CV0-004 Practice Test 12 — 15 Questions

Question 1

A cloud administrator is troubleshooting an issue where users from the 192.0.2.0/24 network cannot access objects in an S3 bucket. The bucket policy is shown in the exhibit. What is the most likely cause of the issue?

Accepted Answer

The policy does not grant the s3:ListBucket action.. The bucket policy grants s3:GetObject but not s3:ListBucket. Without s3:ListBucket, users cannot list the objects in the bucket, so they cannot discover the object keys needed to access objects. Even if they know the exact object key, the missing ListBucket action prevents the initial listing operation, which is required for many S3 access patterns.

Answer

The condition uses an incorrect IP address format.

Answer

The policy is missing a required statement ID.

Answer

The resource ARN does not include the bucket itself.

Question 2

A cloud administrator is configuring a new virtual private cloud (VPC) with a public subnet for a web application. The administrator must ensure that the web application can receive HTTPS traffic from the internet but cannot be directly accessed via SSH. Which TWO security controls should the administrator implement? (Choose two.)

Accepted Answer

Configure a network ACL on the subnet to allow inbound TCP ports 80 and 443 from 0.0.0.0/0 and deny inbound TCP port 22.. Option B is correct because a network ACL (NACL) is a stateless firewall that operates at the subnet level, allowing you to explicitly deny inbound TCP port 22 (SSH) while allowing TCP ports 80 and 443 (HTTP/HTTPS) from 0.0.0.0/0. Option D is correct because a security group (SG) is a stateful firewall at the instance level; by default, SGs deny all inbound traffic, so you must explicitly allow TCP port 443 from 0.0.0.0/0, and since SSH (port 22) is not allowed, it is implicitly denied. Together, these provide defense-in-depth: the NACL blocks SSH at the subnet boundary, and the SG ensures only HTTPS is permitted to the web server.

Answer

Attach an internet gateway (IGW) to the VPC and enable auto-assign public IP on the subnet.

Answer

Place the web server in a private subnet and use a NAT gateway for outbound traffic.

Answer

Deploy a web application firewall (WAF) in front of the web server.

Question 3

Which THREE of the following are key considerations when designing a cloud-native application for high availability? (Select exactly three.)

Accepted Answer

Implement loose coupling between services. Option C is correct because loose coupling between services, typically achieved via asynchronous messaging or API gateways, ensures that the failure of one service does not cascade to others, which is fundamental for high availability in cloud-native architectures. This design pattern allows individual services to be updated, scaled, or fail independently, maintaining overall system resilience.

Answer

Use multithreading for all components

Answer

Use synchronous replication for databases

Question 4

Which TWO factors should be considered when choosing a cloud deployment model (public, private, hybrid)? (Select TWO.)

Accepted Answer

Data sensitivity and classification. Data sensitivity and classification (B) are critical because public cloud providers operate a shared responsibility model where the customer retains control over data classification and access policies, while the provider manages the infrastructure. Highly sensitive data (e.g., PII, trade secrets) often mandates a private or hybrid model to maintain strict network isolation and encryption at rest/in transit. Compliance requirements (C) such as GDPR or HIPAA impose legal obligations on data residency, audit logging, and breach notification, which may restrict the use of certain public cloud regions or require dedicated hardware, directly influencing the deployment model choice.

Answer

Number of monitors connected to the server

Answer

Brand of physical servers used

Answer

Color of server racks in the data center

Question 5

Which THREE are common tasks in a CI/CD pipeline? (Select THREE.)

Accepted Answer

Source code checkout from version control. Source code checkout from version control is a fundamental first step in any CI/CD pipeline. The pipeline agent must retrieve the latest code from a repository (e.g., Git) to build, test, and deploy the application. Without this checkout, subsequent automated steps have no codebase to work with.

Answer

Manual code review by a senior developer

Answer

Handwritten notes for deployment steps

Question 6

A financial services company is subject to strict compliance requirements. They need to ensure that all cloud storage objects are written to a write-once-read-many (WORM) state for a defined retention period. Which feature should be enabled?

Accepted Answer

Lifecycle policies. Lifecycle policies are the correct choice because they can be configured to transition objects to a WORM-compliant state (e.g., using S3 Object Lock in governance or compliance mode) and enforce a defined retention period. This meets the strict compliance requirement by preventing object deletion or overwrite until the retention period expires.

Answer

Versioning

Answer

Object lock

Answer

Replication

Question 7

A cloud administrator is reviewing cost reports and notices that a development environment is incurring high costs due to idle compute resources. The environment is used only during business hours on weekdays. Which of the following actions would MOST effectively reduce costs?

Accepted Answer

Implement an auto-scaling schedule to shut down instances during off-hours.. An auto-scaling schedule allows you to define time-based rules to automatically scale in (terminate) instances during off-hours and scale out (launch) them during business hours. This directly addresses the idle compute waste by ensuring resources are only running when needed, which is the most effective cost reduction strategy for a predictable usage pattern like weekdays 9-to-5.

Answer

Move the development environment to a different region with lower costs.

Answer

Change all instances to smaller instance types.

Answer

Use spot instances for all development servers.

Question 8

Which TWO factors should be considered when selecting a cloud region for deploying a latency-sensitive application serving a global user base?

