CV0-004 Practice Test 12 — 15 Questions

Question 1

An administrator is writing an Ansible playbook to provision cloud resources across multiple cloud providers. The playbook must manage instances in AWS, Azure, and GCP. Which Ansible concept should the administrator use to interact with each cloud provider's API?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modules. Ansible modules are the units of code that perform specific tasks, such as interacting with cloud provider APIs. For multi-cloud provisioning, the administrator would use modules like `amazon.aws.ec2_instance`, `azure.azcollection.azure_rm_virtualmachine`, and `google.cloud.gcp_compute_instance` to manage resources in AWS, Azure, and GCP respectively. Modules abstract the underlying API calls, allowing the playbook to execute tasks across providers.

Answer

Roles

Answer

Inventories

Answer

Playbooks

Question 2

A cloud security engineer is hardening a Kubernetes cluster. Which TWO measures should be implemented to improve container security? (Choose two.)

Accepted Answer

Implement runtime security monitoring. A is correct because runtime security monitoring (e.g., using Falco, Sysdig, or Aqua Security) detects and alerts on anomalous behavior within running containers, such as unexpected system calls, privilege escalations, or file system changes. This is a critical layer of defense that complements image scanning by catching threats that bypass static checks, such as zero-day exploits or compromised containers. Without runtime monitoring, malicious activity inside a container can go undetected until significant damage occurs.

Answer

Store secrets in ConfigMaps

Answer

Disable audit logging to reduce overhead

Answer

Use default service accounts for all pods

Question 3

A company is planning to migrate to AWS and wants to achieve the lowest possible compute costs for a steady-state workload that will run 24/7. Which purchasing option should be recommended?

Accepted Answer

Reserved Instances. Reserved Instances provide a significant discount (up to 72%) compared to On-Demand pricing in exchange for a one- or three-year commitment, making them ideal for steady-state workloads that run 24/7. Because the workload is predictable and continuous, the commitment is easily justified and the effective hourly cost is minimized. This is the standard AWS recommendation for long-running, stable compute.

Answer

Spot Instances

Answer

On-Demand Instances

Answer

Dedicated Hosts

Question 4

A cloud administrator manages a hybrid cloud environment where on-premises servers connect to a VPC in AWS via a VPN connection. The on-premises network uses IP range 10.0.0.0/16. The VPC uses 172.16.0.0/16. The VPN is established and the tunnel status is UP. However, on-premises hosts cannot ping EC2 instances in the VPC. The administrator logs into an EC2 instance and can ping the on-premises VPN gateway IP. The security groups and network ACLs are configured to allow all traffic. The route tables in the VPC have a route to the on-premises network via the virtual private gateway. The on-premises firewall logs show that packets from the VPC are being dropped. What is the most likely cause?

Accepted Answer

The on-premises firewall is blocking traffic from the VPC CIDR range.. The on-premises firewall logs explicitly show that packets from the VPC are being dropped, indicating the firewall is filtering traffic from the VPC CIDR range (172.16.0.0/16). Since the VPN tunnel is UP, the EC2 instance can ping the on-premises VPN gateway IP, and security groups/network ACLs allow all traffic, the only remaining point of failure is the on-premises firewall blocking the return traffic.

Answer

The VPN tunnel is misconfigured and not passing traffic.

Answer

The security group attached to the EC2 instance is blocking inbound ICMP.

Answer

The VPC route table does not have a route to the on-premises network.

Question 5

A cloud engineer is troubleshooting a storage performance issue. The storage is backed by a SAN with a mix of SSD and HDD drives. Which of the following metrics would BEST indicate that the storage subsystem is the bottleneck?

Accepted Answer

High disk queue depth and latency. High disk queue depth and latency directly indicate that I/O requests are waiting, which is a classic sign of a storage bottleneck. Low memory usage (A) does not indicate a storage issue. High network utilization (B) could be caused by storage traffic but does not confirm the storage subsystem is the bottleneck; it could be normal. High CPU utilization (D) points to compute, not storage.

Answer

Low memory usage on the hypervisor

Answer

High network utilization on storage network links

Answer

High CPU utilization on all application servers

Question 6

A cloud engineer notices that a virtual machine (VM) in a public cloud environment is consistently running at 90% CPU during business hours. The VM hosts a customer-facing web application. Which of the following is the BEST initial troubleshooting step?

