CV0-004 Practice Test 13 — 15 Questions

Question 1

A large enterprise is migrating multiple applications to the cloud. They need to ensure compliance with industry regulations and maintain security during the transition. Which THREE best practices should they follow?

Accepted Answer

Encrypt data in transit and at rest. Encrypting data in transit (using TLS 1.2/1.3) and at rest (using AES-256) is a fundamental security best practice for cloud migrations. It ensures that sensitive data remains protected from interception or unauthorized access during the transfer and while stored in cloud services like S3 or EBS, directly supporting compliance with regulations such as GDPR, HIPAA, or PCI DSS.

Answer

Use a single cloud provider for simplicity

Answer

Disable logging to reduce data exposure

Question 2

Refer to the exhibit. A cloud engineer is reviewing logs from an EC2 instance. Which of the following is the MOST likely root cause of the application failure?

Accepted Answer

The disk space reached 100% capacity, preventing the application from writing logs. When disk space reaches 100% capacity, the operating system cannot write new data to the filesystem. Since the application relies on writing logs (and potentially other data) to disk, it will fail when it cannot perform these write operations. This is a common root cause in cloud environments where log rotation is not configured or monitoring thresholds are not set.

Answer

The application experienced a segmentation fault due to a code bug

Answer

The instance ran out of memory because the application had a memory leak

Answer

The instance was stopped by the cloud provider due to a license violation

Question 3

A developer deployed a new version of a cloud function, but the function is returning 500 errors. The previous version worked fine. What is the most likely cause?

Accepted Answer

The new code contains a runtime error.. The most likely cause of 500 errors after deploying a new version of a cloud function is a runtime error in the new code. A 500 Internal Server Error indicates that the function's code executed but threw an unhandled exception or logic error, which did not exist in the previous working version. Since the environment (runtime, memory, timeout) remained unchanged, the introduction of faulty code is the primary suspect.

Answer

The function is using an outdated runtime.

Answer

The function's memory allocation is too low.

Answer

The function's timeout is set too short.

Question 4

Refer to the exhibit. The auto scaling group is fluctuating between 2 and 3 instances every few minutes. What is the most likely cause?

Accepted Answer

The scaling policies are based on metrics that are too sensitive.. The auto scaling group fluctuating between 2 and 3 instances every few minutes indicates a scaling policy that is too sensitive, likely based on a metric such as CPU utilization or request count per target that oscillates rapidly. When the metric crosses the scale-out threshold, a new instance launches, causing the metric to drop below the scale-in threshold, which then terminates an instance, creating a cycle. This is a classic symptom of thrashing due to overly aggressive or poorly configured scaling policies.

Answer

The instances are taking too long to become healthy.

Answer

The launch configuration has incorrect user data.

Answer

The load balancer is not properly distributing traffic.

Question 5

A cloud operations team needs to implement a monitoring solution for a microservices architecture. The solution must provide centralized logging, metrics, and alerting, and must be able to correlate data from multiple services. Which THREE of the following components should the team include?

Accepted Answer

A centralized logging system (e.g., ELK stack).. Option B is correct because a centralized logging system like the ELK stack (Elasticsearch, Logstash, Kibana) aggregates logs from all microservices into a single searchable repository. This enables the team to correlate events across services by timestamp and metadata, which is essential for debugging distributed transactions and identifying root causes of failures.

Answer

A security information and event management (SIEM) system.

Answer

An application performance monitoring (APM) tool.

Question 6

A company is migrating a monolithic application to microservices on a cloud platform. The current application uses a single relational database. The migration plan involves decomposing the application into several services, each with its own database (polyglot persistence). One service handles high-volume time-series data, another handles user profiles, and a third handles transactions. The architect must ensure data consistency across services for user profile updates that affect other services. Which approach should be used to maintain data consistency without tight coupling?

Accepted Answer

Implement a saga pattern using choreography or orchestration. The saga pattern (option D) is the correct approach because it maintains data consistency across microservices without tight coupling by breaking a distributed transaction into a series of local transactions, each with a compensating action for rollback. In this scenario, user profile updates that affect other services can be coordinated via choreography (each service emits and listens to events) or orchestration (a central coordinator manages the steps), ensuring eventual consistency while preserving service autonomy and polyglot persistence.

Answer

Use distributed transactions (e.g., two-phase commit) across all services

Answer

Rely on eventual consistency with asynchronous messaging

Answer

Keep a single shared database for all services

Question 7

A company operates a multi-tier web application on AWS. The web tier runs on EC2 instances behind an Application Load Balancer. The application tier runs on EC2 instances that connect to an RDS MySQL database. Recently, users have reported slow page load times. The cloud administrator investigates and finds the following: CPU utilization on web and app tier instances is below 50%, memory usage is normal, but the RDS instance's CPU utilization is consistently above 80% and the number of database connections is at the maximum. The administrator also notices that the application code opens a new database connection for each HTTP request and does not close them properly. Which action should the administrator take to resolve the performance issue?

