CV0-004 Practice Exam 1 — 20 Questions

Question 1

A cloud engineer is designing a solution for a financial application that requires strict data residency in a specific country. The application must also be highly available across multiple data centers within that country. Which design consideration is most critical?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploying resources in multiple availability zones within the same region.. Deploying across multiple availability zones within the same region keeps data within the country while providing high availability through fault isolation. This satisfies both data residency and availability requirements without introducing cross-border data flows that could violate regulations.

Answer

Using a content delivery network (CDN) to cache data globally.

Answer

Using a global load balancer to distribute traffic across continents.

Answer

Implementing a multi-region active-active architecture.

Question 2

A cloud administrator is reviewing cost reports and notices that a development environment is incurring high costs due to idle compute resources. The environment is used only during business hours on weekdays. Which of the following actions would MOST effectively reduce costs?

Accepted Answer

Implement an auto-scaling schedule to shut down instances during off-hours.. An auto-scaling schedule allows you to define time-based rules to automatically scale in (terminate) instances during off-hours and scale out (launch) them during business hours. This directly addresses the idle compute waste by ensuring resources are only running when needed, which is the most effective cost reduction strategy for a predictable usage pattern like weekdays 9-to-5.

Answer

Move the development environment to a different region with lower costs.

Answer

Change all instances to smaller instance types.

Answer

Use spot instances for all development servers.

Question 3

A cloud administrator needs to ensure that application logs are retained for three years to comply with regulatory requirements. Which of the following is the MOST cost-effective solution?

Accepted Answer

Use a lifecycle policy to transition logs to archive storage after 90 days and delete after three years. The most cost-effective solution because it uses a lifecycle policy to automatically transition logs from hot storage to cheaper archive storage (e.g., Amazon S3 Glacier or Azure Blob Archive tier) after 90 days, then deletes them after three years. This minimizes storage costs by moving infrequently accessed data to lower-cost tiers while still meeting the three-year retention requirement without manual intervention or unnecessary use of expensive block storage.

Answer

Configure log rotation so only the last 30 days of logs are kept in the instance

Answer

Store all logs in block storage for three years

Answer

Compress old logs manually and store them in a separate volume

Question 4

During a security audit, an organization discovers their cloud-based database is accessible from any public IP address due to a firewall rule allowing 0.0.0.0/0 on port 3306 (MySQL). The database must remain accessible to remote developers working from home. What is the most effective remediation?

Accepted Answer

Change the firewall rule to allow only specific known developer IP ranges.. Restricting to specific trusted IP ranges reduces exposure while maintaining remote access.

Answer

Remove the firewall rule entirely and rely on database IAM authentication.

Answer

Enable encryption in transit using TLS and keep the rule as is.

Answer

Move the database to a private subnet without a NAT gateway.

Question 5

An organization must comply with a regulation requiring that all data stored in the cloud be encrypted at rest using a cloud provider's native encryption service. The company also needs to maintain control over the encryption keys. Which solution should the architect recommend?

Accepted Answer

Use the cloud provider's native encryption service with customer-managed keys. The regulation requires cloud-native encryption at rest with customer-controlled keys. Cloud providers offer services like AWS KMS with customer-managed keys (CMKs) or Azure Key Vault with customer-managed keys, which allow the organization to create, rotate, and disable keys independently while the provider handles the underlying encryption of data at rest using envelope encryption. This satisfies both the 'native encryption service' and 'maintain control over the encryption keys' requirements.

Answer

Encrypt the data on-premises before uploading to the cloud

Answer

Use the cloud provider's default encryption with provider-managed keys

Answer

Use a third-party hardware security module (HSM) hosted on-premises

Question 6

A company is migrating 100 TB of data from an on-premises NAS to Amazon S3. The network bandwidth is limited to 100 Mbps, and the transfer must complete within 30 days. Which service should the company use to meet the deadline?

Accepted Answer

AWS Snowball. AWS Snowball is the correct choice because transferring 100 TB over a 100 Mbps link would take far longer than 30 days. At 100 Mbps, the theoretical maximum is about 12.5 MB/s, which over 30 days yields roughly 32 TB, well short of 100 TB. Snowball uses physical devices to ship data, bypassing network bandwidth limitations and meeting the deadline.

Answer

AWS DataSync

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Direct Connect

Question 7

A company wants to implement a disaster recovery strategy with an RTO of 15 minutes and an RPO of 1 hour for a critical application running on AWS. Which approach would best meet these requirements?

Accepted Answer

Continuous replication to a warm standby environment with automated failover. Continuous replication to a standby environment with automatic failover provides the lowest RTO and RPO, meeting the requirements.

