CompTIA Cloud Essentials+ (CLO-002)

C. Both the uptime and response time guarantees were violated.

First, calculate the uptime: 30 days * 24 hours/day * 60 minutes/hour = 43,200 total minutes. Downtime = 20 minutes. Uptime = 43,200 - 20 = 43,180 minutes. Uptime % = (43,180 / 43,200) * 100 = 99.9536%. Since 99.9536% is greater than or equal to 99.95%, the uptime guarantee was NOT violated. Second, the response time increased to 150ms, which is above the 100ms maximum, meaning the response time guarantee WAS violated. Therefore, only the response time guarantee was violated.

A. Rapid Elasticity

Rapid elasticity is the ability of a cloud system to quickly scale resources up or down in response to changing demand, often automatically. This perfectly matches the requirement for handling sudden, unpredictable traffic spikes without manual intervention.

B. Platform as a Service (PaaS)

PaaS provides a complete development and deployment environment in the cloud, abstracting away the underlying infrastructure management. This allows developers to focus on application code, which directly aligns with the startup's need.

C. Snapshots taken every hour, replicated to a secondary region, with automated recovery scripts.

An RPO of 1 hour means data loss must be limited to the last hour, which hourly snapshots satisfy. An RTO of 4 hours requires a fast recovery mechanism, which automated recovery scripts leveraging replicated snapshots to a secondary region can provide, significantly faster than manual or full backup restorations.

C. Multi-cloud portability strategy

A multi-cloud portability strategy uses open standards, containers, and platform-agnostic tooling to design applications that can be deployed or migrated across multiple cloud providers, reducing dependency on any single vendor's proprietary technologies and mitigating vendor lock-in risk.

C. Resource tagging

Resource tagging allows administrators to assign custom metadata (key-value pairs) to cloud resources. This metadata can then be used for organizing, tracking, cost allocation, and applying policies for access control across different resources consistently.

C. Availability Zones (AZs)

Availability Zones (AZs) are distinct, isolated locations within a single cloud region. They are designed to be independent of each other, providing fault isolation for power, cooling, and networking, thus mitigating the impact of a single data center failure.

C. Integrity

Data integrity ensures that data remains accurate, consistent, and unaltered over its entire lifecycle. For sensitive financial data subject to regulatory scrutiny, ensuring that data cannot be changed or deleted without detection is paramount to maintaining its trustworthiness and compliance.

B. Using a Golden Image (AMI/VM Image)

A Golden Image, also known as an AMI (Amazon Machine Image) or VM Image, is a pre-configured template that includes the operating system, applications, and desired security configurations (like closed ports and installed agents). Using it ensures consistency and automation for newly provisioned VMs.

C. Object Storage

Object storage is highly scalable, highly available by design, inherently supports encryption at rest and in transit, and can be accessed concurrently by multiple compute instances via APIs, making it ideal for sensitive, shared, and scalable data processing.

B. Global Reach and Availability Zones

Global Reach and Availability Zones refer to a cloud provider's widespread network of data centers and isolated locations within those regions. This characteristic directly addresses the need to deploy applications in new geographic regions to reduce latency and comply with data sovereignty laws by placing data and services closer to users and within specific jurisdictional boundaries.

A. The customer is responsible for both patching the OS and data encryption.

In an IaaS model, the customer is responsible for the operating system (including patching) and everything above it, including application data and its encryption. The cloud provider is responsible for the underlying physical infrastructure and its security.

C. Monitoring

Monitoring tools collect data on resource performance and health, providing visibility into operational status and utilization. They also allow setting up alerts based on predefined thresholds, directly addressing the engineer's requirements.

A. Implementing automated scheduled start/stop of VMs

Automated scheduled start/stop of VMs directly addresses the problem of idle resources. By stopping VMs outside of business hours, the administrator eliminates compute costs for the majority of the week, leading to significant and immediate savings.

A. Managing which employees have access to customer records

In a SaaS model, the provider manages nearly the entire stack, including infrastructure, OS, and application code, but the customer always retains responsibility for their own data and identity and access management, such as controlling which employees can view records.

A. Hybrid Cloud

Hybrid cloud combines private infrastructure (for sensitive data) with public cloud resources (for less sensitive modules), allowing organizations to meet specific regulatory and security requirements while still benefiting from cloud scalability.

C. Operational Expenditure (OpEx)

Operational Expenditure (OpEx) involves paying for services or products as they are consumed, typically on a recurring basis. This model avoids large upfront costs, making it ideal for startups with limited capital.

A. Total Cost of Ownership (TCO)

Total Cost of Ownership (TCO) provides a holistic view of all costs, both direct (hardware, software, cloud subscriptions) and indirect (maintenance, administration, downtime, training, energy, opportunity costs), over the entire lifecycle of an asset or solution. This makes it ideal for comparing on-premises vs. cloud over multiple years.

A. Direct Connect / ExpressRoute

Direct Connect (AWS) or ExpressRoute (Azure) are dedicated, private network connections from an on-premises data center to a public cloud provider. They bypass the public internet, offering consistent, high-bandwidth, and low-latency connectivity, which can resolve intermittent performance issues caused by public internet routing.

B. $150,000

ALE = Single Loss Expectancy (SLE) × Annualized Rate of Occurrence (ARO) = $50,000 × 3 = $150,000. This quantitative measure helps prioritize risk treatment decisions and justify security spending.

C. NAT Gateway

A NAT Gateway allows instances in a private subnet to connect to services outside the VPC (like the public internet) while preventing external services from initiating connections to those instances. By routing outbound traffic through a NAT Gateway, which can then be configured to send traffic via a security appliance, the administrator can enforce inspection for all outbound public internet traffic.

C. Technical Feasibility

Technical feasibility evaluates whether the proposed cloud solution can be implemented with existing technology, resources, and capabilities. Incompatibility with specific hardware and OS versions directly relates to the technical ability to migrate and run applications in the cloud.

A. Refactoring

Refactoring, also known as re-architecting, involves significant modifications to an application's code and architecture to take full advantage of cloud-native features and services. This approach is chosen when an application requires substantial changes to optimize its performance, scalability, and cost-efficiency in the cloud.

C. High Performance IOPS SSD Block Storage

For 'extremely high IOPS' and 'very low latency' for a transactional database processing millions of transactions, a specialized 'High Performance IOPS SSD Block Storage' is the most appropriate. General Purpose SSD Block Storage offers good performance but not the 'extremely high' levels needed, and object/archive storage are unsuitable for databases with these performance demands.

B. Deterrent control

A deterrent control discourages undesirable behavior by warning of consequences, such as a monitoring notice, without technically blocking or detecting the action itself. It differs from preventive controls that block actions and detective controls that identify them after they occur.