Lab 01 — Build Your Cloud Lab Environment

Before you deploy virtual machines, networks, storage, or applications, you need a safe and organized cloud lab environment. A good cloud engineer does not start by randomly creating resources. They establish guardrails first.

Welcome to your first CompTIA Cloud+ practical lab.

This lab creates the foundation for every Cloud+ lab that follows.

You will prepare a cloud environment where you can safely practice:

• compute
• networking
• storage
• IAM
• monitoring
• security
• backup and recovery
• automation
• troubleshooting

The objective is not simply:

Create a cloud account.

The objective is:

Build a repeatable cloud lab environment that is organized, secure, cost-aware, and easy to troubleshoot and clean up.

🎯 Mission Information

Item	Details
Lab	01 — Build Your Cloud Lab Environment
Difficulty	Beginner
Estimated Time	45–60 Minutes
Primary Focus	Cloud Environment Preparation
Certification Alignment	CompTIA Cloud+
Career Alignment	Cloud Support Engineer, Cloud Administrator, Junior Cloud Engineer
Environment	Approved Cloud Lab Account
Major Skills	Account Security, Regions, Naming, Tags, Cost Awareness, Documentation, Cleanup
Deliverable	Cloud Lab Readiness Checklist

🏢 Scenario

You have recently joined a cloud operations team as a junior engineer.

Your manager asks you to create a sandbox environment where you can safely practice cloud administration.

The organization does not want learners creating resources without:

• clear naming
• ownership
• cost awareness
• basic security
• cleanup procedures

You have therefore been asked to prepare a small cloud lab environment before deploying any workload.

Your lab should answer:

Who Owns the Environment?
        ↓
Which Region Are We Using?
        ↓
How Will Resources Be Named?
        ↓
How Will Resources Be Tagged?
        ↓
How Will Costs Be Controlled?
        ↓
How Will Access Be Protected?
        ↓
How Will Resources Be Documented?
        ↓
How Will Everything Be Removed?

🎯 Lab Objectives

By completing this lab, you should be able to:

• prepare a cloud lab account

• identify your cloud region

• understand region-selection considerations

• secure account access

• enable MFA where supported

• avoid routine use of highly privileged root/owner identities

• define a naming convention

• define a tagging strategy

• organize lab resources

• establish cost controls

• document the environment

• create a cleanup checklist

• validate that the lab is ready for future exercises

🧠 Why This Lab Matters

New cloud learners often begin like this:

Open Cloud Console
      ↓
Create VM
      ↓
Create Storage
      ↓
Create Network
      ↓
Forget What Everything Does
      ↓
Unexpected Costs

A professional approach looks more like:

Prepare Account
      ↓
Secure Access
      ↓
Select Region
      ↓
Define Standards
      ↓
Set Cost Controls
      ↓
Deploy Resources
      ↓
Document
      ↓
Clean Up

That discipline becomes increasingly important when you work with:

• development environments

• production environments

• multiple teams

• multiple cloud accounts

• enterprise governance

⚠️ Safety and Cost Notice

Cloud resources can create charges.

Before continuing:

• use only an account you are authorized to use

• understand the provider’s current pricing model

• prefer free or low-cost resources for labs

• delete resources when they are no longer required

• do not deploy large compute instances

• do not create unnecessary storage

• do not leave public resources running accidentally

🧠 Cloud Cost Principle

Remember:

Stopping a workload does not always eliminate every charge.

Associated resources may continue generating costs, such as:

• disks

• public IP addresses

• snapshots

• backups

• load balancers

• gateways

This is why cleanup must include:

the complete resource set.

🗺️ Lab Architecture

For this first lab, your environment remains intentionally simple.

Cloud Account
     |
     ├── Secure Identity
     |
     ├── Primary Lab Region
     |
     ├── Naming Standard
     |
     ├── Tagging Standard
     |
     ├── Cost Controls
     |
     └── Cloud Lab Documentation

Future labs will expand this into:

Cloud Account
     ↓
Virtual Network
     ↓
Subnets
     ↓
Compute
     ↓
Storage
     ↓
IAM
     ↓
Monitoring

01 — Confirm Your Cloud Provider

You can perform this lab using an approved cloud platform.

Examples include:

• AWS

• Microsoft Azure

• Google Cloud

• another authorized cloud environment

For CompTIA Cloud+, the important concepts are:

provider-neutral cloud principles.

