CV0-004 Practice Test 12 — 15 Questions

Question 1

A cloud architect reviews the above IAM policy attached to a user. What is the effect of this policy on the user's ability to stop or terminate instances?

Accepted Answer

The user can stop only production-tagged instances and cannot terminate any instances. The policy uses a Condition block with StringNotEquals to explicitly deny ec2:StopInstances and ec2:TerminateInstances when the resource tag 'environment' is not equal to 'production'. Since the Deny effect overrides any Allow, the user can only stop instances tagged with 'environment=production' and cannot terminate any instances because the TerminateInstances action is also denied for non-production tags and there is no Allow for termination.

Answer

The user can stop any instance but cannot terminate any instance

Answer

The user can stop only production-tagged instances and terminate only production-tagged instances

Answer

The user can stop any instance and terminate any instance

Question 2

A cloud administrator is troubleshooting connectivity issues between two virtual networks in a public cloud. The networks are in the same region but different VPCs. Both VPCs have route tables and security groups configured. Instances in VPC A cannot ping instances in VPC B. Which of the following is the most likely cause?

Accepted Answer

VPC peering is not established between the two VPCs.. VPC peering is a direct network connection between two VPCs that enables routing of traffic using private IPv4 or IPv6 addresses. Without an established VPC peering connection, instances in different VPCs cannot communicate, even if they are in the same region. Since the question states the VPCs are separate and no peering is mentioned, this is the most likely root cause of the connectivity failure.

Answer

The instances are not assigned public IP addresses.

Answer

Security groups are blocking ICMP traffic.

Answer

Network ACLs are not configured to allow the traffic.

Question 3

A cloud engineer is troubleshooting performance issues in a virtualized environment. Which of the following tools would BEST help identify CPU contention on a hypervisor?

Accepted Answer

esxtop. 'esxtop' (on VMware) provides real-time performance data including CPU ready time, which directly indicates CPU contention. Option A is incorrect because 'iperf' measures network throughput. Option C is incorrect because 'ping' tests basic connectivity. Option D is incorrect because 'nslookup' is for DNS resolution.

Answer

iperf

Answer

ping

Answer

nslookup

Question 4

A cloud engineer needs to ensure that a web application can scale out automatically during traffic spikes. Which design best practice should be implemented?

Accepted Answer

Configure an auto scaling group with a load balancer.. An auto scaling group combined with a load balancer automatically adds or removes VM instances based on predefined metrics (e.g., CPU utilization, request count), ensuring the web application scales out horizontally during traffic spikes without manual intervention. This aligns with cloud elasticity best practices for handling variable workloads.

Answer

Deploy a larger instance size.

Answer

Use a single powerful VM with more vCPUs.

Answer

Manually provision additional VMs during peak times.

Question 5

Refer to the exhibit. An administrator created this policy and attached it to a user. When the user attempts to terminate an instance from an IP address outside the 10.0.0.0/8 range, what will happen?

Accepted Answer

The user will be denied because the condition fails.. The policy includes a condition that restricts the allowed source IP addresses to the 10.0.0.0/8 range. When the user attempts to terminate an instance from an IP address outside this range, the condition fails, and the default implicit deny in IAM (or equivalent policy engine) denies the action. The explicit Allow effect is only applied when the condition is met, so a failed condition results in denial.

Answer

The user will be denied because the action is not allowed.

Answer

The effect will be evaluated as Deny.

Answer

The user will be allowed to terminate instances.

Question 6

A cloud architect is designing a deployment for a multi-tier application that must meet compliance requirements for data residency. The application consists of a web tier, application tier, and database tier. Which TWO deployment strategies should the architect consider to ensure data remains in a specific geographic region while maintaining high availability?

Accepted Answer

Deploy across multiple availability zones in the same region. Deploying across multiple Availability Zones (AZs) within the same region ensures that application components remain within the geographic boundary required for data residency, while providing high availability through fault isolation. If one AZ fails, traffic is automatically routed to healthy instances in other AZs, maintaining uptime without leaving the region.

Answer

Set up a VPN to a neighboring region

Answer

Deploy in a single availability zone

Answer

Deploy across multiple regions

Question 7

A company is migrating to the cloud and needs to ensure high availability for a web application. The solution must tolerate the failure of an entire Availability Zone. Which three actions should the administrator take? (Choose three.)

Accepted Answer

Deploy the application across two or more Availability Zones.. Deploying the application across two or more Availability Zones (AZs) ensures that if an entire AZ fails, the application remains available in the other AZ(s). This is a fundamental design pattern for achieving high availability in AWS, as AZs are physically separate data centers with independent power, cooling, and networking. By distributing resources across multiple AZs, the application can tolerate the failure of one AZ without service interruption.

