CLOUDF EXIN Cloud Computing Foundation Exam Topics and Questions

Cloud principles is the largest single slice of the exam, and it earns that weight because everything else in the syllabus assumes you have this foundation solid. The topic spans definitions, history, architecture, and trade-offs. Where candidates lose ground here is in confusing deployment models with service models, or in treating the benefits-and-limitations questions as too easy to bother reviewing. Neither mistake is safe.

– What cloud is and how it is delivered

The exam tests the concept of cloud computing at the level of recognising what makes something a cloud service rather than conventional hosted IT. You need to distinguish the four deployment models: private, public, community, and hybrid. The distinctions matter in context, so practise applying each model to a scenario rather than memorising labels. The three service models, PaaS, IaaS, and SaaS, are equally scenario-dependent. Knowing which layer of the stack each model hands to the customer is the examinable skill. A question will describe a situation, and you will need to identify which model fits, not just name the acronym. The boundary between IaaS and PaaS catches candidates who have learned the definitions but not thought through where management responsibility shifts.

– How cloud computing developed

Cloud did not arrive without precursors, and the exam expects you to trace the line from earlier concepts to modern cloud. The role of the network and servers, the internet as an enabling layer, virtualisation as the technology that made elastic resource sharing practical, and managed services as the commercial model that preceded cloud-as-a-service: each of these has a distinct contribution. Virtualisation is worth particular attention because questions can probe the specific mechanism it provides, not just the general idea that it abstracts hardware. Managed services is the concept most often treated as background noise, but the exam uses it to test whether you understand why organisations began outsourcing operational responsibility before cloud existed.

– Architecture and the single-purpose versus multipurpose distinction

Cloud architecture questions turn on one key contrast: single-purpose architectures are built for one workload, multipurpose architectures are designed to serve varied workloads from shared infrastructure. The exam expects you to identify the implications of each choice, not just name them. Service-oriented architecture (SOA) sits alongside this as a design philosophy where functionality is exposed as discrete, interoperable services. The examinable point about SOA is what it enables in a cloud context: loose coupling, reuse, and the ability to compose services from multiple providers. Candidates who treat SOA as a general IT concept without connecting it to cloud delivery tend to miss the scenario-based questions that test this link.

– Benefits and limitations in practice

The benefits-and-limitations sub-topics look straightforward, but the exam uses them to test judgment, not recall. Listing benefits gets you nothing if a question describes a situation where a stated benefit does not apply or is outweighed by a limitation. Scalability, cost flexibility, and accessibility are the commonly cited benefits, but the exam is more likely to probe whether you recognise when a limitation, such as dependency on internet connectivity, vendor lock-in, or reduced direct control, changes the picture for a specific organisation. Read limitations as actively as you read benefits. Questions in this area reward candidates who can weigh both sides against a given scenario rather than applying a generic checklist.

How Cloud principles is tested

At 33% of the exam, this topic will account for roughly a third of all items you face. Most of them are scenario-based: a short description of an organisation or situation followed by a question about which model, concept, or trade-off applies. The deployment and service model questions are the most common source of lost marks, because candidates who have memorised the terms still mis-apply them when the scenario adds detail that shifts the answer. Items here reward the ability to match a described situation to the correct model and to explain why the others do not fit.

The benefits-and-limitations questions are a second loss area. They look easy, and that causes candidates to rush them. The trap is that a benefit stated in isolation is not always the right pick when the scenario introduces a constraint. Slow down on those items. The evolution sub-topics generate fewer questions but tend to be precise: the exam tests which technology played which specific role, so vague answers about 'the internet enabling cloud' are not sufficient. Know the contribution of each precursor technology separately.

Where Cloud principles asks you to understand concepts, this topic asks you to apply them to real operational decisions. The shift is from 'what is cloud' to 'how do you build and run it'. Candidates who treated the first topic as an exercise in memorisation find this one harder, because the questions expect you to reason about components, access controls, risk, and service management. The local cloud environment and the ITSM angle are both tested in ways that reward practical thinking.

– Local cloud environments and network access

A local cloud environment is not simply a data centre with a new label. The exam tests whether you know the main components and, more precisely, how they connect to each other. The interconnection logic matters: questions can describe a component and ask what role it plays in the wider architecture, or describe a gap and ask what is missing. Secured access to a LAN is tested at the level of understanding why access controls are needed and what mechanisms achieve them, not at a deep networking-certification level. The risks of connecting a local cloud network to the public internet are a separate and important sub-topic. Treat those risks as distinct from general internet security risks: the exam is interested in what changes specifically because a cloud environment is involved.

