CV0-004 Practice Exam 3 — 20 Questions

Question 1

A company is migrating a legacy on-premises application to a public cloud. The application currently uses a single monolithic architecture and relies on a local file system for storage. The cloud architect needs to redesign the application to take advantage of cloud-native features. Which design principle should the architect prioritize to ensure scalability and resilience?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Refactor the application into microservices deployed across multiple instances. Refactoring the monolithic application into microservices enables independent scaling of components, improves fault isolation, and aligns with cloud-native patterns like containerization and orchestration (e.g., Kubernetes). This approach leverages horizontal scaling across multiple instances, which is essential for achieving elasticity and resilience in a public cloud environment, unlike the legacy single-point-of-failure monolithic design.

Answer

Maintain the monolithic architecture and connect via VPN to on-premises storage

Answer

Use vertical scaling by increasing vCPU and RAM on a single large VM

Answer

Deploy the entire application in a single availability zone to reduce latency

Question 2

A cloud administrator is troubleshooting connectivity to a web server running on a Linux VM. The web server is configured to listen on ports 80 (HTTP) and 443 (HTTPS). The administrator runs the iptables command shown in the exhibit. Based on the output, what is the MOST likely reason that external users cannot access the web server on port 443?

Accepted Answer

The iptables rule for port 443 only allows traffic from the 10.0.0.0/8 subnet, which does not include external IP addresses.. The iptables rule for port 443 specifies a source IP range of 10.0.0.0/8, which is a private RFC 1918 address space. External users have public IP addresses that do not fall within this subnet, so their HTTPS traffic is implicitly dropped by the rule's match condition. The default policy being ACCEPT does not override the explicit rule that only permits traffic from the 10.0.0.0/8 subnet.

Answer

The web server is not configured to listen on port 443, so iptables rules are irrelevant.

Answer

The iptables default policy is ACCEPT, but the rule for port 443 explicitly drops traffic from external sources.

Answer

The rule for port 80 is placed before the rule for port 443, causing all HTTPS traffic to be evaluated as HTTP and dropped.

Question 3

A company is migrating its on-premises database to a cloud-managed database service. The database contains sensitive financial data. Which of the following is the MOST important security configuration to implement after migration?

Accepted Answer

Enable encryption at rest using a customer-managed key. Enabling encryption at rest with a customer-managed key is the most important security configuration for sensitive financial data in a cloud-managed database, because it protects data confidentiality even if the underlying storage is compromised and gives the organization control over key lifecycle and access. Customer-managed keys (via KMS or equivalent) allow granular access policies, rotation, and revocation, which are critical for regulatory compliance such as PCI DSS. This directly addresses the protection of data at rest, the primary security concern after migration.

Answer

Configure automated patching schedule

Answer

Enable public read access for monitoring tools

Answer

Set up cross-region replication for high availability

Question 4

A company uses GCP and wants to ensure that log entries from Compute Engine instances are automatically exported to BigQuery for analysis. The logs must include structured JSON data. Which GCP service should be configured to route logs?

Accepted Answer

Cloud Logging using sinks. Cloud Logging can route logs to BigQuery using sinks. It accepts structured logs in JSON format.

Answer

Cloud Audit Logs

Answer

Cloud Functions

Answer

Cloud Monitoring

Question 5

A cloud administrator needs to centrally collect, search, and retain application and system logs from hundreds of Amazon EC2 instances and AWS services for troubleshooting and compliance. The administrator wants a managed service that stores logs in durable storage and allows ad hoc queries using a query language. Which AWS service should the administrator use?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the managed AWS service for centralizing log data from EC2 instances and AWS services. The CloudWatch agent ships instance logs to log groups, and CloudWatch Logs Insights provides a purpose-built query language to search and analyze events. CloudTrail captures API activity, Config tracks resource configuration, and Trusted Advisor offers recommendations, none of which provide general log ingestion and querying.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 6

An organization uses a cloud-based load balancer to distribute traffic to a web application across multiple availability zones. Users report that the application is intermittently unavailable. The cloud administrator finds that the load balancer health checks are failing on instances in one availability zone. What is the most likely cause?

Accepted Answer

The availability zone is experiencing a partial outage.. When health checks fail for all instances in a single availability zone (AZ) while other AZs remain healthy, the most likely cause is a partial outage or degradation within that AZ. Cloud providers like AWS, Azure, or GCP isolate AZs to prevent single points of failure, but an AZ can experience issues such as network connectivity loss, power disruption, or hardware failures that affect all instances in that zone. The load balancer's health checks are designed to detect such zone-level failures by probing each instance; if an entire AZ is impaired, all its instances will fail the health check simultaneously.

