Free CV0-004 Practice Questions – 2026 Updated

The Payment Card Industry Data Security Standard (PCI-DSS) is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. A fundamental principle of PCI-DSS is the protection of cardholder data. Specifically, Requirement 3 mandates the protection of stored cardholder data, requiring the Primary Account Number (PAN) to be rendered unreadable wherever it is stored. Requirement 4 mandates the encryption of cardholder data during transmission over open, public networks. These requirements directly address the prohibition of exchanging or storing credit card data in cleartext.

A. CSA: The Cloud Security Alliance (CSA) provides research and best practices for cloud security (e.g., the Cloud Controls Matrix), but it is not a regulatory standard specifically for credit card data.

B. GDPR: The General Data Protection Regulation (GDPR) is a European Union regulation focused on the protection of personal data and privacy of EU citizens, not exclusively on payment card information.

C. SOC 2: A Service Organization Control 2 (SOC 2) report is an audit of a service organization's controls related to security, availability, processing integrity, confidentiality, and privacy, but it is not the specific standard governing credit card data.

1. PCI Security Standards Council. (2022). Payment Card Industry (PCI) Data Security Standard: Requirements and Security Assessment Procedures

Version 4.0. Page 48

Requirement 3.5.1 states

"Primary account number (PAN) is rendered unreadable wherever it is stored." Page 58

Requirement 4.2.1 states

"Strong cryptography and security protocols are used to safeguard PAN during transmission over open

public networks."

2. Amazon Web Services (AWS). (2024). PCI DSS Compliance. AWS Compliance Documentation. Retrieved from https://aws.amazon.com/compliance/pci-dss-level-1-faqs/. The documentation states

"The PCI DSS is a proprietary information security standard for organizations that handle branded credit cards from the major card schemes."

3. Microsoft Azure. (2024). Azure compliance documentation: PCI DSS. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-pci-dss. The document clarifies

"The Payment Card Industry (PCI) Data Security Standards (DSS) is a global information security standard designed to prevent fraud through increased control of credit card data."

A Common Vulnerability and Exposure (CVE) identifies a specific, known software flaw. The standard and most direct method to remediate such a vulnerability is to apply the security patch released by the vendor. Given the critical CVSS score of 9.0 and a network attack vector, the vulnerability is remotely exploitable and poses a significant risk. Patching the operating systems directly addresses and eliminates the underlying security flaw, which is the most effective and appropriate mitigation strategy. This action is a fundamental component of vulnerability management and security hygiene.

Upgrading to beta software is not a recommended security practice for production systems as it is untested and likely contains its own bugs and vulnerabilities.

Encrypting operating system disks protects data at rest but offers no protection against a network-based attack that exploits a vulnerability in the running OS.

Disabling ports is a hardening measure but does not fix the vulnerability itself and may not be feasible if the flaw exists on a necessary, business-critical service.

1. National Institute of Standards and Technology (NIST) Special Publication 800-40r4 (Draft)

Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology. Section 2.1

"The Importance of Patch Management

" states

"Patch management is the process of identifying

acquiring

installing

and verifying patches for products and systems. Patches correct security and functionality problems in software and firmware." This establishes patching as the direct corrective action for vulnerabilities.

2. AWS Well-Architected Framework

Security Pillar (July 2023). Page 49

under "Vulnerability Management

" recommends

"Perform vulnerability scans and patching in a timely manner to reduce the attack surface... Automate patching to operating systems and applications to reduce the window of opportunity for an attacker." This highlights patching as a primary security control in a public cloud environment.

3. FIRST.org

Common Vulnerability Scoring System v3.1: Specification Document. Section 2.1

"Attack Vector (AV)

" defines the "Network" value

confirming the remote exploitability. Section 4

"Qualitative Severity Rating Scale

" categorizes a CVSS Base Score of 9.0-10.0 as "Critical

" underscoring the urgency for remediation.

4. Microsoft Azure Documentation

Remediate findings from Microsoft Defender for Endpoint. The documentation outlines the process for handling discovered vulnerabilities

stating

"After you've identified the devices at risk

you can remediate them with a security recommendation." These recommendations consistently prioritize applying vendor-supplied security updates (patches).

A direct connection, such as AWS Direct Connect, Azure ExpressRoute, or Google Cloud Interconnect, establishes a dedicated, private physical or logical network link between an on-premises data center and the cloud provider's network. By bypassing the public internet, this method avoids the variable performance, unpredictable routing, and congestion inherent to shared networks. This results in a highly consistent network experience with minimal latency and lower overhead compared to internet-based solutions like VPNs, which must contend with public network conditions and the processing overhead of encryption/decryption.

A. Site-to-site VPN: This method tunnels traffic over the public internet, which leads to unpredictable latency and performance. The encryption process also introduces computational overhead.

B. Peer-to-peer VPN: This is not the standard terminology for connecting an entire on-premises network to a cloud environment and still relies on the public internet, sharing the same drawbacks as a site-to-site VPN.

D. Peering: In a cloud context, this typically refers to connecting two virtual networks within the cloud (e.g., VPC Peering). It does not describe a dedicated connection from an on-premises location.

1. Microsoft Azure Documentation. (2023). What is Azure ExpressRoute? Microsoft Learn. In the "Benefits" section

it states

"ExpressRoute connections don't go over the public Internet. They offer more reliability

faster speeds

consistent latencies

and higher security than typical connections over the Internet."

2. Amazon Web Services Documentation. (2023). AWS Direct Connect FAQs. Under the question "How is AWS Direct Connect different from an IPsec VPN Connection?"

the documentation explains

"An IPsec VPN connection utilizes the internet... AWS Direct Connect bypasses the internet... [providing] a more consistent network experience than internet-based connections."

3. Google Cloud Documentation. (2023). Choosing a Network Connectivity product. The comparison table shows that for the requirement of "Lowest latency

" the recommended solution is "Dedicated Interconnect

" which is a direct connection. It explicitly contrasts this with Cloud VPN

which operates over the internet.

Cloud-native monitoring services (like AWS CloudWatch, Azure Monitor, or Google Cloud's operations suite) provide high-level metrics from the hypervisor by default, such as overall CPU utilization for a VM. However, to collect detailed in-guest operating system data, such as process-level memory usage, it is necessary to install a dedicated monitoring agent. This agent software runs inside the VM, collects the specified metrics directly from the OS, and sends them to the cloud monitoring service. For an autoscaling group, the agent is installed on the base machine image, ensuring all new instances automatically report these detailed metrics, making it the most effective and scalable solution.

A. Configuring page file/swap metrics: This only tracks the usage of virtual memory on disk, which is an indicator of memory pressure, not a direct measurement of memory usage by individual processes.

C. Scheduling a script to collect the data: This is a custom, non-native solution. While possible, it requires manual development and maintenance and is less integrated and reliable than using the purpose-built agent provided by the cloud platform.

D. Enabling memory monitoring in the VM configuration: This option typically enables hypervisor-level memory metrics, which report the total memory consumed by the VM as a whole, but lack the visibility to report on individual processes running inside the guest OS.

1. Amazon Web Services (AWS) Documentation. The CloudWatch agent is required to collect guest OS-level metrics. "By default

EC2 instances send hypervisor-visible metrics to CloudWatch... To collect metrics from the operating system or from applications

you must install the CloudWatch agent."

Source: AWS Documentation

"The metrics that the CloudWatch agent collects

" Section: "Predefined metric sets for the CloudWatch agent."

2. Microsoft Azure Documentation. The Azure Monitor agent is used to collect in-depth data from the guest operating system of virtual machines. "Use the Azure Monitor agent to collect guest operating system data from Azure... virtual machines... It collects data from the guest operating system and delivers it to Azure Monitor."

Source: Microsoft Learn

"Azure Monitor agent overview

" Introduction section.

3. Google Cloud Documentation. The Ops Agent is Google's solution for collecting detailed telemetry from within Compute Engine instances. "The Ops Agent is the primary agent for collecting telemetry from your Compute Engine instances. It collects both logs and metrics." The agent can be configured to collect process metrics.

Source: Google Cloud Documentation

"Ops Agent overview

" What the Ops Agent collects section.