Answer

Backup to AWS S3 and restore using AWS CloudFormation

Answer

Cross-region replication with a read replica and manual promotion

Answer

Daily snapshots of EBS volumes to another region

Question 8

A company is deploying a stateful application that requires persistent storage. They are using Kubernetes. Which resource should they create to ensure data persists across pod restarts?

Accepted Answer

PersistentVolumeClaim. A PersistentVolumeClaim (PVC) is the correct resource because it abstracts the underlying storage details and allows a pod to request persistent storage that survives pod restarts. When a pod is recreated, the PVC ensures the same volume is reattached, preserving application state. This is essential for stateful applications in Kubernetes, as pods are ephemeral by default.

Answer

Deployment

Answer

Secret

Answer

ConfigMap

Question 9

A cloud operations team needs to implement a monitoring solution for a microservices architecture. The solution must provide centralized logging, metrics, and alerting, and must be able to correlate data from multiple services. Which THREE of the following components should the team include?

Accepted Answer

A centralized logging system (e.g., ELK stack).. Option B is correct because a centralized logging system such as the ELK stack (Elasticsearch, Logstash, Kibana) aggregates logs from all microservices into one searchable store, which is essential for centralized logging and for correlating events across services. Option C is correct because a correlation engine and alerting system is what ties together logs and metrics from multiple services, detects patterns or thresholds, and generates alerts, directly satisfying the alerting and correlation requirements. Option D is correct because a metrics collection agent and dashboard such as Prometheus with Grafana provides time-series metrics collection, storage, and visualization, fulfilling the metrics and dashboarding needs of the monitoring solution. Option A is not required here because a SIEM focuses on security event management and compliance rather than general operational monitoring, metrics, and service correlation. Option E is not required because APM is a specialized tool for tracing application performance and, while useful, is not one of the three core components needed for centralized logging, metrics, and alerting in this scenario.

Answer

A security information and event management (SIEM) system.

Answer

An application performance monitoring (APM) tool.

Question 10

A cloud architect needs to choose a compute service for a batch processing job that runs once a day and takes about 30 minutes. The job is CPU-intensive and can tolerate interruptions. Which compute option is the most cost-effective?

Accepted Answer

Spot (preemptible) instances. (Spot/preemptible instances) is the most cost-effective for this interruptible batch job. Reserved instances (A) require a long-term commitment, on-demand instances (D) are more expensive, and dedicated hosts (C) are costly and unnecessary.

Answer

Reserved instances

Answer

Dedicated hosts

Answer

On-demand instances

Question 11

A cloud engineer needs to collect and query log data from multiple cloud services in a centralized location. Which cloud service should be used for centralized log management?

Accepted Answer

Logging service. A dedicated logging service is designed to ingest, store, and query log data from multiple sources in a centralized location, providing search, filtering, and retention capabilities. It is the purpose-built tool for centralized log management, unlike audit logging (which captures specific compliance events) or monitoring (which focuses on metrics and alerts).

Answer

Audit logging service

Answer

Monitoring service

Answer

Storage service

Question 12

A cloud engineer wants to be notified when the average CPU utilization of an auto-scaling group exceeds 80% for 5 minutes. Which alerting mechanism should be used?

Accepted Answer

AWS CloudWatch Alarm. AWS CloudWatch Alarms are purpose-built to watch a metric (like the Average CPUUtilization of an Auto Scaling group) and trigger actions when a threshold is breached for a defined number of evaluation periods. Configuring an alarm with a threshold of 80%, a period of 300 seconds, and the appropriate statistic/datapoints-to-alarm directly satisfies the 'exceeds 80% for 5 minutes' requirement. Alarms can then notify via SNS, trigger Auto Scaling, or invoke actions.

Answer

AWS Systems Manager OpsCenter

Answer

AWS Config rule

Answer

AWS Trusted Advisor

Question 13

Refer to the exhibit. A cloud administrator runs this command on a VM. Which of the following is most likely causing the high 'wa' value?

Accepted Answer

Disk I/O bottleneck. The 'wa' value in the output of the 'top' or 'vmstat' command represents the percentage of time the CPU spends waiting for I/O operations to complete. A high 'wa' value indicates that the CPU is frequently idle because it is waiting for data from storage devices, which is a classic symptom of a disk I/O bottleneck. This occurs when the storage subsystem cannot keep up with the read/write requests from the VM, causing the CPU to stall.

Answer

Network congestion

Answer

High CPU load

Answer

Insufficient memory

Question 14

A company uses a multi-cloud strategy with both AWS and Azure. The cloud operations team needs to centrally monitor all cloud resources and receive alerts when resource usage exceeds predefined thresholds. Which of the following solutions should the team implement?

