CV0-004 Practice Exam 2 — 20 Questions

Question 1

A cloud administrator is configuring an alert for an Azure virtual machine. The alert should trigger when the average CPU percentage exceeds 90% for more than 10 minutes. Which Azure service should be used to create this metric alert?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Monitor Alerts. Azure Monitor Alerts allow you to create metric alerts based on conditions like CPU percentage thresholds and evaluation periods.

Answer

Azure Advisor

Answer

Azure Log Analytics

Answer

Azure Security Center

Question 2

A small business hosts a web application on a single cloud server. The server has 2 vCPUs and 4 GB RAM. Recently, the application crashes when the number of concurrent users exceeds 50. The administrator checks the system logs and finds out-of-memory (OOM) errors. What is the best course of action to resolve this issue without redesigning the application?

Accepted Answer

Increase the server's RAM to 8 GB. The best course of action is to increase the server's RAM to 8 GB (Option C). The OOM errors indicate that the current 4 GB RAM is insufficient for 50+ concurrent users. Increasing RAM directly addresses the memory shortage without requiring application changes or redesign. Option A (load balancer and another server) adds complexity and cost, and may not resolve the memory issue on the single server if the application is not stateless. Option B (code optimization) is a redesign effort that may not be feasible as a quick fix. Option D (enabling swap space) can lead to severe performance degradation because swapping is much slower than RAM, and may still cause crashes under high load.

Answer

Add a load balancer and another server

Answer

Reduce the application's memory footprint by code optimization

Answer

Enable swap space on the server

Question 3

A cloud team is implementing a CI/CD pipeline for a containerized application. They want to automatically build a Docker image, push it to a registry, and deploy it to a Kubernetes cluster. Which TWO tools from the options below are commonly used as part of this pipeline? (Select 2)

Accepted Answer

Jenkins. Jenkins and GitLab CI are both CI/CD tools that can build Docker images, push to registries, and deploy to Kubernetes. Terraform and CloudFormation are IaC tools, not CI/CD. Docker Compose is for local development.

Answer

CloudFormation

Answer

Terraform

Answer

Docker Compose

Question 4

Which of the following is a stateless network access control that requires explicit allow rules for both inbound and outbound traffic?

Accepted Answer

Network ACL. Network ACLs (NACLs) are stateless; security groups are stateful.

Answer

Security group

Answer

DDoS protection

Answer

Web application firewall

Question 5

A cloud administrator is investigating why a virtual machine is running slowly. The administrator checks the hypervisor performance metrics. Which TWO of the following metrics indicate CPU contention? (Choose TWO.)

Accepted Answer

High CPU ready time. CPU ready time (option A) and co-stop time (option C) are both indicators of CPU contention. Ready time is time a VM is ready to run but waiting for CPU; co-stop time is time a VM is stopped because another vCPU in the same VM is contending. Option E (High CPU usage percentage) is normal utilization, not contention. Option B (High disk queue depth) is storage-related. Option D (High memory ballooning) is memory-related.

Answer

High disk queue depth

Answer

High memory ballooning

Answer

High CPU usage percentage

Question 6

An organization wants to minimize costs for a batch processing workload that runs nightly for 2 hours and can tolerate interruptions. Which pricing model is most cost-effective?

Accepted Answer

Spot instances. Spot instances offer significant discounts but can be terminated; suitable for fault-tolerant, interruptible workloads.

Answer

On-demand instances

Answer

Reserved instances

Answer

Dedicated hosts

Question 7

A company plans to use a public cloud to host a static website with minimal configuration. The website content is stored in an object storage bucket. Users access the site via a custom domain name. Which cloud service should the company use to serve the content with low latency globally?

Accepted Answer

Content delivery network (CDN) with the object storage as origin. A CDN caches static content at edge locations worldwide, reducing latency for global users. By configuring the object storage bucket as the origin, the CDN pulls content on cache miss and serves it from the nearest edge node. This meets the requirement of minimal configuration while providing low-latency delivery via a custom domain.

Answer

Reverse proxy server in each region

Answer

DNS-based round-robin to multiple storage buckets

Answer

Load balancer distributing traffic to multiple object storage endpoints

Question 8

A company is migrating to GCP and needs to ensure data encryption in transit for all external communications. Which THREE measures should be implemented? (Choose three.)

