CV0-004 Practice Test 15 — 15 Questions

Question 1

A startup is deploying a web application on a public cloud and expects variable traffic throughout the day. The team wants to minimize costs while ensuring that the application can handle sudden spikes in demand. Which scaling strategy best meets these requirements?

Accepted Answer

Auto scaling based on CPU utilization thresholds. Auto scaling based on CPU utilization thresholds is the correct strategy because it dynamically adjusts the number of compute instances in response to real-time demand, ensuring the application can handle sudden spikes while minimizing costs during low-traffic periods. This approach aligns with the startup's requirement for variable traffic and cost efficiency, as it only provisions resources when needed, unlike fixed schedules or manual interventions that cannot react to unpredictable spikes.

Answer

Horizontal scaling using a fixed schedule

Answer

Vertical scaling during off-peak hours

Answer

Manual scaling based on historical data

Question 2

A company is deploying a containerized microservices application on a cloud platform. The operations team needs to manage secrets, such as database credentials and API keys, securely without embedding them in container images. Which solution should they use?

Accepted Answer

Use a cloud-native secrets management service to inject secrets at runtime. Option C is correct because a dedicated secrets management service (e.g., AWS Secrets Manager, Azure Key Vault) securely stores and rotates secrets, and containers can retrieve them at runtime via API. Option A is wrong because environment variables in the orchestration platform may expose secrets in logs. Option B is wrong because encrypted configuration files in a storage bucket still require key management. Option D is wrong because storing secrets in the image build process is insecure.

Answer

Include secrets in the container image at build time and encrypt the image

Answer

Encrypt secrets and store them in a cloud storage bucket

Answer

Store secrets as environment variables in the container orchestration platform

Question 3

A company has a hybrid cloud environment where on-premises servers communicate with cloud resources via a VPN connection. The network team notices intermittent connectivity issues and packet loss. The VPN tunnel is established, but performance is degraded. Which step should the team take first to diagnose the issue?

Accepted Answer

Use traceroute and ping to measure latency and packet loss. B is correct because traceroute and ping are the foundational diagnostic tools to measure latency and packet loss across a VPN tunnel. Intermittent connectivity and packet loss often stem from path issues, MTU mismatches, or routing problems that these tools can isolate. Since the tunnel is established, the first step is to quantify the performance degradation before making configuration changes.

Answer

Restart the VPN tunnel and monitor logs

Answer

Increase the MTU size on the VPN tunnel

Answer

Check the CPU utilization of the on-premises VPN appliance

Question 4

An organization is designing a cloud architecture for a data analytics workload that processes large datasets. The workload is CPU-intensive and runs once per day. The company wants to minimize costs. Which compute model should be used?

Accepted Answer

Spot instances with a fallback to on-demand. Option D is correct because spot/preemptible instances offer significant cost savings for fault-tolerant, interruptible workloads like batch processing. Option A is wrong because on-demand instances are more expensive. Option B is wrong because reserved instances are for steady-state usage. Option C is wrong because dedicated hosts are the most expensive option.

Answer

On-demand instances with auto scaling

Answer

Dedicated hosts with a savings plan

Answer

Reserved instances for a 1-year term

Question 5

A company is migrating a legacy monolithic application to a microservices architecture on the cloud. The application has tight coupling and shared database schemas. Which migration strategy should the company adopt to reduce risk and enable iterative migration?

Accepted Answer

Use the strangler fig pattern to gradually replace components. The strangler fig pattern is the correct migration strategy because it allows the company to incrementally replace specific functionalities of the legacy monolithic application with new microservices, reducing risk by keeping the existing system operational during the transition. This approach directly addresses the tight coupling and shared database schema issues by enabling gradual decomposition without requiring a complete rewrite or a risky big-bang migration.

Answer

Re-platform to a managed service and rewrite later

Answer

Containerize the monolithic application and run it on a cluster

Answer

Lift and shift the entire application, then refactor in-place

Question 6

A cloud architect needs to choose a compute service for a batch processing job that runs once a day and takes about 30 minutes. The job is CPU-intensive and can tolerate interruptions. Which compute option is the most cost-effective?

Accepted Answer

Spot (preemptible) instances. Option B is correct because spot instances offer significant discounts and are suitable for interruptible workloads. On-demand (A) costs more. Reserved instances (C) require a long commitment. Dedicated hosts (D) are expensive and unnecessary.

Answer

Reserved instances

Answer

Dedicated hosts

Answer

On-demand instances

Question 7

Which TWO are best practices for designing a multi-tenant SaaS application on a public cloud?

Accepted Answer

Use separate virtual networks or VPCs for each tenant. Options A and C are correct. Tenant isolation at the network layer (VLANs or VPCs) and using row-level security in a shared database are common approaches. Option B is wrong because a dedicated database per tenant is costly for many tenants. Option D is wrong because a single large instance for all tenants creates a noisy neighbor problem. Option E is wrong because a tiered service model is a business decision, not a design best practice for multi-tenancy.

Answer

Assign a dedicated database instance per tenant

Answer

Deploy all tenants on a single large compute instance

Answer

Offer the same service tier to all tenants

Question 8

Which TWO of the following are benefits of a multi-cloud strategy? (Select exactly two.)

Accepted Answer

Avoids vendor lock-in. Options B and D are correct. Multi-cloud avoids vendor lock-in (B) and provides geographic redundancy (D). Option A is wrong because multi-cloud typically increases complexity. Option C is wrong because it doesn't directly reduce bandwidth costs. Option E is wrong because it does not guarantee compliance.

