ISACA • Cloud-Fund
Validates foundational knowledge of cloud computing, covering cloud architecture, deployment models, security, risk assessment, and the ability to optimize cloud potential for business services across cloud concepts, governance, and service support.
Questions
600
Duration
120 minutes
Passing Score
65%
Difficulty
FoundationalLast Updated
Feb 2026
The ISACA Cloud Fundamentals Certificate is a foundational-level credential that validates knowledge of core cloud computing principles, concepts, governance, security, and service support. The exam blends theoretical knowledge with practical, performance-based assessment in a virtual lab environment, distinguishing it from purely multiple-choice certifications. It covers how cloud architecture connects vital services and data to enable digital transformation and business agility, including an understanding of deployment models, risk assessment, and cloud optimization strategies.
Offered under ISACA's Certified in Emerging Technology (CET) certificate family, this credential is designed to affirm both conceptual understanding and practical skills. Candidates are tested across three domains: Cloud Computing Concepts (42%), Cloud Service Support (33%), and Cloud Governance (23%), ensuring a balanced assessment of technical and governance competencies relevant to modern cloud environments.
This certificate is ideal for students, recent graduates, and early-career IT professionals who want to establish a verified foundation in cloud computing. It is particularly well-suited for individuals who are new to IT or transitioning into cloud-related roles such as cloud analyst, cloud support specialist, or cloud security consultant.
Teams and organizations seeking to upskill employees on cloud fundamentals will also find this certificate valuable. Because there are no prerequisites, it is accessible to anyone motivated to demonstrate cloud competency, regardless of prior certifications or formal education in technology.
There are no formal prerequisites for the ISACA Cloud Fundamentals Certificate. Candidates can register for the exam at any time without needing to hold prior certifications or meet specific experience requirements.
While no prerequisites are mandated, candidates are expected to have at least a general familiarity with IT concepts. ISACA recommends using official preparation resources — including the self-guided online review course, hands-on lab package, and the official study guide — to build the practical and conceptual knowledge needed to pass the performance-based components of the exam.
The Cloud Fundamentals exam is computer-based and delivered as a remotely proctored online exam with a 2-hour (120-minute) time limit. It blends two question types: traditional multiple-choice (knowledge-based) questions and performance-based questions set within a virtual lab environment, which test hands-on application of cloud skills rather than purely theoretical recall.
Candidates must earn a passing score of 65% or higher. Exam eligibility is valid for 12 months from the date of registration, and appointments can be scheduled as early as 48 hours after payment. Rescheduling is permitted without penalty if done at least 48 hours before the scheduled appointment. The specific total number of questions is not published by ISACA.
The ISACA Cloud Fundamentals Certificate serves as a recognized entry point into cloud-focused roles, validating skills that are increasingly demanded as organizations accelerate cloud adoption. Job roles accessible with this credential include cloud analyst, cloud support specialist, and cloud security consultant, in both private sector technology firms and public sector agencies that use ISACA credentials as hiring benchmarks. Lightcast data cited by ISACA indicates that CET-related skills — the family this certificate belongs to — command salary premiums of up to US $15,000, with entry-level certified professionals typically earning between $65,000 and $80,000 annually.
Demand for cloud computing security skills specifically is projected to grow 90% over the next five years, making a foundational cloud credential an investment with long-term career relevance. Compared to vendor-specific foundational certifications such as AWS Cloud Practitioner or Microsoft Azure Fundamentals, the ISACA Cloud Fundamentals Certificate differentiates itself by emphasizing governance, risk, and compliance alongside technical concepts — a combination well-aligned with compliance-heavy industries such as finance, healthcare, and government.
5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 600 questions.
1. A software vendor provides applications accessible from web browsers, tablets, and mobile devices without requiring client-side installations. The applications use standard HTTPS protocols for communication. Which NIST essential characteristic does this demonstrate? (Select one!)
Explanation
Broad network access is the NIST characteristic requiring capabilities available over the network via standard mechanisms that promote use by heterogeneous thin or thick client platforms including mobile phones, tablets, laptops, and workstations. Standard protocol access like HTTPS supporting multiple device types demonstrates broad network access. On-demand self-service relates to provisioning without human interaction. Rapid elasticity relates to resource scaling. Resource pooling relates to multi-tenant infrastructure sharing.
2. A Kubernetes cluster requires persistent storage for database workloads that survives pod termination and rescheduling. The storage must be dynamically provisioned when applications request it. Which Kubernetes component provides this capability? (Select one!)
Explanation
Persistent Volume is the Kubernetes abstraction that provides storage resources independent of pod lifecycle. PVs can be dynamically provisioned through StorageClasses when applications request storage via PersistentVolumeClaims, and the data persists even when pods are terminated or rescheduled. ConfigMap stores configuration data. Secret stores sensitive information. EmptyDir provides temporary storage that is deleted when pods terminate, making it unsuitable for persistent database storage requirements.
3. A financial services company implements NIST SP 800-145 resource pooling in their cloud environment. Customers can specify data residency at the country level but cannot control the exact datacenter location. Which cloud characteristic does this exemplify? (Select one!)
Explanation
Location independence is a key aspect of resource pooling where customers generally have no control or knowledge over exact resource location but may specify location at higher abstraction levels such as country, state, or datacenter. This scenario demonstrates location independence by allowing country-level specification while abstracting exact datacenter details. Broad network access relates to heterogeneous platform connectivity. Multi-tenancy describes resource sharing architecture. Measured service relates to metering and resource usage monitoring.
4. A retail company requires their payment processing system to restore operations within 30 minutes of any failure, but can tolerate losing up to 15 minutes of transaction data. Which metrics do these requirements represent? (Select two!)
Multiple correct answersExplanation
Recovery Time Objective of 30 minutes represents the maximum acceptable downtime before operations must be restored. Recovery Point Objective of 15 minutes represents the maximum acceptable data loss measured in time, meaning backups or replication must occur at least every 15 minutes. RTO measures how quickly systems must recover while RPO determines backup frequency. Mean Time to Recovery is an average metric rather than a maximum acceptable timeframe.
5. A disaster recovery architect evaluates strategies for a critical application with 15-minute RTO and 5-minute RPO requirements. Which strategy meets both objectives at the lowest cost? (Select one!)
Explanation
Warm Standby provides minutes-level RTO and seconds-to-minutes RPO by maintaining a scaled-down but fully functional environment with continuous data replication, meeting the 15-minute RTO and 5-minute RPO requirements. Backup and Restore takes hours, missing both targets. Pilot Light typically requires tens of minutes to scale up. Multi-Site Active/Active provides near-zero RTO/RPO but costs significantly more than Warm Standby, making it unnecessarily expensive when 15-minute RTO is acceptable.
One-time access to this exam