Accepted Answer

A third-party monitoring tool that supports both AWS and Azure. A third-party monitoring tool (e.g., Datadog, Splunk, or Dynatrace) can natively ingest metrics and logs from both AWS and Azure APIs, providing a single pane of glass for alerting across a multi-cloud environment. This avoids the vendor lock-in and integration gaps that arise when using native tools from only one cloud provider.

Answer

Azure Monitor with Log Analytics

Answer

AWS CloudWatch with cross-account monitoring

Answer

Custom scripts that log to a central syslog server

Question 15

A cloud administrator needs to perform a disaster recovery test for a critical application running in a different AWS region. The RTO is 1 hour, and the RPO is 15 minutes. Which replication strategy should be used to meet the RPO?

Accepted Answer

Continuous replication. Continuous replication replicates data continuously, so the recovery point objective (RPO) — the maximum acceptable data loss — can be as low as seconds or minutes, meeting the 15-minute requirement. Snapshot-based approaches at hourly or daily intervals cannot meet a 15-minute RPO.

Answer

Hourly snapshot-based replication

Answer

Daily snapshot-based replication

Answer

Cross-region replication with eventual consistency

Question 16

A security administrator is configuring a Web Application Firewall (WAF) to protect a public-facing web application. The application experiences a high volume of traffic from certain geographic regions that are not serving customers. Which WAF feature should be used to block this traffic?

Accepted Answer

Geo-blocking. Geo-blocking allows the WAF to block or allow traffic based on geographic location, reducing unwanted traffic and potential attacks.

Answer

Rate limiting

Answer

OWASP rule set

Answer

IP reputation lists

Question 17

A cloud administrator receives reports that a newly deployed application stack fails health checks and is repeatedly replaced by the orchestrator. Logs show the container starts, then exits after a few seconds with no error. The container image runs a process that daemonizes and returns control to the shell. Which of the following is the MOST likely cause?

Accepted Answer

The container's main process forks into the background, so the runtime sees the foreground process exit and stops the container.. Container lifecycle is bound to the foreground process. When the entrypoint backgrounds the application and returns, the runtime sees the main process complete and stops the container, so the orchestrator repeatedly recreates it. Running the server in the foreground or using a process supervisor keeps the container alive and allows health checks to succeed.

Answer

The orchestrator's restart policy is set to Always, causing healthy containers to be restarted.

Answer

The container image was built for the wrong CPU architecture and the kernel is killing the process.

Answer

The container's health check endpoint is returning 500 errors because the application is not fully initialized.

Question 18

A cloud administrator notices that a cloud-based web application is experiencing intermittent latency during peak hours. The application runs on an auto-scaling group of virtual machines behind a load balancer. Which of the following should the administrator investigate FIRST to resolve the issue?

Accepted Answer

Review the auto-scaling group's scaling policies and thresholds. The intermittent latency during peak hours is most likely caused by the auto-scaling group's scaling policies not reacting quickly enough or being set with thresholds that are too high, leading to insufficient capacity under load. Investigating the scaling policies and thresholds first directly addresses the root cause—whether the group is adding instances too slowly or at too high a utilization trigger—rather than symptoms like health checks or DNS. This aligns with the operational best practice of verifying capacity management before tuning network or load-balancer settings.

Answer

Enable SSL offloading on the load balancer

Answer

Verify the load balancer's health check interval

Answer

Check DNS resolution times for the application domain

Question 19

A cloud engineer is configuring a web application on AWS and needs to ensure that only HTTP and HTTPS traffic from the internet is allowed to reach the EC2 instances. Which AWS service should be used to control inbound traffic at the instance level?

Accepted Answer

Security Group. Security groups are stateful virtual firewalls that control inbound and outbound traffic at the instance level. Network ACLs operate at the subnet level and are stateless.

Answer

AWS Shield

Answer

AWS WAF

Answer

Network ACL

Question 20

A company uses a public cloud PaaS service to run a custom application. They need to ensure the application can handle increased load without downtime. Which action should they take?

Accepted Answer

Configure auto-scaling for the PaaS service. In a PaaS environment, the cloud provider manages the underlying infrastructure, so the customer cannot manually upgrade VMs. Auto-scaling is a built-in feature of many PaaS services that automatically adjusts resources based on demand, ensuring the application can handle increased load without downtime. This is the most appropriate action.

Answer

Deploy a load balancer in front of the application

Answer

Move to IaaS to gain more control over scaling

Answer

Upgrade the underlying virtual machines manually