CV0-004 Practice Test 10 — 10 Questions

Question 1

A cloud administrator is troubleshooting a connectivity issue between two virtual networks in different cloud regions. The networks are connected via a VPN gateway. The administrator can ping resources in one network but not the other. Which of the following should the administrator check FIRST?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Review the route tables on both sides for the remote network prefix. The correct first step is to review the route tables on both sides for the remote network prefix. Since the administrator can ping resources in one direction but not the other, the issue is likely asymmetric routing or a missing route for the return traffic. Route tables control how traffic is forwarded between virtual networks, and a missing or incorrect route for the remote network prefix would prevent bidirectional communication, even if the VPN tunnel is up.

Answer

Confirm the local network gateways have the correct NIC IP addresses

Answer

Verify the VPN tunnel status on both gateways

Answer

Check network security groups for blocking ICMP

Question 2

A financial services company has a disaster recovery (DR) plan for its cloud infrastructure that includes a secondary region 500 miles away. The plan uses synchronous replication for the primary database. During a scheduled DR test, the administrator triggers a failover to the secondary region. The application comes up, but the database is missing the last three minutes of transactions. The RPO requirement is 5 seconds. The administrator finds that the network latency between regions is 40 milliseconds. What is the most likely cause of the data loss, and what should the administrator do?

Accepted Answer

Switch to asynchronous replication and accept a longer RPO, or choose a DR region with lower network latency.. Synchronous replication requires the primary database to wait for acknowledgment from the secondary before committing a transaction. With 40ms network latency, this introduces significant delays, causing timeouts and dropped transactions, resulting in data loss exceeding the 5-second RPO. To meet the RPO, the administrator should either switch to asynchronous replication (which does not wait for acknowledgment, reducing latency impact but requiring a higher RPO) or choose a DR region with lower latency to support synchronous replication. Option A correctly identifies these solutions.

Answer

Reduce the RPO requirement to 30 seconds.

Answer

Enable compression on the replication link to reduce data transfer time.

Answer

Increase the instance size in the secondary region to handle more transactions.

Question 3

A small business uses a public cloud IaaS to host a single Windows virtual machine (VM) running a line-of-business application. The VM has a public IP address and is in a network security group that allows RDP (port 3389) from the internet (0.0.0.0/0). The administrator frequently connects from home and various client sites. The administrator is concerned about brute force attacks on the RDP service. The business does not have a VPN server. What is the best way to secure the RDP access without changing the public IP address or blocking all external access?

Accepted Answer

Remove the public IP address and use a bastion service like Azure Bastion or AWS Systems Manager Session Manager to access the VM via RDP over HTTPS.. The best because using Azure Bastion or AWS Systems Manager Session Manager eliminates public RDP exposure entirely. Instead of opening port 3389 to the internet, the administrator connects through a bastion service that authenticates and tunnels RDP over HTTPS. This prevents brute force attacks since no direct RDP port is exposed. Option B (changing port) is security through obscurity and does not stop automated scans. Option C (MFA on local accounts) is not practical without domain join and still leaves the port open. Option D (smart card certificates) still exposes the port to potential attacks on the certificate authentication process.

Answer

Change the RDP port to a non-standard port (e.g., 3390).

Answer

Enable multi-factor authentication (MFA) on the local Windows user accounts.

Answer

Disable password authentication and require smart card certificates for RDP.

Question 4

During a security assessment, a cloud auditor discovers that a virtual machine has a publicly accessible SSH port (22) open to the entire internet (0.0.0.0/0). The VM is a bastion host intended for administration. What should be done to reduce risk?

Accepted Answer

Remove the network security group rule allowing SSH from 0.0.0.0/0 and add a rule allowing only the corporate VPN's public IP range.. A bastion host should only be accessible from trusted IPs, typically the corporate VPN or a specific IP range, to minimize exposure. Option A is incorrect because removing the security group rule and relying solely on the OS firewall does not address the network-level exposure and may not be as manageable in a cloud environment. Option B is incorrect because disabling SSH entirely would prevent necessary administrative access; serial console is not a scalable alternative. Option C is incorrect because while SSH key authentication improves security, it does not restrict the IP addresses that can attempt to connect, leaving the host exposed to brute-force attacks from the entire internet.

Answer

Remove the security group rule for SSH and rely on the operating system firewall.

Answer

Disable SSH and use a serial console for administration.

Answer

Enable SSH key authentication and disable password login.

Question 5

Which TWO of the following are common vulnerabilities in cloud environments that can lead to unauthorized access? Select two.

Accepted Answer

Lack of encryption for data in transit. Options B and E are correct because lack of encryption for data in transit exposes sensitive data to interception, and misconfigured security groups allowing overly permissive inbound rules can grant unauthorized access. Options A, C, and D are security best practices that help prevent vulnerabilities.