Do not become dependent on one provider’s button names.

📝 Record Your Environment

Create:

Cloud Provider:

Account / Subscription Name:

Purpose:
CompTIA Cloud+ Lab Environment

Owner:

Created Date:

🧠 Career Tip

In enterprise environments, resources should not exist without a clear:

• owner

• purpose

• environment

02 — Sign In to the Cloud Console

Open your approved cloud management console.

Confirm that you can access the environment successfully.

Do not create resources yet.

First understand:

where you are operating.

🔎 Identify

Locate information such as:

• account

• subscription

• project

• tenant

• region selector

• identity information

The exact terminology depends on the provider.

03 — Identify Your Current Identity

Determine which identity you are currently using.

Ask:

Am I using the highest-privileged account?

If yes, avoid using that identity for normal lab work where your provider supports safer delegated administration.

🧠 Identity Principle

Prefer:

Primary Account / Root / Owner
      ↓
Protected
      ↓
Used Only When Necessary

and:

Administrative Lab Identity
      ↓
Daily Lab Activities

04 — Protect the Primary Account

For the main cloud account:

• use a strong unique password

• enable MFA where available

• protect recovery methods

• do not share credentials

🔐 Why MFA Matters

Without MFA:

Password Compromise
      ↓
Account Compromise

With MFA:

Password Compromise
      ↓
Additional Authentication Required

MFA significantly reduces password-only compromise risk.

05 — Enable MFA

Where supported, enable multi-factor authentication.

After enabling it:

1. sign out

2. sign back in

3. confirm MFA is required

📝 Record

MFA Enabled:
Yes / No

Authentication Method:

Validation Completed:
Yes / No

🧠 Security Habit

Do not configure a security control and assume:

it works.

Validate it.

06 — Review Account Recovery

Check the account’s recovery configuration.

Confirm:

• recovery email or mechanism is valid

• recovery access is protected

• obsolete recovery information is removed

🧠 Why This Matters

Attackers sometimes target:

the recovery process

instead of the primary authentication process.

07 — Create a Dedicated Lab Administrator Identity

Where the platform supports it, create or use a dedicated identity for lab administration.

Example naming:

cloudplus-admin

or:

student-cloud-admin

⚠️ Important

This lab environment is for learning.

In enterprise environments, permanent broad administrative access should be minimized.

Later IAM labs will focus much more deeply on:

least privilege.

08 — Review Administrator Permissions

Ask:

What can this identity do?

For the initial lab, you may need broad permissions to create and delete test resources.

But understand the difference between:

Authentication

and:

Authorization

You may successfully log in but still lack permission to perform an action.

🧠 Cloud IAM Model

Identity
   ↓
Role
   ↓
Permission
   ↓
Resource

09 — Choose a Primary Lab Region

Most cloud providers organize infrastructure geographically.

Choose one primary region for your labs.

Record:

Primary Lab Region:

🌍 What Is a Region?

A region is a geographic cloud infrastructure location.

Conceptually:

Cloud Provider
      |
      ├── Region A
      ├── Region B
      └── Region C

🧠 Why Region Selection Matters

Region choice may affect:

• latency

• service availability

• resilience

• compliance

• cost

For a learning lab, choose a region that:

• supports the services you need

• provides reasonable latency

• is appropriate for your account

• allows you to keep resources organized

10 — Understand Availability Concepts

Within regions, providers may offer multiple isolated infrastructure locations or failure domains.

Conceptually:

Region
 |
 ├── Failure Domain A
 ├── Failure Domain B
 └── Failure Domain C

Different providers use different names.

🧠 Why This Matters

Later you will learn how to build:

Application
      ↓
Multiple Failure Domains
      ↓
Higher Availability

For now, simply identify whether your chosen region provides multiple availability locations.

📝 Record

Primary Region:

Availability / Failure Domains Available:

Notes:

11 — Define the Lab Environment Name

Choose one consistent environment name.

Recommended:

cloudplus-lab

You may also include your lab stage:

cloudplus-dev

🧠 Environment Labels

Organizations commonly separate:

DEV
TEST
STAGING
PRODUCTION

For your training environment, clearly identify it as:

LAB.

12 — Define a Naming Convention

Do not create resources called:

server1
network1
test
newserver
abc

Use predictable names.

