CV0-004 Practice Test 20 — 15 Questions

Question 1

A company is migrating on-premises workloads to a public cloud. The disaster recovery plan requires an RTO of 15 minutes and an RPO of 5 minutes. Which replication strategy should be used for a critical database?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Continuous replication to a standby instance in another region. Continuous replication to a standby instance in another region provides an RPO of near-zero (often seconds) and an RTO of minutes, as the standby can be promoted quickly. This meets the required RPO of 5 minutes and RTO of 15 minutes. Continuous replication ensures that data changes are replicated asynchronously or synchronously, depending on configuration, minimizing data loss.

Answer

Weekly full backups with daily incrementals stored in the same region

Answer

Scheduled snapshots every hour with cross-region copy

Answer

Daily snapshots replicated cross-region

Question 2

Which of the following is a benefit of using a Cloud Access Security Broker (CASB) for SaaS applications?

Accepted Answer

It gives visibility and control over Shadow IT and data protection.. CASBs provide visibility into SaaS usage and enforce security policies, such as data loss prevention (DLP) and access control.

Answer

It encrypts data at rest in cloud storage.

Answer

It provides a virtual private network (VPN) for remote access.

Answer

It replaces the need for a web application firewall.

Question 3

A company runs a stateful application that maintains session data in memory on the server. The application experiences performance issues during traffic spikes. Which design change would best improve scalability?

Accepted Answer

Move session state to a shared cache or database (stateless design). Making the application stateless by moving session state to an external store (e.g., Redis or database) allows any instance to handle any request, enabling horizontal scaling.

Answer

Increase the memory of each server (vertical scaling)

Answer

Implement sticky sessions on the load balancer

Answer

Use a CDN to cache static content

Question 4

A cloud engineer is writing a Terraform configuration to deploy an AWS EC2 instance. Which file extension is typically used for Terraform configuration files written in HCL?

Accepted Answer

.tf. Terraform configuration files written in HCL (HashiCorp Configuration Language) typically use the .tf file extension. This is the standard convention for Terraform modules and configurations, and Terraform automatically loads files with this extension. Other extensions like .tf.json are used for JSON-based configurations, but .tf is the primary one for HCL.

Answer

.yaml

Answer

.json

Answer

.hcl

Question 5

A company needs to deploy a web application quickly and reliably. Which approach is best?

Accepted Answer

Use a CI/CD pipeline with automated deployment. A CI/CD pipeline with automated deployment is the best approach because it integrates code changes, runs tests, and deploys to production in a repeatable, auditable manner. This ensures speed, consistency, and rollback capability, which are critical for reliable web application deployment in a cloud or on-premises environment.

Answer

FTP the application to each server individually

Answer

Perform a blue-green deployment manually

Answer

Manually copy the application files to the server

Question 6

Which storage type is most appropriate for a shared file system that multiple virtual machines need to mount simultaneously with read/write access?

Accepted Answer

File storage. File storage (e.g., NFS, SMB, or a shared file system like Azure Files) is designed to be mounted simultaneously by multiple clients with read/write access, providing a shared namespace and file-level locking. Block storage typically attaches to a single VM at a time (unless using shared disks with cluster-aware file systems), and object storage is accessed via HTTP APIs, not mounted as a traditional file system. Archive storage is for long-term retention and is not suitable for active shared read/write workloads.

Answer

Archive storage

Answer

Object storage

Answer

Block storage

Question 7

A DevOps team deploys a containerized application to a Kubernetes cluster. They need to ensure that containers cannot run with privileged access. Which Kubernetes security mechanism should be applied?

Accepted Answer

Pod Security Standards. Pod Security Standards (PSS) define three profiles — Privileged, Baseline, and Restricted — that control whether pods can run with privileged access, host networking, hostPath volumes, and similar elevated capabilities. Enforcing the Restricted or Baseline profile via Pod Security Admission prevents containers from running privileged. This is the native Kubernetes mechanism for restricting pod-level privileges.

Answer

Network policies

Answer

ConfigMaps

Answer

Service accounts

Question 8

A cloud engineer is deploying a serverless application using AWS Lambda. The application processes files uploaded to an S3 bucket. To minimize cold start latency, which deployment configuration should the engineer use?

Accepted Answer

Increase the memory allocation and enable provisioned concurrency.. Provisioned concurrency pre-warms a specified number of Lambda execution environments, eliminating cold starts for those instances. Increasing memory allocation also proportionally increases CPU and network throughput, which can reduce initialization time. Together, these configurations directly address cold start latency for a serverless application processing S3 uploads.