Answer

Reduces data transfer costs

Answer

Ensures regulatory compliance in all regions

Answer

Simplifies management by using a single cloud provider

Question 9

Which TWO of the following are characteristics of a hybrid cloud deployment? (Select exactly two.)

Accepted Answer

Combines on-premises private cloud with public cloud resources. Option A is correct because a hybrid cloud explicitly combines on-premises private cloud infrastructure with public cloud resources, such as AWS, Azure, or GCP. This allows organizations to keep sensitive workloads on-premises while leveraging the scalability of the public cloud for burst or less-sensitive workloads. The connection is typically established via a dedicated VPN or direct link (e.g., AWS Direct Connect or Azure ExpressRoute) to ensure low-latency, secure communication between environments.

Answer

Simplifies data governance across environments

Answer

Typically uses a single public cloud provider

Answer

Uses only community cloud services

Question 10

A cloud architect reviews the above IAM policy attached to a user. What is the effect of this policy on the user's ability to stop or terminate instances?

Accepted Answer

The user can stop only production-tagged instances and cannot terminate any instances. The policy uses a Condition block with StringNotEquals to explicitly deny ec2:StopInstances and ec2:TerminateInstances when the resource tag 'environment' is not equal to 'production'. Since the Deny effect overrides any Allow, the user can only stop instances tagged with 'environment=production' and cannot terminate any instances because the TerminateInstances action is also denied for non-production tags and there is no Allow for termination.

Answer

The user can stop any instance but cannot terminate any instance

Answer

The user can stop only production-tagged instances and terminate only production-tagged instances

Answer

The user can stop any instance and terminate any instance

Question 11

A cloud architect is designing a multi-tier web application that must handle sudden traffic spikes. The application layer is stateless, and the database layer is read-heavy with occasional writes. Which design best meets the requirement for elasticity and cost efficiency?

Accepted Answer

Use auto-scaling for the application tier and read replicas for the database. Option A is correct because auto-scaling the stateless application tier dynamically adds or removes instances based on CPU or request metrics, directly handling traffic spikes without over-provisioning. For the read-heavy database tier, read replicas offload SELECT queries from the primary database, improving read throughput and cost efficiency by scaling horizontally only when needed, while the primary handles occasional writes.

Answer

Implement auto-scaling for the database tier and use a larger application instance

Answer

Use a load balancer to distribute traffic to multiple database instances

Answer

Deploy large application and database instances to handle peak load

Question 12

A company operates a hybrid cloud environment with on-premises servers and a public cloud provider. They use AWS for compute and storage. Their application requires low-latency access to on-premises databases. They set up a Direct Connect link between their data center and AWS. Recently, users report slow application performance. Cloud engineers notice increased latency on the Direct Connect link. The on-premises network team confirms no issues with their internal network. The application uses jumbo frames on the on-premises side for optimized performance. The virtual interface on the AWS side is configured with a default MTU of 1500. Which of the following is the MOST likely cause of the increased latency?

Accepted Answer

The MTU on the virtual interface is set to 1500, causing fragmentation and reassembly delays.. The application uses jumbo frames on-premises, but the AWS virtual interface defaults to an MTU of 1500. When packets larger than 1500 bytes traverse the Direct Connect link, they must be fragmented at the on-premises router and reassembled at the AWS side. This fragmentation and reassembly process introduces significant processing overhead and latency, which explains the reported slow performance.

Answer

The on-premises router has not configured BGP graceful restart for the Direct Connect session.

Answer

The cloud provider's routing table has not propagated the latest on-premises prefixes, causing traffic to take a suboptimal path.

Answer

The Direct Connect link bandwidth is oversubscribed, causing packet loss and retransmission delays.

Question 13

During a deployment using a script, an administrator receives a 'Permission Denied' error. What is the most likely cause?

Accepted Answer

The service account lacks necessary IAM roles. Option A is correct because the service account may not have the required IAM roles to execute the actions. Option B is wrong because region does not affect permissions. Option C is wrong because storage issues cause different errors. Option D is wrong because network latency does not cause permission errors.

Answer

Network latency is causing timeouts

Answer

The deployment is targeting the wrong region

Answer

The instance has insufficient storage

Question 14

A company is deploying a containerized microservices architecture on Azure Kubernetes Service (AKS). The security team requires that all container images are scanned for vulnerabilities before deployment. Which deployment approach should the DevOps team implement to ensure only approved images are used?

Accepted Answer

Enable Azure Container Registry tasks for automatic vulnerability scanning and enforce with Azure Policy.. Option C is correct because Azure Container Registry (ACR) Tasks can automatically scan images for vulnerabilities using Microsoft Defender for Cloud, and Azure Policy can enforce that only images from approved registries or with passing scan results are deployed to AKS. This ensures that all container images are scanned before deployment and that only compliant images are used, meeting the security team's requirement.

Answer

Store all images in a private registry without any scanning.

Answer

Use Docker Content Trust to sign images and verify signatures during deployment.

Answer

Deploy an admission controller that checks image signatures only.

Question 15

What is the primary benefit of using Infrastructure as Code (IaC)?

Accepted Answer

Consistent and repeatable deployments. Option C is correct because IaC ensures consistent and repeatable deployments by defining infrastructure in code. Option A is wrong while improved network performance is not a direct benefit. Option B is wrong because IaC may reduce costs through automation but consistency is key. Option D is wrong because manual control is the opposite of automation.

Answer

Improved network performance

Answer

Full manual control over resources

Answer

Lower cloud service costs