A simple convention:

<course>-<environment>-<resource>-<number>

Example:

cloudplus-lab-vm-01
cloudplus-lab-net-01
cloudplus-lab-storage-01

🧠 Naming Benefits

Good naming improves:

• troubleshooting

• ownership

• automation

• cleanup

• cost management

13 — Create a Naming Standard Table

Use:

Resource Type	Naming Pattern	Example
Network	cloudplus-lab-net-XX	cloudplus-lab-net-01
Subnet	cloudplus-lab-subnet-XX	cloudplus-lab-subnet-01
VM	cloudplus-lab-vm-XX	cloudplus-lab-vm-01
Storage	cloudplus-lab-storage-XX	cloudplus-lab-storage-01
Security Rule	cloudplus-lab-sec-XX	cloudplus-lab-sec-01

14 — Define a Tagging Strategy

Tags or labels attach metadata to resources.

Recommended lab tags:

Tag	Value
Environment	Lab
Course	CompTIA-CloudPlus
Owner	Student
Purpose	Training
ManagedBy	Manual
AutoDelete	Yes

🧠 Why Tags Matter

Imagine an enterprise has:

25,000 Cloud Resources

Without tags, answering:

Who owns this?

or:

Can we delete this?

becomes difficult.

💡 Cost Management Connection

Tags can also help identify:

which team or project is creating cost.

15 — Create a Resource Inventory Template

Before creating resources, create the table you will use throughout the course.

Resource	Type	Region	Purpose	Cost Risk	Cleanup Status

🧠 Professional Habit

Update the inventory:

every time you create something.

Do not wait until cleanup.

16 — Review Your Provider’s Cost Dashboard

Locate the cloud provider’s:

• billing

• cost-management

• usage

• budget

area.

Do not enable paid services unnecessarily.

The objective is simply to understand:

where cloud costs are monitored.

17 — Create a Lab Budget

Where your provider supports budgets or spending alerts, create a small training budget appropriate to your account.

Example concept:

Monthly Lab Budget
      ↓
Usage Threshold
      ↓
Alert

⚠️ Important

Budget alerts generally:

warn you about spending.

They do not necessarily:

automatically stop all resources.

You still need cleanup discipline.

18 — Configure Cost Notifications

Where available, configure alerts at practical thresholds.

For example:

50%
80%
100%

of your chosen lab budget.

📝 Record

Budget Configured:
Yes / No

Budget Amount:

Alert Thresholds:

Notification Destination:

19 — Identify Potential Cost Drivers

Before deploying anything, understand that common cost drivers may include:

• running compute

• storage

• data transfer

• load balancers

• managed databases

• gateways

• backup retention

🧠 Cloud Engineer Question

Before creating a resource ask:

What will this cost while running?

and:

What could continue costing money after I stop using it?

20 — Define Your Resource Lifecycle

Use this lifecycle for every future lab:

Create
 ↓
Tag
 ↓
Document
 ↓
Use
 ↓
Validate
 ↓
Stop if Appropriate
 ↓
Delete
 ↓
Confirm Cleanup

🧠 Why Lifecycle Matters

Cloud makes creation easy.

Professional cloud operations also requires:

disciplined deletion.

21 — Define Your Cleanup Standard

At the end of future labs, review:

• compute

• storage

• snapshots

• networking

• public IPs

• load balancers

• backups

• test identities

📋 Cleanup Checklist

[ ] Compute removed
[ ] Storage reviewed
[ ] Snapshots reviewed
[ ] Public IPs released
[ ] Load balancers removed
[ ] Test gateways reviewed
[ ] Test identities reviewed
[ ] Backup resources reviewed
[ ] Billing dashboard checked

22 — Create Your Lab Documentation Folder

Create a local folder such as:

CompTIA-CloudPlus-Labs/
│
├── 01-Cloud-Lab-Environment/
│   ├── README.md
│   ├── architecture/
│   ├── screenshots/
│   └── evidence/

🧠 Why Documentation Matters

Your lab should produce more than:

memories.