Answer

A single instance in the failing AZ has a misconfigured web server.

Answer

The DNS settings for the application domain are misconfigured.

Answer

The load balancer's listener configuration is incorrect.

Question 7

A company uses Google Cloud Platform (GCP) and wants to enforce that all service accounts used by applications have only the permissions necessary to perform their tasks. Which IAM concept should the administrator apply?

Accepted Answer

Least privilege. The principle of least privilege dictates granting only the required permissions. In GCP, this is achieved by assigning predefined roles that are narrowly scoped to specific services, and by using conditions to further restrict access.

Answer

Separation of duties

Answer

Privileged access management (PAM)

Answer

Role-based access control (RBAC)

Question 8

A company is designing a disaster recovery (DR) plan for a critical application hosted in a public cloud. The application requires a recovery time objective (RTO) of 1 hour and a recovery point objective (RPO) of 15 minutes. Which of the following DR strategies BEST meets these requirements?

Accepted Answer

Warm standby with continuous data replication.. Warm standby with continuous data replication meets the RTO of 1 hour and RPO of 15 minutes because it maintains a partially scaled-down replica of the production environment that can be quickly scaled up, and continuous replication (e.g., using asynchronous replication or Change Block Tracking) ensures data loss is limited to seconds or minutes, well within the 15-minute RPO.

Answer

Backup and restore with daily backups.

Answer

Cold standby with nightly backups.

Answer

Pilot light with hourly snapshots.

Question 9

A company uses Azure and wants to enforce multi-factor authentication (MFA) for all administrative users. The solution must be centrally managed and apply to all Azure subscriptions. Which approach should be used?

Accepted Answer

Create a Conditional Access policy in Azure AD requiring MFA for all cloud apps. Conditional Access policies in Microsoft Entra ID are centrally managed and can enforce MFA for all cloud apps across all Azure subscriptions by targeting the 'Microsoft Azure Management' cloud app. This approach applies to all administrative users regardless of subscription, as Microsoft Entra ID is the identity provider for Azure resources.

Answer

Configure MFA on each individual Azure subscription

Answer

Assign MFA to each user individually in Azure AD

Answer

Use Azure Policy to require MFA for admin roles

Question 10

During a disaster recovery test, a cloud administrator finds that the replicated VMs in the secondary site fail to start because they are assigned to a resource pool that does not exist in the secondary site. Which of the following should the administrator have done to prevent this issue?

Accepted Answer

Map the resource pools between primary and secondary sites.. The issue stems from the replicated VMs being assigned to a resource pool that doesn't exist on the secondary site. By mapping resource pools between primary and secondary sites during replication setup, the administrator ensures that the destination resource pool is created or mapped correctly, allowing the VMs to start without dependency errors. This is a common prerequisite in vSphere Replication or similar disaster recovery tools where resource pool configurations must be mirrored to avoid startup failures.

Answer

Use storage snapshot replication instead.

Answer

Ensure the secondary site has identical hardware.

Answer

Configure the replication job to use a different datastore.

Question 11

An organization uses multiple cloud providers and wants to centralize secrets management. Which solution would best meet this requirement?

Accepted Answer

HashiCorp Vault. HashiCorp Vault is a multi-cloud secrets management solution that can store and rotate secrets across different providers.

Answer

Azure Key Vault

Answer

AWS Secrets Manager

Answer

Google Cloud Secret Manager

Question 12

A company wants to migrate its on-premises workloads to the cloud and requires full control over the operating system, installed software, and security configurations. Which cloud service model should they choose?

Accepted Answer

IaaS. IaaS provides virtualized computing resources where the customer manages the OS and above, giving full control.

Answer

FaaS

Answer

PaaS

Answer

SaaS

Question 13

A cloud database cluster is experiencing replication lag. The primary node shows high write activity, and the replicas are on different availability zones. Which of the following is the most likely cause?

Accepted Answer

Network latency between the primary and replica zones is high.. Network latency between availability zones is a common cause of replication lag in asynchronous replication setups, especially when the primary has high write activity. Option A is incorrect because synchronous replication would cause the primary to wait for acknowledgment from replicas, leading to write slowdown rather than lag on replicas. Option C is incorrect because insufficient storage on replicas would typically cause disk-full errors, not replication lag. Option D is incorrect because vCPU over-allocation on the primary primarily affects compute performance, not the replication process which is more sensitive to network and disk I/O.

Answer

Replication is configured as synchronous.

Answer

The replica nodes have insufficient storage.