Answer

Set the function timeout to the minimum value.

Answer

Place the Lambda function in a VPC without any NAT gateway.

Answer

Configure the function to run in a specific Availability Zone.

Question 9

A company wants to reduce costs by identifying underutilized EC2 instances and receiving recommendations to downsize them. Which AWS service provides rightsizing recommendations based on historical utilization metrics?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer analyzes historical utilization metrics of EC2 instances and provides rightsizing recommendations to downsize underutilized instances, helping reduce costs. It uses machine learning to generate recommendations based on CPU, memory, and other metrics.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Auto Scaling

Question 10

Which cloud deployment model involves connecting an on-premises data center to a public cloud provider using a VPN or dedicated connection?

Accepted Answer

Hybrid cloud. A hybrid cloud is defined by the integration of on-premises infrastructure (private cloud) with a public cloud provider, typically via a secure network connection such as a VPN or dedicated link (e.g., AWS Direct Connect, Azure ExpressRoute). This model allows workloads and data to move between environments, enabling burst capacity, disaster recovery, and gradual migration. The key differentiator is the interconnection between private and public resources, which is exactly what the question describes.

Answer

Private cloud

Answer

Multi-cloud

Answer

Public cloud

Question 11

A cloud administrator notices that a load balancer is marking all instances as unhealthy. The health check is configured to check a specific URL path. Which of the following is the MOST likely cause?

Accepted Answer

The health check path does not exist on the instances.. The health check is configured to check a specific URL path. If that path does not exist on the instances (e.g., returns a 404 or 403 status), the load balancer will consider the instances unhealthy. This is the most direct cause because the health check relies on a successful HTTP response (typically 200 OK) from that exact path.

Answer

The auto scaling group's minimum size is too low.

Answer

The security group for the instances blocks traffic from the load balancer.

Answer

The instances are under high CPU load.

Question 12

An administrator is configuring a backup policy for a critical application database. The policy must allow point-in-time recovery up to the last 5 minutes. The database is updated continuously throughout the day. Which of the following backup strategies BEST meets the requirement?

Accepted Answer

Daily full backups plus transaction log backups every 5 minutes.. It combines daily full backups with transaction log backups every 5 minutes, which is the only strategy that supports point-in-time recovery (PITR) to within 5 minutes for a continuously updated database. Transaction log backups capture every committed transaction, allowing restoration to any specific point in time by replaying logs from the last full backup.

Answer

Weekly full backups with daily differential backups.

Answer

Hourly snapshots of the virtual machine.

Answer

Daily full backups of the database.

Question 13

A cloud operations team wants to analyze application performance and identify slow database queries. They need a distributed tracing solution. Which service should they use?

Accepted Answer

AWS X-Ray. AWS X-Ray is a distributed tracing service that traces requests as they travel through microservices, Lambda functions, and database calls, producing a service map and segment timelines. It can pinpoint slow database queries by showing subsegment durations for SQL and NoSQL calls. This makes X-Ray the correct tool for identifying performance bottlenecks across a distributed application.

Answer

Amazon Inspector

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs Insights

Question 14

According to the shared responsibility model, which of the following is the cloud provider responsible for?

Accepted Answer

Physical infrastructure security. Under the shared responsibility model, the cloud provider is always responsible for the security OF the cloud — the physical facilities, hardware, network fabric, and hypervisor layer that underpin the service. Physical infrastructure security (data center access controls, hardware disposal, environmental controls) is entirely the provider's domain and cannot be delegated to the customer. Customers are responsible for security IN the cloud, which covers their data, configurations, and workloads.

Answer

Operating system patching

Answer

Application code security

Answer

Identity and access management configuration

Question 15

A company uses a cloud provider's key management service to encrypt data at rest. The security team wants to ensure that encryption keys are automatically rotated every 90 days to meet compliance requirements. Which feature should be enabled?

Accepted Answer

Key automatic rotation. Key automatic rotation is the KMS feature that schedules and performs periodic key rotation without manual intervention, satisfying a 90-day compliance requirement. In AWS KMS, Azure Key Vault, and OCI Vault, enabling automatic rotation lets the service generate new key material on a defined schedule while retaining old versions for decryption. This directly meets the requirement of automatic rotation every 90 days.

Answer

Key import scheduling

Answer

Key revocation

Answer

Key policy enforcement