CertiOverview
Exam format, the 750 passing score, six domain weights, and the CV0-003 comparison.
Study guide · Flashcards & memory notes
Cloud+ Flashcards & Memory Notes
40 recall cards for the facts Cloud+ (CV0-004) keeps asking you to separate: service models, migration paths, backups and identity, and the DevOps tools.
How to use these cards: Say the answer out loud before you flip the card, and mark it honestly. Revisit the cards you missed tomorrow rather than rereading them right away. Progress is kept only while this page is open. For the full explanations behind each card, see the core notes.
Study mode
Choose a deck, flip each card, and mark what you already know.
You marked every card in this deck as known. Shuffle and run through it again, or choose another deck.
All flashcards
Select a question to reveal its answer.
Deck 1 · Models and architecture
Service models, sites, storage, and network pieces.
1.1Who patches the guest operating system on IaaS?
You do. The provider patches the hypervisor and the physical host. On PaaS the provider patches the platform.
1.2How does FaaS differ from a virtual machine you leave running?
The function runs when an event invokes it. You do not keep an idle guest. You still own the function code.
1.3What is cloud bursting?
Private capacity overflows into a public cloud. It is not a second availability zone inside one provider.
1.4What is RPO, and what is RTO?
RPO is how much data you can lose. RTO is how long you can be down. A hot site meets a short RTO. A cold site does not.
1.5How do block storage and object storage differ?
Block storage is a disk with IOPS. Object storage is blobs over HTTP, usually with hot, warm, cold, or archive tiers.
1.6When do you choose a network load balancer instead of an application load balancer?
When you forward by address and port and do not need the HTTP path. An application load balancer reads host and path.
1.7How does VPC peering differ from a transit gateway?
Peering connects two networks directly. A transit gateway is a hub so many networks do not need a full mesh.
1.8What is a persistent volume, and what is ephemeral storage?
A persistent volume outlives the container. Ephemeral storage disappears with the instance or container.
1.9What does fan-out do with one event?
It delivers that event to many consumers. Service discovery, a different idea, lets a caller find a healthy instance.
1.10What does host affinity do?
It pins a virtual machine to a chosen host. Anti-affinity, which keeps copies apart, is not the term CV0-004 prints.
Deck 2 · Deployment and cost
Rollouts, the six migration paths, and billing.
2.1How does blue-green differ from a canary?
Blue-green switches all traffic between two full environments. A canary sends a small share first.
2.2How does a rolling update differ from an in-place update?
Rolling replaces instances in batches, so old and new run together. In-place updates the existing instances and makes rollback harder.
2.3What is rehost, and what is refactor?
Rehost moves the workload unchanged. Refactor changes the application so it can use cloud services.
2.4How do retain and retire differ?
Retain leaves the system where it is. Retire turns it off. Neither one is a move into the cloud.
2.5How does replatform differ from re-architect?
Replatform makes a small platform change, such as a managed database. Re-architect redesigns the structure, for example into microservices.
2.6What is drift?
Live infrastructure no longer matches the code that defined it. Versioning the file does not by itself detect that mismatch.
2.7How do infrastructure as code and configuration as code differ?
Infrastructure as code provisions resources. Configuration as code sets the system after it exists. Terraform provisions. Ansible configures.
2.8Why would you choose a spot instance?
The price is low and the workload can be interrupted. Reserved capacity is the committed discount. Pay-as-you-go has no commitment.
2.9What is a dedicated host for?
A physical server billed to you, often for socket-based licenses. It is not the same thing as a reserved virtual machine.
2.10What do tagging and rightsizing do for cost?
Tags attribute spend to an owner. Rightsizing matches size to measured use. Metering is how the provider counts that use.
Deck 3 · Operations and security
Scale, backups, identity, and attacks.
3.1How do horizontal and vertical scaling differ?
Horizontal adds instances. Vertical makes one instance larger. Vertical hits a size ceiling and often needs a restart.