It should produce evidence showing:

• what you built

• why you built it

• how you secured it

• how you validated it

23 — Create Your Lab README

Use:

Lab:
Build Your Cloud Lab Environment

Cloud Provider:

Primary Region:

Environment:
LAB

Objectives:

Security Controls:

Cost Controls:

Naming Standard:

Tagging Standard:

Resources Created:

Validation:

Cleanup Status:

24 — Create the Initial Architecture Diagram

Document:

Cloud Lab Account
       |
       ├── Lab Administrator
       |
       ├── MFA
       |
       ├── Primary Region
       |
       ├── Budget / Cost Monitoring
       |
       └── Future Lab Resources

The diagram can be simple.

The goal is learning to communicate architecture.

25 — Create Your Cloud Lab Standards

Document the following.

Identity Standard

Primary account protected with MFA.
Daily administration uses an approved lab identity where supported.

Region Standard

Cloud+ labs use one primary region unless the lab specifically requires another region.

Naming Standard

cloudplus-lab-<resource>-<number>

Tag Standard

Environment = Lab
Course = CompTIA-CloudPlus
Purpose = Training

Cost Standard

Use minimal resources and remove them after each lab.

26 — Validate Your Environment

Check:

Can I Sign In?
        ↓
Is MFA Working?
        ↓
Am I in the Correct Account?
        ↓
Am I in the Correct Region?
        ↓
Do I Know My Naming Standard?
        ↓
Do I Know My Tags?
        ↓
Can I View Cost Management?
        ↓
Do I Have a Cleanup Process?

If all answers are yes:

your lab environment is ready.

🧪 Validation Checklist

Control	Status
Cloud account accessible
Primary account secured
MFA enabled where supported
Lab administrator identified
Region selected
Naming standard documented
Tagging standard documented
Billing dashboard located
Budget/alert reviewed
Resource inventory created
Cleanup checklist created
Lab documentation created

27 — Perform a Cloud Console Orientation

Before leaving the lab, identify where your provider exposes major service categories.

Find areas related to:

• compute

• networking

• storage

• identity

• monitoring

• billing

Do not create resources yet.

Your objective is to understand:

where cloud capabilities are organized.

🧠 Cloud+ Mental Model

Try to map the console into:

Identity
 ↓
Compute
 ↓
Network
 ↓
Storage
 ↓
Monitoring
 ↓
Security
 ↓
Cost

This provider-neutral model is more important than memorizing a console layout.

28 — Understand the Management Plane

Everything you have done so far has largely interacted with the:

cloud management plane.

The management plane allows authorized identities to:

• create resources

• modify resources

• delete resources

• configure security

🚨 Security Importance

A compromised cloud administrator may be able to:

Create Resources
Modify Firewalls
Change Permissions
Access Data
Disable Logging

This is why account security matters before resource deployment.

29 — Create Your First Cloud Risk Register

Document a few simple risks.

Risk	Impact	Control
Primary account compromise	High	MFA
Forgotten resources	Cost	Cleanup checklist
Unknown resource ownership	Operations	Tags
Wrong region deployment	Governance	Region standard
Weak naming	Operations	Naming standard

🧠 Security and Operations Connection

Good cloud engineering combines:

Security
+
Operations
+
Cost
+
Governance

30 — Simulate a Governance Question

Imagine your manager asks:

Why does this resource exist?

You should be able to answer using:

Resource Name
+
Tag
+
Inventory
+
Documentation

31 — Simulate a Cost Question

Your manager asks:

Which lab resources are still running?

Use your:

• resource inventory

• cloud console

• billing dashboard

to answer.

32 — Simulate a Security Question

Your security team asks:

Who can administer this cloud environment?

You should be able to identify:

• primary account

• lab administrative identity

• authentication controls

33 — Simulate an Incident Question

Suppose you receive:

An unexpected cloud resource was created.

What information would you want?

Think:

Who Created It?
 ↓
When?
 ↓
Which Region?
 ↓
What Resource?
 ↓
Why?
 ↓
Is It Public?
 ↓
Is It Still Needed?

This prepares you for later:

cloud logging and incident-investigation labs.

🎯 Certification Connection

For Cloud+ questions involving a new environment, think beyond:

deploy the workload.

Consider:

Governance
Identity
Cost
Security
Availability
Operations

🎤 Interview Questions

Practice without notes.

