CV0-004 Practice Test 14 — 15 Questions

Question 1

A company uses Azure Log Analytics to centralize logs from multiple subscriptions. The security team requires that logs be retained for seven years to meet compliance regulations. What should the administrator configure to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set the retention policy in the Log Analytics workspace to 2555 days. Log Analytics workspaces allow setting retention policies up to 730 days (2 years) by default, but for longer retention, Azure Data Explorer or archive to Azure Storage with lifecycle management can be used. However, the question expects the correct answer as setting retention policy to 2555 days (7 years) is possible if workspace is configured for longer retention (up to 7 years with additional cost).

Answer

Export logs to Azure Blob Storage and set a lifecycle management policy

Answer

Enable Azure Sentinel

Answer

Create a log-based alert to notify when logs are about to expire

Question 2

A company is designing a disaster recovery plan for its cloud infrastructure. The primary site is in US-East, and the DR site is in US-West. The RPO is 15 minutes, and the RTO is 2 hours. Which replication strategy best meets these requirements at the lowest cost?

Accepted Answer

Asynchronous replication from primary to DR. Asynchronous replication sends data changes from the primary site to the DR site with minimal delay, typically within seconds to minutes, which meets the 15-minute RPO. It does not require the low-latency link that synchronous replication demands, making it more cost-effective for geographically separated sites. The 2-hour RTO is achievable because the DR site can be activated quickly from the replicated data, without the overhead of restoring from backups.

Answer

Scheduled nightly backups to DR

Answer

Synchronous replication between sites

Answer

No replication; manual failover

Question 3

Refer to the exhibit. A cloud administrator launched a CloudFormation stack to deploy an EC2 instance, but the stack is rolling back. What is the MOST likely cause?

Accepted Answer

The AMI ID is invalid or has been deregistered.. CloudFormation validates the AMI ID during stack creation. If the AMI ID is invalid (e.g., mistyped, belongs to a different region, or has been deregistered), the EC2 instance launch fails, causing CloudFormation to roll back the stack. This is a common misconfiguration when copying templates across regions without updating AMI IDs.

Answer

The security group referenced in the template does not exist.

Answer

The subnet ID is in a different VPC.

Answer

The instance type is not available in the selected region.

Question 4

A cloud administrator is setting up monitoring for a web application. The application must be highly available across multiple availability zones. Which of the following metrics should be monitored to ensure that the application meets its service level agreement (SLA) for uptime?

Accepted Answer

The result of the load balancer health check for each instance.. The load balancer health check result directly indicates whether each instance is reachable and responding correctly to application traffic. Monitoring these results allows the administrator to detect instance failures and verify that the application remains available across multiple availability zones, which is the core requirement for meeting an uptime SLA. Other metrics like throughput, disk space, or CPU utilization are performance indicators but do not directly confirm application availability.

Answer

Network throughput per minute.

Answer

Percentage of disk space used on each instance.

Answer

Average CPU utilization across all instances.

Question 5

A cloud architect is designing a disaster recovery plan for a critical application with an RTO of 15 minutes and an RPO of 1 minute. The application runs on AWS EC2 instances with data stored on EBS volumes. Which replication strategy best meets these requirements?

Accepted Answer

Continuous replication using AWS Elastic Disaster Recovery. Continuous replication (e.g., using AWS Elastic Disaster Recovery) provides near-synchronous replication with very low RPO. Snapshot-based replication has higher RPO. Cross-region replication for S3 is for object storage.

Answer

EBS snapshots replicated to another region every hour

Answer

Daily AMI backups stored in a different region

Answer

Cross-region replication of S3 buckets

Question 6

The exhibit shows the health check status for targets in an application load balancer's target group. The target group has a health check on port 80. An administrator notices that one target is unhealthy on port 80 but healthy on port 443. What is the most likely cause?

Accepted Answer

The security group for the target is blocking port 80 from the load balancer.. The target is healthy on port 443 but unhealthy on port 80, indicating that port 80 is not reachable from the load balancer. The most likely cause is that the security group for the target is blocking inbound traffic on port 80 from the load balancer. Option A is incorrect because the target is healthy on 443, so the web server is listening on that port, but it could still be listening on 80; the issue is connectivity. Option C is incorrect because if the load balancer were in a different VPC, it wouldn't be able to communicate with any targets at all. Option D is incorrect because the health check path applies to both port 80 and 443 health checks if configured separately, but since only port 80 is failing and the path is the same, the path is not the issue.

Answer

The web server on the target is not listening on port 443.

Answer

The load balancer is in a different VPC.

Answer

The health check path is incorrect.

Question 7

A financial services company requires a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 5 minutes for its critical database. Which high availability architecture should they implement?

Accepted Answer

Active-passive with synchronous replication. Active-passive with synchronous replication provides fast failover and minimal data loss, meeting the RTO of 15 minutes and RPO of 5 minutes. Hot standby can fail over quickly, but synchronous replication ensures the RPO.

Answer

Warm standby

Answer

Active-active with asynchronous replication

Answer

Cold standby

Question 8

A cloud operations team is investigating a security breach where an unauthorized user accessed a storage bucket containing sensitive data. The logs show that the access occurred using valid access keys from an IP address outside the company's network. The administrator checks the IAM policies and finds that the keys belong to a service account that has read access to the bucket. Which of the following actions would be MOST effective in preventing a recurrence?

