CV0-004 Practice Test 17 — 15 Questions

Question 1

A company is migrating its on-premises applications to a public cloud. The security team wants to ensure that the cloud provider is responsible for physical security of data centers, while the company remains responsible for securing guest operating systems. Which concept does this describe?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Shared responsibility model. The shared responsibility model delineates security obligations between the cloud provider (physical infrastructure, hypervisor) and the customer (OS, applications, IAM).

Answer

Least privilege principle

Answer

Zero Trust architecture

Answer

Defense in depth

Question 2

A company's compliance team must provide evidence that their cloud environment meets PCI DSS requirements. Which AWS service can aggregate security findings and automate compliance checks?

Accepted Answer

AWS Security Hub. AWS Security Hub provides a comprehensive view of security alerts and compliance status across AWS accounts, including automated checks against standards like PCI DSS.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 3

A cloud engineer is troubleshooting an issue where an application running in a container on a Kubernetes cluster is unable to resolve DNS names. The cluster uses CoreDNS. The engineer checks the CoreDNS pod logs and sees no errors. Which of the following should the engineer check next?

Accepted Answer

The container's /etc/resolv.conf file. The container's /etc/resolv.conf file. In Kubernetes, pods use the DNS configuration specified in their /etc/resolv.conf, which should point to the CoreDNS service IP. If this file is misconfigured (e.g., due to a custom pod DNS policy or a problem with the kubelet), DNS resolution will fail. The CoreDNS pod logs show no errors, indicating CoreDNS is running fine, so the issue is likely in how the pod is configured to contact CoreDNS. Option A (checking the Kubernetes DNS service IP) is not the next step because the DNS service IP is typically correct; the problem is whether the pod is using it. Option C (checking the cloud provider's DNS resolver settings) is for external DNS resolution, not for internal cluster DNS. Option D (checking network policies) would cause traffic to be dropped entirely, not just DNS, and would likely show in logs or other symptoms.

Answer

The Kubernetes DNS service IP address

Answer

The cloud provider's DNS resolver settings

Answer

The network policy for the namespace

Question 4

A company uses a hybrid cloud model and experiences intermittent connectivity issues between the on-premises network and the public cloud VPC. The administrator has verified that the VPN connection is established. Which of the following should the administrator check next?

Accepted Answer

Routing tables on both sides.. Since the VPN connection is established (tunnel is up), the issue is likely with traffic routing rather than basic connectivity. Routing tables on both the on-premises router and the cloud VPC must have correct routes pointing to the VPN gateway and the remote subnets; a missing or misconfigured route (e.g., a missing static route or incorrect VPC route table entry) will cause intermittent connectivity even when the VPN tunnel itself is active.

Answer

Firewall rules for outbound traffic.

Answer

Public IP address of the VPN gateway.

Answer

DNS resolution of cloud endpoints.

Question 5

A company hosts its critical applications on a cloud provider's virtual machines within a virtual private cloud. The security team receives an alert from the intrusion detection system indicating that one of the VMs is exhibiting signs of a ransomware infection. The administrator connects to the VM via a bastion host and observes that several important files have been encrypted and a ransom note has been left. The incident response plan is still being developed, but the administrator knows the immediate priority is to contain the threat and prevent it from spreading to other VMs and storage resources. The company has daily backups stored in a separate cloud storage service that is not directly accessible from the production network. Which of the following actions should the administrator take FIRST to contain the incident and minimize further damage?

Accepted Answer

Immediately disconnect the network interface of the infected VM.. Isolating the infected VM by disconnecting its network interface stops the ransomware from communicating with command-and-control servers and prevents lateral movement. Restoring from backup without verification may reintroduce the infection. Notifying law enforcement is important but not the first step. Running antivirus on the active VM could trigger further encryption or be ineffective.

Answer

Restore the VM from the most recent backup.

Answer

Notify law enforcement about the ransomware attack.

Answer

Run a full antivirus scan on the infected VM.

Question 6

Which encryption standard is most commonly used for data at rest in cloud storage services?

Accepted Answer

AES-256. AES-256 is the industry standard for encrypting data at rest in cloud environments.

Answer

Blowfish

Answer

DES

Answer

RSA

Question 7

A DevOps team deploys a containerized application to a Kubernetes cluster. They need to ensure that containers cannot run with privileged access. Which Kubernetes security mechanism should be applied?

Accepted Answer

Pod Security Standards. Pod Security Standards define policies like 'restricted' that prevent privileged containers.

Answer

Network policies

Answer

ConfigMaps

Answer

Service accounts

Question 8

A company is deploying a critical financial application on a private cloud. The compliance team requires that all data at rest be encrypted with a key managed by the company's hardware security module (HSM). The cloud architect must select a storage solution that supports customer-managed keys and integrates with the existing HSM. Which storage option should the architect choose?

Accepted Answer

Encrypted volumes on a software-defined storage (SDS) cluster. A software-defined storage (SDS) cluster can be configured to use customer-managed encryption keys that integrate directly with the company's existing hardware security module (HSM) via standard interfaces like PKCS#11 or KMIP. This allows the company to maintain full control over key management and meet the compliance requirement for data-at-rest encryption with HSM-managed keys.

