CV0-004 Practice Test 18 — 15 Questions

Question 1

Which cloud deployment model involves using services from multiple public cloud providers to avoid vendor lock-in and leverage best-of-breed solutions?

Accepted Answer

Multi-cloud. Multi-cloud is the use of multiple public cloud providers to gain flexibility and avoid dependency on a single vendor.

Answer

Public cloud

Answer

Hybrid cloud

Answer

Private cloud

Question 2

A company wants to minimize cloud costs for a batch processing job that runs for a few hours each night and can be interrupted. Which pricing model is most appropriate?

Accepted Answer

Spot instances. Spot instances are ideal for batch processing jobs that can tolerate interruptions because they offer significant cost savings (up to 90% off on-demand) by utilizing spare cloud capacity. Since the job runs for a few hours each night and can be interrupted, spot instances provide the most cost-effective solution. They can be terminated by the cloud provider if capacity is needed, but for interruptible workloads, this is acceptable.

Answer

Dedicated hosts

Answer

On-demand instances

Answer

Reserved instances

Question 3

A company is deploying a global web application and wants to reduce latency for users around the world. The application serves static content (images, CSS) and dynamic API responses. Which combination of services should the architect use?

Accepted Answer

CDN for static content and a global load balancer with latency-based routing for dynamic content. CDN caches static content at edge locations, reducing latency. For dynamic content, a global load balancer with latency-based routing directs users to the closest region. DNS alone cannot reduce latency for dynamic content. A single load balancer does not provide global distribution.

Answer

CDN for all content without backend routing

Answer

A single load balancer in one region with a CDN

Answer

DNS round-robin for both static and dynamic content

Question 4

Refer to the exhibit. A cloud administrator sees this log after a nightly backup job. Which of the following is the most likely cause of the timeout?

Accepted Answer

The volume has a high I/O load during the snapshot.. The log indicates a timeout during a nightly backup job that involves creating a snapshot. A high I/O load on the volume during the snapshot process can cause the snapshot to take longer than the configured timeout threshold, as the snapshot must capture a consistent point-in-time state while the volume is actively being written to. This is a common issue in cloud environments where the snapshot process competes for disk resources, leading to delays that exceed the timeout limit.

Answer

The volume is attached to an instance that is powered off.

Answer

The snapshot target region is unreachable.

Answer

The backup agent is not installed.

Question 5

An e-commerce application experiences variable traffic with sudden spikes during flash sales. The application is designed to be stateless. Which scaling approach should the cloud architect implement to handle these spikes efficiently?

Accepted Answer

Horizontal auto-scaling based on CPU utilization. Horizontal auto-scaling based on CPU utilization allows the application to dynamically add or remove instances in response to traffic spikes. Since the application is stateless, new instances can be added seamlessly behind a load balancer, providing efficient scaling during flash sales.

Answer

Vertical scaling on a single large instance

Answer

Using a load balancer with active-passive failover

Answer

Pre-provisioning a fixed cluster of instances

Question 6

Which cloud service model provides the customer with the most control over the operating system and applications?

Accepted Answer

IaaS. IaaS provides virtualized computing resources where customers manage OS and above.

Answer

FaaS

Answer

PaaS

Answer

SaaS

Question 7

An organization is migrating a legacy application to the cloud. The application writes logs to a local file system. The cloud architect recommends using a centralized logging service. Which of the following BEST explains why this change is important?

Accepted Answer

Because cloud instances are ephemeral and local logs would be lost if instances terminate. Cloud instances are ephemeral, meaning they can be terminated, replaced, or scaled down at any time, and any logs stored only on the local file system are lost when the instance goes away. Centralized logging ensures logs persist independently of instance lifecycle, which is critical for troubleshooting, auditing, and compliance. This is the most direct and fundamental reason to move logs off local storage in the cloud.

Answer

To meet regulatory compliance requirements for log retention

Answer

To reduce storage costs by using object storage for logs

Answer

To encrypt log data at rest and in transit

Question 8

A cloud administrator notices that a cloud-based application is running slowly. The administrator checks the cloud monitoring dashboard and sees that CPU utilization is at 95% for the application server. Which of the following should the administrator do first?

Accepted Answer

Scale out by adding another instance.. With CPU utilization at 95% on the application server, the bottleneck is compute capacity, so the first remediation step is to scale out by adding another instance to distribute the load. Horizontal scaling directly addresses sustained high CPU by adding parallel processing capacity. This is the least disruptive and most appropriate first action before considering vertical scaling or restarts.

Answer

Add an additional network interface.

Answer

Reboot the server.

Answer

Increase the memory allocation.

Question 9

A company uses AWS and wants to centralize security monitoring across multiple accounts. Which service should they use to aggregate security findings and check compliance against standards like CIS AWS Foundations?

