CV0-004 Practice Test 17 — 15 Questions

Question 1

During a cloud deployment, a virtual machine is created from a custom image. After boot, the VM is not accessible via SSH. Which of the following should the administrator check FIRST?

Accepted Answer

The security group rules for inbound SSH. The most common reason a newly deployed VM is inaccessible via SSH is that the security group or network ACL does not permit inbound TCP port 22 traffic. Security groups act as a virtual firewall at the instance level, and if the rule allowing SSH from the administrator's IP is missing or misconfigured, the connection will be refused. This should be the first check because it is a frequent misconfiguration during deployment.

Answer

The boot volume is encrypted

Answer

The hypervisor version compatibility

Answer

The image's OS license activation status

Question 2

A company is implementing a cloud-based SIEM solution. Which TWO of the following are essential data sources that should be integrated to ensure comprehensive security monitoring?

Accepted Answer

DNS query logs from the cloud DNS service.. Option D is correct because DNS query logs from the cloud DNS service provide visibility into domain resolution activity, enabling detection of malicious domains, DNS tunneling, and command-and-control beaconing that other telemetry may miss. Option E is correct because network flow logs from virtual network appliances capture IP-level metadata (source/destination, ports, protocol, bytes) across cloud traffic, which is essential for identifying lateral movement, exfiltration, and anomalous communication patterns in a SIEM. Option A is not essential for a cloud-based SIEM since physical data center access logs pertain to on-premises facility security rather than cloud workload or network activity. Option B is not a continuous monitoring data source; firewall configuration backups are static artifacts useful for compliance or change auditing, not real-time event correlation. Option C is irrelevant to security monitoring because employee vacation schedules have no bearing on detecting threats or correlating security events.

Answer

Physical access logs from the data center.

Answer

Firewall configuration backup files.

Answer

Employee vacation schedule.

Question 3

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The team wants to isolate each build job to avoid interference. Which cloud concept should be utilized?

Accepted Answer

Containerization with orchestration. Containerization with orchestration (e.g., Docker and Kubernetes) provides isolated runtime environments for each build job by packaging the application and its dependencies into lightweight containers. This ensures that build processes do not interfere with each other, as each container runs in its own isolated user space with dedicated resources, and orchestration manages scheduling, scaling, and lifecycle. This approach is ideal for CI/CD pipelines in microservices architectures where build isolation is critical.

Answer

Dedicated hosts

Answer

Virtual private cloud (VPC)

Answer

Serverless functions

Question 4

A cloud administrator receives an alert that a virtual machine has unexpectedly shut down. The administrator checks the hypervisor logs and finds an entry "Out of memory: killed process" in the VM's OS logs. Which of the following is the most likely cause?

Accepted Answer

The VM has a memory leak in its application.. The log entry 'Out of memory: killed process' indicates that the Linux kernel's Out-Of-Memory (OOM) killer terminated a process to free memory. This is typically triggered when the system runs out of available memory, often due to a memory leak in an application consuming memory over time without releasing it. While hypervisor-level issues can cause VM instability, the specific OOM killer message points to a guest OS-level memory exhaustion problem, making a memory leak the most likely cause.

Answer

The hypervisor memory overcommitment is too high.

Answer

The VM's memory balloon driver is not installed.

Answer

The VM's swap space is insufficient.

Question 5

A company wants to automate the deployment of cloud resources using code. Which tool is BEST suited for this purpose?

Accepted Answer

Infrastructure as Code (IaC) templates. Infrastructure as Code (IaC) templates (Option C) are the best tool for automating cloud resource deployment because they allow you to define, version, and provision infrastructure through machine-readable definition files. Tools like Terraform, AWS CloudFormation, or Azure Resource Manager templates enable repeatable, consistent deployments without manual intervention, directly aligning with the goal of automating cloud resource deployment using code.

Answer

SSH

Answer

An IP address management tool

Answer

A configuration management database

Question 6

A cloud architect is designing a web application that must remain available during a full region outage. They plan to deploy identical resources in two separate geographical regions. Which high availability architecture is described?

Accepted Answer

Active-active. Active-active is the correct architecture because it deploys identical resources in two or more regions simultaneously, with both regions actively serving traffic. This provides high availability and load distribution, and if one region fails, the other continues to handle requests without interruption. This is the only option that describes both regions actively running and serving users at the same time.

Answer

Cold standby

Answer

Active-passive

Answer

Warm standby

Question 7

A cloud administrator is responsible for ensuring the availability of a critical application that runs on a virtual machine. The administrator needs to implement a solution that can automatically restart the virtual machine if it becomes unresponsive due to an operating system crash. Which of the following should the administrator configure?

Accepted Answer

A VM group configured with automatic recovery. Configuring automatic recovery for the VM (or a group of VMs) allows the cloud platform to detect a VM failure and automatically restart it. This is a feature provided by most cloud providers to ensure high availability.

Answer

A snapshot-based backup policy

Answer

A load balancer with a health probe

Answer

A custom script that sends a heartbeat to a monitoring service

Question 8

A developer wants to deploy an application using Azure Bicep. What is a key benefit of using Bicep over ARM templates?

Accepted Answer

Bicep has simpler, more readable syntax than ARM JSON. Bicep is a domain-specific language that provides a cleaner, more readable, and more concise syntax than ARM JSON templates. It abstracts away much of the JSON boilerplate, such as parameters, variables, and resource declarations, while still compiling to ARM JSON for deployment. This makes authoring and maintaining infrastructure-as-code easier.

