CV0-004 Practice Test 13 — 15 Questions

Question 1

A mid-sized company is migrating its on-premises applications to a public cloud. The security team has implemented a cloud access security broker (CASB) to monitor and enforce policies for sensitive data. The company uses a multi-cloud environment with both AWS and Azure. After deployment, the security team receives alerts that a developer accidentally exposed a set of credentials in a public GitHub repository. The credentials were associated with a service account that has read-write access to an AWS S3 bucket containing customer PII (personally identifiable information). The team immediately revokes the credentials and rotates the access keys. The security team wants to prevent such incidents in the future and ensure that any exposed credentials are promptly detected without relying solely on manual GitHub scans. The company also wants to maintain a least-privilege model for all cloud resources. Given this scenario, which of the following actions should the security team take FIRST to reduce the risk of credential exposure and improve detection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the CASB to integrate with the GitHub API to continuously scan for exposed secrets and automatically trigger alerts.. A CASB is designed to integrate with cloud services like GitHub via APIs to provide continuous monitoring and policy enforcement. By configuring the CASB to scan GitHub repositories in real-time, the security team can detect exposed credentials immediately upon commit, rather than relying on periodic scans or manual reviews. This aligns with the requirement for prompt detection without manual intervention and leverages the existing CASB investment for multi-cloud environments.

Answer

Implement a periodic secret scanning tool that runs every 24 hours and reports any found credentials to the security team.

Answer

Disable all public repositories and require all code to be stored in private repositories with strict branch protection rules.

Answer

Require all developers to use a password manager to store secrets and set up a process to manually review GitHub commits.

Question 2

A cloud architect is designing a disaster recovery plan. The application requires a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 hour. Which strategy best meets these requirements?

Accepted Answer

Continuous replication to a warm standby site. Continuous replication to a warm standby site best meets the RTO of 15 minutes and RPO of 1 hour. Warm standby maintains a scaled-down but functional copy of the environment that can be quickly scaled up, and continuous replication ensures data loss is within minutes, satisfying the RPO.

Answer

Daily snapshots replicated to another region

Answer

Scheduled cross-region snapshots every 6 hours

Answer

Backup to tape and store offsite

Question 3

A company is deploying a critical financial application on a private cloud. The compliance team requires that all data at rest be encrypted with a key managed by the company's hardware security module (HSM). The cloud architect must select a storage solution that supports customer-managed keys and integrates with the existing HSM. Which storage option should the architect choose?

Accepted Answer

Encrypted volumes on a software-defined storage (SDS) cluster. A software-defined storage (SDS) cluster can be configured to use customer-managed encryption keys that integrate directly with the company's existing hardware security module (HSM) via standard interfaces like PKCS#11 or KMIP. This allows the company to maintain full control over key management and meet the compliance requirement for data-at-rest encryption with HSM-managed keys.

Answer

Object storage with server-side encryption using a cloud provider key

Answer

Instance store volumes on the compute nodes

Answer

Network-attached storage (NAS) appliance with built-in encryption

Question 4

A cloud architect is designing a multi-tier application in a public cloud that must comply with PCI DSS. The web tier must be accessible from the internet, but the application tier should not have any public IP addresses. Which architecture meets these requirements?

Accepted Answer

Place the web tier in a public subnet behind an internet-facing load balancer, and the app tier in a private subnet with a NAT gateway for outbound traffic.. It places the web tier in a public subnet with an internet-facing load balancer, allowing internet access, and the app tier in a private subnet with no public IP, meeting the requirement. The NAT gateway enables outbound traffic for the app tier (e.g., for updates) without exposing it inbound. Option A is wrong because it assigns public IPs to both tiers, which violates the requirement that the app tier should not have public IPs. Option B is wrong because deploying both in private subnets would prevent internet access to the web tier, and VPC peering to a data center does not address internet access. Option C is wrong because a site-to-site VPN would route all traffic through on-premises, which is unnecessary and doesn't provide direct internet access to the web tier as required.

Answer

Assign public IP addresses to both tiers and use security group rules to restrict traffic.