Accepted Answer

Configure load balancer to redirect HTTP to HTTPS. TLS 1.2+ ensures strong encryption in transit. Certificate management ensures valid certificates. Enforcing HTTPS via load balancer policies redirects HTTP traffic.

Answer

Disable TLS for internal VPC traffic

Answer

Enable AES-256 encryption at rest

Question 9

Refer to the exhibit. A cloud engineer is reviewing logs from an EC2 instance. Which of the following is the MOST likely root cause of the application failure?

Accepted Answer

The disk space reached 100% capacity, preventing the application from writing logs. When disk space reaches 100% capacity, the operating system cannot write new data to the filesystem. Since the application relies on writing logs (and potentially other data) to disk, it will fail when it cannot perform these write operations. This is a common root cause in cloud environments where log rotation is not configured or monitoring thresholds are not set.

Answer

The application experienced a segmentation fault due to a code bug

Answer

The instance ran out of memory because the application had a memory leak

Answer

The instance was stopped by the cloud provider due to a license violation

Question 10

During a cloud deployment, a virtual machine is created from a custom image. After boot, the VM is not accessible via SSH. Which of the following should the administrator check FIRST?

Accepted Answer

The security group rules for inbound SSH. The most common reason a newly deployed VM is inaccessible via SSH is that the security group or network ACL does not permit inbound TCP port 22 traffic. Security groups act as a virtual firewall at the instance level, and if the rule allowing SSH from the administrator's IP is missing or misconfigured, the connection will be refused. This should be the first check because it is a frequent misconfiguration during deployment.

Answer

The boot volume is encrypted

Answer

The hypervisor version compatibility

Answer

The image's OS license activation status

Question 11

A cloud administrator is troubleshooting a performance issue where an application running on a VM in a private cloud is experiencing high latency. The VM is connected to a virtual switch that uses SR-IOV. The administrator suspects network bottlenecks. Which of the following is the MOST likely cause of the latency?

Accepted Answer

The physical network interface card (NIC) is saturated.. SR-IOV allows a physical NIC to present multiple virtual functions (VFs) directly to VMs, bypassing the virtual switch for data plane traffic. When the physical NIC reaches its bandwidth capacity, all VFs sharing that NIC experience increased latency and packet drops, making NIC saturation the most likely cause of the high latency.

Answer

The virtual switch is dropping packets due to buffer exhaustion.

Answer

The VM's virtual NIC is not using the correct driver.

Answer

The hypervisor's CPU is overloaded due to SR-IOV emulation.

Question 12

A company uses a multi-cloud strategy with both AWS and Azure. The cloud operations team needs to centrally monitor all cloud resources and receive alerts when resource usage exceeds predefined thresholds. Which of the following solutions should the team implement?

Accepted Answer

A third-party monitoring tool that supports both AWS and Azure. A third-party monitoring tool (e.g., Datadog, Splunk, or Dynatrace) can natively ingest metrics and logs from both AWS and Azure APIs, providing a single pane of glass for alerting across a multi-cloud environment. This avoids the vendor lock-in and integration gaps that arise when using native tools from only one cloud provider.

Answer

Azure Monitor with Log Analytics

Answer

AWS CloudWatch with cross-account monitoring

Answer

Custom scripts that log to a central syslog server

Question 13

A company hosts a critical application on a single virtual machine in a public cloud. The virtual machine has been running without issues for months. Recently, the application became unresponsive, and users report a '500 Internal Server Error'. The cloud administrator checks the virtual machine's status and finds it is 'Running'. The administrator can successfully ping the virtual machine's public IP address. The administrator then attempts to SSH into the virtual machine but receives 'Connection timed out'. The virtual machine's security group allows SSH (port 22) from the administrator's IP address. The operating system firewall is enabled and configured to allow SSH. What should the administrator do next to troubleshoot the issue?

Accepted Answer

Use a serial console or out-of-band management to access the virtual machine's console.. The administrator can ping the VM (ICMP works) but SSH (TCP/22) times out, indicating the application is running but the SSH service or network stack is not responding to new connections. Since the cloud security group and OS firewall are correctly configured, the issue is likely at the OS level (e.g., SSH daemon crashed, kernel panic, or network service hung). Using a serial console or out-of-band management (e.g., AWS EC2 Serial Console, Azure Serial Console) provides direct, network-independent access to the VM's console, bypassing the broken network stack to diagnose and fix the OS-level problem.

