Domain 1: Cloud Architecture
- IaaS gives you virtual machines, storage and networking and leaves the guest operating system upward to you. PaaS gives you a managed runtime where you supply code and configuration. SaaS gives you finished software where you supply only data and settings.
- Function as a Service (serverless) runs event-triggered code with no persistent server to manage, and bills by invocation and duration rather than by uptime.
- Database as a Service is a managed database where the provider handles patching, backup and availability while you own schema, queries and data.
- XaaS - Anything as a Service - is the umbrella term for the whole family of consumption-based service models.
- The deployment models are public, private, community and hybrid. Public is provider-owned shared infrastructure; private is dedicated to one organisation; community is shared by organisations with common requirements; hybrid combines two or more with orchestration between them.
- Multicloud means using more than one public provider, which is a sourcing strategy. It is not the same as hybrid, which is about mixing deployment models.
- Under shared responsibility the provider always owns the physical data centre and hardware, and the customer always owns their application code and data. What moves between them is everything in the middle, and it moves with the service model.
- In IaaS the customer patches the guest OS, configures the firewall rules and sets the encryption options. In PaaS the provider takes the OS and runtime, and in SaaS the provider takes the application as well.
- Identity and access management is a customer responsibility in every service model, including SaaS - the provider supplies the mechanism, the customer decides who has access.
- On-demand self-service means a consumer can provision capacity without human interaction from the provider, which is what removes the procurement cycle from the deployment path.
- Rapid elasticity means capacity scales out and back in with demand, ideally automatically. Measured service means consumption is metered and billed, which is what makes elasticity visible as cost.
- Resource pooling means the provider serves multiple tenants from shared physical infrastructure, with resources assigned and reassigned dynamically.
Domain 2: Deployment
- Declarative provisioning states the desired end state and lets the tool work out how to reach it. Imperative provisioning defines an exact sequence of commands. Declarative with state reconciliation is what supports consistent, repeatable environments.
- Idempotency means repeated runs converge on the same end state. Idempotent tooling detects that the environment already matches and makes no changes.
- A script without an existence check is not idempotent: rerunning it creates duplicate resources, which is the classic failure of imperative provisioning.
- The state file records the attributes of the resources the tool manages, and it is how the tool knows what it created.
- Configuration drift is a mismatch between the actual infrastructure and the defined configuration. Manual console edits and out-of-band scripts are its usual causes.
- A plan or preview step detects drift before any change is applied, and reapplying the template restores the defined configuration and removes it.
- State can drift out of sync with reality when resources are changed outside the tool, which is why the preview step matters even when nobody believes anything has changed.
- State locking prevents two operations modifying state at the same time. A remote shared state backend with locking is what lets a team collaborate safely; local-only state risks stale, conflicting runs with no cross-team write lock.
- Losing the state file makes the tool lose track of resources it already created, after which it will try to create them again.
- A template is a reusable, version-controlled definition of a set of resources. A module is a callable package of related resources, which is the reuse unit above a template.
- Replacing hardcoded values with input variables is what makes a template reusable across environments.
- Pin a module to a specific tested version. Floating to the latest means an upstream change alters your infrastructure without a change on your side.
Domain 3: Operations
- A performance baseline is required before you can judge whether new data is abnormal - without one, every number is just a number.
- A counter is a cumulative metric that only increases or resets to zero; a gauge records a point-in-time value that can move in either direction. Choosing the wrong one makes a dashboard misleading.
- Application performance monitoring instruments application code and transactions to measure what users actually experience, rather than inferring it from infrastructure metrics.
- A trace follows a request across services and a span is one discrete timed unit of work within it. A shared correlation or trace ID passed between services is what links their logs and spans together.
- Observability is the combined use of metrics, logs and traces to understand a system's internal state from its outputs.
- Centralised log aggregation lets teams search and correlate logs from every source together, which is the difference between having logs and being able to use them.
- Structured logging uses consistent fields that automated tools can parse and query reliably, rather than free-text lines that only a human can read.
- A log retention policy that matches the regulatory period satisfies the compliance requirement; log rotation separately prevents unbounded growth from exhausting local disk.
