CV0-004 Practice Test 14 — 15 Questions

Question 1

A security analyst is reviewing logs and finds that an unauthorized user accessed a storage blob in a cloud environment. The analyst needs to determine which permissions allowed the access. Which cloud feature provides a detailed view of effective permissions for a user?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Role-Based Access Control (RBAC) with effective permissions analysis. Role-Based Access Control (RBAC) systems often provide an 'effective permissions' or 'check access' feature that allows an administrator to evaluate the cumulative permissions assigned to a specific user, group, or service principal for a given resource scope. This feature calculates the net effect of all role assignments, including inherited permissions from higher-level scopes such as management groups, subscriptions, and resource groups, enabling the analyst to pinpoint exactly which role granted the unauthorized access.

Answer

Privileged Identity Management (PIM)

Answer

Blueprints/Service Catalog

Answer

Policy Enforcement

Question 2

A company is migrating its on-premises application to the cloud and needs to ensure high availability. The application requires a stateless web tier and a stateful database tier. Which design approach BEST meets these requirements?

Accepted Answer

Deploy web servers behind a load balancer and use a managed database with multi-AZ replication.. Deploying web servers behind a load balancer provides horizontal scaling and fault tolerance for the stateless web tier, while using a managed database with multi-AZ replication ensures automatic failover and data durability for the stateful database tier. This combination meets high availability requirements by eliminating single points of failure and providing redundancy across Availability Zones.

Answer

Deploy one large web server and one large database server.

Answer

Use round-robin DNS for web servers and a read replica for the database.

Answer

Use auto-scaling for web servers and a single database instance.

Question 3

A cloud administrator is writing an Ansible playbook to provision cloud resources. The administrator wants to ensure that the playbook can run without requiring any agent software on the target machines. Which Ansible feature enables this agentless operation?

Accepted Answer

SSH-based connection to managed nodes. Ansible is agentless by design and connects to managed nodes over standard SSH (or WinRM for Windows). This means no Ansible agent or daemon needs to be installed on target machines — the control node pushes modules over SSH, executes them, and removes them. SSH-based connection is the foundational mechanism that enables this agentless architecture.

Answer

Ansible inventory files that list hosts

Answer

Ansible modules that run on the control node

Answer

Pull mode from a central repository

Question 4

An organization has a hybrid cloud environment with resources in both a private cloud and a public cloud. The operations team reports that the cloud management platform cannot collect monitoring data from the public cloud instances. The security team recently updated firewall rules. Which of the following is the MOST likely cause?

Accepted Answer

The public cloud instances cannot reach the management platform's IP address due to firewall changes. The security team's recent firewall rule update is the most likely cause because the cloud management platform typically uses specific ports and protocols (e.g., HTTPS on TCP 443, SSH on TCP 22, or WinRM on TCP 5985/5986) to collect monitoring data from public cloud instances. If the firewall rules block outbound traffic from the public cloud instances to the management platform's IP address, or block inbound traffic from those instances at the platform's side, the data collection will fail. This directly aligns with the reported symptom of the management platform being unable to collect monitoring data after a firewall change.

Answer

The load balancer in front of the management platform is misconfigured

Answer

The SNMP community string was modified on the instances

Answer

The management platform's NAT IP address was changed

Question 5

An organization uses CloudFormation to manage infrastructure across multiple AWS accounts. The team wants to deploy a common set of resources, such as VPCs and security groups, to all accounts in a consistent manner. Which CloudFormation feature should they use?

Accepted Answer

StackSets. StackSets allow deploying stacks across multiple accounts and regions. Change sets preview changes, drift detection checks for manual changes, and nested stacks organize templates within a single account.

Answer

Change sets

Answer

Drift detection

Answer

Nested stacks

Question 6

A cloud engineer is designing a deployment strategy for a web application that requires zero downtime. The engineer has set up two identical production environments, one active and one idle. After deploying the new version to the idle environment, the engineer switches the DNS record to point to the idle environment. This deployment method is known as:

Accepted Answer

Blue/green deployment. Blue/green deployment maintains two identical environments: one live (blue) and one idle (green). After deploying the new version to the idle environment and testing it, traffic is switched from the active to the idle environment, typically via DNS or a load balancer. This provides zero downtime and instant rollback because the previous environment remains intact until the switch is validated.

Answer

Rolling deployment

Answer

A/B testing deployment

Answer

Canary deployment

Question 7

An organization's cloud environment has a policy that all administrative access must be logged and recorded. Which of the following is the best method to enforce this policy?

Accepted Answer

Use a bastion host with session recording.. A bastion host with session recording provides a centralized, auditable gateway for administrative access. It logs all commands and keystrokes, directly meeting the policy requirement that all administrative access must be logged and recorded. This method captures the full session activity, not just connection metadata.

Answer

Require multifactor authentication.

Answer

Implement a VPN connection for all administrators.

