CV0-004 Practice Test 10 — 10 Questions

Question 1

A cloud engineer is troubleshooting a performance issue with a web application that uses a cloud load balancer and multiple backend instances. Users report intermittent slow responses. The engineer reviews metrics and finds that CPU utilization on backend instances stays below 50% but network throughput is near the instance limit. Which THREE actions should the engineer take to improve performance?

Accepted Answer

Distribute instances across multiple availability zones.. Distributing instances across multiple availability zones (AZs) improves fault tolerance and can reduce network congestion by spreading traffic across physically separate infrastructure. In this scenario, network throughput is near the instance limit, so adding instances in different AZs allows the load balancer to distribute traffic more evenly, preventing any single instance from being overwhelmed. This also leverages the load balancer's cross-zone load balancing capability, which can improve overall throughput and reduce latency for users.

Answer

Change the load balancing algorithm to least connections.

Answer

Increase the number of backend instances.

Question 2

A cloud administrator is trying to attach an EBS volume to an EC2 instance for a database migration. The attachment fails with the error shown in the exhibit. The volume contains critical data. Which of the following is the MOST appropriate action to take?

Accepted Answer

Detach the volume from instance 'i-0123ijkl' first, then attach to the new instance.. The error indicates the EBS volume is already attached to another EC2 instance (i-0123ijkl). An EBS volume can only be attached to one instance at a time in a standard attachment. The correct procedure is to first detach the volume from instance i-0123ijkl, then attach it to the target instance. This preserves the critical data without risk of corruption or data loss.

Answer

Create a new volume and copy the data from the existing volume.

Answer

Terminate instance 'i-0123ijkl' to release the volume.

Answer

Force-detach the volume from the other instance.

Question 3

A company experiences a data breach where an attacker exfiltrated data from a cloud storage bucket. The security team discovers that the bucket had a policy allowing public access. The cloud administrator had previously set the bucket to be private. Which of the following is the MOST likely reason the bucket became public?

Accepted Answer

An IAM role with administrative privileges applied a bucket policy that overrode the private setting.. A bucket policy that grants public access (e.g., `Principal: "*"` with `Effect: "Allow"`) can override the private block public access setting at the bucket level. Even if the cloud administrator set the bucket to private via the console or ACLs, an IAM role with administrative privileges can apply a bucket policy that explicitly allows public access, effectively making the bucket public. This is because bucket policies are evaluated separately and can grant permissions that supersede other access controls.

Answer

The bucket had versioning enabled, which reverted to a previous public state.

Answer

Access logs were not enabled, so the change was not recorded.

Answer

Server-side encryption was disabled, causing the bucket to become public.

Question 4

A cloud administrator is troubleshooting a performance issue where a web application is responding slowly. The application runs on virtual machines in a private cloud. The administrator has verified that CPU and memory utilization are within normal limits. Which TWO additional metrics should the administrator check to diagnose the issue?

Accepted Answer

Network latency between the application and database servers. Network latency between the application and database servers is a critical metric because slow database queries or network congestion can cause the web application to respond slowly even when CPU and memory on the VMs are normal. High latency increases round-trip time for SQL queries, directly impacting page load times. Disk I/O wait time on the hypervisor is also essential because excessive I/O wait indicates storage contention, which can throttle read/write operations for the VMs, leading to application sluggishness.

Answer

Number of running processes

Answer

Virtual machine snapshot size

Answer

Hypervisor version

Question 5

A cloud engineer receives an alert that the root filesystem (/) is at 93% usage. The /data volume has plenty of free space. The application stores logs in /var/log/app/ on the root filesystem. Which of the following is the BEST long-term solution?

Accepted Answer

Move the /var/log/app directory to the /data partition and create a symlink. Moving the /var/log/app directory to the /data partition and creating a symlink is the best long-term solution because it permanently relocates the log data to a volume with ample free space without requiring application reconfiguration. The symlink (/var/log/app -> /data/app) makes the application continue to write to the same logical path, while the actual storage is on the /data filesystem. This resolves the root filesystem capacity issue without altering the application's logging behavior or risking data loss.