- A static threshold that ignores seasonal patterns produces false alerts during expected peaks. Anomaly detection with dynamic baselining flags deviation from a learned normal instead.
- Alert fatigue is what happens when excessive low-value alerts train staff to disregard notifications, at which point the alerting system is worse than none.
- Flapping alerts are stabilised with hysteresis, so the value has to clear a buffer zone before the state changes back.
- Event correlation links related events from different sources to reveal a shared root cause, rather than paging on each symptom separately.
- A service level indicator is the measured value; the service level objective is the target it is compared against.
- The 99th percentile latency exposes the slow outlier requests that an average hides, which is why percentiles rather than means are used for user-facing latency.
- A warning severity fits a recoverable issue that did not stop the request succeeding; reserve higher severities for user-visible failure.
- An escalation policy automatically routes an unacknowledged alert to the next responder, so a missed page does not become an outage.
- Synthetic monitoring runs scripted, simulated transactions to test availability proactively, catching failures before a real user does.
Domain 4: Security
- A role is assumed for temporary, scoped access rather than being a permanent identity, which is what makes it preferable to a long-lived user for both cross-account access and workload identity.
- An instance or workload role replaces the embedded personal access key on a server - the credential is issued dynamically and rotates automatically.
- Attach policies to a group rather than to each user individually, so joining and leaving is a membership change rather than a permissions rewrite.
- The root or global administrator account has unrestricted, unscoped access, should not be used for daily work, and needs the strongest available protection.
- Least privilege grants only the access needed for the task. Scope a policy down to the specific resource rather than granting the whole service.
- An explicit deny overrides a conflicting allow, which is what makes guardrail policies effective regardless of what a lower-level policy grants.
- Condition elements enforce context-aware access - source network, time, MFA state, resource tag - and are how a single policy covers a nuanced rule.
- Separation of duties splits sensitive tasks across identities so no single person can complete a high-risk action alone.
- Test and simulate policy changes before applying them in production; a policy evaluator shows the effective result of overlapping documents.
- RBAC assigns permissions through a fixed role, so adding a person means assigning them the existing role. ABAC evaluates attributes of the user, the resource and the environment, so access adapts automatically as tags change.
- ABAC scales through attribute logic rather than through more roles, which is the answer to role explosion - many narrow roles and persistent confusion about which to assign.
- Multi-factor authentication requires at least two distinct factor categories. Two devices of the same category is not MFA - what defines it is the category, not the device count.
- A locally generated time-based one-time password works offline, which matters where a phone has no signal or data.
- Number matching defeats push-fatigue attacks by requiring the user to enter a value shown on the sign-in screen rather than simply approving a prompt.
- Periodic access review - removing unused accounts and re-checking group membership - is what stops entitlements accumulating quietly over time.
Domain 5: DevOps Fundamentals
- The standard pipeline order is build, then test, then deploy. Continuous integration triggers an automated build and test run on every merge; continuous deployment releases every passing build to production automatically.
- Trunk-based development favours frequent small commits to one shared main branch; the feature branch workflow isolates work on a branch and merges it back when complete.
- Merge conflicts arise from conflicting edits to the same lines in different branches, and are resolved by a person deciding which change wins.
- A fast-forward merge simply moves the branch pointer forward because no divergent commits exist. Rebase rewrites history onto a new base; merge preserves history and adds a merge commit.
- Tags mark a specific commit as a fixed named reference point, which is how a release is identified after the branch has moved on.
- In semantic versioning the MINOR number increases for new backward-compatible functionality, MAJOR for a breaking change, and PATCH for a backward-compatible fix.
- Automated pipeline testing catches defects earlier, runs repeatably and gives faster feedback than manual testing at the end.
- A smoke test is a quick check that the essential paths work after a deployment. Regression testing reruns the existing suite to catch previously working features that have broken.
- Shift-left testing moves testing earlier in the development process, so defects are found when they are cheapest to fix.
- An artifact repository stores versioned build outputs for later deployment, and immutable artifacts guarantee the exact tested build is what gets promoted to every environment.
- Rebuilding separately for each environment risks shipping code that was never actually tested - build once, promote the same artifact.
