CV0-004 Practice Test 15 — 15 Questions

Question 1

A DevOps team is deploying a containerized application to Google Kubernetes Engine (GKE). The team wants to automate the deployment of the application along with its dependencies, such as ConfigMaps and Services, using a single package. Which tool should the team use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Helm charts. Helm is the de facto package manager for Kubernetes and bundles all related manifests — Deployments, Services, ConfigMaps, Secrets, Ingress — into a single versioned chart that can be installed, upgraded, and rolled back with one command. This directly matches the requirement to deploy an application and its dependencies as a single package. Helm also supports templating and values files for environment-specific configuration.

Answer

kubectl apply with multiple manifest files

Answer

Kustomize overlays

Answer

Docker Compose

Question 2

A cloud architect is designing a disaster recovery plan for a critical application with an RTO of 15 minutes and an RPO of 1 minute. The application runs on AWS EC2 instances with data stored on EBS volumes. Which replication strategy best meets these requirements?

Accepted Answer

Continuous replication using AWS Elastic Disaster Recovery. An RPO of 1 minute requires near-continuous data replication, which AWS Elastic Disaster Recovery (DRS) provides by continuously replicating block-level changes from source EC2/EBS to a staging area in the target region. Snapshots every hour (RPO up to 60 min) and daily AMIs (RPO up to 24 h) cannot meet a 1-minute RPO. S3 CRR is irrelevant because the data lives on EBS, not S3.

Answer

EBS snapshots replicated to another region every hour

Answer

Daily AMI backups stored in a different region

Answer

Cross-region replication of S3 buckets

Question 3

A cloud engineer wants to receive real-time notifications when a CloudWatch Alarm enters the ALARM state. Which notification channel can be configured directly within the CloudWatch Alarm action?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon CloudWatch Alarms natively support Amazon SNS topics as an alarm action — when the alarm transitions to ALARM state, CloudWatch publishes a message to the configured SNS topic, which then fans out to email, SMS, Lambda, SQS, or HTTP endpoints. SNS is the only notification channel that can be configured directly in the alarm's action list without additional integration services.

Answer

PagerDuty

Answer

AWS Chatbot

Answer

Slack webhook

Question 4

A company is experiencing intermittent connectivity issues between its on-premises data center and a public cloud environment over a VPN connection. Which TWO of the following should the administrator check to troubleshoot the problem?

Accepted Answer

Validate the route tables on both sides of the VPN.. Option B is correct because intermittent VPN connectivity is frequently caused by asymmetric or missing routes, so validating the route tables on both the on-premises and cloud sides ensures traffic is being forwarded to the correct tunnel and subnet. Option E is correct because reviewing VPN logs and monitoring packet loss reveals tunnel renegotiation failures, IKE/IPsec errors, or dropped packets that directly explain intermittent connectivity. Options A, C, and D are not the best choices: bandwidth may affect performance but not intermittent drops, cloud storage performance is unrelated to VPN transport, and DNS resolution issues would typically cause name resolution failures rather than intermittent tunnel connectivity.

Answer

Verify that the internet bandwidth is sufficient.

Answer

Ensure the cloud storage performance is adequate.

Answer

Check the DNS resolution of cloud endpoints.

Question 5

A cloud administrator notices that a virtual machine is unresponsive. The VM is running on a hypervisor host that shows high CPU utilization. What should the administrator do first?

Accepted Answer

Check the VM console for OS-level issues. The first step in troubleshooting an unresponsive VM is to check the VM console for OS-level issues. This allows the administrator to see if the OS is hung, has a kernel panic, or is waiting for input. Option A is wrong because rebooting the hypervisor host would affect all VMs and is a drastic measure that should only be taken after other diagnostics. Option B is wrong because increasing the VM's vCPU count does not address the root cause of unresponsiveness and could worsen resource contention on an already overloaded host. Option C is wrong because migrating the VM to another host is premature without first determining if the issue is OS-related; also, migration might not be possible if the VM is completely unresponsive.

