CV0-004 Practice Test 15 — 15 Questions

Question 1

A company is designing a hybrid cloud storage solution. Which TWO storage services are suitable for a shared file system accessible from both on-premises and cloud VMs? (Select TWO.)

Accepted Answer

Azure Files. File storage services like Amazon EFS and Azure Files provide shared file systems accessible over NFS or SMB. Block and object storage are not typically used as shared file systems.

Answer

Azure Blob

Answer

Amazon S3

Answer

Amazon EBS

Question 2

A company uses a cloud provider's container orchestration service (e.g., EKS, AKS, GKE) to run a set of microservices. The current cluster uses three worker nodes, each of size m5.large (2 vCPU, 8 GB RAM). The operations team notices that CPU utilization on the worker nodes averages 80% during peak hours, and some pods are being evicted due to resource pressure. The team wants to ensure that the cluster can handle a 50% increase in traffic without performance degradation. Which action should the cloud architect take?

Accepted Answer

Create a new node pool using a larger instance type, such as m5.xlarge, and migrate the pods. The current nodes are already at 80% CPU utilization during peak hours, and a 50% traffic increase would push them to 120% utilization, causing severe performance degradation and pod evictions. Scaling to a larger instance type (m5.xlarge with 4 vCPU, 16 GB RAM) doubles the available resources per node, providing sufficient headroom to absorb the traffic spike without requiring additional nodes or architectural changes. This directly addresses the resource pressure by increasing the capacity per node, which is more efficient than scaling out horizontally when the existing node type is already saturated.

Answer

Configure horizontal pod autoscaling to scale out pods automatically

Answer

Implement cluster autoscaler to add more nodes of the same type during peak

Answer

Reduce the CPU and memory requests in the pod specifications to allow more pods per node

Question 3

A company is experiencing increased traffic to its web application. They want to handle the load by adding more web server instances behind a load balancer. This approach is known as:

Accepted Answer

Horizontal scaling. Horizontal scaling (scaling out) adds more instances to distribute the load, as opposed to vertical scaling which adds resources to a single instance.

Answer

Stateless design

Answer

Auto-scaling

Answer

Vertical scaling

Question 4

A deployment fails with a message about missing dependencies. What should the administrator check first?

Accepted Answer

Review the deployment logs to identify missing packages. When a deployment fails with a 'missing dependencies' message, the first step is to review the deployment logs. Logs will contain specific error messages indicating which packages or libraries are absent, allowing the administrator to install them directly. This aligns with standard troubleshooting methodology: identify the root cause from logs before taking corrective action.

Answer

Change the instance type to one with more memory

Answer

Reinstall the operating system

Answer

Restart the server and retry the deployment

Question 5

A company runs an e-commerce platform on a public cloud. The architecture consists of a front-end load balancer, a web server tier, and an RDS database. The web servers are in an auto-scaling group across two availability zones. The database is a single Multi-AZ deployment. After a recent traffic surge, the web servers scaled but the database CPU utilization reached 90%, causing slow page loads. The database is a db.r5.large instance with 16 GB RAM and 2 vCPUs. The company expects double the traffic during the upcoming holiday season. The budget is limited. Which action should the cloud architect take to address the database bottleneck while minimizing cost?

Accepted Answer

Add read replicas of the database and configure the application to use them for read queries; implement auto-scaling for read replicas based on average CPU utilization. Adding read replicas offloads read queries from the primary database, reducing CPU utilization. Auto-scaling read replicas based on average CPU utilization ensures cost efficiency by scaling only when needed, which aligns with the limited budget and expected traffic surge. This approach directly addresses the bottleneck without requiring a costly instance upgrade or complex sharding.

Answer

Implement a fully managed caching layer, such as ElastiCache, in front of the database

Answer

Separate the database into multiple smaller databases using sharding

Answer

Upgrade the database to a larger instance type, such as db.r5.2xlarge

Question 6

A cloud administrator needs to deploy a web application in a public cloud. The application must automatically scale out based on CPU utilization and scale in during low demand. Which of the following is the BEST approach?

Accepted Answer

Configure an auto scaling group with a scaling policy based on average CPU utilization. An auto scaling group with a scaling policy based on average CPU utilization is the best approach because it dynamically adjusts the number of instances in response to real-time demand. This method uses CloudWatch metrics to trigger scale-out when CPU exceeds a threshold (e.g., 70%) and scale-in when it drops, ensuring the application remains responsive while minimizing cost during low usage.