Accepted Answer

Review the VM's performance metrics and application logs.. The initial step in troubleshooting high CPU usage is to gather diagnostic data. Reviewing the VM's performance metrics (e.g., CPU utilization, memory, disk I/O) and application logs helps identify whether the issue is caused by a legitimate workload spike, a memory leak, or a misconfiguration. This aligns with the 'identify before act' principle in cloud operations, ensuring the engineer understands the root cause before making changes.

Answer

Migrate the VM to a different availability zone.

Answer

Reboot the VM to reset resource usage.

Answer

Scale up the VM to a larger instance size.

Question 7

A security engineer is reviewing a cloud storage bucket policy. Which of the following best describes the security issue present in the exhibit?

Accepted Answer

The bucket policy allows public read access to all objects, creating a data exposure risk.. The exhibit (a bucket policy granting public read access) exposes all objects in the bucket to anyone on the internet, which is a data exposure risk (D). Public read access on a storage bucket is one of the most common cloud misconfigurations and a leading cause of data breaches, because it allows unauthenticated principals to list and download objects. The correct characterization is that the policy creates an exposure risk, not that it is secure or needs write access.

Answer

The bucket policy correctly limits access to read-only operations, which is secure by default.

Answer

The bucket policy should be modified to allow write access for full functionality.

Answer

The bucket policy should include an IP address restriction to limit access to corporate IPs.

Question 8

A cloud orchestration template fails to deploy resources with the error 'Resource limit exceeded'. The administrator has enough quota for all services. What is the most likely cause?

Accepted Answer

A specific resource type has reached its service limit.. Certain resource types have service-specific limits that are separate from the overall account quota. Even if the administrator has enough total quota, a specific resource type (e.g., virtual machines, storage accounts) may have reached its maximum allowed count. Option A is incorrect because a syntax error would cause a different error, such as parsing failure. Option C is incorrect because a corrupted image would typically result in image-related errors. Option D is incorrect because permission issues would generate an access denied error, not 'Resource limit exceeded'.

Answer

The template has a syntax error in the JSON.

Answer

The custom image used is corrupted.

Answer

The IAM role used does not have permission to create resources.

Question 9

Which TWO of the following are best practices for managing cloud storage in a multi-account environment? (Choose two.)

Accepted Answer

Implement bucket policies to restrict cross-account access.. Option A is correct because implementing bucket policies (e.g., S3 bucket policies or equivalent resource-based policies) lets you explicitly define which accounts, principals, or roles may access a bucket, thereby restricting unintended cross-account access in a multi-account environment. Option C is correct because enabling logging and monitoring of all storage operations (such as S3 server access logging, CloudTrail data events, or equivalent audit logs) provides the visibility needed to detect unauthorized access, verify compliance, and troubleshoot issues across accounts. Option B is not a recognized best practice in the same sense, since key management should follow a deliberate strategy (e.g., KMS key policies, centralized vs. per-account keys) rather than simply mandating separate keys per account. Option D is wrong because a single shared bucket for all accounts undermines isolation, least privilege, and blast-radius containment. Option E is wrong because full public access violates security best practices and risks data exposure.

Answer

Use separate encryption keys for each account.

Answer

Use a single storage bucket/container for all accounts to simplify management.

Answer

Allow full public access to ensure availability.

Question 10

A cloud architect is designing a deployment pipeline for a multi-tier application. The team wants to automate testing and deployment while ensuring that only healthy code reaches production. Which TWO practices should they implement?

Accepted Answer

Blue/green deployment. Blue/green deployment (C) is correct because it maintains two identical environments and shifts traffic only after the new (green) version passes health checks, so unhealthy code never receives production traffic and rollback is instant by reverting the router/load balancer. Canary releases (D) are correct because they route a small percentage of production traffic to the new version and progressively increase it only while health and error-rate metrics stay within thresholds, automatically halting or rolling back on failure. Together these deployment strategies directly enforce the requirement that only verified healthy code reaches full production. Infrastructure as Code (A) and immutable infrastructure (B) improve provisioning consistency and reproducibility but do not by themselves gate traffic on health, and manual approval gates (E) add human sign-off rather than automated health-based promotion, so they do not satisfy the stated goal.