3.2Which backup copies changes since the last full backup?
Differential. Incremental copies changes since the last backup of any type. Full copies everything in scope.
3.3How do logs, metrics, and traces differ?
Logs are events. Metrics are numbers over time. A trace follows one request across services. An alert is the notice that one of those left the baseline.
3.4What are the four vulnerability-management steps, in order?
Scanning scope, identification, assessment, then remediation. A CVE names the vulnerability. The fix is the last step, not the first.
3.5How do SAML and OAuth 2.0 differ?
SAML federates sign-in. OAuth 2.0 delegates authorization. OpenID Connect adds sign-in on top of OAuth 2.0.
3.6What does HTTP 401 mean, and what does 403 mean?
401 means not authenticated. 403 means the caller is known and is not allowed. 429 means the API is throttling the caller.
3.7How do data sovereignty and data locality differ?
Sovereignty is which law applies. Locality is where the bytes sit. Ownership is who owns the data, which stays with the customer in a normal contract.
3.8What is a bastion host for?
It is the jump host allowed to reach private systems. Publishing SSH or RDP on every instance skips that control.
3.9How do cryptojacking and a zombie instance differ?
Cryptojacking spends your compute on mining. A zombie instance is compromised and acts for someone else, often in a flood.
3.10How does a WAF differ from a network ACL?
A WAF inspects web requests. A network ACL filters by address and port and does not read the HTTP body.
Deck 4 · DevOps and troubleshooting
Source control, named tools, and the fault that fits.
4.1What is the order of commit, push, and merge?
Commit records the change locally. Push sends it to the remote. Merge combines branches after review. A pull request is the review request, not the commit itself.
4.2Which tool provisions infrastructure, and which one configures it?
Terraform provisions. Ansible configures. Kubernetes orchestrates containers. Docker builds and runs them.
4.3How do ELK and Grafana differ?
ELK collects and searches logs. Grafana shows metrics. Jenkins runs build jobs. GitHub Actions runs workflows in the Git host.
4.4How does REST differ from GraphQL?
REST addresses resources with HTTP verbs. GraphQL lets the client ask for the fields it needs. SOAP uses an XML contract.
4.5Two virtual networks will not peer. What is the usual address fault?
Their ranges overlap. A missing route is a different fault, and it shows up after the networks are already connected.
4.6The API returns 429 while you create instances. What is happening?
Throttling. A service quota is a ceiling on how many you may create even when the API is not busy.
4.7Names fail and IP addresses still answer. What broke?
DNS. If addresses also fail, look at routes or NAT, not the name.
4.8Old clients fail a TLS handshake and DNS still resolves. What was removed?
A cipher suite they still need. This is deprecation, not a DHCP failure.
4.9A template works in one region and the service is missing in another. Why?
Regional service availability. The same definition cannot create a service that region does not offer.
4.10The cloud bill spikes and an instance is mining. What attack is that?
Cryptojacking. Close the leaked credential or metadata path. A DDoS is a flood against you, not mining on your bill.
Continue the Cloud+ study path
Test what you have learned with a timed practice exam.
Core Notes
Reference notes for models, migration, scaling, identity, DevOps tools, and troubleshooting.
Flashcards & Memory Notes
40 recall cards in four decks, plus memory notes for models, backups, and the tool list.
Practice Exams
200 original questions with custom exams, explanations, and an unofficial score on the 100-900 scale.
Related Tools
Useful companions while you study.
JSON/YAML Converter
Convert structured data between JSON and YAML with formatting and validation.
Base64 Converter
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Password Generator
Generate strong random passwords with custom length, characters, symbols, and security options.
Time Calculator
Calculate elapsed time, add or subtract hours and minutes, and convert time to decimal hours.
Legal Disclaimer
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. CompTIA and Cloud+ are trademarks of CompTIA, Inc. Certicab is not affiliated with, endorsed by, or sponsored by CompTIA.