Answer

Reset the virtual machine from the cloud provider's management console.

Answer

Create a new virtual machine and migrate the application.

Answer

Check the application logs from the cloud provider's monitoring service.

Question 14

A cloud administrator is troubleshooting a network connectivity issue between two subnets. They suspect a security group or NACL is blocking traffic. Which tool should they use to analyze the traffic flow?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture network traffic metadata, helping identify dropped packets.

Answer

AWS X-Ray

Answer

AWS CloudTrail

Answer

AWS Config

Question 15

A cloud architect is designing a container security strategy. Which TWO of the following should be implemented to secure containers? (Choose two.)

Accepted Answer

Runtime security monitoring for anomalous behavior. Image scanning detects vulnerabilities in container images, and runtime security monitors containers for anomalous behavior. Network ACLs are not container-specific. Using the latest base image reduces vulnerabilities. Disabling security controls is wrong.

Answer

Disabling all security contexts in Kubernetes

Answer

Using the latest base images without scanning

Answer

Implementing network ACLs at the hypervisor level

Question 16

A company migrated to a hybrid cloud and users report slow access to files stored in the cloud. The on-premises network is 100 Mbps. What troubleshooting step should be taken?

Accepted Answer

Check VPN bandwidth and latency. Slow file access over a hybrid connection is often due to limited VPN bandwidth or high latency. Option A is wrong because increasing storage performance tier may not address network bottlenecks. Option C is wrong because moving files back defeats the hybrid cloud purpose. Option D is wrong because compression may help but isn't the first step to diagnose the issue.

Answer

Enable compression on the cloud storage gateway

Answer

Increase cloud storage performance tier

Answer

Move files to on-premises storage

Question 17

A cloud application returns HTTP 503 errors during high traffic. The application runs on VMs behind a load balancer. Which action is most likely to resolve the issue?

Accepted Answer

Add additional VMs to the backend pool.. Adding VMs increases the overall capacity to handle high traffic, directly addressing the 503 errors caused by overload. Option A is incorrect because restarting only one VM does not increase capacity; it might briefly disrupt service. Option B is incorrect because lowering the DNS TTL affects how clients resolve the domain, not the backend capacity. Option C is incorrect because increasing the health check interval only delays detection of unhealthy VMs, which does not prevent overload.

Answer

Restart the web server service on one VM.

Answer

Change the DNS TTL to a lower value.

Answer

Increase the health check interval on the load balancer.

Question 18

A cloud administrator is configuring an alert for an Azure virtual machine. The alert should trigger when the average CPU percentage exceeds 90% for more than 10 minutes. Which Azure service should be used to create this metric alert?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Scheduled scaling to add instances before 9 AM. Scheduled scaling allows you to increase capacity at specific times. Target tracking and step scaling are reactive. Cooldown periods are settings within policies.

Answer

Step scaling with a cool-down period

Answer

Simple scaling with a 300-second cooldown

Answer

Target tracking scaling based on average CPU utilization

Question 19

A company needs to migrate 50 TB of data from an on-premises file server to a cloud storage service. The network bandwidth is limited and the migration must be completed within one week. Which cloud service is specifically designed for offline data transfer of large datasets?

Accepted Answer

Offline data transfer via physical device. Offline data transfer via physical device is specifically designed for offline data transfer of large datasets, such as 50 TB, when network bandwidth is limited. It provides physical storage devices that are shipped to the customer, loaded with data, and returned to the cloud provider for ingestion into the cloud storage service, bypassing network constraints entirely. This makes it the ideal choice for completing a 50 TB migration within one week over a limited bandwidth connection.

Answer

Online data transfer service

Answer

Batch processing service

Answer

Data transfer acceleration

Question 20

A developer is deploying a serverless function that processes images uploaded to an S3 bucket. The function should be triggered automatically whenever a new object is created in the bucket. Which event source should be configured to invoke the Lambda function?

Accepted Answer

Amazon S3. S3 can send events to Lambda when objects are created, enabling automatic processing without polling.

Answer

Amazon SQS

Answer

Amazon EventBridge

Answer

API Gateway