Answer

Infrastructure as Code

Answer

Immutable infrastructure

Answer

Manual approval gates

Question 11

A cloud administrator notices that a virtual machine is consuming excessive CPU resources with no apparent workload. Which of the following should the administrator investigate FIRST to determine the cause?

Accepted Answer

A runaway process inside the VM. A runaway process inside the VM is the most likely cause when a VM exhibits high CPU utilization without an apparent workload. This could be due to a background service, malware, or an application stuck in an infinite loop. Option A is incorrect because a misconfigured load balancer would direct traffic to the VM, which would result in network and CPU activity associated with processing that traffic, not idle high CPU. Option B is incorrect; CPU hotplug settings affect the ability to add CPUs but do not themselves cause high CPU usage. Option D is incorrect; memory overcommitment affects memory availability, not CPU utilization.

Answer

A misconfigured load balancer sending traffic to the VM

Answer

CPU hotplug settings on the hypervisor

Answer

Memory overcommitment ratio

Question 12

A cloud administrator is tasked with ensuring that only encrypted connections are used to transfer files to a cloud storage bucket. Which of the following should the administrator enforce?

Accepted Answer

Require HTTPS for all uploads.. HTTPS (HTTP over TLS) encrypts data in transit using TLS, ensuring that files uploaded to a cloud storage bucket are protected from eavesdropping and tampering. By requiring HTTPS for all uploads, the administrator enforces encrypted connections as mandated by the security policy, which is a standard practice for cloud storage services like AWS S3 or Azure Blob Storage.

Answer

Use HTTP with a custom header.

Answer

Allow FTP but restrict to specific IPs.

Answer

Enable SFTP access to the bucket.

Question 13

A company uses AWS and wants to implement structured logging for their applications to improve queryability. Which THREE practices should they follow? (Select THREE.)

Accepted Answer

Include timestamp, severity, and request ID in each log entry. Option B is correct because including timestamp, severity, and request ID in each log entry provides the essential contextual fields needed for filtering, correlating, and troubleshooting requests across distributed services. Option C is correct because a consistent schema across all services ensures that queries, dashboards, and log-processing pipelines can reliably parse and aggregate logs without per-service custom logic. Option D is correct because writing logs in JSON format produces machine-readable, structured events with named fields, which is the foundation for queryability in tools like Amazon CloudWatch Logs Insights or Athena. Option A is not appropriate because dumping all logs into a single unpartitioned S3 bucket hurts query performance and increases scan costs, since partitioning by date or service is a best practice. Option E is not part of structured logging; KMS encryption at rest is a security control and does not improve the structure or queryability of log data.

Answer

Send all logs to a single S3 bucket without partitioning

Answer

Encrypt log files at rest using AWS KMS

Question 14

A cloud application returns HTTP 503 errors during high traffic. The application runs on VMs behind a load balancer. Which action is most likely to resolve the issue?

Accepted Answer

Add additional VMs to the backend pool.. HTTP 503 Service Unavailable during high traffic indicates that the backend servers cannot handle the current load, often because all VMs are saturated or the load balancer has no healthy backends. Adding additional VMs to the backend pool increases capacity and distributes the load, directly addressing the root cause. This is the standard horizontal scaling response to traffic-induced 503 errors.

Answer

Restart the web server service on one VM.

Answer

Change the DNS TTL to a lower value.

Answer

Increase the health check interval on the load balancer.

Question 15

A cloud administrator needs to receive real-time notifications when CPU utilization exceeds 90% on a production server. Which AWS service should be used to trigger an alert based on a metric threshold?

Accepted Answer

CloudWatch Alarms. CloudWatch Alarms monitor CloudWatch metrics and trigger actions when a metric crosses a defined threshold, such as CPU utilization exceeding 90% for a specified number of evaluation periods. Alarms can send notifications via Amazon SNS, trigger Auto Scaling, or invoke Lambda functions. This makes CloudWatch Alarms the correct service for threshold-based alerting on metrics.

Answer

Amazon SNS

Answer

AWS Config

Answer

AWS CloudTrail