Answer

Configure syslog forwarding for all devices.

Question 8

A company uses a cloud load balancer to distribute traffic to a group of web servers. After a recent update, some users report being redirected to a maintenance page when the application is actually available. What is the most likely cause?

Accepted Answer

The load balancer health check is misconfigured and marking healthy instances as unhealthy.. The most likely cause is that the load balancer's health check is misconfigured, causing it to incorrectly mark healthy web servers as unhealthy. When all instances are marked unhealthy, the load balancer has no available targets and may route traffic to a fallback maintenance page or return an error. This explains why users see a maintenance page despite the application being available.

Answer

The load balancer's SSL certificate has expired.

Answer

The DNS record for the load balancer has a short TTL.

Answer

The web servers are not configured with the same security group.

Question 9

A cloud engineer deployed the infrastructure shown. The load balancer's health checks are failing for the EC2 instance. Which of the following is the MOST likely cause?

Accepted Answer

The health check endpoint /health does not exist on the web server.. The health check is failing because the load balancer is configured to check the /health endpoint, but the web server does not have that endpoint defined. Without a matching route or file for /health, the server returns a non-2xx/3xx status code (e.g., 404 Not Found), causing the load balancer to mark the instance as unhealthy.

Answer

The web server is not running HTTP.

Answer

The EC2 instance is in the wrong subnet.

Answer

The security group does not allow traffic from the load balancer.

Question 10

What is the primary benefit of using Infrastructure as Code (IaC)?

Accepted Answer

Consistent and repeatable deployments. The primary benefit of Infrastructure as Code (IaC) is that it enables consistent and repeatable deployments by defining infrastructure in code, which can be version-controlled, tested, and automatically provisioned. This reduces human error and ensures identical environments across stages. Improved network performance, full manual control, and lower costs are not the primary benefits; IaC may indirectly affect costs but not as its main purpose.

Answer

Improved network performance

Answer

Full manual control over resources

Answer

Lower cloud service costs

Question 11

A cloud administrator is configuring a new virtual private cloud (VPC) and needs to ensure that traffic between web servers and database servers is restricted to only the necessary ports. Which security approach should the administrator implement?

Accepted Answer

Configure a security group with inbound rules for the web tier and outbound rules for the database tier.. Security groups are stateful firewalls that operate at the instance level. By configuring a security group for the database tier with an inbound rule that allows traffic only from the web tier's security group on the necessary database port (e.g., 3306 for MySQL), and a corresponding outbound rule on the web tier's security group, the administrator can restrict traffic to only the required ports. Network ACLs are stateless and require explicit rules for return traffic, making them more complex and error-prone. IAM policies manage permissions, not traffic. Flow logs only monitor traffic, they do not block it.

Answer

Enable VPC flow logs to detect and block malicious traffic.

Answer

Create an IAM policy to restrict access between subnets.

Answer

Implement network ACLs with rules that allow only database-specific ports (e.g., 3306) from web to database and block all other traffic.

Question 12

A cloud architect is designing a DDoS protection strategy for a web application hosted on AWS. The application uses an Application Load Balancer (ALB). Which service provides automatic, always-on DDoS protection at no additional cost?

Accepted Answer

AWS Shield Standard. AWS Shield Standard provides automatic protection against common DDoS attacks for all AWS customers at no additional cost.

Answer

AWS WAF

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Question 13

A company uses GitHub Actions to build and deploy a microservices application. They want to automate the deployment to a Kubernetes cluster only when changes are pushed to the main branch. Which GitHub Actions event trigger should be used in the workflow?

Accepted Answer

on: push: branches: [ main ]. The 'push' event with branch filters triggers on pushes to main. 'pull_request' triggers on PR events; 'schedule' triggers on a cron; 'workflow_dispatch' triggers manually.

Answer

on: workflow_dispatch:

Answer

on: schedule: - cron: '0 0 * * *'

Answer

on: pull_request: branches: [ main ]

Question 14

Match each disaster recovery term to its definition.

Accepted Answer

RTO: Maximum allowed downtime. Key disaster recovery terms: RTO focuses on downtime, RPO on data loss, failover is automatic, and cold site has minimal setup. Common confusions involve swapping RTO and RPO definitions or mischaracterizing failover as manual.

Answer

RTO: Maximum acceptable data loss

Answer

Failover: Manual process to restore service

Question 15

Match each acronym to its definition.

Accepted Answer

IaaS: Provides virtualized computing resources over the internet.. IaaS, PaaS, SaaS, and FaaS are common cloud service models. IaaS provides virtualized hardware, PaaS provides a development platform, SaaS provides ready-to-use software, and FaaS provides event-driven code execution. Common confusions include swapping IaaS and PaaS definitions.

Answer

IaaS: Provides a platform for developing and deploying applications.

Answer

PaaS: Provides virtualized computing resources such as virtual machines.