4. Armbrust

M.

et al. (2010). A View of Cloud Computing. This foundational academic paper from UC Berkeley discusses the challenges of cloud monitoring

implying the need for mechanisms beyond the hypervisor to understand application-level performance. The distinction between what the infrastructure provider can see (hypervisor-level) and what the user needs to see (in-guest) necessitates agent-based approaches for detailed monitoring.

Source: Communications of the ACM

53(4)

50-58. Section 5.3

"Monitoring and Auditing." DOI: https://doi.org/10.1145/1721654.1721672

Infrastructure as a Service (IaaS) is the most appropriate model as it provides fundamental computing resources, including virtual servers, networking, and storage. This gives the engineering department the maximum level of control needed to provision a large cluster of servers (100+), install custom operating systems and dependencies, and deploy their in-house software for a comprehensive scalability test. The on-demand, pay-as-you-go nature of IaaS is ideal for a temporary, month-long project, allowing the company to access massive computing power without the capital expense of purchasing physical hardware.

A. PaaS abstracts the underlying server infrastructure, which would limit the team's ability to control the environment and install the specific software stack required for their test.

B. SaaS provides ready-to-use software applications, not the underlying infrastructure needed to test a company's own custom-developed software.

C. DBaaS is a specialized service for managing databases. It does not provide the general-purpose server cluster needed to run the application itself.

1. Mell

P.

& Grance

T. (2011). The NIST Definition of Cloud Computing (NIST Special Publication 800-145). National Institute of Standards and Technology.

Page 2

Section "Infrastructure as a Service (IaaS)": "The capability provided to the consumer is to provision processing

storage

networks

and other fundamental computing resources where the consumer is able to deploy and run arbitrary software

which can include operating systems and applications." This directly supports the need to deploy in-house software on a large number of servers.

2. Armbrust

M.

Fox

A.

Griffith

R.

Joseph

A. D.

Katz

R.

Konwinski

A.

Lee

G.

Patterson

D.

Rabkin

A.

Stoica

I.

& Zaharia

M. (2009). Above the Clouds: A Berkeley View of Cloud Computing (Technical Report No. UCB/EECS-2009-28). University of California

Berkeley.

Page 5

Section 3.1: Discusses how IaaS enables "pay-as-you-go" access to infrastructure

which is ideal for short-term

large-scale needs like the month-long test described

a use case often termed "batch processing" or "elastic computing."

3. Microsoft Azure Documentation. (n.d.). What is Infrastructure as a Service (IaaS)?

Section "Common IaaS business scenarios": "Test and development. Teams can quickly set up and dismantle test and development environments

bringing new applications to market faster. IaaS makes it quick and economical to scale up dev-test environments up and down." This explicitly validates using IaaS for temporary

large-scale testing.

Ephemeral storage, also known as container-scoped storage, is intrinsically tied to the lifecycle of a container. It exists as the container's writable layer. When a container is stopped, restarted, or deleted, this writable layer is destroyed, and any data written to it is permanently lost. This type of storage is suitable for temporary files or cache data that an application needs during its runtime but does not need to persist. The data does not survive a restart, which directly answers the question.

A. Object: Object storage is a persistent storage service external to the container. Data is managed as objects and is not lost when a container restarts.

B. Persistent volume: A persistent volume is an abstraction for a piece of storage that exists independently of a container's or pod's lifecycle, explicitly designed to preserve data.

D. Block: Block storage provides persistent volumes that can be attached to containers. The data on these volumes is independent of the container's lifecycle and survives restarts.

---

1. Kubernetes Documentation

"Volumes". The official Kubernetes documentation describes ephemeral volume types like emptyDir. It states

"When a Pod is removed from a node for any reason

the data in the emptyDir is deleted forever." This confirms that data in this type of volume is lost when the container's pod is terminated. (Source: Kubernetes.io

Concepts > Storage > Volumes

Section: emptyDir).

2. Docker Documentation

"Manage data in Docker". The official Docker documentation explains that data not stored in a volume is written to the container's writable layer. It clarifies

"The data doesn't persist when that container is no longer running

and it can be difficult to get the data out of the container if another process needs it." (Source: Docker Docs

Storage > Volumes > "Manage data in Docker").

3. Red Hat Official Documentation

"Understanding container storage". This vendor documentation distinguishes between ephemeral and persistent storage. For ephemeral storage

it notes

"The storage is tightly coupled with the container’s life cycle. If the container crashes or is stopped

the storage is lost." (Source: Red Hat Customer Portal

OpenShift Container Platform 4.10 > Storage > "Understanding container storage"

Section: "Ephemeral storage").

4. University of California

Berkeley

"CS 162: Operating Systems and System Programming"

Lecture 19: "Virtual Machines

Containers

and Cloud Computing". Course materials often describe the container file system as a series of read-only layers with a final writable layer for the specific container. This top writable layer is ephemeral and is discarded when the container is destroyed. (Reference concept covered in typical advanced OS/Cloud Computing university curricula).

The core of the question is protecting data from a natural disaster by using a geographically separate facility. This practice is known as off-site disaster recovery. By renting a colocation space in another part of the country, the organization establishes a secondary location that is unlikely to be affected by the same disaster that impacts the primary site. This geographic separation is the fundamental principle of an off-site strategy, ensuring business continuity and data availability in the event of a regional catastrophe.

A. On-site: This practice involves keeping data backups or redundant systems at the same physical location as the primary data, offering no protection against a site-wide disaster like a fire or flood.

B. Replication: This is the process of copying data. While replication is a mechanism used to send data to an off-site location, "off-site" is the specific disaster recovery practice described in the scenario.

C. Retention: This refers to policies that dictate how long data is stored. Data retention is unrelated to the physical location of data for disaster recovery purposes.

1. National Institute of Standards and Technology (NIST) Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems. Section 4.3.2

"Alternate Storage Site

" states: "An alternate storage site is used for storage of backup media... The site should be geographically separated from the primary site so as not to be susceptible to the same hazards." This directly supports the concept of using a geographically distant location (off-site) for disaster protection.

2. Amazon Web Services (AWS)

Disaster Recovery of Workloads on AWS: Recovery in the Cloud (July 2021). Page 6

in the section "Backup and Restore

" discusses storing backups in a separate AWS Region. It states

"By replicating your data to another Region

you can protect your data in the unlikely event of a regional disruption." This exemplifies the off-site practice in a cloud context.

3. Microsoft Azure Documentation

Disaster recovery and high availability for Azure applications. In the section "Azure services that provide disaster recovery

" it describes Azure Site Recovery

which "replicates workloads to a secondary location." The use of a secondary

geographically distinct location is the definition of an off-site strategy.

The optimal backup solution must meet three criteria: cost-effectiveness, granular recovery, and multilocation storage.

1. Multilocation: An off-site or cloud-based storage solution is essential for disaster recovery, satisfying the multilocation requirement by storing data in a geographically separate location from the primary site.

2. Cost-Effective & Granular Recovery: A strategy combining full, incremental, and differential backups provides the most flexibility. Incremental backups are highly cost-effective as they only copy data that has changed since the last backup of any type, minimizing storage space and network bandwidth usage—key cost drivers in the cloud. All three backup types (full, incremental, differential) support the granular recovery of specific files or data points. This combination offers the best balance of recovery speed, storage cost, and data granularity.

B. Cloud site, full, and differential

This option is less cost-effective than a strategy that includes incremental backups, which consume less storage and bandwidth for frequent backups.

C. On-site. full, and incremental

On-site storage fails the multilocation requirement, as it does not protect against a site-wide disaster (e.g., fire, flood) affecting the primary data and its backup.

D. On-site. full, and differential

On-site storage fails the multilocation requirement, offering no protection from localized disasters that could destroy both the original data and the backup.

---

1. National Institute of Standards and Technology (NIST) Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems.

Section 3.4.2.1

"Backup Types": This section details full

differential

and incremental backups. It explains that incremental backups copy data modified since the last backup

making them efficient. "Incremental backups are the most efficient because they copy the least amount of data." (Page 29).

Section 3.4.2.2

"Off-site Storage": This section explicitly states

"To protect against a disaster that could damage the primary facility...backup media should be stored at an off-site location." (Page 30). This supports the "multilocation" requirement.

2. Amazon Web Services (AWS) Documentation

How AWS Backup works.