Answer

Use a script to increase the instance size when CPU exceeds 80%

Answer

Implement scheduled scaling to add instances during business hours

Answer

Create a load balancer and manually add instances during peak hours

Question 7

A company uses a cloud load balancer to distribute traffic to web servers. The load balancer health checks are failing for all instances. The instances are running and can be accessed directly via their private IPs from within the VPC. What is the most likely cause?

Accepted Answer

The security group of the instances is not allowing traffic from the load balancer.. The most likely cause is that the security group attached to the web server instances does not include an inbound rule allowing traffic from the load balancer's source IP addresses or the load balancer's security group. Even though the instances are healthy and reachable via private IPs from within the VPC, the load balancer's health check probes (typically HTTP/HTTPS or TCP) are blocked by the instance-level firewall, causing all health checks to fail.

Answer

The load balancer's cross-zone load balancing is disabled.

Answer

The load balancer's listeners are configured on the wrong ports.

Answer

The instances are not registered with the target group.

Question 8

A company is experiencing intermittent performance issues in a microservices application. Which TWO tools can help diagnose latency problems through distributed tracing? (Choose TWO)

Accepted Answer

Azure Application Insights. AWS X-Ray and Azure Application Insights provide distributed tracing capabilities.

Answer

AWS CloudWatch Logs

Answer

Azure Monitor

Answer

AWS CloudTrail

Question 9

A company running a critical web application wants to protect against SQL injection and cross-site scripting attacks. The application is behind a load balancer. Which type of service should be deployed to provide this protection?

Accepted Answer

Web application firewall (WAF). A web application firewall (WAF) is designed to protect web applications from common web exploits like SQL injection and cross-site scripting. It can be integrated with load balancers to inspect HTTP/HTTPS traffic and filter malicious requests based on customizable rules. This makes it the correct choice for the described threat scenario.

Answer

Network firewall

Answer

DDoS protection service

Answer

Intrusion detection system

Question 10

A cloud administrator needs to audit all API calls made in a GCP project for compliance purposes. Which service should be enabled to log these actions?

Accepted Answer

GCP Cloud Audit Logs. Cloud Audit Logs in GCP record administrative activities and data access. CloudTrail is AWS-specific, Azure Monitor is for Azure, and Security Command Center is a security dashboard.

Answer

Azure Monitor

Answer

GCP Security Command Center

Answer

AWS CloudTrail

Question 11

An organization uses AWS and wants to control inbound traffic to its EC2 instances. They need a solution that automatically allows response traffic for any permitted inbound request. Which of the following should they use?

Accepted Answer

Security groups. Security groups are stateful, meaning if you allow inbound traffic, the response is automatically allowed regardless of outbound rules. Network ACLs are stateless and require explicit rules for both directions.

Answer

DDoS protection

Answer

Web Application Firewall

Answer

Network ACLs

Question 12

A cloud architect needs to ensure that all data transmitted between an on-premises data center and a cloud VPC is encrypted. Which solution should be implemented?

Accepted Answer

VPN Gateway. A VPN connection encrypts traffic in transit using IPsec tunnels.

Answer

Security group

Answer

Cloud KMS

Answer

Direct Connect

Question 13

A DevOps team is deploying containerized applications on Kubernetes. They want to ensure containers do not run with root privileges and that host filesystem access is restricted. Which Kubernetes feature should they use?

Accepted Answer

Pod Security Standards. Pod Security Standards (PSS) define security levels (privileged, baseline, restricted) to enforce security policies on pods, such as disallowing root access and restricting host filesystem access.

Answer

Service accounts

Answer

ConfigMaps

Answer

Network policies

Question 14

A security engineer is reviewing IAM policies and notices a policy that allows all actions on all resources for a user. Which principle of security is being violated?

Accepted Answer

Least privilege. The principle of least privilege states that users should be granted only the permissions necessary to perform their job functions.

Answer

Separation of duties

Answer

Need to know

Answer

Defense in depth

Question 15

A company has deployed a containerized application on a Kubernetes cluster. The security team wants to ensure that containers cannot run as the root user and that the container's root filesystem is read-only. Which Kubernetes security mechanism should be used?

Accepted Answer

Pod Security Standards. Pod Security Standards (PSS) provide predefined security profiles (privileged, baseline, restricted) that enforce policies like running as non-root and read-only root filesystem.

Answer

Network policies

Answer

Seccomp profiles

Answer

Resource quotas