Answer

Object storage with server-side encryption using a cloud provider key

Answer

Instance store volumes on the compute nodes

Answer

Network-attached storage (NAS) appliance with built-in encryption

Question 9

A cloud administrator manages a hybrid cloud environment where on-premises servers connect to a VPC in AWS via a VPN connection. The on-premises network uses IP range 10.0.0.0/16. The VPC uses 172.16.0.0/16. The VPN is established and the tunnel status is UP. However, on-premises hosts cannot ping EC2 instances in the VPC. The administrator logs into an EC2 instance and can ping the on-premises VPN gateway IP. The security groups and network ACLs are configured to allow all traffic. The route tables in the VPC have a route to the on-premises network via the virtual private gateway. The on-premises firewall logs show that packets from the VPC are being dropped. What is the most likely cause?

Accepted Answer

The on-premises firewall is blocking traffic from the VPC CIDR range.. The on-premises firewall logs explicitly show that packets from the VPC are being dropped, indicating the firewall is filtering traffic from the VPC CIDR range (172.16.0.0/16). Since the VPN tunnel is UP, the EC2 instance can ping the on-premises VPN gateway IP, and security groups/network ACLs allow all traffic, the only remaining point of failure is the on-premises firewall blocking the return traffic.

Answer

The VPN tunnel is misconfigured and not passing traffic.

Answer

The security group attached to the EC2 instance is blocking inbound ICMP.

Answer

The VPC route table does not have a route to the on-premises network.

Question 10

A cloud architect is evaluating deployment strategies for a microservices application that requires high availability and minimal downtime during updates. Which TWO deployment methods should the architect consider?

Accepted Answer

Rolling deployment. Both rolling deployment (B) and blue/green deployment (E) are suitable for microservices applications requiring high availability and minimal downtime during updates. Rolling deployment updates instances incrementally, replacing old versions with new ones in batches while keeping the application available. Blue/green deployment maintains two identical environments (blue and green), allowing traffic to be switched instantly from the old version to the new version, thus minimizing downtime. These strategies align with the requirements for high availability and minimal downtime.

Answer

Immutable deployment

Answer

In-place deployment

Answer

Canary deployment

Question 11

A financial services company must store sensitive customer data in the cloud. The compliance team requires that data at rest be encrypted using customer-managed keys (CMK), and that the keys are rotated every 90 days. Additionally, the cloud provider must not have access to the keys. Which key management solution should the company choose?

Accepted Answer

Use a dedicated HSM (hardware security module) with automated key rotation. A dedicated HSM provides a tamper-resistant hardware appliance where the customer exclusively controls the encryption keys, ensuring the cloud provider has no access. Automated key rotation policies can be configured on the HSM to meet the 90-day rotation requirement, satisfying both the CMK and provider non-access mandates.

Answer

Store the encryption keys in the cloud provider's parameter store with rotation policy

Answer

Use the cloud provider's default server-side encryption with a managed key

Answer

Implement client-side encryption using a third-party key management service

Question 12

A cloud administrator is troubleshooting an application that fails to connect to a database. The application and database are in the same VPC. Which THREE steps should the administrator take to diagnose the issue?

Accepted Answer

Test connectivity to the database using a telnet or netcat command from the application server.. Telnet or netcat can test basic TCP connectivity to the database port, confirming whether the database is reachable from the application server at the network layer. This step isolates whether the issue is a network connectivity problem versus an authentication or configuration issue within the database itself.

Answer

Check the routing table for a route to the internet.

Answer

Check the DNS resolution of the database endpoint in the application's subnet.

Question 13

A company must migrate 50 TB of data from an on-premises NFS server to Amazon S3 within one week. The network bandwidth averages 50 Mbps. The administrator is evaluating AWS DataSync and AWS Snowball. Which service should the administrator choose?

Accepted Answer

AWS Snowball. At 50 Mbps, transferring 50 TB would take about 95 days, exceeding the one-week deadline. Snowball provides offline physical transfer, making it feasible within a week.

Answer

AWS DataSync

Answer

S3 Transfer Acceleration

Answer

AWS Database Migration Service

Question 14

An organization uses Azure DevOps for CI/CD. They need to deploy a Bicep template that creates resources in multiple Azure regions. The deployment must be idempotent and handle dependencies between resources. Which Azure DevOps task should they use?

Accepted Answer

Azure Resource Group Deployment task. The Azure Resource Group Deployment task in Azure DevOps can deploy ARM/Bicep templates and handle resource dependencies and idempotency through Azure Resource Manager.

Answer

Azure PowerShell task with New-AzResourceGroupDeployment

Answer

Azure File Copy task

Answer

Azure CLI task with az deployment group create

Question 15

A cloud engineer is designing a deployment strategy for a web application that requires zero downtime. The engineer has set up two identical production environments, one active and one idle. After deploying the new version to the idle environment, the engineer switches the DNS record to point to the idle environment. This deployment method is known as:

Accepted Answer

Blue/green deployment. Blue/green deployment involves two environments (blue = current, green = new) and switching traffic via DNS or load balancer. Canary and rolling deploy gradually, while A/B testing is for feature comparison.

Answer

Rolling deployment

Answer

A/B testing deployment

Answer

Canary deployment