"Backups" section: The documentation explains that AWS Backup leverages the native snapshot capabilities of services like Amazon EBS

which are incremental. "The first snapshot of a volume is always a full snapshot. Subsequent snapshots of the same volume are incremental... This saves on storage costs because data is not duplicated." This directly links the incremental method to the "cost-effective" requirement in a cloud context.

3. Microsoft Azure Documentation

About Azure VM backup.

"Backup process" section: The documentation states

"For Azure VMs

the initial backup is a full backup... Subsequent backups are incremental." This highlights that major cloud providers use incremental backups as a standard

cost-effective practice for virtual machine protection.

The requirements for immediate failover and a maximum replication latency of one second necessitate a continuous, near-real-time data protection strategy. Live replication, often implemented as synchronous or near-synchronous replication, continuously transmits data changes from the primary VM to a replica in a secondary data center as they occur. This method ensures the replica is always in a consistent and up-to-date state, enabling an immediate and automated failover with a Recovery Point Objective (RPO) of near-zero. This directly meets the stringent availability and low-latency demands described in the scenario for mission-critical applications.

A. Snapshot: Snapshot replication is periodic, creating copies at discrete intervals. This method cannot meet the immediate failover or sub-second latency requirements due to inherent data loss (RPO) between snapshots.

B. Transactional: Transactional replication is a database-specific technology that replicates database transactions. It does not apply to the entire virtual machine state, including the operating system and application files.

D. Point-in-time: This is a general term for creating a copy of data as it existed at a specific moment, which includes snapshots. It is not a continuous process and cannot support immediate failover.

1. VMware

Inc. (2023). vSphere Storage Documentation

Administering vSphere Virtual Machine Storage

Chapter 8: Virtual Machine Storage Policies. VMware. In the section "Site disaster tolerance

" the documentation explains that synchronous replication provides the highest level of availability with a Recovery Point Objective (RPO) of zero

which is essential for immediate failover scenarios. This aligns with the concept of "live" replication.

2. Kyriazis

D.

et al. (2013). Disaster Recovery for Infrastructure-as-a-Service Cloud Systems: A Survey. ACM Computing Surveys

46(1)

Article 10. In Section 3.2

"Replication Techniques

" the paper contrasts synchronous and asynchronous replication. It states

"Synchronous replication... offers a zero RPO... suitable for mission-critical applications with low tolerance for data loss." This supports the choice of a live/synchronous method for immediate failover. https://doi.org/10.1145/2522968.2522978

3. Microsoft Corporation. (2023). Azure Site Recovery documentation

About Site Recovery. Microsoft Docs. The documentation describes "continuous replication" for disaster recovery of VMs

which provides minimal RPOs. While specific RPO values vary

the principle of continuous or "live" data transfer is fundamental to achieving the low latency and immediate failover required.

The scenario describes an e-commerce website with performance degradation during "random periods," indicating unpredictable traffic spikes. Automatic elasticity is a fundamental cloud computing characteristic designed specifically for this use case. It allows the system to automatically scale resources (e.g., compute instances) up or down based on real-time demand, monitored through metrics like CPU utilization or network traffic. This ensures that the website has sufficient resources to maintain performance during unexpected surges and scales down to reduce costs when the demand subsides. This dynamic and automated approach is the most effective and efficient way to manage variable workloads.

A. Migrating to a dedicated host: This provides a fixed amount of resources. It does not dynamically scale to meet random demand and can lead to either under-provisioning or costly over-provisioning.

B. Purchasing additional servers: This is a static, capital-intensive solution. It lacks the agility to respond to real-time, random fluctuations in traffic and is not a typical cloud approach.

C. Scheduling resource allocation: This method is only effective for predictable, cyclical traffic patterns (e.g., daily or weekly peaks), not for the "random periods" mentioned in the question.

1. Mell

P.

& Grance

T. (2011). The NIST Definition of Cloud Computing (Special Publication 800-145). National Institute of Standards and Technology. On page 2

under "Essential Characteristics

" it defines Rapid elasticity: "Capabilities can be elastically provisioned and released

in some cases automatically

to scale rapidly outward and inward commensurate with demand."

2. Armbrust

M.

Fox

A.

Griffith

R.

Joseph

A. D.

Katz

R.

Konwinski

A.

... & Zaharia

M. (2010). A view of cloud computing. Communications of the ACM

53(4)

50-58. In Section 3.1

"Elasticity and the Illusion of Infinite Resources

" the UC Berkeley authors state

"Cloud Computing gives the illusion of infinite computing resources available on demand... This elasticity of resources

without paying a premium for large scale

is unprecedented in the history of IT." This directly addresses the need to handle variable demand effectively. DOI: https://doi.org/10.1145/1721654.1721672

3. Vaquero

L. M.

Rodero-Merino

L.

Caceres

J.

& Lindner

M. (2008). A break in the clouds: towards a cloud definition. ACM SIGCOMM Computer Communication Review

39(1)

50-55. In Section 3

"A Proposed Definition

" the paper highlights elasticity as a key property

stating that it "allows for the dynamic reconfiguration of the infrastructure according to the service's needs." This supports the use of elasticity for managing fluctuating performance requirements. DOI: https://doi.org/10.1145/1496091.1496100

The Service Level Agreement (SLA) mandates that each hypervisor SFP must match the maximum link speed of the SAN array. By inspecting the service processors, we see the SAN array's ports are operating at 8 Gbps. The hypervisor's ports were initially misconfigured to 16 Gbps, creating a link speed mismatch. This mismatch prevented successful link negotiation, which is why Service Processor A had "no initiators currently logged in." This failure breaks the required path redundancy, halves the available I/O bandwidth, and causes the observed low IOPS. Adjusting all four hypervisor ports to 8 Gbps resolves the configuration conflict, restores redundant paths to both service processors, and meets the performance and SLA requirements.

Dell EMC Unity: High Availability - A Detailed Review, White Paper, August 2020. Page 9, in the "Front-End Connectivity" section, describes how hosts connect to both Service Processors (SPs) to ensure no single point of failure. This design is contingent on all physical paths being correctly configured and operational, which a link speed mismatch would prevent.

Brocade Fabric OS Administration Guide (9.0.x). In the chapter on "Port Configuration," the description of the portcfgspeed command explains that for a link to be established, port speed settings must be compatible. Forcing a speed (e.g., 16 Gbps) on a port connected to a device that only supports a lower maximum speed (e.g., 8 Gbps) will result in a failed link state, such as "No_Sync."

Clark, T. (2017). Designing Storage Area Networks (3rd ed.). Addison-Wesley Professional. Chapter 4, "Fibre Channel Cabling and Components," specifies that Fibre Channel ports auto-negotiate to the highest common speed. If one port is fixed to a speed not supported by the connecting port, the link will not initialize, leading to path failure in a SAN fabric.

The process involves calculating the average usage for each resource, adding a 20% overhead, and selecting the smallest available specification that meets the new requirement.

• CPU: The average CPU usage is 16.57% of 4 vCPUs, which is 0.66 vCPUs. With a 20% overhead, the requirement is $0.66 \times 1.20 = 0.79$ vCPUs. The smallest option is 1 vCPU.
• RAM: Average RAM usage is 15% of 16GB, which is 2.4GB. With a 20% overhead, the requirement is $2.4\text{GB} \times 1.20 = 2.88\text{GB}$. The smallest option is 4GB.
• Disk: Average disk throughput is 4.43 MBps. With a 20% overhead, the requirement is $4.43 \times 1.20 \approx 5.32$ MBps. The smallest option is 10MBps.

Following the same right-sizing methodology as the web server:

• CPU: The average CPU usage is 65.57% of 4 vCPUs, which is 2.62 vCPUs. With a 20% overhead, the requirement is $2.62 \times 1.20 \approx 3.15$ vCPUs. The best-fit option is 4 vCPU.
• RAM: Average RAM usage is 80% of 16GB, which is 12.8GB. With a 20% overhead, the requirement is $12.8\text{GB} \times 1.20 = 15.36\text{GB}$. The smallest available option that meets this is 16GB.
• Disk: Average disk throughput is 86.71 MBps. With a 20% overhead, the requirement is $86.71 \times 1.20 \approx 104.05$ MBps. The next available tier is 110MBps.

