D-CIS-FN-01 Cloud Infrastructure and Services Foundations Practice Questions

A WAF is essential for protecting against web-based attacks like SQL injection and cross-site scripting (XSS).

MFA is critical for securing user accounts and preventing unauthorized access, even if passwords are compromised.

An IAM system is fundamental for managing user identities and enforcing the principle of least privilege, ensuring users only have access to the resources they need.

In a microservices architecture, an application is built as a collection of small, independent services. Each service is self-contained, runs in its own process, and communicates with other services through well-defined APIs. This loose coupling allows individual services to be developed, deployed, and scaled independently, which is a major advantage over monolithic designs where the entire application must be redeployed for any change.

A hybrid cloud is a composition of a public cloud and a private environment, such as a private cloud or on-premises data center, with orchestration and connectivity between the two. The key characteristic described is the integration and workload portability between the private and public cloud environments, which defines a hybrid cloud model.

Synchronous replication is the only method that can achieve a zero RPO, as it requires write acknowledgment from both the primary and secondary sites before confirming the write to the application. However, the speed of light introduces latency over long distances (500 km). This latency directly impacts application performance, as the application must wait for the round trip acknowledgment. Therefore, meeting the zero RPO requirement with synchronous replication over a long distance while also avoiding performance impact is a significant challenge.

According to the pie chart, Compute Instances account for 55% of the total monthly cloud costs, which is more than all other categories combined. To make the most significant impact on cost reduction, the operations manager should prioritize optimizing compute resources. This could involve right-sizing instances, using reserved instances, or implementing auto-scaling.

Infrastructure as Code (IaC) tools like Terraform are specifically designed for provisioning and managing infrastructure using a declarative approach. Terraform uses a consistent workflow (init, plan, apply) and supports multiple cloud providers, which directly matches the team's requirements. While configuration management tools like Ansible can provision infrastructure, they are primarily focused on configuring existing systems (procedural), whereas Terraform excels at provisioning the systems themselves (declarative).

A Business Impact Analysis (BIA) is the foundational process in business continuity planning. Its purpose is to identify critical business functions and determine the quantitative (financial) and qualitative (reputational) impacts that a disruption might have on them. The output of the BIA, including Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO), directly informs the strategy for the Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP).

Hold Your Own Key (HYOK) is the correct model for this scenario. It allows an organization to use its on-premises key management infrastructure, such as an HSM, to generate and manage encryption keys. The cloud service uses these keys to encrypt and decrypt data but never has access to the keys themselves, fulfilling the strict compliance requirement. Cloud provider-managed keys and keys in a cloud vault both involve the provider having some level of access or control, which is forbidden by the requirements. Encryption in use protects data during processing, which is different from key management.

The 3-2-1 rule dictates maintaining at least three copies of your data (the primary data plus two backups).

The rule specifies using two different storage media types (e.g., disk and cloud storage, or disk and tape) to protect against media-specific failures.

The rule requires keeping one copy off-site to protect against local disasters like fire or flood.

Refactoring is the most appropriate approach. It involves restructuring and re-architecting parts of the application to take advantage of cloud-native features, such as breaking down the monolith into microservices. This directly addresses the need to scale and update components independently without a complete rewrite. Rehosting would not solve the underlying architectural problems. Replatforming would make only minor changes. Rebuilding implies a complete rewrite, which the company wants to avoid.