Answer

Use an Application Load Balancer with cross-zone load balancing enabled.

Answer

Use a single instance in a larger instance size.

Question 8

A cloud architect needs to centrally manage logs from multiple AWS accounts. Which service should be used to aggregate logs into a single view?

Accepted Answer

AWS CloudWatch Logs. AWS CloudWatch Logs can aggregate log data from multiple accounts into a single log group for centralized monitoring.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS X-Ray

Question 9

A company uses AWS and wants to receive alerts when CPU utilization of an EC2 instance exceeds 90% for 10 minutes. Which AWS service should be used to create this alarm?

Accepted Answer

Amazon CloudWatch Alarms. CloudWatch Alarms monitor metrics and trigger actions based on thresholds and duration.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 10

A cloud administrator is troubleshooting why a newly launched VM did not complete its initialization. According to the exhibit, what is the most likely cause?

Accepted Answer

The package repository is not configured correctly. The error 'E: Unable to locate package python3-pip' indicates that the package repository is not configured correctly or the package does not exist in the configured sources. This prevents cloud-init from installing the specified package, so the most likely cause is an incorrect repository configuration. Therefore, option B is correct. Option A is incorrect because cloud-init is executing commands, showing it is installed. Option C is incorrect because the error is about a missing package, not a syntax error. Option D is incorrect because the command ran successfully, indicating no network issues; the problem is repository configuration.

Answer

Cloud-init is not installed on the VM

Answer

The cloud-init user data script contains a syntax error

Answer

The VM does not have internet access

Question 11

A cloud team wants to automatically scale an application based on the number of pending messages in a message queue. Which scaling policy type should be used?

Accepted Answer

Dynamic scaling (metric-based). Dynamic scaling (metric-based) adjusts the number of instances to keep a specific metric, such as queue depth, at a target value. This is the appropriate policy for scaling based on real-time queue depth.

Answer

Scheduled scaling

Answer

Manual scaling

Answer

Static scaling

Question 12

A cloud engineer is designing an auto-scaling solution for a stateful application. The scaling policy must ensure that instances are properly drained before termination and that new instances are fully initialized before receiving traffic. Which THREE features should be used? (Choose THREE.)

Accepted Answer

Elastic Load Balancer target group health checks. Lifecycle hooks allow custom actions during scale-in (draining) and scale-out (initialization). Health checks ensure instances are healthy before receiving traffic. Cooldown periods prevent rapid scaling. Elastic Load Balancer target group ensures traffic distribution. CloudWatch alarms trigger scaling.

Answer

Scheduled scaling actions

Answer

Cooldown periods

Question 13

During a disaster recovery test, a cloud administrator finds that the replicated VMs in the secondary site fail to start because they are assigned to a resource pool that does not exist in the secondary site. Which of the following should the administrator have done to prevent this issue?

Accepted Answer

Map the resource pools between primary and secondary sites.. The issue stems from the replicated VMs being assigned to a resource pool that doesn't exist on the secondary site. By mapping resource pools between primary and secondary sites during replication setup, the administrator ensures that the destination resource pool is created or mapped correctly, allowing the VMs to start without dependency errors. This is a common prerequisite in vSphere Replication or similar disaster recovery tools where resource pool configurations must be mirrored to avoid startup failures.

Answer

Use storage snapshot replication instead.

Answer

Ensure the secondary site has identical hardware.

Answer

Configure the replication job to use a different datastore.

Question 14

A company is deploying a stateless application across multiple Availability Zones in AWS. The application must automatically scale based on CPU utilization. Which combination of services should the architect use to achieve this?

Accepted Answer

Auto Scaling group and Application Load Balancer. Auto Scaling groups manage instance scaling across AZs, and Application Load Balancer distributes traffic; this combination provides elasticity and high availability.

Answer

Auto Scaling group and CloudFront

Answer

Auto Scaling group and Network Load Balancer

Answer

Auto Scaling group and Classic Load Balancer

Question 15

A systems administrator is troubleshooting a network connectivity issue between two peered VPCs in different regions. The VPC peering connection is established and the route tables are configured. However, instances cannot communicate. What should be checked NEXT?

Accepted Answer

The security group rules on the instances. Since the VPC peering connection is established and route tables are configured, the next likely cause is that security group rules on the instances are blocking traffic. Security groups act as virtual firewalls at the instance level, and by default they deny all inbound traffic; explicit rules must allow traffic from the peered VPC's CIDR or security group. This is a common oversight when peering VPCs across regions, as security groups do not automatically permit cross-peering traffic.

Answer

The route propagation of the peering connection

Answer

The network ACLs at the subnet level

Answer

The MTU settings on the instances