Accepted Answer

Number of availability zones. Option B is correct because the number of availability zones within a region directly impacts the resilience and fault tolerance of a latency-sensitive application. Deploying across multiple availability zones allows for high availability and failover without adding significant latency, as zones are typically within a few milliseconds of each other. This ensures the application remains responsive even if one zone fails, which is critical for a global user base.

Answer

Cost of compute and storage

Answer

Data sovereignty and compliance requirements

Answer

Available network bandwidth between zones

Question 9

A cloud architect is planning a disaster recovery (DR) strategy for a mission-critical application. The RTO must be under 1 hour and RPO under 15 minutes. The primary site is in a different region. Which DR pattern meets these requirements?

Accepted Answer

Pilot light. The pilot light pattern meets the RTO under 1 hour and RPO under 15 minutes because it keeps a minimal core set of services (e.g., database replicating via asynchronous replication) running in the DR region, allowing rapid scale-up of the full application stack during failover. This pattern balances cost and recovery speed, as the replicated data ensures an RPO of seconds to minutes, and the pre-provisioned core infrastructure enables failover within minutes, satisfying the strict RTO.

Answer

Backup and restore

Answer

Cold standby

Answer

Multi-site active-active

Question 10

Which TWO are advantages of using containers over virtual machines? (Select TWO.)

Accepted Answer

Less overhead because they share the host OS kernel. Option B is correct because containers share the host operating system kernel, eliminating the need for a separate guest OS per instance. This reduces overhead significantly compared to virtual machines, which each require their own full OS, leading to more efficient use of system resources.

Answer

Better hardware isolation

Answer

Requires a hypervisor to run

Answer

Larger resource consumption

Question 11

A cloud engineer is deploying a serverless application using AWS Lambda. The application processes files uploaded to an S3 bucket. To minimize cold start latency, which deployment configuration should the engineer use?

Accepted Answer

Increase the memory allocation and enable provisioned concurrency.. Provisioned concurrency pre-warms a specified number of Lambda execution environments, eliminating cold starts for those instances. Increasing memory allocation also proportionally increases CPU and network throughput, which can reduce initialization time. Together, these configurations directly address cold start latency for a serverless application processing S3 uploads.

Answer

Set the function timeout to the minimum value.

Answer

Place the Lambda function in a VPC without any NAT gateway.

Answer

Configure the function to run in a specific Availability Zone.

Question 12

A cloud administrator needs to deploy a new application that requires a static IP address. The administrator is using a cloud provider that allows the reservation of elastic IP addresses. Which deployment step should be taken to ensure the IP address is not lost when the resource is stopped?

Accepted Answer

Allocate an elastic IP address and associate it with the resource.. Elastic IP addresses are static public IPv4 addresses that you can allocate to your account and associate with a resource. When you associate an elastic IP with an instance, it persists even if the instance is stopped, because the IP is reserved in your account until you explicitly release it. This ensures the IP address is not lost when the resource is stopped, unlike ephemeral public IPs that change on stop/start.

Answer

Configure the instance to obtain an IP via DHCP.

Answer

Assign a private IP address from a reserved range.

Answer

Set up an external DNS service to point to the public IP.

Question 13

An organization wants to migrate its on-premises virtual machines to the cloud with minimal changes. Which deployment model is most appropriate?

Accepted Answer

Lift-and-shift to IaaS. The lift-and-shift (rehost) model migrates on-premises virtual machines to IaaS with minimal changes, preserving the OS, applications, and configurations. This approach avoids refactoring or re-architecting, making it the most appropriate for minimizing modifications during cloud migration.

Answer

Re-platform to PaaS

Answer

Refactor into SaaS

Answer

Re-architect as containerized applications

Question 14

A company is planning to migrate a legacy application to the cloud. They want to leverage cloud-native features while minimizing code changes. Which TWO migration strategies should they consider?

Accepted Answer

Replatform. Replatform (A) is correct because it involves migrating the application to a cloud-managed platform (e.g., moving from a self-managed database to Amazon RDS or Azure SQL Database) with minimal code changes, allowing the company to leverage cloud-native features like automated backups and scaling. Replace (D) is correct because it means adopting a SaaS alternative (e.g., replacing a custom CRM with Salesforce) that provides cloud-native capabilities without modifying existing code, aligning with the goal of minimizing code changes.

Answer

Rehost

Answer

Rebuild

Answer

Refactor

Question 15

A company uses a cloud load balancer to distribute traffic to a group of web servers. After a recent update, some users report being redirected to a maintenance page when the application is actually available. What is the most likely cause?

Accepted Answer

The load balancer health check is misconfigured and marking healthy instances as unhealthy.. The most likely cause is that the load balancer's health check is misconfigured, causing it to incorrectly mark healthy web servers as unhealthy. When all instances are marked unhealthy, the load balancer has no available targets and may route traffic to a fallback maintenance page or return an error. This explains why users see a maintenance page despite the application being available.

Answer

The load balancer's SSL certificate has expired.

Answer

The DNS record for the load balancer has a short TTL.

Answer

The web servers are not configured with the same security group.

CV0-004 Practice Test 12 — 15 Questions

Exhibit

CV0-004 Practice Test 12 — 15 Questions

Exhibit