1. What is a cloud region?

2. Why does region selection matter?

3. What is an availability zone or failure domain concept?

4. Why should the primary/root cloud account be protected?

5. Why is MFA important?

6. Authentication vs authorization?

7. What is resource tagging?

8. Why are naming standards useful?

9. Why are tags useful for cost management?

10. Why should cloud labs have cleanup procedures?

11. Why can stopped cloud resources still generate charges?

12. What is the cloud management plane?

13. Why should every cloud resource have an owner?

14. Why are cost controls part of cloud operations?

15. What should you verify before deploying a cloud workload?

🚨 Scenario Interview Question 1

You inherit a cloud environment containing hundreds of resources named test1, test2, and new-server.

What would you recommend?

Discuss:

• inventory

• ownership

• tags

• naming standards

• lifecycle management

🚨 Scenario Interview Question 2

The organization’s primary cloud account is used by five administrators.

Discuss:

• individual identities

• MFA

• accountability

• least privilege

• primary-account protection

🚨 Scenario Interview Question 3

A development team creates cloud resources but frequently forgets to delete them.

Discuss:

Tagging
+
Ownership
+
Budgets
+
Lifecycle
+
Automation

🚨 Scenario Interview Question 4

The billing team reports unexpected cloud charges after all VMs were stopped.

Investigate associated resources such as:

• storage

• snapshots

• public IPs

• load balancers

• gateways

🚨 Scenario Interview Question 5

A cloud administrator deploys resources into multiple regions without documentation.

Discuss:

• region strategy

• cost

• governance

• security

• operational complexity

🧠 Cloud Operations Interview Framework

For new environments use:

Account
 ↓
Identity
 ↓
Region
 ↓
Standards
 ↓
Cost
 ↓
Security
 ↓
Resources
 ↓
Monitoring
 ↓
Lifecycle

💬 Interview Tip

Avoid:

“I would just create the VM.”

A stronger answer is:

“Before deploying workloads, I would verify the correct cloud account and region, secure administrative access, define naming and tagging standards, establish cost visibility and lifecycle controls, document ownership, and then create the required resources using the smallest appropriate configuration.”

That demonstrates Cloud Administrator and Cloud Engineer thinking.

📁 Portfolio Deliverables

After completing this lab, keep sanitized versions of the following.

1. Cloud Lab Architecture

Cloud Account
     ↓
Secure Identity
     ↓
Primary Region
     ↓
Future Lab Resources

2. Naming Standard

Example:

cloudplus-lab-vm-01
cloudplus-lab-net-01

3. Tagging Standard

Include:

• environment

• owner

• purpose

• course

4. Resource Inventory

Maintain a simple resource register.

5. Cost-Control Checklist

Document:

• budget

• billing review

• cleanup process

6. Cloud Lab Readiness Checklist

Capture the validation table from this lab.

📝 Resume Examples

Instead of:

Familiar with cloud platforms.

Use:

Built and governed a structured cloud lab environment using secure administrative access, MFA, resource naming and tagging standards, cost controls, lifecycle management, and documented cleanup procedures.

Or:

Established a provider-neutral cloud-lab governance model covering identity, regional deployment, resource ownership, cost monitoring, tagging, and operational documentation while preparing for CompTIA Cloud+.

⭐ Lab Readiness Check

You should now be able to explain:

• which cloud account you are using

• which region you selected

• why that region was selected

• which identity performs lab administration

• whether MFA is enabled

• how resources will be named

• which tags you will use

• how costs will be monitored

• how resources will be inventoried

• how lab resources will be removed

• where documentation will be stored

If you cannot answer these questions, complete those sections before moving forward.

🏆 Mission Complete

You have successfully established the foundation for the rest of your Cloud+ practical environment.

You now have:

Cloud Account
      ↓
Secure Access
      ↓
Lab Region
      ↓
Naming
      ↓
Tagging
      ↓
Cost Controls
      ↓
Documentation
      ↓
Cleanup Process

The most important lesson from this lab is:

Professional cloud engineering begins before the first workload is deployed.

A well-managed environment starts with:

• identity

• standards

• ownership

• security

• cost visibility

• lifecycle management

🚀 What’s Next?

Your cloud lab environment is now ready.

The next lab moves from preparation into actual infrastructure deployment.

You will create your first cloud workload and explore:

• virtual machines

• CPU and memory sizing

• operating-system selection

• virtual disks

• network interfaces

• IP addressing

• workload connectivity

• start/stop operations

• resizing

• monitoring

• basic troubleshooting

• cleanup

➡️ Next: Lab 02 — Deploy and Manage a Cloud Virtual Machine