Answer

Reboot the hypervisor host

Answer

Increase the VM's vCPU count

Answer

Migrate the VM to another host

Question 6

A cloud administrator is troubleshooting a performance issue where an application occasionally experiences high latency. The application runs on AWS and uses EC2, ELB, and RDS. Which combination of tools would best help trace the request flow and identify the bottleneck?

Accepted Answer

AWS X-Ray and VPC Flow Logs. AWS X-Ray traces requests through the application, including calls to downstream services like RDS, and VPC Flow Logs capture IP traffic to and from network interfaces, helping identify network-level bottlenecks. Together, they provide end-to-end visibility from the request entry point to the database and network layer. This combination is best for tracing request flow and pinpointing latency issues.

Answer

AWS Trusted Advisor and AWS Personal Health Dashboard

Answer

Amazon CloudWatch Logs and AWS Shield

Answer

AWS CloudTrail and AWS Config

Question 7

A cloud administrator receives an alert that the CPU utilization on a production web server has exceeded 90% for the past hour. The administrator checks the metrics and sees that the request rate has increased. Which of the following is the MOST appropriate action to resolve the issue in the short term?

Accepted Answer

Increase the number of vCPUs or add additional instances behind a load balancer.. Increasing the number of vCPUs or adding additional instances behind a load balancer directly addresses the high CPU utilization caused by increased request rate. This scales the compute resources horizontally or vertically to handle the load, which is the most immediate and effective short-term action for a production web server under sustained high traffic.

Answer

Increase the memory allocation for the virtual machine.

Answer

Implement rate limiting to reduce incoming requests.

Answer

Optimize the application code to reduce CPU usage.

Question 8

A company is designing a hybrid cloud architecture connecting their on-premises data center to AWS. Which TWO options provide dedicated, private network connectivity? (Select TWO.)

Accepted Answer

Site-to-Site VPN. AWS Direct Connect provides dedicated private connection, and VPN over the internet can also be private if encrypted, but it's not dedicated. Site-to-Site VPN is a valid private connectivity option. Internet gateway is public, VPC peering is between VPCs, not on-premises.

Answer

Internet gateway

Answer

VPC peering

Answer

NAT gateway

Question 9

A company uses a hybrid cloud model with an AWS Direct Connect connection to its on-premises network. Users report intermittent connectivity to cloud resources. A network engineer finds packet loss on the Direct Connect virtual interface. Which of the following should be checked FIRST to resolve the issue?

Accepted Answer

The BGP session status between the on-premises router and the AWS Direct Connect endpoint. Intermittent packet loss on a Direct Connect virtual interface is most commonly caused by BGP session flapping or misconfiguration, as BGP is the routing protocol that establishes and maintains connectivity between the on-premises router and the AWS Direct Connect endpoint. Checking the BGP session status first allows the engineer to quickly identify if the issue is due to route advertisement problems, hold timer mismatches, or session resets, which are frequent root causes of intermittent packet loss.

Answer

The physical port status of the Direct Connect router

Answer

The MTU setting on the on-premises firewall

Answer

The VPN tunnel status for the Direct Connect link

Question 10

Refer to the exhibit. A cloud load balancer is returning 502 Bad Gateway errors to clients. What is the most likely cause?

Accepted Answer

The backend web servers are not responding correctly.. A 502 Bad Gateway error indicates that the load balancer (acting as a proxy or gateway) received an invalid or no response from the upstream backend web servers. This typically occurs when the backend servers are overloaded, have crashed, or are misconfigured (e.g., incorrect health check path, application pool failure). The load balancer successfully forwards the request but fails to get a valid HTTP response, triggering the 502 error.

Answer

The load balancer's SSL certificate is invalid.

Answer

The security group allows inbound traffic from the load balancer.

Answer

The DNS record points to the wrong IP.

Question 11

A cloud administrator is investigating a sudden increase in cost for a production environment. The administrator wants to identify the sources of the cost increase and implement a tagging strategy for cost allocation. Which TWO actions should the administrator take? (Choose two.)

