CV0-004 Practice Test 2 — 10 Questions

Question 1

A cloud architect is designing a VPC with public and private subnets. Which component is required to allow instances in the private subnet to access the internet for software updates?

Accepted Answer

NAT gateway. A NAT gateway is required to enable instances in a private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT gateway's Elastic IP address using source network address translation (SNAT). An Internet gateway alone cannot serve private subnets because it requires a route table entry pointing to a public subnet with a public IP address.

Answer

Elastic IP

Answer

VPN connection

Answer

Internet gateway

Question 2

A company is adopting a shared responsibility model for a PaaS cloud deployment. Which THREE responsibilities belong to the customer?

Accepted Answer

Data classification and encryption. In a PaaS shared responsibility model, the customer is responsible for data classification and encryption of data at rest and in transit. The cloud provider manages the underlying infrastructure, but the customer must classify data according to sensitivity and apply encryption mechanisms, such as using TLS 1.2/1.3 for data in transit and AES-256 for data at rest, as the provider cannot access or classify customer data.

Answer

Management of the runtime environment

Answer

Physical security of data centers

Question 3

A cloud architect is designing an auto-scaling policy for a web application that experiences predictable traffic spikes every weekday morning from 8 to 10 AM. The application runs on a group of virtual machines behind a load balancer. Which scaling approach is MOST cost-effective while ensuring performance during the spike?

Accepted Answer

Scheduled scaling to increase capacity before 8 AM and decrease after 10 AM. Scheduled scaling is the most cost-effective approach because the traffic pattern is predictable (every weekday 8–10 AM). By configuring the auto-scaling group to add instances before the spike and remove them after, you avoid paying for idle resources during off-peak hours while ensuring capacity is ready when needed. This approach directly matches the known schedule without relying on reactive metrics or manual intervention.

Answer

Dynamic scaling based on CPU utilization threshold

Answer

Proactive scaling using machine learning to predict spikes

Answer

Manual scaling by the operations team each morning

Question 4

A cloud engineer is troubleshooting a VM that is experiencing high latency. The VM is hosted on a hypervisor with other VMs. Which TWO metrics should the engineer review to identify if resource contention is occurring?

Accepted Answer

Memory ballooning. Memory ballooning (A) is a VMware mechanism where the hypervisor reclaims idle memory from a VM by inflating a balloon driver, forcing the VM to swap. High ballooning indicates memory overcommitment and contention, directly causing latency. CPU ready time (B) measures the time a VM is ready to run but waiting for a physical CPU core; elevated ready time signals CPU contention among VMs on the same hypervisor.

Answer

Network packet drops

Answer

Swap usage

Answer

Disk queue length

Question 5

A company has deployed a multi-tier application on a public cloud platform. The security team discovers that a Compute Instance is communicating with an external IP address known for malicious activity. The instance is part of an auto scaling group. What is the BEST immediate action to contain the threat while minimizing downtime?

Accepted Answer

Remove the instance from the auto scaling group and attach a security group that blocks all traffic.. Isolating the compromised instance by detaching it from the auto scaling group and applying a security group that denies all traffic can quickly contain the threat. Network ACLs are attached to subnets and changing them could affect other instances. Suspending the auto scaling group alone may not stop the current instance. Updating routing tables is complex and could disrupt legitimate traffic.

Answer

Suspend the auto scaling group to prevent additional instances from being launched.

Answer

Use a routing table blackhole to drop traffic from the instance.

Answer

Modify the network ACL for the subnet to deny traffic to the malicious IP.

Question 6

A cloud architect is designing a VPC with public and private subnets. Which component is required to allow instances in the private subnet to access the internet for software updates?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Place web servers in a public subnet and database servers in a private subnet. Public subnets for web servers and private subnets for databases, with a load balancer in the public subnet routing to web servers in a private subnet if needed; but typically web servers are in public subnets.

Answer

Place all servers in public subnets and restrict access via security groups

Answer

Place web servers in a private subnet and database servers in a public subnet

Answer

Place all servers in private subnets and use a bastion host for access

Question 7

An organization uses a cloud-based load balancer to distribute traffic to a web application across multiple availability zones. Users report that the application is intermittently unavailable. The cloud administrator finds that the load balancer health checks are failing on instances in one availability zone. What is the most likely cause?

Accepted Answer

The availability zone is experiencing a partial outage.. When health checks fail for all instances in a single availability zone (AZ) while other AZs remain healthy, the most likely cause is a partial outage or degradation within that AZ. Cloud providers like AWS, Azure, or GCP isolate AZs to prevent single points of failure, but an AZ can experience issues such as network connectivity loss, power disruption, or hardware failures that affect all instances in that zone. The load balancer's health checks are designed to detect such zone-level failures by probing each instance; if an entire AZ is impaired, all its instances will fail the health check simultaneously.

Answer

A single instance in the failing AZ has a misconfigured web server.

Answer

The DNS settings for the application domain are misconfigured.

Answer

The load balancer's listener configuration is incorrect.

Question 8

A cloud administrator is configuring a CASB (Cloud Access Security Broker) for SaaS applications. Which TWO capabilities should the administrator expect from the CASB? (Choose two.)

Accepted Answer

Discover and control shadow IT usage. CASBs provide visibility into shadow IT, enforce data loss prevention policies, and control access to SaaS applications.

Answer

Manage on-premises server patches

Answer

Provide local DNS resolution

Answer

Replace the cloud provider's infrastructure

Question 9

A company is migrating a legacy application to the cloud using a replatforming strategy. The application uses a proprietary logging framework that writes logs to local disk. The cloud architecture uses ephemeral storage for the application servers. The operations team notices that logs are lost when servers are replaced during auto-scaling events. What is the best solution to ensure logs are preserved?

Accepted Answer

Configure the logging framework to write to a central log server over the network.. The core issue is that ephemeral storage is lost when instances are terminated or replaced during auto-scaling events. By configuring the logging framework to write to a central log server over the network (e.g., using syslog, HTTP, or a dedicated log aggregation service), logs are persisted independently of the application server's lifecycle. This decouples log storage from compute resources, ensuring logs survive scaling events.

Answer

Increase the size of the ephemeral storage.

Answer

Use memory-only logging to speed up disk I/O.

Answer

Disable auto-scaling for the application servers.

Question 10

A company is migrating a legacy database that relies on a specific hardware security module (HSM) that cannot be moved to the cloud. The application must continue to function with minimal redevelopment. Which migration strategy is most appropriate?

Accepted Answer

Replace. (Replace) because the legacy database depends on a specific hardware security module (HSM) that cannot be migrated to the cloud. Replacing the database with a cloud-native equivalent (e.g., Amazon RDS or Azure SQL Database) that supports a cloud-based HSM (like AWS CloudHSM or Azure Key Vault Managed HSM) allows the application to continue functioning with minimal redevelopment, as the replacement typically maintains SQL compatibility and standard interfaces.

Answer

Refactor

Answer

Rehost

Answer

Rebuild