AWS Well-Architected Framework, Cost Optimization Pillar (Whitepaper).

Reference: "Right Sizing" section under "Cost-effective resources."

Content: This official AWS document outlines the best practice of analyzing utilization metrics over time to select the instance type that meets performance requirements at the lowest cost. It explicitly advises against overprovisioning and recommends using monitoring data to make informed decisions, which is the core principle applied in this question.

Microsoft Azure Well-Architected Framework.

Reference: "Cost optimization" pillar, "Right-size resources" principle.

Content: Similar to AWS, this official Microsoft documentation emphasizes analyzing performance data such as CPU, memory, and IOPS to identify and deallocate underutilized resources. This directly supports the task of examining usage graphs to select smaller, more cost-effective server specifications.

Armbrust, M., et al. "A view of cloud computing." Communications of the ACM, vol. 53, no. 4, 2010, pp. 50-58.

Reference: Section 3, "Classes of Utility Computing," paragraph on pay-for-use models.

Content: This foundational academic paper discusses the economic benefits of cloud computing, including the ability to finely tune resource allocation to workload demands. The concept of right-sizing is a practical application of this principle, allowing users to avoid the costs of idle capacity inherent in statically provisioned on-premises environments.

DOI: https://doi.org/10.1145/1721654.1721672

This configuration correctly implements the required security layers for a low-risk tolerance identity solution.

1. SSO (Single Sign-On): This control addresses the requirement to minimize user logins. It allows authenticated users to access multiple applications and resources within the cloud environment without needing to log in repeatedly.
2. MFA (Multi-Factor Authentication): This control fulfills the need for secondary authentication. It enhances security by requiring users to provide two or more verification factors, making it significantly harder for unauthorized users to gain access.
3. SIEM (Security Information and Event Management): This server is essential to track user activity and monitor for anomalies. A SIEM system collects, aggregates, and analyzes log data from across the network, including authentication events from SSO and MFA, to detect and alert on suspicious behavior.

National Institute of Standards and Technology (NIST) Special Publication 800-63-3, Digital Identity Guidelines. This document details modern identity solutions.

For SSO: Section 4.2 discusses federation and SSO as a mechanism to provide a "seamless user experience when accessing multiple applications."

For MFA: Section 5.1, "Authenticator and Verifier Requirements," outlines the use of multiple factors for authentication to achieve higher assurance levels.

Source: https://doi.org/10.6028/NIST.SP.800-63-3

National Institute of Standards and Technology (NIST) Special Publication 800-92, Guide to Computer Security Log Management. This guide provides a foundation for security monitoring.

For SIEM: Section 2.3.4, "Log Analysis Tools," describes how SIEMs centralize log storage and analysis, providing "correlation of events among multiple log sources" which is crucial for detecting anomalous activity.

Source: https://doi.org/10.6028/NIST.SP.800-92

Saltzer, J. H., & Kaashoek, M. F. (2009). Principles of Computer System Design: An Introduction. Morgan Kaufmann. This textbook covers foundational security principles.

For all concepts: Chapter 10, "Security and Protection," discusses the principles of authentication (including multi-factor) and auditing (the basis of SIEM) as fundamental components for securing systems, particularly in networked environments. (Refer to sections on authentication and accountability).

The user's inability to access the web-based login prompt points to a misconfiguration in the Web Application Firewall (WAF). The finance application (FIN) is hosted on webapp1 as per its service details. Upon reviewing the WAF configuration, Rule ID 1006 is specifically configured to Block traffic destined for the URL ^https://webapp[1].jcompita[.]org/login[.]html$. This rule is the direct cause of the login page failing to load. Changing the action for this specific rule from Block to Allow will permit traffic to the login page and resolve the client's access issue.

Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson.

Reference: Chapter 21, "Firewalls and Intrusion Prevention Systems," Section 21.1 Firewall Characteristics. This section discusses how firewalls, including WAFs, use rule-based policies to filter traffic. A misconfigured rule that incorrectly blocks a specific URL or path is a common cause for legitimate traffic being denied access to a web application resource.

Amazon Web Services. (2025). AWS WAF Developer Guide.

Reference: Section "Rule action." The documentation explicitly defines the Block action, which instructs AWS WAF to stop the web request. This aligns with the scenario where the user's access to login.html is being stopped by the WAF. The guide also defines the Allow action as the remedy to permit such requests.

Saltzer, J. H., & Kaashoek, M. F. (2009). Principles of Computer System Design: An Introduction. Morgan Kaufmann.

Reference: Chapter 8, "The Network," Section 8.4.3 Firewalls. The text explains that a firewall's effectiveness is entirely dependent on its configured policy. An incorrect "deny" (or "block") rule within the policy is a primary cause of access problems, where the system incorrectly identifies legitimate traffic as hostile and prevents it from reaching its destination.

Part 1:

The problematic devices are Router 1 and Router 2, which are failing to establish a stable Site-to-Site IPsec VPN tunnel.

This failure is due to two specific misconfigurations:

1. Mismatched Pre-Shared Keys (PSK): Router 1 is configured with the PSK Cloud001, while Router 2 is configured with Cloud002. For a successful IKE Phase 1 negotiation, the PSKs on both VPN gateways must be identical.
2. Incorrect Remote Network on Router 1: The VPN configuration for Router 1 incorrectly defines the remote "Address Space" as 10.1.1.0/24, which is its own local network. It should be configured to route for the remote cloud network, 10.1.2.0/24.

The consequence of this failed VPN connection is that the application servers in the cloud (10.1.2.0/24 network) cannot communicate with the database server in the on-premises datacenter (10.1.1.0/24 network), causing the 80% of user sessions routed to the cloud to fail.

Part 2:

The selected options resolve the issue through two different strategies.

1. Fixing the VPN Connectivity: Updating the PSK on Router 2 to match Router 1 (Cloud001) is a required step to correct the IPsec tunnel configuration. A mismatched PSK is a fundamental error that prevents the VPN tunnel from being established.
2. Architectural Improvement: Deploying a database replica in the cloud is a strategic solution that resolves the application failure by removing the real-time dependency on the cross-site VPN connection for database queries. This is a common best practice in hybrid cloud architectures to improve application performance, increase resilience, and reduce data transfer latency. By placing a database replica close to the cloud application servers, the application can function even if the VPN tunnel is unstable or has high latency.

These two actions combined ensure both the immediate connectivity issue is addressed and the long-term architectural stability of the hybrid application is improved.

On IPsec Pre-Shared Key (PSK) Matching:

Microsoft Azure Documentation, "About cryptographic requirements and VPN devices for Site-to-Site VPN gateway connections," states that for IKEv1, the Pre-Shared Key must match on both VPN devices. Refer to the section on IKEv1 parameters.

Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. Chapter 8 discusses the principles of network security, where the establishment of a shared secret (like a PSK) is fundamental for authentication in protocols like IPsec.

On IPsec Remote Network (Address Space) Configuration:

Cisco, "IPsec Site-to-Site VPN Tunnel Configuration Example," illustrates that the access list or crypto map used in the IPsec configuration must define the traffic to be encrypted, which corresponds to the subnets at the local and remote sites. For Router 1, this means defining traffic between 10.1.1.0/24 (local) and 10.1.2.0/24 (remote). Refer to the sections on configuring access lists for the crypto map.

On Hybrid Cloud Database Architecture:

Armbrust, M., et al. (2010). "A view of cloud computing." Communications of the ACM, 53(4), 50-58. This seminal paper discusses the architectural patterns of cloud computing, including the challenges of data locality and latency in hybrid models, implicitly supporting architectures that replicate data closer to the compute resources. DOI: 10.1145/1721654.1721672

AWS Whitepaper, "Hybrid Cloud with AWS," discusses patterns for creating resilient hybrid architectures. One common pattern is creating read replicas of on-premises databases in the cloud to serve read traffic from cloud-based applications, thereby reducing latency and dependence on the site-to-site connection. Refer to the section on Data and Database Integration strategies.

The user's "Browser cannot display the webpage" error is primarily caused by Firewall 2, which lacks rules to allow traffic from the Network Load Balancers (NLBs) to the CTM server. Rules must be added to permit TCP traffic on ports 80 (HTTP) and 443 (HTTPS) from the NLB IPs (192.168.1.51, 192.168.1.52) to the CTM server IP (192.168.2.15), as defined in dataflow 1A.