– Managing cloud services through ITSM principles

ISO/IEC 20000 is the reference standard here, and the exam uses it to test whether you understand how established IT service management principles translate into a cloud context. You do not need deep ISO/IEC 20000 knowledge, but you do need to know what the standard addresses and why its principles are relevant when services are delivered from cloud infrastructure. Service level management is the more heavily tested of the two ITSM sub-topics. Questions typically describe a service level scenario and ask what the management response should be, or ask what makes SLA management different in cloud compared with on-premises IT. The key distinction is that cloud introduces multi-party chains: your SLA with your customer may depend on an SLA your provider holds with their infrastructure supplier. That dependency is the examinable point.

How Implementing and managing cloud is tested

At 21%, this topic generates a meaningful portion of your paper. Items here are predominantly applied: they describe a scenario involving a local cloud setup, a network access decision, or a service management situation, and ask you to identify the appropriate component, control, or principle. The local environment questions reward knowing the architecture well enough to reason about it, not just name its parts.

The ITSM questions are where candidates who come from a non-IT-service-management background tend to drop marks. The ISO/IEC 20000 reference is not there to test whether you have studied the standard in depth; it is there to test whether you understand the role of formalised service management in a cloud delivery context. Items reward connecting the standard's intent to the specific cloud scenario described. The service level management questions are the most nuanced: the trap is applying on-premises SLA logic to a cloud scenario without accounting for the additional layers of provider dependency. Candidates who recognise that distinction consistently outperform those who treat SLAs as a generic ITSM concept.

The previous two topics covered the architecture and management of cloud from the inside. This topic shifts to the perspective of users, businesses, and service providers who interact with cloud from the outside. The access methods, the business process implications, and the changed vendor-customer dynamic all appear here. Candidates sometimes underestimate this topic because it feels less technical, but the business-facing questions demand precise thinking about roles and relationships rather than just general familiarity.

– How users reach cloud services

Cloud access is tested across four delivery modes: web browser access to web applications, the cloud web access architecture that sits behind that browser experience, thin clients, and mobile devices. For each mode the exam expects you to understand what it is and what its specific role or constraint is in a cloud context, not just that it exists. The cloud web access architecture sub-topic is worth careful attention: it tests the layers between a user's request and the cloud resource that serves it. Thin clients are often glossed over in study, but the exam uses them to probe understanding of where processing actually occurs in a cloud delivery model. Mobile device access questions tend to focus on what changes about access management and connectivity when the endpoint is mobile.

– Cloud in business and the provider relationship

The business process sub-topics ask you to think about how cloud computing affects what an organisation actually does, not just how it stores data. The impact on primary business processes is tested at the level of identifying which processes are affected and how. Standard applications for collaboration are a specific focus: the exam tests the role these applications play in enabling teams to work across locations and devices, which is a direct consequence of cloud delivery. The service provider sub-topics shift the angle again: how does the vendor-customer relationship change when services are cloud-based, and what are the specific benefits and risks for a provider who delivers cloud-based services? The risks side of that last question is where candidates lose marks by giving generic business risk answers rather than cloud-specific ones.

How Using the cloud is tested

At 17%, this topic produces a noticeable share of your paper. The access-method questions are usually the most straightforward, but they can trip candidates who have not thought carefully about what distinguishes each method. Knowing that a thin client exists is not enough: items reward understanding where computation sits and why that matters for cloud delivery.

The business process questions are the ones most likely to catch candidates off guard. They are not asking for IT knowledge; they are asking you to reason about organisational impact. Items in this area reward the ability to connect a cloud capability to a specific business effect, positive or negative. Vague answers about 'improved efficiency' do not score. The vendor-customer relationship questions are similarly precise: the exam is interested in the structural change that cloud introduces to that relationship, not a general commentary on outsourcing. The benefits-and-risks question for service providers is a close cousin of the limitations material from topic one, but viewed from the supply side. Keeping those two perspectives distinct in your thinking will help.

Security sits at the same weight as Using the cloud, but it draws on a different kind of thinking. Where the previous topic asked you to reason about access and business impact, this one asks you to identify risks, match them to mitigations, and understand the governance layer that sits above the technical controls. Identity management and privacy compliance are not decorative additions to a security topic: they are distinct testable areas that require their own preparation.