Answer

Increase the size of the root filesystem

Answer

Delete the /data partition and merge it with root

Answer

Configure log rotation to delete logs more frequently

Question 6

A cloud architect is designing a deployment for a multi-tier application that must meet compliance requirements for data residency. The application consists of a web tier, application tier, and database tier. Which TWO deployment strategies should the architect consider to ensure data remains in a specific geographic region while maintaining high availability?

Accepted Answer

Deploy across multiple availability zones in the same region. Deploying across multiple Availability Zones (AZs) within the same region ensures that application components remain within the geographic boundary required for data residency, while providing high availability through fault isolation. If one AZ fails, traffic is automatically routed to healthy instances in other AZs, maintaining uptime without leaving the region.

Answer

Set up a VPN to a neighboring region

Answer

Deploy in a single availability zone

Answer

Deploy across multiple regions

Question 7

Which TWO of the following are best practices when configuring a cloud-based virtual private cloud (VPC) for a multi-tier application?

Accepted Answer

Place each application tier in a separate subnet.. Option A is correct because placing each application tier (e.g., web, application, database) in a separate subnet allows you to apply distinct network access control lists (NACLs) and security groups per tier. This segmentation enforces the principle of least privilege, ensuring that only the web tier can communicate with the application tier on specific ports, and only the application tier can reach the database tier. It also isolates failures and simplifies troubleshooting by containing traffic within defined network boundaries.

Answer

Disable VPC flow logs to reduce costs.

Answer

Use the default security group for all instances.

Answer

Place all instances in the same subnet for simplicity.

Question 8

Refer to the exhibit. A cloud security engineer is reviewing an S3 bucket policy that controls access to the 'example-bucket' bucket. The 'AdminRole' IAM role attempts to upload an object to the bucket using the AWS CLI without specifying the '--server-side-encryption' parameter. The object transfer uses HTTPS. What will be the outcome?

Accepted Answer

The upload fails because the condition in the Allow statement is not satisfied.. The S3 bucket policy includes an Allow statement with a condition that requires `s3:x-amz-server-side-encryption` to be `AES256`. Since the `AdminRole` IAM role did not specify the `--server-side-encryption` parameter, the condition is not satisfied, and the Allow statement does not grant permission. Without a matching Allow, the default implicit deny applies, causing the upload to fail.

Answer

The upload succeeds but the object is stored without server-side encryption.

Answer

The upload succeeds because the request uses HTTPS and the role is allowed.

Answer

The upload fails because the Deny statement blocks all requests that are not using HTTPS.

Question 9

A company runs a web application on three virtual machines behind a load balancer. During a traffic spike, one VM becomes unresponsive. The load balancer continues sending traffic to it, causing errors. Which configuration change would prevent this issue in the future?

Accepted Answer

Configure health checks on the load balancer.. Health checks allow the load balancer to periodically probe the status of each backend VM (e.g., via HTTP GET or TCP SYN). If a VM fails a configurable number of consecutive checks, the load balancer automatically marks it as unhealthy and stops routing traffic to it, preventing errors during a spike. This is the standard mechanism in AWS ELB, Azure Load Balancer, and HAProxy to detect and isolate failed instances.

Answer

Set a longer connection timeout on the load balancer.

Answer

Increase the number of VMs to five.

Answer

Change the load balancing algorithm to round-robin.

Question 10

An organization is migrating a legacy application to a public cloud. The application requires a static IP address that does not change after a VM is stopped. Which of the following should the cloud architect use to meet this requirement?

Accepted Answer

Reserved IP address. A reserved IP address is a static, persistent public IP that remains assigned to a VM even when the VM is stopped or deallocated. In public cloud platforms like Azure, a reserved IP (or static IP) is explicitly set to not change across VM lifecycle events, meeting the requirement for a fixed address that survives stop/deallocate operations.

Answer

Elastic IP address

Answer

Ephemeral IP address

Answer

Floating IP address