8 CompTIA Cloud+ Questions Most Candidates Get Wrong
Here are 8 multiple-choice questions designed to match the difficulty, style, and domain coverage of the CompTIA Cloud+ (CV0-004) exam. These questions test your applied knowledge of cloud concepts, architecture, security, and operations.
Instructions: Choose the single best answer for each question. The questions are scenario-based to reflect the real exam’s focus on practical decision-making. For a deeper dive, check out 10 AWS Cloud Practitioner Questions Most Candidates Get Wrong.
Q1. A company is migrating a legacy application to the cloud. The application has unpredictable usage spikes and requires a low upfront cost. Which cloud pricing model is the most cost-effective choice?
A. Reserved Instances
B. On-demand Instances
C. Dedicated Hosts
D. Savings Plans
Answer: B
Explanation: On-demand pricing allows you to pay only for what you use with no upfront commitment, which is ideal for unpredictable workloads. Reserved Instances and Savings Plans require a 1- or 3-year commitment, which is risky for spiky usage. Dedicated Hosts are a physical server solution, not a pricing model, and are the most expensive option.
Q2. A cloud administrator needs to ensure that a VM's data is immediately recoverable if the underlying physical host fails. Which configuration best meets this requirement?
A. Snapshotting the VM every hour
B. Storing the VM on a RAID 5 virtual disk
C. Using a hypervisor-level high availability (HA) cluster
D. Placing the VM in a different availability zone
Answer: C
Explanation: Hypervisor HA automatically restarts the VM on a different healthy host in the cluster upon a physical host failure, ensuring rapid recovery. Snapshots are for rollback, not high availability. RAID 5 protects against disk failure, not host failure. Availability zones protect against entire data center failures, but a VM is not automatically moved there without a failover plan.
Q3. Which of the following is the PRIMARY benefit of implementing a "lift and shift" migration strategy?
A. Optimizing the application to use cloud-native services
B. Reducing the total cost of ownership (TCO) immediately
C. Migrating to the cloud with minimal changes to the application
D. Automatically scaling the application based on demand Readers also benefit from 10 AWS Advanced Networking Specialty Questions Most Candidates Get Wrong.
Answer: C
Explanation: Lift and shift (rehosting) moves applications to the cloud without redesigning them, which is the fastest and least risky migration path. It does not optimize for cloud-native features (A) and often does not reduce TCO immediately (B). Auto-scaling (D) requires application modifications to be effective, which is not part of a pure lift and shift.
Q4. A security auditor requires that all data stored in the cloud be encrypted at rest. The company needs to manage its own encryption keys. Which solution should the administrator implement?
A. Enabling default encryption with the cloud provider's managed key
B. Using a Customer-Managed Key (CMK) with a Key Management Service (KMS)
C. Encrypting the data before sending it to the cloud via a VPN
D. Implementing a Network Access Control List (NACL) on the storage subnet
Answer: B
Explanation: A CMK allows the customer to have full control over the lifecycle of the encryption key, including rotation and revocation, meeting the auditor's requirement. Option A gives the provider control. Option C protects data in transit, not at rest. Option D is a network security control, not a data encryption control.
Q5. A cloud administrator is deploying a three-tier web application. They need to ensure that the database tier is not accessible from the public internet, but it must be accessible by the application tier. Which of the following is the BEST way to achieve this?
A. Place both tiers in the same public subnet.
B. Place the database in a private subnet and the application in a public subnet.
C. Assign a public IP address to the database server.
D. Use a VPN connection for all database traffic.
Answer: B
Explanation: A private subnet isolates the database from the internet, while a public subnet allows the web tier to receive traffic. The application tier can reach the database via a private IP address. Option A exposes the database to the internet. Option C directly exposes it. Option D is for remote user access, not internal server-to-server communication.
Q6. A company is deploying a new application and expects a steady, predictable workload for the next 3 years. They want the lowest possible cost for compute resources. Which purchasing option should they choose?
A. On-demand instances
B. Spot instances You might also find 7 AWS DevOps Engineer Professional Questions Most Candidates Get Wrong helpful.
C. Reserved Instances
D. Burstable instances
Answer: C
Explanation: Reserved Instances require a 1- or 3-year commitment and offer a significant discount (up to 70%) compared to on-demand, making them the lowest cost for predictable, steady-state workloads. Spot instances are cheaper but can be terminated at any time, making them unsuitable for a steady baseline. On-demand is the most expensive. Burstable instances are for VMs that are idle most of the time and do not have a steady high CPU load.
Q7. Which of the following failure domains provides the BEST protection against a regional outage?
A. Availability Zone
B. Fault Domain
C. Update Domain
D. Region
Answer: D
Explanation: A region is a large geographic area containing multiple availability zones. Deploying across two separate regions protects against a total regional failure (e.g., a natural disaster). An Availability Zone (A) is a single data center within a region. Fault (B) and Update (C) domains are within a single data center and protect against rack/network failures, not regional outages.
Q8. A cloud administrator needs to identify which user in their organization made a specific API call to delete a storage bucket last week. Which tool should they review?
A. Cloud monitoring dashboard
B. Cloud audit log
C. Configuration management database (CMDB)
D. Network flow logs
Answer: B
Explanation: Cloud audit logs (e.g., AWS CloudTrail, Azure Activity Log) record all API calls, including the user, time, source IP, and action taken. Monitoring dashboards (A) show performance metrics, not user actions. A CMDB (C) tracks configuration items, not user activity. Network flow logs (D) track IP traffic, not API-level user actions.
These questions cover key domains like architecture, security, and cost management. For more practice and to simulate the full exam environment, make sure you're timing yourself and reviewing the explanations for every answer.
If you want a schedule that fits your available study time, a free CompTIA Cloud+ study plan can map out your preparation.
Take the guesswork out of your exam prep — CompTIA Cloud+ practice exam questions let you know where you really are.
If you want a quick check of your weak topics before test day, a free CompTIA Cloud+ readiness check shows which areas to review.