Answer

The primary node's vCPU is over-allocated.

Question 14

An organization wants to audit all API calls made in their AWS account. Which AWS service should be enabled to capture these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity for governance, compliance, and auditing.

Answer

Amazon CloudWatch

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 15

A company manages a multi-account AWS environment and wants to deploy consistent infrastructure across several accounts using CloudFormation. The solution must support updates to the infrastructure and detect configuration drift. Which TWO CloudFormation features should be used?

Accepted Answer

StackSets. StackSets (B) is correct because it is the CloudFormation feature designed to deploy and update the same template across multiple AWS accounts and Regions from a single administrator account, which directly satisfies the requirement for consistent infrastructure across several accounts. Drift detection (E) is correct because it lets CloudFormation compare a stack's actual resource configuration against its expected template configuration and report resources that have been modified outside CloudFormation, satisfying the drift-detection requirement. Change sets (A) only preview how proposed changes would affect a single stack before execution, so they do not provide multi-account deployment or drift detection. Outputs (C) merely export values from a stack for cross-stack references and do not deploy or monitor infrastructure. Nested stacks (D) help organize reusable templates within a single account/stack hierarchy but do not natively roll out stacks across multiple accounts or detect drift.

Answer

Change sets

Answer

Outputs

Answer

Nested stacks

Question 16

A cloud administrator is designing network security for a three-tier application. The web tier must be accessible from the internet, but the application and database tiers should only be reachable from the web tier. Which security group configuration should be used?

Accepted Answer

Use separate security groups: web allows HTTP/HTTPS from 0.0.0.0/0; app allows traffic from web security group; db allows traffic from app security group. It uses separate security groups for each tier, implementing the principle of least privilege. The web tier security group allows HTTP/HTTPS from 0.0.0.0/0 for internet access, while the app tier security group references the web tier security group as its source, ensuring only traffic from the web tier can reach the application tier. Similarly, the database tier security group references the app tier security group, restricting access exclusively to the application tier. This configuration enforces strict east-west traffic control and prevents direct internet access to the internal tiers.

Answer

Assign the same security group to all tiers and use a single inbound rule

Answer

Place all tiers in the same subnet and use a network ACL to permit all traffic

Answer

Configure a network ACL for each subnet with allow rules for the required traffic

Question 17

A company wants to migrate its on-premises workloads to the cloud but must keep sensitive data on-premises due to regulatory requirements. Which cloud deployment model should the company use?

Accepted Answer

Hybrid cloud. A hybrid cloud deployment model combines on-premises infrastructure with public cloud services, allowing sensitive data to remain on-premises while other workloads leverage cloud scalability. This directly meets the regulatory requirement to keep sensitive data local while still benefiting from cloud resources for other components.

Answer

Multi-cloud

Answer

Public cloud

Answer

Private cloud

Question 18

A cloud administrator is troubleshooting why a newly launched VM did not complete its initialization. According to the exhibit, what is the most likely cause?

Accepted Answer

The package repository is not configured correctly. The error 'E: Unable to locate package python3-pip' indicates that the package repository is not configured correctly or the package does not exist in the configured sources. This prevents cloud-init from installing the specified package, so the most likely cause is an incorrect repository configuration. Therefore, option B is correct. Option A is incorrect because cloud-init is executing commands, showing it is installed. Option C is incorrect because the error is about a missing package, not a syntax error. Option D is incorrect because the command ran successfully, indicating no network issues; the problem is repository configuration.

Answer

Cloud-init is not installed on the VM

Answer

The cloud-init user data script contains a syntax error

Answer

The VM does not have internet access

Question 19

A cloud administrator needs to design a storage solution that provides block-level access for a database server and must be highly durable. Which storage type should be used?

Accepted Answer

Block storage. Block storage is the correct choice because it provides raw, low-latency block-level access that database servers require for high-performance read/write operations. It also supports features like RAID, snapshots, and replication to achieve high durability, making it ideal for transactional databases.

Answer

File storage

Answer

Archive storage

Answer

Object storage

Question 20

Which of the following is a characteristic of serverless computing (FaaS)?

Accepted Answer

You are charged per execution or compute time. Serverless computing (FaaS) abstracts all infrastructure management and bills based on actual consumption — typically per invocation and per GB-second of compute time. This means you pay only when your function executes, not for idle capacity. This consumption-based model is the defining economic characteristic of FaaS platforms like AWS Lambda, Azure Functions, and Google Cloud Functions.

Answer

You pay for allocated resources regardless of usage

Answer

You must manage the underlying servers

Answer

You have to provision capacity in advance