Accepted Answer

Implement a connection pooling mechanism in the application tier.. The performance issue is caused by the application opening a new database connection for each HTTP request and not closing them properly, which exhausts the maximum connections on RDS. Implementing a connection pooling mechanism in the application tier reuses existing connections, reduces connection overhead, and prevents connection exhaustion without requiring a larger instance or increasing the connection limit. This directly addresses the root cause—inefficient connection management—rather than treating symptoms like high CPU or connection limits.

Answer

Scale the RDS instance vertically to a larger instance class.

Answer

Increase the timeout for idle database connections.

Answer

Increase the maximum number of database connections on RDS.

Question 8

A company is migrating its on-premises e-commerce application to a public cloud provider. The application consists of a web tier, an application tier, and a database tier. The cloud architect has designed a three-tier architecture using virtual machines (VMs) in a virtual private cloud (VPC). During the deployment, the web servers are placed in a public subnet, the application servers in a private subnet, and the database servers in a separate private subnet. All security groups and network ACLs have been configured to allow the required traffic. After deploying the application, the operations team reports that the web servers cannot communicate with the application servers. The web servers are able to reach the internet, and the application servers can be reached from the operations team's management bastion host. Which of the following is the MOST likely cause of the issue?

Accepted Answer

The route table associated with the web servers' subnet is missing a route to the application servers' subnet.. The web servers are in a public subnet with a route table that typically includes a default route (0.0.0.0/0) pointing to an internet gateway, enabling internet access. However, for the web servers to reach the application servers in a private subnet, the route table associated with the web servers' subnet must also contain a route to the destination CIDR block of the application servers' subnet, pointing to a local route or a virtual private cloud (VPC) peering connection. Without this explicit route, traffic from the web servers to the application servers is dropped because the route table does not know how to forward packets to that subnet, even though security groups and network ACLs are correctly configured.

Answer

The web servers do not have a route to the internet gateway.

Answer

The network ACL on the application servers' subnet is blocking inbound traffic from the web servers.

Answer

The security group on the web servers is blocking outbound traffic to the application servers.

Question 9

A mid-sized company is migrating its on-premises applications to a public cloud. The security team has implemented a cloud access security broker (CASB) to monitor and enforce policies for sensitive data. The company uses a multi-cloud environment with both AWS and Azure. After deployment, the security team receives alerts that a developer accidentally exposed a set of credentials in a public GitHub repository. The credentials were associated with a service account that has read-write access to an AWS S3 bucket containing customer PII (personally identifiable information). The team immediately revokes the credentials and rotates the access keys. The security team wants to prevent such incidents in the future and ensure that any exposed credentials are promptly detected without relying solely on manual GitHub scans. The company also wants to maintain a least-privilege model for all cloud resources. Given this scenario, which of the following actions should the security team take FIRST to reduce the risk of credential exposure and improve detection?

Accepted Answer

Configure the CASB to integrate with the GitHub API to continuously scan for exposed secrets and automatically trigger alerts.. Option B is correct because a CASB is designed to integrate with cloud services like GitHub via APIs to provide continuous monitoring and policy enforcement. By configuring the CASB to scan GitHub repositories in real-time, the security team can detect exposed credentials immediately upon commit, rather than relying on periodic scans or manual reviews. This aligns with the requirement for prompt detection without manual intervention and leverages the existing CASB investment for multi-cloud environments.

Answer

Implement a periodic secret scanning tool that runs every 24 hours and reports any found credentials to the security team.

Answer

Disable all public repositories and require all code to be stored in private repositories with strict branch protection rules.

Answer

Require all developers to use a password manager to store secrets and set up a process to manually review GitHub commits.

Question 10

A company runs an e-commerce platform on a public cloud. The architecture consists of a front-end load balancer, a web server tier, and an RDS database. The web servers are in an auto-scaling group across two availability zones. The database is a single Multi-AZ deployment. After a recent traffic surge, the web servers scaled but the database CPU utilization reached 90%, causing slow page loads. The database is a db.r5.large instance with 16 GB RAM and 2 vCPUs. The company expects double the traffic during the upcoming holiday season. The budget is limited. Which action should the cloud architect take to address the database bottleneck while minimizing cost?

Accepted Answer

Add read replicas of the database and configure the application to use them for read queries; implement auto-scaling for read replicas based on average CPU utilization. Option B is correct because adding read replicas offloads read queries from the primary database, reducing CPU utilization. Auto-scaling read replicas based on average CPU utilization ensures cost efficiency by scaling only when needed, which aligns with the limited budget and expected traffic surge. This approach directly addresses the bottleneck without requiring a costly instance upgrade or complex sharding.