Answer

Deploy both tiers in private subnets and use a VPC peering connection to the corporate data center.

Answer

Use a site-to-site VPN between the cloud VPC and an on-premises network for all traffic.

Question 5

A company uses AWS and Azure to run identical workloads for redundancy. They want to simplify management by using a single set of tools across both clouds. Which architectural approach should they consider?

Accepted Answer

Multi-cloud using a cloud-agnostic orchestration tool. Multi-cloud with a cloud-agnostic abstraction layer (e.g., using Terraform or Kubernetes) allows managing resources across providers with a unified toolset.

Answer

Use each provider's native management tools

Answer

Single cloud migration to one provider

Answer

Hybrid cloud using VPN between AWS and Azure

Question 6

Match each high-availability concept to its description.

Accepted Answer

Failover: Automatic switching to a redundant system upon failure. Correct matches: Failover (auto-switch to standby), Load Balancing (distribute workload), Clustering (group as one system), Redundancy (duplicate components). Common confusions: swapping failover and load balancing definitions.

Answer

Failover: Distributing workloads across multiple resources

Answer

Load Balancing: Automatic switching to a redundant system upon failure

Question 7

A cloud engineer is writing a Terraform configuration to provision an AWS EC2 instance. They need to pass the AMI ID as a variable to make the configuration reusable. Which Terraform block should be used to define the variable?

Accepted Answer

variable. Variables are defined using the 'variable' block. 'resource' declares resources; 'provider' configures providers; 'output' defines outputs.

Answer

output

Answer

provider

Answer

resource

Question 8

Arrange the steps to implement a cloud security group that allows only specific IPs to access an application.

Accepted Answer

Step 1: Identify IPs, Step 2: Create security group with rule, Step 3: Set source (IP range), Step 4: Associate security group with resource, Step 5: Test connectivity. The correct sequence ensures that the security group is properly configured with the known allowed IPs before being attached to the resource, and then tested. Identifying IPs first prevents misconfiguration, and setting the source within the rule during creation ensures the rule is complete before association.

Answer

Step 1: Create security group with rule, Step 2: Identify IPs, Step 3: Set source (IP range), Step 4: Associate security group with resource, Step 5: Test connectivity

Answer

Step 1: Identify IPs, Step 2: Create security group with rule, Step 3: Associate security group with resource, Step 4: Set source (IP range), Step 5: Test connectivity

Answer

Step 1: Identify IPs, Step 2: Set source (IP range), Step 3: Create security group with rule, Step 4: Associate security group with resource, Step 5: Test connectivity

Question 9

An organization is deploying a multi-tier application in the cloud. The web tier uses auto scaling, and the database tier uses a managed database service. During a load test, the web tier scales up correctly, but the database performance degrades significantly, causing timeout errors. The administrator reviews the database metrics and finds that CPU and memory are normal, but the number of connections is high. Which of the following is the BEST action to resolve the issue?

Accepted Answer

Implement connection pooling on the web servers to limit database connections.. The issue is that the database is overwhelmed by a high number of connections, not by CPU or memory pressure. Connection pooling on the web servers reuses a fixed set of database connections, reducing the connection overhead and preventing the database from hitting its maximum connection limit. This directly addresses the symptom of high connection count without changing the database's compute capacity or the web tier's scaling behavior.

Answer

Add read replicas to offload read traffic from the primary database.

Answer

Increase the maximum number of web servers in the auto scaling group.

Answer

Increase the compute size of the database instance.

Question 10

An organization is migrating its on-premises virtualization environment to a public cloud. The current environment uses VMware vSphere with VM templates. The cloud provider supports importing VMs in OVF format. Which step should the cloud administrator take to prepare the VMs for migration?

Accepted Answer

Export each VM as an OVF template.. The cloud provider supports importing VMs in OVF format, which is an open standard for packaging and distributing virtual appliances. Exporting each VM as an OVF template from VMware vSphere creates the necessary .ovf descriptor file and accompanying disk files (e.g., .vmdk) that the provider can directly import. This is the correct preparation step because it produces the exact format required by the target cloud platform.