Answer

Bicep can be used to manage any cloud provider

Answer

Bicep eliminates the need for resource providers

Answer

Bicep supports imperative scripting

Question 9

A company is deploying a web application on Google Cloud that requires low-latency access to static content (images, CSS) for global users. The application also needs to handle SSL termination to reduce load on backend instances. Which TWO services should the architect use? (Select TWO.)

Accepted Answer

Cloud CDN. Cloud CDN (Option C) is correct because it uses Google's global edge cache to deliver static content (images, CSS) with low latency by caching content at points of presence (PoPs) close to users. Cloud Load Balancing (Option D) is correct because it provides global anycast-based load balancing with integrated SSL termination, offloading the SSL/TLS handshake from backend instances and reducing their CPU load.

Answer

Compute Engine with enhanced network

Answer

Cloud Functions

Answer

Cloud Storage

Question 10

A company uses Azure AD for identity federation with an on-premises Active Directory. They want to enable single sign-on (SSO) for cloud applications using an open standard. Which protocol should they use?

Accepted Answer

SAML 2.0. SAML (Security Assertion Markup Language) and OIDC (OpenID Connect) are open standards for federation. SAML is commonly used for SSO with Microsoft Entra ID. OAuth is for authorization, not authentication. LDAP is a directory protocol. Kerberos is for on-premises.

Answer

OAuth 2.0

Answer

LDAP

Answer

Kerberos

Question 11

Sequence the steps to configure a cloud monitoring alert for high memory usage on a virtual machine.

Accepted Answer

Go to monitoring, then create alarm, then set threshold, then configure notification, then test. Go to monitoring, create alarm, set threshold, configure notification, then test.

Answer

Create alarm, then go to monitoring, then set threshold, then configure notification, then test

Answer

Go to monitoring, then create alarm, then configure notification, then set threshold, then test

Answer

Go to monitoring, then set threshold, then create alarm, then configure notification, then test

Question 12

A cloud architect is designing a disaster recovery plan that includes testing. Which TWO activities are commonly performed as part of DR testing?

Accepted Answer

Chaos engineering. Chaos engineering (C) is a valid DR testing activity because it deliberately injects failures—such as terminating instances, blocking network paths, or simulating AZ outages—to verify that failover, replication, and recovery mechanisms actually work under real fault conditions. Scheduled DR drills (D) are also a core DR testing practice, as they exercise documented runbooks and recovery procedures (for example, promoting a standby database or failing over to a secondary region) on a planned cadence to validate RTO and RPO targets. The remaining options are not DR testing activities: Reserved Instance planning (A) is a cost-optimization/billing exercise, rightsizing recommendations (B) are about matching instance capacity to utilization for efficiency, and tagging resources (E) is a governance and metadata practice that supports organization and cost allocation but does not itself test recovery.

Answer

Reserved Instance planning

Answer

Rightsizing recommendations

Answer

Tagging resources

Question 13

Which TWO factors should be considered when choosing a cloud deployment model (public, private, hybrid)? (Select TWO.)

Accepted Answer

Data sensitivity and classification. Option B (Data sensitivity and classification) is correct because the sensitivity of the data directly drives the choice of deployment model — highly sensitive or regulated data may require a private or hybrid model to keep it under organizational control, while less sensitive workloads can run in a public cloud. Option C (Compliance requirements such as GDPR, HIPAA) is correct because legal and regulatory mandates dictate where data may reside and how it must be protected, often forcing private or hybrid deployments to satisfy data-residency, audit, and security obligations. In contrast, option A (number of monitors connected to the server) is irrelevant, as display peripherals have no bearing on cloud deployment architecture. Option D (brand of physical servers) does not determine the deployment model, since public, private, and hybrid clouds can all be built on various hardware vendors. Option E (color of server racks) is purely cosmetic and has no technical or compliance impact on deployment model selection.

Answer

Number of monitors connected to the server

Answer

Brand of physical servers used

Answer

Color of server racks in the data center

Question 14

A cloud engineer is using Ansible to automate cloud resource provisioning. Which statement about Ansible is true?

Accepted Answer

Ansible uses YAML for playbook definitions.. Ansible playbooks are written in YAML, a human-readable data serialization format that defines plays, tasks, modules, and variables. This YAML-based syntax is a defining characteristic of Ansible and is why it is popular for configuration management and orchestration.

Answer

Ansible uses JSON for configuration management.

Answer

Ansible requires an agent to be installed on each managed node.

Answer

Ansible is a cloud-only tool that cannot manage on-premises servers.

Question 15

A cloud engineer is using Terraform to manage infrastructure. They need to store the state file remotely for team collaboration and to enable state locking. Which THREE of the following backends support state locking? (Select THREE.)

Accepted Answer

Consul backend. The Consul backend (A) supports state locking natively through Consul's session and key-value store mechanisms, so Terraform can acquire a lock before modifying state. Azure Blob Storage with blob lease (D) supports locking because Terraform uses Azure's blob lease feature to prevent concurrent state writes. Amazon S3 with DynamoDB for locking (E) supports locking by using a DynamoDB table to coordinate and hold the lock while state is stored in S3. The local file system (B) does not provide remote locking suitable for team collaboration, and the HTTP backend (C) does not support state locking, so neither belongs among the correct answers.

Answer

Local file system

Answer

HTTP backend