CV0-004 Practice Test 19 — 15 Questions

Question 1

A company wants to deploy a containerized application to a Kubernetes cluster using a rolling update strategy. They have defined a Kubernetes Deployment manifest. Which field controls the number of pods that can be unavailable during the update?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

spec.strategy.rollingUpdate.maxUnavailable. The `spec.strategy.rollingUpdate.maxUnavailable` field in a Kubernetes Deployment manifest explicitly controls the maximum number of Pods that can be unavailable during a rolling update. This field can be set as an absolute number or a percentage of the desired Pod count, ensuring that the update proceeds without dropping below a specified availability threshold.

Answer

spec.strategy.rollingUpdate.maxSurge

Answer

spec.template.spec.containers[].readinessProbe

Answer

spec.replicas

Question 2

A cloud architect is designing a network to protect a web application from common attacks such as SQL injection and cross-site scripting. Which cloud service should be used?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) is specifically designed to inspect HTTP/HTTPS traffic and block application-layer attacks such as SQL injection, cross-site scripting (XSS), and other OWASP Top 10 threats. It operates at Layer 7 and applies rule sets or signatures to web requests and responses. This makes it the correct cloud service for protecting a web application from these attacks.

Answer

DDoS Protection

Answer

Network ACL

Answer

Security Group

Question 3

A cloud administrator needs to provide a shared file system that can be accessed by multiple Linux-based virtual machines in the same VPC. Which storage type should be used?

Accepted Answer

File storage. File storage provides a shared, hierarchical file system (e.g., NFS, SMB) that multiple Linux VMs in the same VPC can mount simultaneously, making it ideal for shared access. In AWS, this is Amazon EFS (Elastic File System), which supports concurrent NFS mounts across EC2 instances. Block and object storage do not natively provide a shared POSIX file system for multiple Linux hosts.

Answer

Object storage

Answer

Archive storage

Answer

Block storage

Question 4

An organization wants to deploy a new application with zero downtime by switching traffic between two identical production environments. Which deployment strategy should be used?

Accepted Answer

Blue/green deployment. Blue/green deployment maintains two identical production environments (blue and green) and switches traffic from one to the other, typically via a load balancer or DNS cutover. This provides near-zero downtime and instant rollback by simply redirecting traffic back to the previous environment if issues arise.

Answer

Rolling deployment

Answer

Canary deployment

Answer

In-place deployment

Question 5

A security analyst is investigating a potential data exfiltration from a cloud environment. The analyst finds that an instance IAM role was assumed by a compromised user, and the role has permissions to read from a sensitive database. What is the BEST way to prevent this type of attack in the future?

Accepted Answer

Enforce MFA for all users and require MFA when assuming the role.. The best because enforcing MFA for all users and requiring MFA when assuming roles ensures that even if a user's credentials are compromised, the attacker cannot assume the IAM role without also having access to the user's MFA device. This directly addresses the scenario. Option B is not the best because adding a resource-based policy to deny access from the role would break legitimate access and does not prevent the compromised user from assuming the role. Option C is not the best because rotating the role's access keys every 30 days does not prevent an attacker from using the role's temporary credentials if they have already assumed the role; also, IAM roles do not have access keys; they issue temporary credentials. Option D is not the best because removing the IAM role and using a service account would not solve the underlying issue and could introduce other security risks.

Answer

Add a resource-based policy to the database to deny access from the role.

Answer

Rotate the IAM role's access keys every 30 days.

Answer

Remove the IAM role and use a service account instead.

Question 6

A company is migrating an on-premises MySQL database to Azure SQL Database using Azure Database Migration Service. They want minimal downtime. Which migration mode should they choose?

Accepted Answer

Online migration with continuous sync. Azure DMS offers online migration mode that uses CDC to replicate ongoing changes, allowing near-zero downtime. Offline mode requires stopping writes during migration.

Answer

Bulk copy

Answer

Offline migration

Answer

Schema conversion only

Question 7

A company wants to migrate its existing on-premises web application to the cloud to reduce operational overhead. The application runs on a custom Linux distribution with specific kernel modules. Which cloud deployment model would best minimize the need to refactor the application while still reducing maintenance of the underlying infrastructure?

Accepted Answer

Infrastructure as a Service (IaaS). IaaS (Infrastructure as a Service) provides virtualized compute resources where you retain full control over the operating system, including custom Linux distributions and kernel modules. This allows you to migrate the application as-is without refactoring, while the cloud provider handles the underlying physical infrastructure maintenance, such as hardware failures and network cabling.

Answer

Container as a Service (CaaS)

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Question 8

Which encryption standard is most commonly used for data at rest in cloud storage services?

Accepted Answer

AES-256. AES-256 is the de facto standard for data-at-rest encryption in cloud storage services such as Amazon S3, Azure Blob Storage, and Google Cloud Storage. It provides strong symmetric encryption with a 256-bit key, is FIPS 140-2/3 validated, and is widely supported by hardware acceleration. Cloud providers default to AES-256 (or AES-128 in some cases) for server-side encryption.