Answer

Implement a fully managed caching layer, such as ElastiCache, in front of the database

Answer

Separate the database into multiple smaller databases using sharding

Answer

Upgrade the database to a larger instance type, such as db.r5.2xlarge

Question 11

A company recently migrated its on-premises e-commerce application to a public cloud using lift-and-shift. After the migration, users report that the application is slower than before. The application consists of a web server, an application server, and a database server, all deployed on separate virtual machines. The cloud architecture uses the same instance sizes as the on-premises servers. The cloud administrator notices that the database server's disk I/O latency is higher than expected. What is the most likely cause of the performance degradation?

Accepted Answer

The database server is using standard HDD storage instead of SSD.. The database server's disk I/O latency is higher than expected because the lift-and-shift migration likely retained the same storage type as on-premises, but the cloud environment's standard HDD (hard disk drive) storage has significantly lower IOPS and higher latency compared to SSD (solid-state drive) storage. In a public cloud, standard HDD is optimized for sequential workloads and infrequent access, not for the random I/O patterns typical of a database server, causing performance degradation. The administrator should have provisioned SSD-backed storage (e.g., AWS gp3 or Azure Premium SSD) for the database VM to match or exceed on-premises performance.

Answer

The cloud provider's network has high latency.

Answer

The application server is not load-balanced.

Answer

The web server has too many vCPUs allocated.

Question 12

A company hosts a critical application on a single virtual machine in a public cloud. The virtual machine has been running without issues for months. Recently, the application became unresponsive, and users report a '500 Internal Server Error'. The cloud administrator checks the virtual machine's status and finds it is 'Running'. The administrator can successfully ping the virtual machine's public IP address. The administrator then attempts to SSH into the virtual machine but receives 'Connection timed out'. The virtual machine's security group allows SSH (port 22) from the administrator's IP address. The operating system firewall is enabled and configured to allow SSH. What should the administrator do next to troubleshoot the issue?

Accepted Answer

Use a serial console or out-of-band management to access the virtual machine's console.. The administrator can ping the VM (ICMP works) but SSH (TCP/22) times out, indicating the application is running but the SSH service or network stack is not responding to new connections. Since the cloud security group and OS firewall are correctly configured, the issue is likely at the OS level (e.g., SSH daemon crashed, kernel panic, or network service hung). Using a serial console or out-of-band management (e.g., AWS EC2 Serial Console, Azure Serial Console) provides direct, network-independent access to the VM's console, bypassing the broken network stack to diagnose and fix the OS-level problem.

Answer

Reset the virtual machine from the cloud provider's management console.

Answer

Create a new virtual machine and migrate the application.

Answer

Check the application logs from the cloud provider's monitoring service.

Question 13

A company is migrating its on-premises e-commerce application to a public cloud. The application consists of a stateless web tier, a stateful application tier that stores session data in memory, and a relational database. The migration must ensure high availability, scalability, and minimal downtime during cutover. The cloud provider offers load balancers, auto-scaling groups, managed database services, and caching services. The current on-premises architecture uses a single web server, a single application server, and a single database server. The application tier stores session data in local memory, which is lost if the server fails. The team needs to redesign the architecture to be cloud-native. Which of the following is the BEST course of action?

Accepted Answer

Deploy the web tier behind a load balancer with auto-scaling. Move session state from the application tier to a distributed caching service. Deploy the application tier behind a separate load balancer with auto-scaling. Migrate the database to a managed Multi-AZ deployment.. Option B is correct because it addresses the key requirements: high availability, scalability, and minimal downtime. By moving session state from local memory to a distributed caching service (e.g., Amazon ElastiCache or Azure Cache for Redis), the application tier becomes stateless and can be auto-scaled behind its own load balancer. The managed Multi-AZ database provides automatic failover and high availability, while the web tier behind a load balancer with auto-scaling ensures scalability and fault tolerance. This design eliminates single points of failure and allows zero-downtime cutover by scaling out before decommissioning on-premises resources.

Answer

Deploy the web tier behind a load balancer with auto-scaling. Keep the application tier as a single instance with session replication to a secondary instance. Use a managed database with a read replica.

Answer

Use a load balancer for the web tier with auto-scaling. Deploy the application tier as a single large instance with sticky sessions. Migrate the database to a larger single-instance managed database.

Answer

Deploy both web and application tiers behind a load balancer with auto-scaling. Use sticky sessions to maintain session state. Migrate the database to a managed Multi-AZ deployment.

Question 14

Order the steps to perform a disaster recovery failover to a secondary cloud region.

Question 15

A cloud engineer is designing a disaster recovery plan for a critical application. The application requires a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 hour. Which replication strategy should be used?

Accepted Answer

Asynchronous replication with snapshots every 30 minutes.. Asynchronous replication with snapshots every 30 minutes meets the RPO of 1 hour because data loss is limited to at most 30 minutes of changes, which is within the 1-hour window. The RTO of 15 minutes is achievable because the replicated data is readily available in the secondary region, allowing for rapid failover without the delay of restoring from backups.

Answer

Daily backups stored in a different region.

Answer

No replication; rely on infrastructure rebuild.

Answer

Synchronous replication between two regions.