CV0-004 Practice Test 18 — 15 Questions

Question 1

A cloud administrator is troubleshooting a performance issue where a virtual machine running a database is experiencing high latency. The hypervisor shows the VM has been allocated 4 vCPUs and 16 GB of RAM, but the host server has 32 GB of RAM and 16 cores. Which of the following is most likely the cause of the latency?

Accepted Answer

The VM is over-provisioned on vCPUs relative to physical cores.. The VM is allocated 4 vCPUs, but the host has only 16 physical cores. If the VM's workload (e.g., a database) is CPU-intensive and the hypervisor is oversubscribing vCPUs across multiple VMs, the vCPUs may be waiting for physical cores, causing CPU ready time and high latency. This is a classic symptom of CPU over-provisioning.

Answer

The VM's storage is on a network share.

Answer

The VM has too little RAM.

Answer

The VM is using paravirtualized drivers.

Question 2

Which THREE elements are required for a complete key lifecycle management strategy in a cloud environment? (Choose three.)

Accepted Answer

Secure key generation. Secure key generation is the foundational first step in a key lifecycle management strategy. In a cloud environment, keys must be generated using a FIPS 140-2 validated hardware security module (HSM) or a cloud provider's equivalent (e.g., AWS CloudHSM, Azure Key Vault Premium) to ensure cryptographic strength and prevent exposure of the private key material during creation.

Answer

Key backup and recovery

Answer

Key access control

Question 3

A cloud administrator is designing a backup strategy for a virtual machine running a critical application. The application stores data on a separate data disk. Which TWO of the following practices should the administrator include to ensure a reliable backup?

Accepted Answer

Ensure the backup includes the system state and data disk.. Option A is correct because guest-level backups ensure application consistency. Option D is correct because snapshot consistency ensures crash-consistent not application-consistent. Option B is wrong because file-level backups are less efficient. Option C is wrong because snapshot-only lacks application consistency. Option E is wrong because encryption not directly backup reliability.

Answer

Encrypt the backup files before storing them off-site.

Answer

Use file-level backups for the data disk only.

Answer

Rely solely on hypervisor-level snapshots.

Question 4

A company is migrating to the cloud and needs to ensure high availability for a web application. The solution must tolerate the failure of an entire Availability Zone. Which three actions should the administrator take? (Choose three.)

Accepted Answer

Deploy the application across two or more Availability Zones.. Option A is correct because deploying the application across two or more Availability Zones (AZs) ensures that if an entire AZ fails, the application remains available in the other AZ(s). This is a fundamental design pattern for achieving high availability in AWS, as AZs are physically separate data centers with independent power, cooling, and networking. By distributing resources across multiple AZs, the application can tolerate the failure of one AZ without service interruption.

Answer

Use an Application Load Balancer with cross-zone load balancing enabled.

Answer

Use a single instance in a larger instance size.

Question 5

A company uses a cloud object storage service to store backup data. The cloud provider charges for storage and retrieval. The operations team wants to minimize costs while ensuring data is available within 24 hours of a restore request. Which storage tier should they use?

Accepted Answer

Cold storage tier with retrieval time of 12 hours. Option C is correct because the cold storage tier offers a retrieval time of 12 hours, which meets the requirement of making data available within 24 hours while minimizing costs compared to hotter tiers. Cold storage is designed for infrequently accessed data with longer retrieval times, providing a cost-effective balance between availability and expense for backup data that does not need immediate access.

Answer

Archive storage tier with retrieval time of 48 hours

Answer

Hot storage tier

Answer

Infrequent access tier with retrieval time of 1 hour

Question 6

A company is experiencing intermittent connectivity issues between its on-premises data center and a public cloud environment over a VPN connection. Which TWO of the following should the administrator check to troubleshoot the problem?

Accepted Answer

Validate the route tables on both sides of the VPN.. Route tables control the path that traffic takes between networks. If the route tables on either the on-premises VPN device or the cloud virtual network gateway do not have the correct entries (e.g., missing routes for the remote subnet or incorrect next-hop IPs), traffic can be dropped or misdirected, causing intermittent connectivity. Validating these routes ensures that packets destined for the cloud or on-premises are properly forwarded over the VPN tunnel.

Answer

Verify that the internet bandwidth is sufficient.

Answer

Ensure the cloud storage performance is adequate.

Answer

Check the DNS resolution of cloud endpoints.

Question 7

A cloud administrator needs to apply a critical security patch to a virtual machine that is part of a production application. The application must remain available during patching. Which of the following is the BEST approach?

Accepted Answer

Remove the VM from the load balancer, apply the patch, then return it to service during a maintenance window. Removing the VM from the load balancer ensures that no new traffic is sent to it while the patch is applied, maintaining application availability for users. After the patch is applied and the VM is verified as healthy, it can be returned to the load balancer pool. This approach aligns with a rolling update strategy, which is the standard method for applying patches to production VMs without downtime.

Answer

Postpone the patch until the next scheduled update cycle

Answer

Patch all VMs simultaneously to minimize the time to full deployment

Answer

Apply the patch during peak usage hours to ensure immediate deployment

Question 8

A cloud administrator is troubleshooting a connectivity issue between two virtual machines in the same VPC but different subnets. Both VMs have security groups that allow all traffic from the VPC CIDR. What should the administrator check first?