For the entire application to function correctly, two other sets of misconfigurations must be corrected:

1. Improper VLAN assignments prevent network segmentation. The BI Server must be moved from VLAN 104 to VLAN 102 (BI), and the Database Server must be moved from VLAN 106 to VLAN 104 (DB).
2. Firewall 3 contains a DENY ALL rule at the top of its access list, which incorrectly blocks all subsequent traffic, including the necessary communications between the CTM, BI, and Database servers (dataflows 2A, 2B, 3B). This rule must be removed to allow the specific ALLOW rules to be processed. A DENY ALL should be the final rule to enforce a policy of least privilege.

National Institute of Standards and Technology (NIST), Special Publication 800-41 Revision 1, Guidelines on Firewalls and Firewall Policy. Section 4.3, "Firewall Rule Sets," discusses the importance of rule set order, stating, "The firewall examines the packet’s header against the rules in its rule set, in order, from first to last. When it finds a rule that matches the packet, the firewall follows the instructions in that rule...". This supports the correction of the DENY rule placement on Firewall 3.

IEEE Std 802.1Q™-2018, IEEE Standard for Local and metropolitan area networks—Bridges and Bridged Networks. Section 3.14, "VLAN," provides the foundational definition of Virtual Local Area Networks (VLANs) as a mechanism to create logically separate broadcast domains on a shared physical network infrastructure. Proper VLAN assignment, as corrected in the BI and DB tiers, is essential for implementing this segmentation.

Kurose, J., & Ross, K. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. Chapter 5 discusses the network layer, including the function of firewalls and Access Control Lists (ACLs) to filter packets based on source/destination IP addresses and port numbers. The configuration changes align with the fundamental principles of packet filtering described.

A Content Delivery Network (CDN) is a geographically distributed network of proxy servers and data centers designed to provide high availability and performance. For a static website accessed globally, a CDN caches the site's content (e.g., HTML, CSS, images) at edge locations around the world. When a user requests the website, the content is served from the nearest edge location, which significantly reduces the physical distance the data must travel. This minimization of distance is the most effective way to reduce network latency for end-users.

A. VPC: A Virtual Private Cloud (VPC) provides a logically isolated network environment within a public cloud. Its primary purpose is security and network segmentation, not global performance optimization or latency reduction.

B. Application load balancer: An Application Load Balancer (ALB) distributes traffic across multiple targets (like virtual machines) within a specific region to enhance availability and scalability, but it does not distribute content globally to reduce latency.

D. API gateway: An API gateway acts as a reverse proxy to manage, secure, and route API requests to backend services. It is not designed for caching and delivering static website content to reduce latency.

1. Amazon Web Services (AWS) Documentation. (2023). What Is Amazon CloudFront? Amazon Web Services

Inc. Retrieved from https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html. In the "How CloudFront delivers content" section

it states

"When a user requests content that you're serving with CloudFront

the request is routed to the edge location that provides the lowest latency (time delay)

so that content is delivered with the best possible performance."

2. Microsoft Azure Documentation. (2023). What is a content delivery network (CDN) on Azure? Microsoft. Retrieved from https://learn.microsoft.com/en-us/azure/cdn/cdn-overview. The overview section states

"A content delivery network (CDN) is a distributed network of servers that can efficiently deliver web content to users. CDNs store cached content on edge servers in point-of-presence (POP) locations that are close to end users

to minimize latency."

3. Google Cloud Documentation. (2023). Cloud CDN overview. Google. Retrieved from https://cloud.google.com/cdn/docs/overview. The document explains

"Cloud CDN (Content Delivery Network) uses Google's global edge network to bring content closer to your users. Bringing content closer to your users accelerates response times for your websites and applications."

4. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 2

Section 2.6

"Content Distribution Networks

" the text details how CDNs place servers in multiple geographically distributed locations to serve content to users from the closest edge server

thereby reducing latency and improving user experience.

A managed SQL database, often referred to as Database as a Service (DBaaS) or a Platform as a Service (PaaS) offering, is the most suitable choice for minimizing operational overhead. In this model, the cloud service provider is responsible for managing the underlying infrastructure, operating system, database software patching, backups, and high availability. This allows the company's development team to focus on schema design and application integration rather than the time-consuming tasks of database administration, directly fulfilling the core requirement of the question.

A. A database installed on a virtual machine: This Infrastructure as a Service (IaaS) approach maximizes operational overhead, as the company is responsible for managing the OS, patching, backups, and all database software administration.

C. A database migration service: This is a tool or service used to move existing databases to the cloud. It is not a hosting solution for a new application's database.

D. A hybrid database setup: A hybrid model, which combines on-premises and cloud resources, typically increases complexity and operational overhead due to the need to manage and synchronize two distinct environments.

1. Mell

P.

& Grance

T. (2011). The NIST Definition of Cloud Computing (Special Publication 800-145). National Institute of Standards and Technology.

Section: "Platform as a Service (PaaS)": This section defines PaaS

stating

"The consumer does not manage or control the underlying cloud infrastructure including network

servers

operating systems

or storage

but has control over the deployed applications..." This directly supports the concept of reduced operational overhead for the consumer.

2. Amazon Web Services (AWS). (n.d.). Amazon RDS Features.

Section: "Easy to Administer": The documentation states

"Amazon RDS makes it easy to go from project conception to deployment. Use the AWS Management Console... to access the capabilities of a production-ready relational database in minutes. No need for infrastructure provisioning

and no need for installing and maintaining database software." This contrasts directly with the high overhead of managing a database on a VM (IaaS).

3. Microsoft Azure. (n.d.). What is Azure SQL Database?.

Section: "Overview": The documentation describes Azure SQL Database as a "fully managed platform as a service (PaaS) database engine that handles most of the database management functions like upgrading

patching

backups

and monitoring without user involvement." This explicitly confirms that managed services are designed to minimize administrative burden.

4. Armbrust

M.

Fox

A.

Griffith

R.

Joseph

A. D.

Katz

R.

Konwinski

A.

... & Zaharia

M. (2010). A view of cloud computing. Communications of the ACM

53(4)

50-58.

DOI: https://doi.org/10.1145/1721654.1721672

Page 51

Section 2.1 "Classes of Utility Computing": The paper explains that with PaaS

the provider manages the "operating system

and the collective hardware

" which "lowers the barrier to entry for deploying applications" by reducing the need for system administration expertise.

Deploying application instances in multiple geographic regions is a fundamental strategy for serving a global user base. The primary motivation for placing resources closer to end-users, such as deploying a website in Europe for European customers, is to reduce network latency. Latency is the delay in data transmission, which is significantly influenced by the physical distance between the user and the server. By serving requests from a geographically proximate server, the round-trip time is minimized, leading to faster page loads and a better user experience.

A. To simplify workflow: Managing a multi-region deployment adds complexity to workflows, including data synchronization, configuration management, and monitoring, rather than simplifying them.

B. To enhance security: While a multi-region setup can improve availability and disaster recovery (which are aspects of security), it is not the primary driver for this specific action compared to the direct performance benefit.

D. To decrease cost: Operating infrastructure in an additional region incurs extra costs for compute, storage, and inter-region data transfer, thus increasing overall expenditure.

1. AWS Well-Architected Framework

Performance Efficiency Pillar (July 2023): In the section "PERF 2: How do you select the best performing architecture?"

the framework states

"To reduce latency

you can locate your infrastructure closer to your users or locate your data closer to your infrastructure." It further advises to "Select the right AWS Region(s) and Edge locations based on where your customers are located to reduce latency." (Page 11).

2. Microsoft Azure Documentation

"Multi-region N-tier application": In the architecture overview

it is stated

"Deploying the application in multiple regions can reduce latency for users. If you route users to the nearest region

they will experience lower network latency." This is listed as a primary benefit of the multi-region pattern. (Reference Architecture ID: architectures/n-tier/multi-region-n-tier.yml).

3. Google Cloud Documentation

"Choosing a network service tier": This document explains how network design impacts performance for global users. It notes

"For the lowest possible latency

Google Cloud recommends that you serve your traffic from a region that is closest to your users." (Section: "When to use Standard Tier and Premium Tier").