Answer

Take a snapshot of each VM and copy the snapshot files.

Answer

Convert each VM to an ISO image.

Answer

Copy the VM's VMDK files and import them as VHDX.

Question 11

A company uses a hybrid cloud model and experiences intermittent connectivity issues between the on-premises network and the public cloud VPC. The administrator has verified that the VPN connection is established. Which of the following should the administrator check next?

Accepted Answer

Routing tables on both sides.. Since the VPN connection is established (tunnel is up), the issue is likely with traffic routing rather than basic connectivity. Routing tables on both the on-premises router and the cloud VPC must have correct routes pointing to the VPN gateway and the remote subnets; a missing or misconfigured route (e.g., a missing static route or incorrect VPC route table entry) will cause intermittent connectivity even when the VPN tunnel itself is active.

Answer

Firewall rules for outbound traffic.

Answer

Public IP address of the VPN gateway.

Answer

DNS resolution of cloud endpoints.

Question 12

Which deployment strategy minimizes risk by gradually shifting a small percentage of traffic to a new version before full rollout?

Accepted Answer

Canary deployment. A canary deployment minimizes risk by routing a small percentage of traffic (e.g., 5-10%) to the new version while the majority continues to use the stable version. This allows real-world validation of the new version under production load before a full rollout, and if issues are detected, traffic can be instantly redirected back to the old version. The strategy is named after the 'canary in a coal mine' concept, where early detection of problems prevents widespread impact.

Answer

In-place deployment

Answer

Rolling deployment

Answer

Blue-green deployment

Question 13

A cloud administrator notices that an auto-scaling group is frequently adding and removing instances due to brief spikes in CPU usage. What should be adjusted to stabilize the scaling activity?

Accepted Answer

Increase the cooldown period. Increasing the cooldown period prevents the auto-scaling group from launching or terminating additional instances immediately after a scaling activity, which smooths out reactions to brief CPU spikes. A longer cooldown gives metrics time to stabilize before another scaling decision is made, reducing thrashing. This directly addresses the frequent add/remove behavior described.

Answer

Increase the maximum instance count

Answer

Decrease the minimum instance count

Answer

Decrease the cooldown period

Question 14

A cloud operations team is troubleshooting a performance issue with a database that is running on a virtual machine. The database is experiencing high latency during peak hours. Metrics show that CPU and memory usage are below 50%, but disk I/O latency spikes. The database is hosted on a cloud provider's virtual machine with premium SSDs. Which of the following is the MOST likely cause of the disk I/O latency?

Accepted Answer

The disk IOPS limit is being exceeded during peak loads.. Premium SSDs have defined IOPS limits that, when exceeded during peak loads, cause disk I/O latency spikes. Since CPU and memory are below 50%, the bottleneck is at the storage layer, not compute or memory. The high latency indicates the disk queue depth is growing as requests exceed the provisioned IOPS cap, leading to queuing delays.

Answer

The OS is paging memory to disk due to insufficient RAM.

Answer

The virtual machine's network bandwidth is saturated.

Answer

The database application is CPU-bound.

Question 15

Which TWO of the following are benefits of using a content delivery network (CDN) with cloud-hosted applications? (Choose two.)

Accepted Answer

Reduces load on the origin server. Option A is correct because a CDN serves cached copies of content from edge nodes, so a large share of user requests never reach the origin server, directly reducing CPU, bandwidth, and concurrent-connection load on the origin. Option D is correct because CDNs cache content at edge locations geographically close to end users, shortening the network round-trip distance and thus reducing latency compared with fetching every request from a distant origin region. Option B is not a CDN benefit, since integrating a CDN typically adds a distribution and cache-invalidation layer rather than simplifying the application architecture. Option C is wrong because CDNs do not remove the need for HTTPS; they usually require TLS between clients and edge nodes and often between the edge and origin. Option E is not guaranteed, as CDN usage adds service charges that may or may not be offset by reduced origin costs.

Answer

Simplifies application architecture

Answer

Eliminates the need for HTTPS encryption

Answer

Lowers overall infrastructure cost