Accepted Answer

The network ACLs for both subnets.. Option A is correct because network ACLs are stateless and must explicitly allow traffic in both directions. Option B is unlikely due to the automatic local route. Options C and D are not the first step.

Answer

The VPC flow logs.

Answer

The route tables for both subnets.

Answer

The DHCP option set.

Question 9

A company is migrating its on-premises workloads to a public cloud. The security team requires that all data in transit between the cloud resources and on-premises be encrypted. Which solution should the cloud architect recommend?

Accepted Answer

Implement a VPN tunnel between the cloud VPC and the on-premises network.. A VPN tunnel encrypts all IP traffic between the cloud VPC and on-premises network, covering all data in transit. Other options are insufficient or address different aspects.

Answer

Deploy a hardware security module (HSM) for key management.

Answer

Enable encryption on the cloud storage buckets.

Answer

Use TLS for all application traffic.

Question 10

A cloud architect is designing a disaster recovery plan for a critical application. The application runs on virtual machines in a public cloud. The recovery time objective (RTO) is 1 hour, and the recovery point objective (RPO) is 15 minutes. Which three strategies should the architect implement? (Select THREE).

Accepted Answer

Implement active-passive failover with automated DNS.. Synchronous replication provides low RPO; warm standby ensures quick failover within RTO; active-passive with automated DNS reduces transition time.

Answer

Take daily snapshots of the VMs.

Answer

Use asynchronous replication with a 10-minute lag.

Question 11

A cloud administrator is troubleshooting a connectivity issue between two virtual networks in different cloud regions. The networks are connected via a VPN gateway. The administrator can ping resources in one network but not the other. Which of the following should the administrator check FIRST?

Accepted Answer

Review the route tables on both sides for the remote network prefix. Option D is correct: route tables must have entries for the remote network. Option A is wrong because ping is already working in one direction, so VPN tunnel is up. Option B is wrong: NSGs affect traffic but routes are more fundamental. Option C is wrong: if both sides have local NICs configured, routing is the next step.

Answer

Confirm the local network gateways have the correct NIC IP addresses

Answer

Verify the VPN tunnel status on both gateways

Answer

Check network security groups for blocking ICMP

Question 12

Which THREE of the following are recommended practices for securing cloud API access? (Choose three.)

Accepted Answer

Use role-based access control to limit permissions for each API user. Options A, C, and D are correct. API keys should be rotated regularly (A), access should be logged and monitored (C), and principle of least privilege should be applied (D). Option B is wrong: hardcoding keys is insecure. Option E is wrong: public exposure increases risk.

Answer

Embed API keys directly in application source code for convenience

Answer

Expose API endpoints publicly for easy access by all clients

Question 13

A company is migrating its on-premises data center to the cloud. The current backup solution uses a tape library. The company wants to implement a cloud-based backup strategy that ensures data durability and rapid restoration. Which of the following is the BEST option?

Accepted Answer

Use cloud storage with versioning and lifecycle policies.. Option A is correct because cloud storage with versioning and lifecycle policies provides high durability (redundant storage) and allows quick restore of previous versions. Option B is wrong because virtual tape libraries (VTL) may have slower restore times. Option C is wrong because third-party backup software may add complexity and does not inherently ensure rapid restoration. Option D is wrong because block storage snapshots are designed for cloud instances, not on-premises data migration.

Answer

Use cloud virtual tape library (VTL).

Answer

Use block storage snapshots.

Answer

Use a third-party backup software that backs up to cloud storage.

Question 14

A company has a policy that all cloud resources must be tagged with 'CostCenter' and 'Project' tags. The cloud operations team uses a monitoring tool to alert when untagged resources are created. The team receives an alert for a new EC2 instance that lacks the required tags. The instance was launched two hours ago by a DevOps engineer who is on leave. The instance is critical for production. What should the administrator do to resolve the compliance violation?

Accepted Answer

Apply the required tags to the existing instance using the cloud provider's console or CLI.. The best practice is to apply the missing tags to the existing instance, as it is a critical production resource. Removing or stopping the instance would cause downtime. Applying tags ensures compliance without disrupting operations.

Answer

Terminate the instance immediately and launch a new one with proper tags.

Answer

Ignore the alert because the instance is critical and the engineer will fix it when back.

Answer

Modify the tag policy to exempt instances launched by senior engineers.

Question 15

A cloud operations team is troubleshooting a performance issue with a database that is running on a virtual machine. The database is experiencing high latency during peak hours. Metrics show that CPU and memory usage are below 50%, but disk I/O latency spikes. The database is hosted on a cloud provider's virtual machine with premium SSDs. Which of the following is the MOST likely cause of the disk I/O latency?

Accepted Answer

The disk IOPS limit is being exceeded during peak loads.. Option B is correct because exceeding provisioned IOPS limits causes throttling and latency. Option A is wrong because CPU and memory are low, indicating no processing bottleneck. Option C is wrong because premium SSDs typically host OS and data, and the problem is I/O. Option D is wrong because network bandwidth doesn't directly cause disk I/O latency.

Answer

The OS is paging memory to disk due to insufficient RAM.

Answer

The virtual machine's network bandwidth is saturated.

Answer

The database application is CPU-bound.