4. Armbrust

M.

et al. (2009). Above the Clouds: A Berkeley View of Cloud Computing. University of California

Berkeley. In Section 3.2

"Classes of Utility Computing

" the paper discusses the importance of geographic location for latency-sensitive applications: "For a user in New York

a datacenter in California can easily add 80 ms of latency to every interaction due to the speed of light

versus a datacenter in New York." (Page 10

EECS Department

Technical Report No. UCB/EECS-2009-28).

The scenario describes heavy performance degradation during specific times, which indicates a resource bottleneck under peak load. When a Virtual Machine's (VM) workload demands more memory than the physically allocated RAM (8 GB in this case), the hypervisor or the VM's guest operating system will resort to swapping. This process involves moving memory pages to much slower disk storage to free up RAM. The high latency of disk I/O compared to RAM access causes a severe and noticeable drop in application and system performance, a condition often called "thrashing." This directly matches the symptoms described.

A. The host requires additional physical CPUs.

While CPU contention can cause slowdowns, the "heavy degradation" described is more characteristic of memory exhaustion and swapping than CPU queuing.

B. A higher number of processes occur at those times.

This describes the cause of the increased load but is not the root explanation for the performance failure; the failure is the system's inability to handle that load due to a resource limit.

D. The storage is overutilized.

This is a possible outcome of heavy swapping but not the root cause. The primary issue is the lack of RAM, which forces the system to overutilize storage for swapping operations.

---

1. VMware Official Documentation. (2023). vSphere Resource Management for VMware vSphere 8.0. Chapter 8: Managing Memory Resources

Section: Host-Level Swapping. The guide states

"Host-level swapping is a last resort for ESXi to reclaim memory... The performance of a virtual machine can degrade significantly when the guest operating system or the host swaps." This confirms that swapping due to memory pressure causes severe performance degradation.

2. University Courseware. Arpaci-Dusseau

R. H.

& Arpaci-Dusseau

A. C. (2018). Operating Systems: Three Easy Pieces. Arpaci-Dusseau Books. In Chapter 22

"Swapping: Mechanisms

" the text explains that when physical memory is full

the OS will swap pages to disk. Chapter 23

"The Memory Hierarchy

" quantifies the performance difference

noting that accessing disk is orders of magnitude (100

000x) slower than accessing DRAM

which explains the "heavy" performance degradation.

3. Peer-Reviewed Academic Publication. Waldspurger

C. A. (2002). Memory resource management in VMware ESX server. In Proceedings of the 5th symposium on Operating systems design and implementation (OSDI '02). USENIX Association

USA

181–194. Section 4.4

"Swapping

" explicitly states

"As a last resort

ESX can reclaim memory by swapping pages from a VM to a server swap file... Since swapping requires disk I/O

it can impose a large performance overhead." This foundational paper validates that swapping is a high-overhead

last-resort mechanism.

The Common Vulnerability Scoring System (CVSS) is the global industry standard for assessing the severity of security vulnerabilities. It provides a numerical score from 0.0 to 10.0, along with a qualitative representation (e.g., Medium, High, Critical), to reflect severity. An organization would use the CVSS framework to calculate a score for the Log4j vulnerability based on metrics such as Attack Vector, Attack Complexity, Privileges Required, and the impact on Confidentiality, Integrity, and Availability. This score enables the organization to quantify the risk and prioritize remediation efforts effectively.

A. CWE: The Common Weakness Enumeration (CWE) is a community-developed list of common software and hardware weakness types. It serves as a dictionary for classifying weaknesses, not for scoring the severity of a specific vulnerability.

C. CWSS: The Common Weakness Scoring System (CWSS) is designed to score the severity of weaknesses (CWEs) in software. While it is a scoring system, CVSS is the standard specifically used for scoring discovered vulnerabilities in deployed products.

D. CVE: Common Vulnerabilities and Exposures (CVE) is a system that provides a unique identifier for a specific, publicly known security vulnerability. The CVE entry itself does not calculate severity; rather, it typically contains a CVSS score.

1. FIRST.org

Inc. (2019). Common Vulnerability Scoring System v3.1: Specification Document. Section 1

"Introduction". This document states

"The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and severity of software vulnerabilities." It details the metrics used for calculation. Available at: https://www.first.org/cvss/v3.1/specification-document

2. National Institute of Standards and Technology (NIST). NVD - CVSS v3 Calculator. The National Vulnerability Database (NVD)

a U.S. government repository

uses CVSS as its standard for severity scoring. The NVD's documentation and tools are built around the CVSS framework. For example

the entry for the Log4j vulnerability (CVE-2021-44228) prominently features its CVSS score. See: https://nvd.nist.gov/vuln-metrics/cvss

3. Carnegie Mellon University Software Engineering Institute (SEI). (2017). Introduction to the Common Weakness Enumeration (CWE). This resource clarifies the distinction: "CWE is a list of weakness types... CVE® is a dictionary of specific vulnerability instances. CVSS is a scoring system for vulnerabilities." This highlights the different purposes of each system. Available at: https://resources.sei.cmu.edu/assetfiles/WhitePaper/2017019001503379.pdf (Page 2

Section "How is CWE Different from CVE

CAPEC

and CVSS?")

The Common Vulnerability Scoring System (CVSS) is the industry-standard open framework for assessing and communicating the severity of software vulnerabilities. It provides a numerical score (ranging from 0.0 to 10.0) based on a set of metrics, including attack vector, complexity, user interaction, and impact on confidentiality, integrity, and availability. An organization would use the CVSS score assigned to the specific Log4j vulnerability (e.g., CVE-2021-44228, which had a base score of 10.0) to calculate and understand its severity, enabling effective risk prioritization and remediation planning.

A. CWE: The Common Weakness Enumeration (CWE) is a dictionary of common software and hardware weakness types. It classifies the type of flaw, not the severity of a specific vulnerability instance.

C. CWSS: The Common Weakness Scoring System (CWSS) scores the severity of weaknesses (CWEs) in a general context, often during development, not the risk of a specific vulnerability in a deployed product.

D. CVE: Common Vulnerabilities and Exposures (CVE) provides a unique identification number for a specific, publicly known vulnerability. The CVE entry contains a CVSS score but is not the system used to calculate it.

1. FIRST.org

Inc. (2019). Common Vulnerability Scoring System v3.1: Specification Document. Section 1

"Introduction". "The Common Vulnerability Scoring System (CVSS) is an open framework for communicating the characteristics and severity of software vulnerabilities."

Available at: https://www.first.org/cvss/v3.1/specification-document

2. National Institute of Standards and Technology (NIST). (n.d.). NVD - CVSS v3 Calculator. National Vulnerability Database. The NVD

a primary source for vulnerability data

uses CVSS to score vulnerabilities. The glossary defines CVE as an identifier and CVSS as the scoring system.

Reference: The NVD's use and explanation of CVSS scores for CVE entries

such as CVE-2021-44228.

3. The MITRE Corporation. (2023). About CVE. The CVE Program. "CVE is a list of entries—each containing an identification number... for publicly known cybersecurity vulnerabilities." This clarifies that CVE is an identifier

not a scoring methodology.

Available at: https://www.cve.org/About/Overview

4. The MITRE Corporation. (2023). About CWE. Common Weakness Enumeration. "CWE is a community-developed list of common software and hardware weakness types that have security ramifications." This defines CWE as a classification system for types of flaws.

Available at: https://cwe.mitre.org/about/index.html

The question requires a backup solution that is fast and uses minimal bandwidth from Monday to Saturday, while also ensuring a low Mean Time to Recovery (MTTR).

Speed and Bandwidth (Mon-Sat): Incremental backups are the most efficient in this regard. They only back up data that has changed since the last backup (either full or incremental), resulting in the smallest possible backup size and fastest completion time on a daily basis.

Low MTTR: While differential backups offer a faster restore process (requiring only the last full and the last differential), they consume progressively more time and bandwidth each day, violating the primary Mon-Sat constraint.

Optimal Strategy: The strategy of a full backup on Sunday (outside the constrained period) and incremental backups on all other days (B) provides the best balance. It satisfies the critical requirement for low-impact daily backups while still providing a reliable, albeit more complex, recovery path to meet the MTTR expectation.