– Recognising and mitigating cloud security risks

The exam does not test security at a deep technical level, but it does expect precision. Recognising cloud security risks means being able to identify what makes a risk specific to cloud delivery, not just a general IT risk. The shared responsibility model, the exposure that comes from multi-tenancy, data in transit across public networks, and the reduced visibility that cloud customers have over underlying infrastructure are all relevant here. Mitigation measures are tested in relation to specific risks: the exam rewards pairing a risk with an appropriate control rather than listing generic security practices. Encryption, access controls, and network segmentation each address different parts of the cloud risk picture, and questions will test whether you know which control addresses which risk.

– Identity management and privacy compliance

Identity management in cloud covers the main aspects of establishing, verifying, and controlling who can access what. The exam is interested in the components of identity management and their purpose, particularly as they apply when users, services, and data span multiple cloud environments. Privacy in cloud is tested through the lens of compliance: what obligations arise, what risks exist, and what safeguards address them. This is not a legal examination, but you need to know the categories of concern well enough to identify a privacy issue in a described scenario and match it to a safeguard. The intersection of identity and privacy is worth noting: weak identity management is itself a privacy risk, and questions can test that connection by describing an identity failure and asking about its privacy implications.

How Cloud security, identity and privacy is tested

At 17%, this topic carries equal weight to Using the cloud but demands a more analytical response. Security items on this exam are typically recognition and application questions: a scenario describes a cloud environment or an event, and you identify the risk, the gap in controls, or the appropriate mitigation. Items reward specificity: a candidate who can name the right control for the right risk scores; a candidate who gives a broadly correct security answer without matching it to the cloud-specific context does not.

Identity management questions tend to be definitional but applied: you will need to know what each component of identity management does in order to select the right answer when a scenario describes a gap. Privacy questions are the most compliance-oriented items in the exam. The trap here is treating them as pure legal knowledge questions: they are not. They test whether you understand the practical safeguards that address privacy risks in cloud delivery. Candidates who study security in isolation without connecting it to the identity and privacy sub-topics tend to find that the scenario questions span all three areas at once, which makes partial preparation costly.

The final topic is the lightest by weight, but it closes the exam with a set of questions that require you to synthesise financial and performance thinking rather than recall definitions. TCO and RoI are not just accounting concepts here: the exam tests them as evaluation tools for cloud decisions. The performance and provider evaluation sub-topics add an operational dimension. Candidates who treat this topic as a short appendix to the syllabus often find the questions harder than expected.

– Financial evaluation: TCO and RoI

Total cost of ownership in a cloud context means accounting for costs that do not appear on a simple subscription invoice: migration costs, integration work, staff retraining, and the residual cost of any on-premises infrastructure that cannot be decommissioned immediately. The exam tests whether you can identify what belongs in a TCO analysis, not just that TCO exists as a concept. Return on investment questions ask you to evaluate cloud adoption in terms of measurable business benefit relative to cost. The trap is treating RoI as a pure cost-reduction calculation: the exam includes scenarios where the return is operational or strategic, and candidates who apply a narrow financial lens miss those items. Knowing the difference between what TCO measures and what RoI measures, and when each is the right lens, is the examinable skill.

– Evaluating performance and service providers

Performance evaluation in cloud covers three dimensions: performance factors, which relate to how well the service delivers against technical expectations; management requirements, which relate to what the organisation needs to operate the service effectively; and satisfaction factors, which relate to user and business experience. The exam tests whether you can identify what belongs in each dimension and why it matters for an evaluation decision. Service provider evaluation adds a selection and ongoing assessment angle: what criteria matter when choosing a cloud provider, and how do you assess whether a provider's services continue to meet requirements over time? Questions here reward structured thinking about evaluation criteria rather than general opinions about what makes a good provider.

How Evaluation of cloud computing is tested

At 12%, this topic produces fewer items than the others, but those items tend to require more deliberate reasoning. TCO questions reward candidates who understand the full scope of cloud costs, including the indirect and transitional costs that a straightforward subscription model obscures. RoI questions reward candidates who can apply the concept to a described scenario and identify whether the return is financial, operational, or strategic.

Performance evaluation questions are the most analytical in the topic. They describe a cloud deployment or a management situation and ask you to identify what should be evaluated and through which lens. The three-dimension framework of performance, management, and satisfaction factors is the structure the exam uses, and knowing which factor type applies to a described situation is where marks are won or lost. Provider evaluation questions can overlap with the service level material from topic two: candidates who have connected those two areas of the syllabus tend to handle the combined scenarios more reliably than those who studied each topic in isolation. This topic rewards breadth of preparation more than any other.