312-40 Sample Questions & Answers

The Pilot Light strategy provides a balance between cost and recovery time. The core infrastructure is running (the 'pilot light'), and data is actively replicated (RDS read replica, S3 CRR), which supports a low RPO. In a disaster, the infrastructure can be scaled out relatively quickly (e.g., via Auto Scaling), meeting the < 1 hour RTO without the cost of a fully scaled-out warm standby environment.

AWS CloudTrail is the correct source. It provides a record of actions taken by a user, role, or an AWS service. All management API calls, including PutBucketAcl, are recorded in CloudTrail logs, providing the necessary audit trail for forensic investigation of permission changes.

Azure Policy is the correct service. It allows you to create policies that enforce and control the properties of a resource. These policies can enforce rules for resource configuration, such as allowing only certain VM SKUs or requiring tags. It has built-in policy initiatives that map to compliance frameworks like NIST, making it the ideal tool for governance and compliance enforcement.

This is the ideal implementation. It uses subnetting for network segmentation and granular, stateful Security Groups to enforce the principle of least privilege. Traffic flow is strictly controlled between tiers (ELB -> Web -> App -> DB), providing strong defense-in-depth.

Data sovereignty is the concept that information which has been converted and stored in binary digital form is subject to the laws of the country in which it is located. For GDPR compliance, this means ensuring EU citizen data is stored and processed within designated regions (like EU regions offered by cloud providers) to comply with legal requirements about data residency and cross-border transfers.

Scanning during the build phase ('shift left') is a critical best practice. It provides the earliest possible feedback to developers, allowing them to fix vulnerabilities before the image is even stored in a registry.

Scanning images in the registry is essential. Most registries, like ACR, have built-in scanning capabilities. This ensures that even images built outside the pipeline are checked and provides a continuous assessment for newly discovered vulnerabilities in existing images.

Runtime scanning is another layer of defense. It can detect vulnerabilities in running containers that might have been missed, or it can identify malicious processes and activities. Services like Microsoft Defender for Containers provide this capability.

Platform as a Service (PaaS) is the correct model. It provides a platform allowing customers to develop, run, and manage applications without the complexity of building and maintaining the infrastructure typically associated with developing and launching an app. The cloud provider manages the OS, patching, and runtime, letting developers focus on their application code and data.

Correct. Objects in Google's Archive Storage are offline and must be restored before they can be accessed. Initiating a restore operation creates a temporary, cached copy of the object that becomes available for access after a few hours. The original archived object remains.

After detection and initial analysis, the immediate priority is Containment. This involves isolating the compromised system to prevent the threat from spreading to other parts of the network. This could be done by applying a restrictive Network Security Group (NSG) or moving the VM to an isolated VNet.

Preventive guardrails are implemented using Service Control Policies (SCPs) which are part of AWS Organizations. They are designed to enforce policies and prevent actions that would lead to a policy violation. An SCP can be configured to deny actions like cloudtrail:StopLogging or cloudtrail:DeleteTrail for all principals in an account, including the root user, making it the correct tool for this requirement.