- Caching dependencies speeds up builds by skipping redundant downloads, which is usually the largest single saving in pipeline duration.
- Blue-green deployment runs two complete environments and switches traffic between them, so rollback is switching traffic back to the untouched previous environment.
- A canary deployment routes a small share of traffic to the new version first, so problems surface against a limited blast radius before full rollout.
Domain 6: Troubleshooting
- For connectivity between two networks, start with routing and security rules. Peering is not symmetric by configuration: each side needs its own route back, and a missing return route breaks the reply path only.
- A stateless network ACL evaluates both directions independently, so it can permit the request and block the return traffic. A stateful security group tracks the connection and allows the reply automatically.
- First-match rule ordering means a broad deny placed above a specific allow wins, which is why rule order matters as much as rule content.
- Asymmetric routing sends replies back through a different path, and a stateless firewall on that path drops them because it never saw the outbound flow.
- Overlapping CIDR ranges between connected networks make routes ambiguous and are a design problem rather than a configuration one.
- When name resolution differs between internal and external clients, check the private DNS zone and split-horizon configuration - the record may exist but not be served to the client that needs it.
- Resolvers that already cached a record keep honouring the TTL in effect when they cached it, so lowering a TTL does not take effect until the old TTL expires.
- Blocked ICMP prevents Path MTU Discovery from working, so a jumbo-frame mismatch shows up as large packets failing while small ones succeed.
- A global load balancer sending traffic to a distant region usually lacks latency-aware or location-aware routing configuration rather than being broken.
- A worse route metric or disabled multi-pathing forces traffic down the slower of two available paths.
- Provisioning failures that mention capacity are often quota rather than availability - existing resources are consuming the headroom.
- A subnet that has run out of assignable addresses fails new deployments while existing resources continue working normally.
- An access denied error from an automated process usually means the identity's role is missing the specific data-plane permission, not that the credential is wrong.
- A template failure complaining about a type mismatch is typically a quoted value passing a string where an integer was expected.
- A resource created before its dependency needs an explicit declared dependency, because the tool parallelises anything it does not know is ordered.
- Intermittent failures under load with no error in the application are frequently provider API rate limiting rather than a fault in the workload.
CompTIA Cloud+ (CV0-004) exam tips
- Cloud+ is vendor-neutral, so answer with the concept rather than a provider's product name. If two options describe the same mechanism under different vendor branding, the exam wants the generic one.
- Shared responsibility questions are answered by locating the service model first. Data and identity are always the customer's; physical infrastructure is always the provider's; everything in between moves with IaaS, PaaS or SaaS.
- For troubleshooting, follow the order the exam expects: routing, then security rules, then name resolution, then quota and capacity. Jumping to the exotic cause is the trap, and the return path is the single most common answer.
- Distinguish stateful from stateless filtering deliberately. Any scenario where the request arrives but the reply never comes back points at a stateless ACL or asymmetric routing.
- In IaC questions, prefer declarative, idempotent, remote-state-with-locking and pinned module versions. Almost every wrong answer in this domain is imperative, local-state, unpinned or lacking an existence check.
Study guide FAQ
How is the CV0-004 exam scored and structured?
CompTIA Cloud+ CV0-004 has a maximum of 90 multiple-choice and performance-based questions in 90 minutes, scored on a scale of 100 to 900 with 830 required to pass. Performance-based questions appear first and are worth attempting rather than skipping.
Which domain should I focus on most?
Cloud Architecture is the largest domain in this bank, with Deployment and Security close behind. Troubleshooting is smaller by question count but disproportionately valuable, because those questions are scenario-based and the same diagnostic order applies across many of them.
Do I need experience with a specific cloud provider?
No, and the exam deliberately avoids provider-specific naming. Hands-on experience with any major provider helps considerably, because the concepts - routing, security groups, IAM, IaC state, autoscaling - are the same everywhere. What matters is recognising the mechanism regardless of what it is called.
How does Cloud+ differ from a vendor cloud certification?
A vendor certification tests one platform's services and their specific behaviour. Cloud+ tests operating cloud infrastructure generally, with more weight on day-two operations, observability, troubleshooting and the shared responsibility model, and none on a particular provider's console or CLI.