A. This is an incomplete strategy. An incremental backup plan is not viable without a periodic full backup to serve as a baseline for restoration.

C. Differential backups grow larger and slower throughout the week, which would violate the requirement to run quickly and reduce bandwidth from Monday to Saturday.

D. A non-daily backup schedule (Monday, Wednesday, Friday) fails to protect data created on other days, increasing the Recovery Point Objective (RPO) and risk of data loss.

1. NIST Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems.

Section 4.3.2

Data Backup and Storage (Page 43): This section defines the backup types. It states

"Incremental backups process files that have been created or modified since the last backup... This results in a smaller

faster backup." It also notes that for restoration

"the last full backup and all incremental backups since the last full backup must be restored

" which highlights the MTTR trade-off.

2. University of Washington

CSE 451: Introduction to Operating Systems

Lecture 21

Filesystems 3: logging

backups.

Slide 24

"Backups: Dumps": This slide presents a table comparing backup types. It explicitly shows that "Incremental" backups have a "fast" dump time but a "slow" restore time

whereas "Differential" backups have a "medium" dump time and a "fast" restore time. This academic source confirms the direct trade-off between daily backup performance and MTTR that the question requires balancing.

3. Microsoft Azure Documentation

About Azure VM backup.

Section: "Backup and restore considerations": The documentation states

"The initial backup is a full backup... Subsequent backups are incremental backups." This shows that the full-plus-incremental model is a standard

efficient industry practice for cloud VM protection

prioritizing low-impact daily operations

which aligns with the question's constraints.

Service discovery is a design pattern used to automatically detect the network locations (IP addresses and ports) of service instances in a microservices architecture. Services register themselves with a central registry upon startup and are de-registered upon shutdown. Other services can then query this registry to find the current, valid endpoint for a service they need to communicate with. This completely automates the process of endpoint management, directly resolving the developer's issue of manually updating IP addresses in a dynamic environment where instances and their IPs frequently change.

B. Fan-out: This is a messaging pattern where a single message is broadcast to multiple consumers. It does not address the core problem of how services locate each other.

C. Managed container services: These are platforms (like Kubernetes) that provide service discovery as a feature, but service discovery is the specific mechanism that solves the stated problem.

D. DNS: While DNS is often used as a component of service discovery, the complete pattern also includes service registration and health checking, making it a more comprehensive solution than DNS alone.

1. Microsoft. (2023). Implement service discovery in a .NET microservices application. Microsoft Learn. In the section "The service discovery pattern

" it states

"If you want to communicate with a service

you need a service discovery mechanism. This is a critical service in a microservices architecture

because it's the way to get the actual endpoint for a service instance." This directly supports service discovery as the solution for locating services.

2. AWS. (n.d.). Service discovery. AWS Whitepapers & Guides. In the "Microservices on AWS" guide

the section on service discovery explains

"Service discovery is a key component of a microservice architecture. With service discovery

services are automatically discovered as they are launched and terminated." This confirms its role in automating endpoint management.

3. Google Cloud. (n.d.). Service discovery and DNS. Google Kubernetes Engine (GKE) Documentation. The document clarifies the relationship between the concepts: "Kubernetes lets you discover Services through two mechanisms: environment variables and DNS." This shows that DNS is an implementation detail within a broader service discovery framework provided by a managed container service.

Containers are the best choice to meet the company's goals. They provide operating-system-level virtualization where multiple containerized applications share the host operating system's kernel. This design significantly lowers the overhead associated with managing multiple operating systems because there is only one host OS to patch, license, and maintain. Furthermore, because containers do not bundle a full guest OS, they are more lightweight and consume fewer resources (CPU, RAM, storage) than virtual machines, directly contributing to the optimization of cloud resources.

A. VM: A virtual machine (VM) encapsulates a full guest operating system, which increases management overhead and resource consumption, directly contradicting the stated goals.

C. Remote desktops: Remote desktop solutions are typically deployed on top of VMs, inheriting the same high overhead for OS management and resource usage.

D. Bare-metal servers: While eliminating hypervisor overhead, this option does not inherently optimize resource usage for multiple workloads and still requires managing a separate OS for each server.

1. Microsoft Azure Documentation. (n.d.). What are containers? Microsoft Docs. Retrieved from https://docs.microsoft.com/en-us/azure/container-apps/containers. In the section "Containers vs. virtual machines

" it states

"Unlike virtual machines

containers don't include a guest operating system in each instance. Instead

they use the features and resources of the host operating system... This makes containers more lightweight and portable."

2. Amazon Web Services (AWS) Documentation. (n.d.). What is a Container? AWS. Retrieved from https://aws.amazon.com/containers/. The documentation explains

"Unlike VMs

containers do not bundle a full operating system—only the libraries and settings required to make the software work. This makes them efficient

lightweight

portable

and scalable."

3. Red Hat Documentation. (n.d.). Chapter 1. Introduction to containers. Red Hat Customer Portal. Retrieved from https://access.redhat.com/documentation/en-us/redhatenterpriselinux/8/html/buildingrunningandmanagingcontainers/procunderstanding-containersbuilding-running-and-managing-containers. Section 1.1

"Understanding Containers

" contrasts containers with VMs

noting

"Instead of virtualizing the underlying hardware

containers virtualize the operating system... Because containers share a single operating system kernel

they are much more lightweight than virtual machines."

4. University of California

Berkeley

EECS Courseware. Kubiatowicz

J. (2022). CS 162: Operating Systems and System Programming

Lecture 19: Virtual Machines. Slide 45

"Containers: Lightweight Virtualization." The slide deck compares VMs and containers

highlighting that containers "Share kernel with host" and have "Lower overhead

" which directly supports the reasoning for selecting containers for resource optimization and reduced management.

Moving from a single-region to a multiregional architecture requires continuous replication and client access across geographically dispersed sites. The additional traffic leaves the original region and must traverse the provider’s WAN or the public Internet, so inter-region data-transfer (network egress/ingress) charges rise sharply. Storage capacity, facility power/cooling, or regulatory scope may also grow, but they are not a “transfer” cost; only network traffic is directly classified and billed as a transfer item by major cloud vendors.

A. Storage – Extra copies increase capacity charges, but vendors bill this as storage, not transfer.

B. Power and cooling – An internal operational cost to the provider; customers are not billed per-transfer for it.

D. Compliance and regulation – Jurisdictional scope changes, yet no metered “transfer” fee is associated with it.

1. Amazon Web Services

“AWS Data Transfer Pricing

” Inter-Region Data Transfer section

https://aws.amazon.com/ec2/pricing/on-demand/ (accessed 2025-10-17).

2. Google Cloud Platform

“Network Pricing

” ‘Inter-region egress within Cloud’ table

https://cloud.google.com/vpc/network-pricing

§Inter-region traffic

2024.

3. Microsoft Azure Documentation

“Bandwidth Pricing Details

” ‘Data transfer between regions’ paragraph

https://azure.microsoft.com/pricing/details/bandwidth

2024.

4. Abad

C. & G. Campbell

“Understanding the Cost of Cloud Connectivity

” IEEE Cloud Computing

vol. 6

no. 3

pp. 40-50

2019. DOI:10.1109/MCC.2019.2897684

5. MIT 6.824 Distributed Systems

Lecture 9 notes

“Geo-replication costs

” p.4

Spring 2023.

Platform as a Service (PaaS) delivers a complete runtime platform—OS, middleware, and development tools—managed by the provider. The customer simply uploads or pushes application code; the platform automatically handles provisioning, scaling, patching, and other infrastructure concerns. Therefore, when a company’s primary requirement is to “deploy its own code directly in the cloud without provisioning additional infrastructure,” PaaS is the most appropriate model.

B. SaaS – Provider supplies finished applications; customers have no ability to deploy their own code.

C. IaaS – Customer must provision and manage virtual machines, OSs, and middleware before deploying code.

D. XaaS – Umbrella term for “Anything-as-a-Service”; lacks the specificity required.

1. NIST Special Publication 800-145

“The NIST Definition of Cloud Computing

” Sect. 5

p. 2: “PaaS… allows consumers to deploy… applications onto the cloud infrastructure… without managing the underlying cloud infrastructure.”