Accepted Answer

Rotate the compromised keys and implement multi-factor authentication on the account.. Rotating the compromised keys immediately invalidates the stolen credentials, while implementing multi-factor authentication (MFA) on the service account adds an additional layer of security. Even though service accounts typically don't support interactive MFA, using IAM conditions to require MFA for API calls or using workload identity federation can enforce MFA-like controls. This directly addresses the root cause—compromised static keys—and prevents reuse of the stolen access keys.

Answer

Remove the bucket and restore from backup to a new bucket.

Answer

Delete the service account and create a new one with the same permissions.

Answer

Change the bucket policy to deny access from outside the company's IP range.

Question 9

A cloud administrator is migrating a legacy application to a public cloud IaaS environment. The application requires a static IP address for licensing. Which of the following should the administrator configure to meet this requirement?

Accepted Answer

Reserved public IP. A reserved public IP (also known as a static public IP) ensures the legacy application always has the same public IP address for licensing purposes. In IaaS environments like Azure, this is called a 'reserved IP' or 'static public IP', which persists even after the VM is stopped or deallocated, meeting the licensing requirement.

Answer

NAT gateway

Answer

Virtual IP address

Answer

Elastic IP

Question 10

A cloud operations team is designing a disaster recovery plan that includes regular testing. Which TWO activities should be part of the DR testing process? (Select TWO.)

Accepted Answer

Chaos engineering experiments. Scheduled drills validate the plan, and chaos engineering tests resilience.

Answer

Updating security patches

Answer

Reviewing billing reports

Answer

Performing daily backups

Question 11

A company uses Azure DevOps to deploy a critical application. They need to implement a deployment strategy that ensures zero downtime by directing all traffic to the new environment after validation, while keeping the old environment as a fallback. Which deployment strategy should be configured in the Azure Pipelines release pipeline?

Accepted Answer

Blue/green deployment. Blue/green deployment is the correct strategy because it maintains two identical environments (blue and green) and switches the router or load balancer to direct all traffic to the new (green) environment only after validation is complete. The old (blue) environment remains untouched and can serve as an immediate fallback if issues arise, ensuring zero downtime during the cutover.

Answer

Canary deployment

Answer

In-place deployment

Answer

Rolling deployment

Question 12

A company uses a multi-cloud strategy with workloads in AWS and Azure. The cloud team wants a centralized log management solution to correlate security events across both platforms. Which approach is most suitable?

Accepted Answer

Deploy a third-party SIEM solution such as Splunk. Azure Log Analytics, AWS CloudWatch Logs, and GCP Cloud Logging each work only within their own cloud. A third-party SIEM like Splunk can aggregate logs from multiple clouds.

Answer

Use AWS CloudWatch Logs with cross-account log groups

Answer

Use GCP Cloud Logging with a log sink to BigQuery

Answer

Use Azure Log Analytics and forward AWS logs to it via an agent

Question 13

A company is migrating its on-premises e-commerce application to a public cloud. The application consists of a stateless web tier, a stateful application tier that stores session data in memory, and a relational database. The migration must ensure high availability, scalability, and minimal downtime during cutover. The cloud provider offers load balancers, auto-scaling groups, managed database services, and caching services. The current on-premises architecture uses a single web server, a single application server, and a single database server. The application tier stores session data in local memory, which is lost if the server fails. The team needs to redesign the architecture to be cloud-native. Which of the following is the BEST course of action?

Accepted Answer

Deploy the web tier behind a load balancer with auto-scaling. Move session state from the application tier to a distributed caching service. Deploy the application tier behind a separate load balancer with auto-scaling. Migrate the database to a managed Multi-AZ deployment.. It addresses the key requirements: high availability, scalability, and minimal downtime. By moving session state from local memory to a distributed caching service (e.g., Amazon ElastiCache or Azure Cache for Redis), the application tier becomes stateless and can be auto-scaled behind its own load balancer. The managed Multi-AZ database provides automatic failover and high availability, while the web tier behind a load balancer with auto-scaling ensures scalability and fault tolerance. This design eliminates single points of failure and allows zero-downtime cutover by scaling out before decommissioning on-premises resources.

Answer

Deploy the web tier behind a load balancer with auto-scaling. Keep the application tier as a single instance with session replication to a secondary instance. Use a managed database with a read replica.

Answer

Use a load balancer for the web tier with auto-scaling. Deploy the application tier as a single large instance with sticky sessions. Migrate the database to a larger single-instance managed database.

Answer

Deploy both web and application tiers behind a load balancer with auto-scaling. Use sticky sessions to maintain session state. Migrate the database to a managed Multi-AZ deployment.

Question 14

A cloud administrator wants to ensure that patches are applied to cloud workloads with minimal risk. Which TWO practices should the administrator follow? (Choose two.)

Accepted Answer

Automate patch deployment using orchestration tools.. Automating patch deployment using orchestration tools ensures consistent, repeatable, and scheduled patching across cloud workloads, reducing human error and manual overhead. Option E is correct because testing patches in a staging environment first validates compatibility and identifies regressions before production deployment, which is a critical risk mitigation practice in cloud operations.

Answer

Skip patches for legacy systems to avoid regression.

Answer

Patch in production during peak hours to save time.

Answer

Always apply patches manually to ensure control.

Question 15

A company runs a stateless web application on AWS EC2 instances behind an Application Load Balancer. To reduce costs, they want to use the most cost-effective compute option that can handle variable traffic and be interrupted. Which pricing model should they use for the EC2 instances?

Accepted Answer

Spot instances. Spot instances offer significant cost savings but can be interrupted, making them suitable for stateless, fault-tolerant workloads that can handle interruptions.

Answer

Dedicated hosts

Answer

Reserved instances

Answer

On-demand instances