneath them: a type 1, or bare metal, hypervisor runs directly on the hardware, while a type 2 runs as an application on top of a conventional operating system. The guest is the operating system inside a virtual machine, and the host is the physical machine together with its hypervisor.

Your Answer : (Not Answered)

Correct Answer : B

Correct answer: 1 and 2 only

Statements 1 and 2 define the two terms correctly. Statement 3 collapses a real distinction: hybrid is about spanning deployment models and is usually driven by data residency, existing investment or latency, while multi-cloud is about spanning providers and is usually driven by resilience, negotiating position or the wish to use a particular service. An estate can be both, or either alone.

Your Answer : (Not Answered)

Correct Answer : A

Correct answer: Both A and R are true, and R is the correct explanation of A

Both are true and the reason gives the criterion. The hybrid model is about combining *deployment models* - typically private with public - not about counting providers. Two public clouds, however tightly integrated, remain the same model twice over, and the word for that is multi-cloud. The distinction matters because the two arrangements are adopted for quite different reasons.

Your Answer : (Not Answered)

Correct Answer : C

Correct answer: A-2, B-4, C-1, D-3

Four models distinguished by who shares the infrastructure. Public is open to the general public and shared among unrelated tenants. Private is exclusive to one organisation. Community is shared by organisations with a common concern - a regulator, a sector, a research consortium. Hybrid is two or more of these bound together so that data and applications can move between them.

Your Answer : (Not Answered)

Correct Answer : C

Correct answer: control over configuration and versions

Infrastructure as a service is chosen when the specifics matter - a particular kernel or database version, an unusual network arrangement, a licence tied to the machine, a compliance requirement about where and how software runs. The other three options are claims the model does not support: it means more operational work, not less, and neither better security nor lower cost follows automatically from it.

Your Answer : (Not Answered)

Correct Answer : B

No provider can know who should have access or what the data means. This is why access misconfiguration is the most persistent category of cloud security failure. Meaning stays with the owner. No provider can know who should have access.

Your Answer : (Not Answered)

Correct Answer : B

Both are true and the reason gives the advantage, though the cost is a loss of control over version and configuration that a few workloads genuinely need. Most workloads never notice the loss. A few genuinely need a specific version.

Your Answer : (Not Answered)

Correct Answer : A

The provider handles patching, backup and failover while the customer designs the schema and writes the queries. It is the classic example of a platform service. Backup and failover come with it. The schema remains the customer's work.

Your Answer : (Not Answered)

Correct Answer : B

Correct answer: a hosted email or relationship product

Software as a service is a finished application the customer simply uses, with no infrastructure, runtime or application maintenance visible - hosted email and CRM being the standard examples. A block volume and a rented virtual machine are infrastructure, and a managed Kubernetes cluster is a platform on which the customer still deploys and runs their own software.

Your Answer : (Not Answered)

Correct Answer : D

Zones within a region are isolated for failure but connected with low latency. Deploying across zones protects against a single facility failure while staying within one region. Zones fail independently. Two regions are needed for regional resilience. Zone failure is the case a pair protects against.

Your Answer : (Not Answered)

Correct Answer : A

Correct answer: on-demand self-service

NIST lists five: on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. Self-service comes first because it is the one that changes how the organisation works - capacity is obtained without raising a request or waiting on anyone, which is what turns provisioning from a project into a command. Unlimited capacity, guaranteed availability and free access are none of them, and no provider offers any of the three.