Answer

Blowfish

Answer

DES

Answer

RSA

Question 9

A company's compliance team must provide evidence that their cloud environment meets PCI DSS requirements. Which AWS service can aggregate security findings and automate compliance checks?

Accepted Answer

AWS Security Hub. AWS Security Hub aggregates security findings from multiple AWS services and third-party tools, and it can run automated compliance checks against standards like PCI DSS. It provides a central dashboard for security posture. AWS Config records resource configurations but does not aggregate findings or automate compliance checks in the same way. Amazon Inspector is for vulnerability assessment, and CloudTrail logs API activity.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 10

A company is implementing a cloud governance strategy. They need to ensure that all resources are tagged with cost center and environment, and any untagged resources are automatically remediated. Which of the following best practices should be applied?

Accepted Answer

Use policy-as-code to enforce tagging and automatically apply tags to untagged resources. Policy-as-code (e.g., Azure Policy, AWS Config Rules, or Open Policy Agent) allows you to define tagging requirements declaratively and automatically remediate non-compliant resources. This approach enforces governance in real-time without manual intervention, ensuring all resources are tagged with cost center and environment as specified.

Answer

Implement role-based access control to restrict resource creation

Answer

Set up budget alerts to notify when costs exceed thresholds

Answer

Create a manual audit process to check tags weekly

Question 11

A cloud administrator is troubleshooting a performance issue in a virtualized environment. Which TWO metrics should be monitored to identify CPU contention on the hypervisor?

Accepted Answer

CPU ready time. CPU ready time (B) measures the time a virtual machine is ready to execute but must wait for the hypervisor to schedule it on a physical core. High ready time directly indicates CPU contention, as the VM is being starved of CPU cycles. CPU co-stopping time (E) occurs when multiple vCPUs in a single VM must wait to be scheduled simultaneously, which also signals CPU overcommitment and contention on the hypervisor.

Answer

Swap rate

Answer

Memory ballooning

Answer

CPU utilization per core

Question 12

A company has a three-tier application in a cloud VPC: web servers in a public subnet, application servers in a private subnet, and database servers in a private subnet. The web servers can connect to the application servers, but the application servers cannot connect to the database servers. The security groups are configured as follows:
- Web SG: inbound HTTP from 0.0.0.0/0, outbound all
- App SG: inbound HTTP from Web SG, outbound all
- DB SG: inbound MySQL from App SG, outbound all
What is the most likely cause of the connectivity issue?

Accepted Answer

The network access control list (NACL) on the database subnet is blocking inbound traffic from the application subnet.. The most likely cause is a network ACL (NACL) on the database subnet blocking inbound traffic from the application subnet. Security groups are stateful and allow return traffic, but NACLs are stateless and must explicitly allow both inbound and outbound traffic on ephemeral ports. If the NACL denies inbound MySQL (port 3306) from the app subnet's CIDR, the connection fails even though the security groups are correctly configured.

Answer

The database security group is missing an inbound rule for MySQL.

Answer

The application security group is missing an outbound rule for MySQL.

Answer

The web security group is blocking traffic to the database.

Question 13

A cloud customer is deploying a virtual machine (VM) in a public IaaS environment. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Patching the guest operating system. In the shared responsibility model for IaaS, the cloud provider is responsible for the security 'of' the cloud (physical security, hypervisor, network infrastructure), while the customer is responsible for security 'in' the cloud. Patching the guest operating system is a customer task because the customer has full control over the VM's OS, including updates, configuration, and application security. This aligns with the principle that the customer manages everything from the OS up, while the provider manages the virtualization layer and below.

Answer

Securing the hypervisor

Answer

Physical security of the data center

Answer

Network infrastructure integrity

Question 14

A cloud architect is designing an auto-scaling policy for a web application. The application's traffic spikes predictably every weekday at 9 AM and decreases after 5 PM. Which scaling policy is most cost-effective?

Accepted Answer

Scheduled scaling policy that increases capacity at 8:45 AM and decreases at 5:15 PM. Scheduled scaling is designed for predictable, time-based traffic patterns. Scaling up at 8:45 AM and down at 5:15 PM pre-provisions capacity before the 9 AM spike and removes it after the 5 PM decline, avoiding the lag and over-provisioning inherent in reactive policies. This is the most cost-effective approach for a known weekly pattern.

Answer

Step scaling policy that adds instances when CPU > 70%

Answer

Simple scaling policy with a cooldown of 300 seconds

Answer

Target tracking policy with a target CPU of 50%

Question 15

A company is deploying a new version of a microservice on Amazon EKS. The deployment must ensure that new pods are created and become healthy before old pods are terminated. The current deployment uses a ReplicaSet. Which Kubernetes resource and strategy should be used?

Accepted Answer

Deployment with RollingUpdate strategy. A Deployment manages ReplicaSets and supports a RollingUpdate strategy that creates new pods and waits for them to become ready before terminating old ones.

Answer

ReplicaSet with RollingUpdate strategy

Answer

DaemonSet with RollingUpdate

Answer

StatefulSet with OnDelete strategy