Accepted Answer

AWS Security Hub. AWS Security Hub is a centralized security and compliance service that aggregates findings from multiple AWS services (like GuardDuty, Inspector, Macie) and third-party tools across accounts, and it runs automated compliance checks against standards such as CIS AWS Foundations, AWS Foundational Security Best Practices, and PCI DSS. It is purpose-built for cross-account security aggregation and compliance monitoring, making it the correct choice.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Config

Question 10

Which of the following is the cloud provider's responsibility under the shared responsibility model?

Accepted Answer

Securing the physical data center. Under the shared responsibility model, the cloud provider is responsible for security 'of' the cloud, which includes the physical data center, hardware, and infrastructure. Securing the physical data center is solely the provider's responsibility. The customer is responsible for security 'in' the cloud, such as data encryption, IAM policies, and guest OS patching.

Answer

Encrypting data stored in cloud resources

Answer

Configuring identity and access management policies

Answer

Patching guest operating systems

Question 11

During a security assessment, a cloud auditor discovers that a virtual machine has a publicly accessible SSH port (22) open to the entire internet (0.0.0.0/0). The VM is a bastion host intended for administration. What should be done to reduce risk?

Accepted Answer

Remove the network security group rule allowing SSH from 0.0.0.0/0 and add a rule allowing only the corporate VPN's public IP range.. A bastion host should only be accessible from trusted IPs, typically the corporate VPN or a specific IP range, to minimize exposure. Option A is incorrect because removing the security group rule and relying solely on the OS firewall does not address the network-level exposure and may not be as manageable in a cloud environment. Option B is incorrect because disabling SSH entirely would prevent necessary administrative access; serial console is not a scalable alternative. Option C is incorrect because while SSH key authentication improves security, it does not restrict the IP addresses that can attempt to connect, leaving the host exposed to brute-force attacks from the entire internet.

Answer

Remove the security group rule for SSH and rely on the operating system firewall.

Answer

Disable SSH and use a serial console for administration.

Answer

Enable SSH key authentication and disable password login.

Question 12

An organization needs to store archival data for 7 years to meet compliance requirements. The data is rarely accessed, and retrieval time is not critical. Which cloud storage type is most cost-effective?

Accepted Answer

Archive storage. Archive storage (e.g., AWS Glacier, Azure Archive) is designed for long-term, infrequently accessed data at the lowest cost. Block storage is for VMs. Object storage is for frequent access. File storage is for shared file systems.

Answer

Block storage

Answer

File storage

Answer

Object storage

Question 13

A company's cloud environment has experienced a sudden spike in network traffic, causing a critical application to become unresponsive. Which of the following is the FIRST step the cloud administrator should take to address this issue?

Accepted Answer

Analyze the network traffic logs to identify the source of the spike.. The first step in troubleshooting a traffic spike is to analyze network traffic logs to identify the source, whether it is a DDoS attack, a misconfigured application, or a legitimate surge. Diagnosis must precede remediation so the fix addresses the actual cause. Restarting, contacting the provider, or adding bandwidth without diagnosis may mask the symptom or waste resources.

Answer

Restart the application server to restore service.

Answer

Contact the cloud provider to report the issue.

Answer

Increase the bandwidth for the affected application.

Question 14

A DevOps team uses infrastructure as code to deploy cloud resources. Security policy requires that all storage buckets have versioning enabled and are not publicly accessible. How can these requirements be enforced automatically?

Accepted Answer

Implement a cloud policy that disallows public access and requires versioning on all storage resources.. Using a cloud policy service (e.g., AWS Service Control Policy, Azure Policy, or GCP Organization Policy) can enforce rules like 'deny public access' and 'require versioning' at the account or organizational level, automatically applying to all storage resources. Option A is wrong because pre-commit hooks check templates but do not enforce at deployment; they can be bypassed. Option B is wrong because security groups apply to network resources like VMs, not storage buckets. Option D is wrong because a manual approval gate adds human review but does not automatically enforce the security requirements.

Answer

Add pre-commit hooks to check the IAC templates for compliance.

Answer

Use security group rules to restrict access to the storage buckets.

Answer

Configure a manual approval gate in the deployment pipeline for any storage changes.

Question 15

A cloud architect is designing a multi-tier application on a public cloud. To minimize costs while maintaining performance for variable workloads, the architect decides to use a mix of reserved and spot instances. Which design principle is being applied?

Accepted Answer

Cost optimization. Using a mix of reserved and spot instances directly reduces compute costs by committing to predictable workloads with reserved instances (which offer significant discounts over on-demand) and using spot instances for fault-tolerant, flexible workloads at steep discounts (often 60-90% off on-demand). This hybrid approach is a core cost optimization strategy in public cloud design, as it balances upfront commitment with opportunistic savings without sacrificing performance for variable workloads.

Answer

Scalability

Answer

High availability

Answer

Security