2. Microsoft Azure Documentation

“What is PaaS?

” Learn Module

para. 2–3 (Microsoft Docs

2023): emphasizes code deployment while infrastructure is provider-managed.

3. Armbrust et al.

“Above the Clouds: A Berkeley View of Cloud Computing

” Univ. of California Technical Report UCB/EECS-2009-28

§4.1 (p. 10): describes PaaS platforms such as Google App Engine enabling code upload without server provisioning.

The question requires the most cost-efficient storage solution for data that must be retained for over ten years for compliance purposes. This implies the data will be accessed very infrequently, if at all. The Archive storage tier is specifically designed for this use case. It provides the lowest storage cost in exchange for longer data retrieval times (often hours), which is an acceptable trade-off for long-term compliance data that does not require immediate access. This makes it the most cost-efficient option for the described scenario.

B. Hot: This tier is for frequently accessed data requiring low latency. It is the most expensive storage option and is inappropriate for long-term archival.

C. Cold: While "Cold" storage is for infrequently accessed data, the "Archive" tier is specifically designated as the lowest-cost option for very long-term retention.

D. Warm: This tier represents a balance between cost and access frequency, making it more expensive than Archive and unsuitable for data that is rarely accessed.

1. Microsoft Azure Documentation. Archive access tier - Azure Blob Storage. Microsoft Docs. "The archive access tier is an offline tier for storing data that is rarely accessed... The archive tier has the lowest storage cost. However

it also has the highest data retrieval costs and latency... Data in the archive tier can take several hours to retrieve." This source directly validates that the Archive tier is the lowest-cost option for rarely accessed

long-term data.

2. Amazon Web Services (AWS) Documentation. Amazon S3 storage classes. AWS Documentation. "For archiving data that is rarely accessed

choose one of the archive storage classes

S3 Glacier Instant Retrieval

S3 Glacier Flexible Retrieval

and S3 Glacier Deep Archive. These storage classes offer the lowest-cost storage in the AWS Cloud... S3 Glacier Deep Archive is the lowest-cost storage class and is ideal for long-term retention (of 7-10 years or more) for data that is accessed at most once or twice a year." This aligns perfectly with the 10+ year requirement.

3. Google Cloud Documentation. Storage classes. Google Cloud Documentation. "Archive Storage is the lowest-cost

highly durable storage service for data archiving

online backup

and disaster recovery... Archive Storage is the best choice for data that you plan to access less than once a year." This confirms that across major cloud providers

the "Archive" tier is the most cost-effective for long-term retention.

4. Patterson

D. A.

& Hennessy

J. L. (2017). Computer Organization and Design RISC-V Edition: The Hardware Software Interface. Morgan Kaufmann. In Chapter 6

"Parallel Processors from Client to Cloud

" the text discusses warehouse-scale computer storage hierarchies

explaining the trade-offs between access time and cost per bit

where archival storage (tape or very low-cost disk tiers) represents the most cost-efficient layer for long-term data. (See Section 6.7 for discussions on storage hierarchies in warehouse-scale computers).

WebSockets establish a persistent, full-duplex communication channel between a client and a server over a single TCP connection. This architecture is inherently bidirectional, allowing both the client and server to send data independently at any time. This eliminates the need for repeated client polling (common with REST APIs), which significantly reduces unnecessary network traffic and HTTP overhead. The server can push data to the client as soon as it becomes available, facilitating the real-time results required by developers for applications displaying critical, live information.

A. REST API: REST is based on a stateless, client-server, request-response model. It is not inherently bidirectional or real-time; achieving real-time updates requires inefficient polling, which increases network traffic.

B. RPC: Remote Procedure Call (RPC) is typically a request-response protocol where a client invokes a procedure on a remote server. Like REST, it is not designed for persistent, bidirectional communication.

C. GraphQL: GraphQL is a query language for APIs that reduces traffic by preventing data over-fetching. However, its core model is request-response. Real-time functionality is added via "Subscriptions," which are most often implemented over WebSockets.

1. Internet Engineering Task Force (IETF). RFC 6455: The WebSocket Protocol. December 2011.

Section 1.1 (Background): "Historically

creating web applications that need bidirectional communication between a client and a server (e.g.

instant messaging and gaming applications) has required an abuse of HTTP to poll the server for updates... The WebSocket Protocol was designed to supersede existing bidirectional communication technologies that use HTTP as a transport layer to benefit from existing infrastructure..." This highlights the bidirectional nature and its efficiency over polling.

2. Mozilla Developer Network (MDN) Web Docs. "The WebSocket API (WebSockets)".

In the introductory paragraph: "The WebSocket API is an advanced technology that makes it possible to open a two-way interactive communication session between the user's browser and a server. With this API

you can send messages to a server and receive event-driven responses without having to poll the server for a reply." This confirms the bidirectional

real-time

and traffic-reducing benefits over polling.

3. GraphQL Foundation. "Subscriptions". graphql.org.

In the introductory paragraph: "Subscriptions are a GraphQL feature that allows a server to send data to its clients when a specific event happens. Subscriptions are usually implemented with WebSockets." This reference clarifies that GraphQL itself is not the transport mechanism for real-time data; it relies on an underlying protocol like WebSockets.

4. Fielding

R. T. "Architectural Styles and the Design of Network-based Software Architectures." University of California

Irvine

2000.

Section 5.2.1.2 (Client-Server): This foundational text on REST describes the architecture as having a strict separation of concerns where the client initiates requests. This confirms the non-bidirectional nature of the core REST pattern. (DOI: https://www.ics.uci.edu/~fielding/pubs/dissertation/restarchstyle.htm)

The scenario describes a predictable, recurring load pattern: 5,000 employees access an application "on a daily basis during the same time frame." The most efficient and proactive approach for such a workload is scheduled autoscaling. Scaling horizontally (adding more instances) is the standard method for web applications to handle increased concurrent user traffic, enhancing both performance and availability. By scaling horizontally based on a schedule, resources are provisioned just before the anticipated peak usage and de-provisioned afterward, ensuring performance during high-demand periods while optimizing costs during off-peak times. This preemptive strategy avoids the performance lag that can occur with reactive, load-based scaling.

A. Scale vertically based on a trend.

Vertical scaling (increasing resources of a single instance) has inherent limits and can cause downtime. Trend-based scaling is reactive, not proactive for a known, daily schedule.

C. Scale vertically based on a load.

This is a reactive approach that waits for performance to degrade before acting. Vertical scaling is also less flexible and resilient for web traffic than horizontal scaling.

D. Scale horizontally based on an event.

While horizontal scaling is appropriate, event-based (or load-based) scaling is reactive. It waits for a performance threshold to be breached, which is less optimal than a proactive, scheduled approach for a predictable load.

1. Google Cloud Documentation

"Autoscaling groups of instances": "You can use schedules to configure scaling events that happen at specific times. Scheduled autoscaling is useful when you have a workload that has predictable

recurring peaks. For example

your application might serve a high volume of traffic during the workday and a low volume of traffic during the night." This directly supports using a schedule for predictable

daily traffic peaks.

2. Amazon Web Services (AWS) Documentation

"Scheduled scaling for Amazon EC2 Auto Scaling": "Scheduled scaling allows you to set your own scaling schedule for predictable load changes. For example

let's say that every week the traffic to your web application starts to increase on Wednesday

remains high on Thursday

and starts to decrease on Friday. You can plan your scaling activities based on the predictable traffic patterns of your web application."

3. Microsoft Azure Documentation

"Get started with autoscale in Azure": "You can also schedule autoscale to happen at fixed times. You can create rules that scale based on a schedule... This approach can be useful when you see a consistent time-based pattern in your load and want to scale out before an anticipated peak in load occurs to ensure that capacity is ready."

4. Mell

P.

& Grance

T. (2011). The NIST Definition of Cloud Computing (NIST Special Publication 800-145): The concept of "Rapid elasticity" (p. 2) is a core cloud characteristic. Scheduled scaling is a specific implementation of this principle

allowing for capabilities to be "elastically provisioned and released... to scale rapidly outward and inward commensurate with demand." For predictable demand

a schedule is the most efficient method of provisioning. (DOI: https://doi.org/10.6028/NIST.SP.800-145)