Accepted Answer

Use the cloud provider's cost explorer to analyze cost drivers.. Option B is correct because the cloud provider's cost explorer (e.g., AWS Cost Explorer or Azure Cost Management) lets the administrator visualize and filter spending by service, account, region, and tag, which directly identifies the sources of the sudden cost increase. Option C is correct because enabling detailed billing reports (such as AWS Cost and Usage Report or Azure detailed usage data) with resource tags activated provides granular, per-resource cost and usage data that is required to build and validate a tag-based cost allocation strategy. Option A is not correct because a rightsizing recommendation report only suggests instance size or type changes and does not analyze cost drivers or enable tag-based allocation. Option D is not correct because purchasing Reserved Instances for all resources is a commitment-based discount action, not an investigation or tagging strategy, and could increase risk if usage changes. Option E is not correct because a budget alert only notifies when total monthly cost crosses a threshold; it does not identify cost sources or implement tagging for allocation.

Answer

Implement a rightsizing recommendation report.

Answer

Purchase Reserved Instances for all resources.

Answer

Create a budget alert for the total monthly cost.

Question 12

A cloud engineer is tasked with setting up a disaster recovery (DR) plan for a critical application that runs on virtual machines in a private cloud. The DR site is a public cloud. The application requires low recovery time objective (RTO) of less than 15 minutes and recovery point objective (RPO) of less than 5 minutes. Which of the following replication strategies BEST meets these requirements?

Accepted Answer

Use continuous asynchronous replication to the DR site.. Continuous asynchronous replication replicates data changes to the DR site with minimal lag (often seconds), meeting an RPO of under 5 minutes while allowing recovery within the 15-minute RTO. It is the standard approach for cross-cloud DR where synchronous replication is impractical due to WAN latency. This strategy balances low RPO/RTO with the realities of replicating from a private cloud to a public cloud.

Answer

Replicate virtual machine images to the DR site daily.

Answer

Use synchronous replication to keep data identical.

Answer

Configure agent-based backup to the DR site every 5 minutes.

Question 13

A cloud administrator needs to deploy a new application that requires a static IP address. The administrator is using a cloud provider that allows the reservation of elastic IP addresses. Which deployment step should be taken to ensure the IP address is not lost when the resource is stopped?

Accepted Answer

Allocate an elastic IP address and associate it with the resource.. Elastic IP addresses are static public IPv4 addresses that you can allocate to your account and associate with a resource. When you associate an elastic IP with an instance, it persists even if the instance is stopped, because the IP is reserved in your account until you explicitly release it. This ensures the IP address is not lost when the resource is stopped, unlike ephemeral public IPs that change on stop/start.

Answer

Configure the instance to obtain an IP via DHCP.

Answer

Assign a private IP address from a reserved range.

Answer

Set up an external DNS service to point to the public IP.

Question 14

A security administrator needs to enforce least privilege for a Kubernetes cluster in a cloud environment. Which approach should be used to restrict permissions for pods that need to access the cloud provider's API?

Accepted Answer

Use a service account with a role that has only the required permissions. In Kubernetes, pods assume a Kubernetes service account, and cloud providers support mapping that service account to a cloud IAM role via workload identity (for example, IRSA on EKS or Workload Identity on GKE/AKS). This lets the pod obtain short-lived credentials scoped to only the permissions in the role, enforcing least privilege without embedding static credentials.

Answer

Assign the pod a static cloud IAM user credential

Answer

Disable cloud API access for all pods

Answer

Grant the pod cluster-admin privileges in Kubernetes

Question 15

A company uses a cloud-based logging service to aggregate logs from multiple servers. Suddenly, the logging service stops receiving logs from several servers. The administrator checks the logging agent status on those servers and finds that the agents are running but not sending data. The network connectivity between the servers and the logging service is verified as working. Which of the following is the MOST likely cause?

Accepted Answer

The logging endpoint configuration on the agents is incorrect.. The logging agents are running but not sending data, and network connectivity is verified as working. This points to a configuration issue where the agents are pointing to an incorrect logging endpoint (e.g., wrong URL, port, or API key). Even if the service is healthy, misconfigured agents will fail to transmit logs, which matches the symptom of agents running but idle.

Answer

The logging service has reached its storage quota.

Answer

The logging agent is out of memory.

Answer

A firewall is blocking the outbound traffic from the servers.