CV0-004 Practice Test 18 — 15 Questions

Question 1

An organization is using Azure DevOps to implement a CI/CD pipeline. In which stage of the pipeline would automated unit tests typically be executed?

Accepted Answer

Build. Unit tests are typically run in the build stage after compilation. Source is for code fetching, deploy for release, and verify for post-deployment checks.

Answer

Deploy

Answer

Verify

Answer

Source

Question 2

An administrator is configuring a backup policy for a critical application database. The policy must allow point-in-time recovery up to the last 5 minutes. The database is updated continuously throughout the day. Which of the following backup strategies BEST meets the requirement?

Accepted Answer

Daily full backups plus transaction log backups every 5 minutes.. It combines daily full backups with transaction log backups every 5 minutes, which is the only strategy that supports point-in-time recovery (PITR) to within 5 minutes for a continuously updated database. Transaction log backups capture every committed transaction, allowing restoration to any specific point in time by replaying logs from the last full backup.

Answer

Weekly full backups with daily differential backups.

Answer

Hourly snapshots of the virtual machine.

Answer

Daily full backups of the database.

Question 3

A company is implementing multi-factor authentication (MFA) for cloud console access. Which TWO of the following are valid MFA methods? (Select TWO.)

Accepted Answer

A password and a hardware TOTP token. A hardware TOTP token generates a time-based one-time password (RFC 6238) that changes every 30 or 60 seconds, providing a second factor independent of the user's password. Combining this with a password satisfies the MFA requirement of using two different authentication factors (something you know and something you have).

Answer

Two different passwords

Answer

A password and a security question

Answer

A username and password

Question 4

A company's IaaS environment has a high rate of failed login attempts to a critical database server. The security team wants to temporarily block the source IPs after 5 failed attempts within 10 minutes. Which security control should be implemented?

Accepted Answer

Configure host-based firewall rules on each database server.. Host-based firewall rules on each database server can be configured to dynamically block source IPs after a threshold of failed login attempts. For example, tools like fail2ban can monitor authentication logs and automatically update the host-based firewall (e.g., iptables or Windows Firewall) to temporarily block IPs that exceed the failure limit. This provides precise, dynamic control without relying on a centralized appliance. Option A is incorrect because TLS mutual authentication secures the connection but does not block IPs. Option B is incorrect because a WAF only inspects HTTP/HTTPS traffic, not database protocols like MySQL or PostgreSQL. Option C is incorrect because a CASB is designed for cloud application access, not database server protection.

Answer

Enable TLS mutual authentication for the database.

Answer

Deploy a web application firewall (WAF) with rate-limiting rules.

Answer

Implement a cloud access security broker (CASB).

Question 5

A company wants to deploy a Kubernetes application across multiple AWS accounts using a single set of manifests. The team needs to manage the deployment centrally while allowing each account to have its own configuration values (e.g., environment-specific variables). Which approach should the team use?

Accepted Answer

Use Helm charts with per-environment values files. Helm charts package Kubernetes manifests and support parameterization via values files, allowing centralized deployment with per-environment overrides.

Answer

Use Terraform workspaces with Kubernetes provider

Answer

Use CloudFormation StackSets with Kubernetes resources

Answer

Create separate manifests for each account

Question 6

A cloud architect is designing a CI/CD pipeline for a critical application that requires zero-downtime deployments. The architect wants to gradually shift traffic to the new version while monitoring for errors and automatically rolling back if issues are detected. Which TWO deployment strategies should the architect consider? (Select TWO.)

Accepted Answer

Blue/green deployment. Canary and blue/green both support gradual traffic shift and rollback. Rolling updates are gradual but may not have automatic rollback based on monitoring. A/B testing is not a deployment strategy. Immutable deployments replace instances but not gradual.

Answer

Rolling deployment

Answer

Immutable deployment

Answer

A/B testing deployment

Question 7

A cloud engineer needs to store database backups that must be retained for seven years. The backups are rarely accessed. Which storage type is most cost-effective for this use case?

Accepted Answer

Archive storage. Archive storage (like Glacier or Azure Archive) is designed for long-term cold storage at low cost.

Answer

Object storage

Answer

Block storage

Answer

File storage

Question 8

A company runs a stateless web application on virtual machines. To handle increased traffic, they add more virtual machines and distribute incoming requests among them. What is this scaling method called?

Accepted Answer

Horizontal scaling. Horizontal scaling adds more instances to handle load, as opposed to vertical scaling which increases the resources of a single instance.

Answer

Right-sizing

Answer

Vertical scaling

Answer

Auto-scaling

Question 9

A company hosts a web application on AWS and wants to improve latency for global users. Which service should they use to cache static content at edge locations?

Accepted Answer

AWS CloudFront. A CDN (like CloudFront) caches content at edge locations to reduce latency for users worldwide.

Answer

Application Load Balancer

Answer

AWS Global Accelerator

Answer

Amazon Route 53

Question 10

A company wants to migrate its on-premises workload to the cloud and needs to maintain full control over the operating system, middleware, and applications. Which cloud service model should the company choose?

Accepted Answer

IaaS. IaaS provides virtualized computing resources (VMs, storage, networking) where the customer manages the OS and above, making it the right choice for full control.

Answer

PaaS

Answer

FaaS

Answer

SaaS

Question 11

A cloud architect is designing a highly available web application. The application must remain available even if an entire AWS Availability Zone fails. The architect decides to deploy identical application instances in two separate Availability Zones and distribute traffic equally. Which architecture is being implemented?

Accepted Answer

Active-active. Active-active architecture distributes traffic across all instances; if one zone fails, the other continues serving traffic.

Answer

Fault tolerance

Answer

Warm standby

Answer

Active-passive

Question 12

Which of the following is a characteristic of serverless computing (FaaS)?

Accepted Answer

You are charged per execution or compute time. FaaS executes code in response to events and charges only for the compute time consumed.

Answer

You pay for allocated resources regardless of usage

Answer

You must manage the underlying servers

Answer

You have to provision capacity in advance

Question 13

A cloud administrator is writing an Ansible playbook to provision cloud resources. The administrator wants to ensure that the playbook can run without requiring any agent software on the target machines. Which Ansible feature enables this agentless operation?

Accepted Answer

SSH-based connection to managed nodes. Ansible connects via SSH (or WinRM) by default, no agent needed. Pull mode requires an agent, modules are code units, and inventory lists hosts.

Answer

Ansible inventory files that list hosts

Answer

Ansible modules that run on the control node

Answer

Pull mode from a central repository

Question 14

A DevOps team uses Jenkins for CI/CD. They want to automatically deploy containerized applications to a Kubernetes cluster. Which Jenkins feature or plugin can integrate with Kubernetes to manage deployments?

Accepted Answer

Kubernetes plugin. The Kubernetes plugin for Jenkins allows Jenkins agents to be dynamically provisioned as pods within a Kubernetes cluster, enabling automated deployment of containerized applications. It integrates directly with the Kubernetes API to manage deployments, services, and other resources, making it the correct choice for this scenario.

Answer

Jenkins Declarative Pipeline

Answer

Jenkins Blue Ocean

Answer

Jenkins Multibranch Pipeline

Question 15

An organization is designing a VPC with public and private subnets. The web servers must be accessible from the internet, but database servers must not. The architecture also requires high availability across two Availability Zones. What is the minimum number of public subnets and private subnets needed?

Accepted Answer

Two public, two private. For high availability across two AZs, you need at least two public subnets (one per AZ) and two private subnets (one per AZ).

Answer

One public, two private

Answer

Two public, one private

Answer

One public, one private