Answer

Enabling automatic patching

Answer

Using multi-factor authentication

Answer

Properly scoped IAM roles

Question 6

A cloud administrator is responsible for a multi-tier application hosted in a public cloud. The application consists of a web tier, application tier, and database tier. Recently, users have reported that the application is responding slowly during peak hours. The administrator checks the cloud monitoring dashboard and notices that the web tier instances are running at 90% CPU utilization, but the auto-scaling group has not triggered any scaling events. The scaling policy is set to scale out when average CPU exceeds 80% for 5 minutes. What should the administrator do to resolve this issue?

Accepted Answer

Review the cooldown period settings of the auto-scaling group. The cooldown period settings determine how long the auto-scaling group waits before initiating another scaling activity after a previous scaling event. If the cooldown period is too long, new scaling events may be suppressed even when the CPU threshold is exceeded for the required duration. The administrator should review and potentially reduce the cooldown period to allow the auto-scaling group to respond more quickly to high CPU utilization. Option A is wrong because manual scaling is a temporary workaround and does not address the underlying auto-scaling configuration issue. Option B is wrong because increasing the CPU threshold to 95% would make scaling less sensitive, likely worsening performance during peak hours. Option D is wrong because health check configuration affects load balancer traffic routing, not the triggering of scaling events based on CPU metrics.

Answer

Manually increase the number of web tier instances

Answer

Increase the CPU threshold to 95% to avoid unnecessary scaling

Answer

Check the health check configuration of the load balancer

Question 7

A cloud administrator deploys a new application that writes logs to a block storage volume attached to a virtual machine. The application's performance degrades after a few hours. Monitoring shows that the volume's read latency is low, but write latency spikes periodically. The administrator discovers that the volume type is standard HDD. What should the administrator do to improve write performance without changing the application?

Accepted Answer

Migrate to a volume type with provisioned IOPS (SSD).. Standard HDD volumes have low maximum IOPS and burst performance that is quickly exhausted under sustained writes, leading to write latency spikes. Migrating to a volume type with provisioned IOPS, such as SSD, provides consistent and higher write performance without requiring application changes. Option B is incorrect because increasing the volume size does increase baseline IOPS for HDD volumes, but the improvement is marginal and still relies on burst credits, which will be depleted again. Option C is incorrect because moving logs to object storage changes the storage paradigm and would require application modifications to use different APIs. Option D is incorrect because write caching on a data volume is not recommended as it can lead to data loss in the event of a power failure, and caching is typically for read performance.

Answer

Increase the volume size to gain higher baseline IOPS.

Answer

Move the logs to an object storage service.

Answer

Enable write caching on the volume.

Question 8

A DevOps team uses infrastructure as code to deploy cloud resources. Security policy requires that all storage buckets have versioning enabled and are not publicly accessible. How can these requirements be enforced automatically?

Accepted Answer

Implement a cloud policy that disallows public access and requires versioning on all storage resources.. Using a cloud policy service (e.g., AWS Service Control Policy, Azure Policy, or GCP Organization Policy) can enforce rules like 'deny public access' and 'require versioning' at the account or organizational level, automatically applying to all storage resources. Option A is wrong because pre-commit hooks check templates but do not enforce at deployment; they can be bypassed. Option B is wrong because security groups apply to network resources like VMs, not storage buckets. Option D is wrong because a manual approval gate adds human review but does not automatically enforce the security requirements.

Answer

Add pre-commit hooks to check the IAC templates for compliance.

Answer

Use security group rules to restrict access to the storage buckets.

Answer

Configure a manual approval gate in the deployment pipeline for any storage changes.

Question 9

Which TWO of the following are best practices for securing a cloud object storage bucket?

Accepted Answer

Enable bucket versioning.. Options A and D are correct. Enabling versioning helps protect against accidental deletion or overwrite, and bucket policies can restrict access to specific principals. Option B is wrong because public access is generally not recommended. Option C is wrong because lifecycle policies are for management, not security. Option E is wrong because encryption is important but does not enforce access control.

Answer

Set the bucket ACL to public-read-write for ease of access.

Answer

Configure a lifecycle policy to delete objects after 30 days.

Answer

Encrypt all objects using server-side encryption.

Question 10

Which TWO are best practices for designing a multi-tenant SaaS application on a public cloud?

Accepted Answer

Use separate virtual networks or VPCs for each tenant. Using separate virtual networks or VPCs for each tenant provides strong network isolation, preventing cross-tenant traffic and reducing the blast radius of a security breach. This aligns with the shared responsibility model in public cloud SaaS design, where the provider ensures infrastructure-level separation.

Answer

Assign a dedicated database instance per tenant

Answer

Deploy all tenants on a single large compute instance

Answer

Offer the same service tier to all tenants