Free CompTIA Cloud+ Practice Test (CV0-004) 2026

Right answer (C): Rapid elasticity (NIST SP 800-145) provisions and releases capacity automatically based on demand. An auto-scaling group tied to CPU CloudWatch alarms would scale OUT past 12 instances at 13:00 and scale IN to 2-3 overnight, fixing both saturation and waste.

Wrong answers:

• A): Measured service is the metering/billing characteristic that produces the cost column - it reports usage but does not change capacity.
• B): Resource pooling is the multi-tenant abstraction the provider uses internally; it does not adjust your fleet size.
• D): Broad network access means the service is reachable over standard networks and clients - irrelevant to right-sizing capacity.

Right answer (B): Hybrid cloud combines on-premises infrastructure with public cloud, bound together by orchestration or dedicated connectivity (Direct Connect / ExpressRoute / Cloud Interconnect). The diagram is textbook hybrid: regulated data stays on-prem, elastic tiers run in AWS.

Wrong answers:

• A): Public-only would have no on-prem component, but HRIS and file shares are explicitly on-prem.
• C): Community cloud is shared between organizations with similar compliance needs - there is only one tenant here.
• D): Multi-cloud requires two or more public providers (e.g., AWS + Azure); only AWS is shown.

Right answer (A): Zero Trust ("never trust, always verify") evaluates identity, device, location, and session attributes on every request. The conditions block - MFA presence, MFA age, source IP, and principal tag - is a canonical Zero Trust enforcement point.

Wrong answers:

• B): Perimeter-based security trusts everything inside the boundary; this policy revalidates even from inside 10.0.0.0/16.
• C): Segmentation alone is the SourceIp condition only - this policy adds identity, MFA, and tags.
• D): Implicit allow is the opposite of what this policy does; access is denied unless every condition is met.

Right answer (D): The block configures SSE-KMS with a customer-managed key (CMK), which is encryption at rest. TLS in transit is enforced separately (via bucket policy denying aws:SecureTransport=false), and tokenization/hashing are application-layer concerns.

Wrong answers:

• A): In-transit encryption requires TLS / aws:SecureTransport conditions, which are not in this resource.
• B): Tokenization replaces sensitive values with non-sensitive surrogates and is not what SSE-KMS does.
• C): Object integrity (ETag/MD5/SHA-256) is metadata; SSE encrypts but does not by itself verify integrity.

Right answer (B): IaC defines infrastructure (VPCs, subnets, ASGs, security groups) declaratively in code that is versioned and applied repeatably. Terraform is the canonical IaC tool; CloudFormation, Bicep, and Pulumi are equivalents.

Wrong answers:

• A): Configuration management (Ansible, Chef, Puppet) configures inside existing servers; it does not provision VPCs or ASGs.
• C): CI is the pipeline that runs terraform plan/apply, not the act of defining infrastructure as code.
• D): PaaS is a service consumption model (App Service, App Engine), not a way of writing infrastructure definitions.

Right answer (A): Rehosting (lift and shift) moves workloads to the cloud with minimal changes - exactly what VM Import/Export of unmodified OVAs accomplishes. It is the fastest path but captures the least cloud-native value.

Wrong answers:

• B): Refactor would mean rewriting the apps to containers, microservices, or serverless - the scenario explicitly says no app changes.
• C): Repurchase replaces the workload with SaaS (e.g., on-prem Exchange to M365); the VMs are still VMs here.
• D): Retire decommissions; nothing is being decommissioned, all 80 VMs are migrated.

Right answer (C): Distributing the ASG across three AZs and using Multi-AZ RDS means the loss of AZ-1a removes 1/3 of the app capacity and triggers an automatic RDS failover to the 1b standby - the service stays up.

Wrong answers:

• A): Vertical scaling makes a single instance bigger; if its AZ fails, the instance fails with it.
• B): Same-AZ backups vanish or become unreachable along with the AZ.
• D): Bigger instances do nothing for AZ-level fault tolerance - they share fate with the AZ they run in.

Right answer (B): Sustained high CPU, latency 10x+ above threshold, and freeable memory near zero are textbook capacity exhaustion - the instance is undersized for the workload and needs more vCPU/RAM (or read replicas to offload reads).

Wrong answers:

• A): Security-group rule count is a configuration metric and does not indicate compute pressure.
• C): IAM user count is governance, not capacity.
• D): DNS lookup time measures Route 53/resolver behavior, not RDS load.

Right answer (D): 504 means the LB could not get a response from a backend in time. Two of three targets are unhealthy and the 30-second target_processing_time matches the idle timeout - the issue is at the backend / health-check layer, not the app code.

Wrong answers:

• A): Cert expiration produces 502 / SSL handshake errors, not 504 timeouts.
• B): DNS issues produce NXDOMAIN or no connection - not intermittent timeouts after a successful connection.
• C): App logs are clean and a third instance returns 200 successfully - the code path works.

Right answer (A): The rule table opens 80, 443, and ICMP, but TCP/22 is missing - so inbound SSH is implicitly denied. Status checks pass because the OS is healthy; only the firewall is the problem. Add an inbound rule allowing TCP/22 from your admin CIDR.

Wrong answers:

• B): A deleted OS would fail the instance status check (1/2), not pass 2/2.
• C): If the region were offline, the EC2 console itself would be inaccessible.
• D): Hypervisor thermal events are extremely rare on managed cloud hardware and would surface as instance retirement or impaired status, not pass 2/2.