CV0-004 Practice Exam 4 — 20 Questions

Question 1

A DevOps team is implementing a CI/CD pipeline using Jenkins. They want to ensure that code is automatically built, tested, and deployed to a staging environment before manual approval for production. Which stage should include the deployment to staging?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy. In a Jenkins CI/CD pipeline, the Deploy stage is responsible for taking the built and verified artifact and releasing it to an environment — in this case, the staging environment. The pipeline flow is typically Source → Build → Test/Verify → Deploy (staging) → Manual Approval → Deploy (production). Placing staging deployment in the Deploy stage correctly separates it from build and test activities.

Answer

Build

Answer

Source

Answer

Verify

Question 2

A company uses Azure DevOps to deploy a critical application. They need to implement a deployment strategy that ensures zero downtime by directing all traffic to the new environment after validation, while keeping the old environment as a fallback. Which deployment strategy should be configured in the Azure Pipelines release pipeline?

Accepted Answer

Blue/green deployment. Blue/green deployment is the correct strategy because it maintains two identical environments (blue and green) and switches the router or load balancer to direct all traffic to the new (green) environment only after validation is complete. The old (blue) environment remains untouched and can serve as an immediate fallback if issues arise, ensuring zero downtime during the cutover.

Answer

Canary deployment

Answer

In-place deployment

Answer

Rolling deployment

Question 3

Which THREE of the following are valid methods to manage identity and access in a multi-cloud environment?

Accepted Answer

Implement a federation using SAML 2.0 between the corporate identity provider and each cloud.. Option B is correct because SAML 2.0 federation lets the corporate identity provider act as the authoritative IdP, issuing signed assertions that each cloud provider's STS trusts, enabling single sign-on and centralized identity lifecycle management across clouds. Option C is correct because tagging resources and referencing those tags in ABAC policies allows a single, consistent authorization model (for example, 'allow if resource tag owner == user.department') to be evaluated across heterogeneous cloud IAM engines. Option E is correct because a CASB sits between users and multiple cloud services to enforce authentication, authorization, DLP, and shadow-IT policies uniformly, which is a recognized way to govern access in multi-cloud environments. Option A is not an identity or access management method; a site-to-site VPN only provides encrypted network connectivity between on-premises and cloud networks. Option D is not valid because a single shared API key is a static, non-attributable credential that cannot be scoped per user or cloud, breaks least privilege and auditability, and is an anti-pattern for identity management.

Answer

Set up a site-to-site VPN between the on-premises network and each cloud.

Answer

Use a single shared API key for all clouds to simplify automation.

Question 4

A cloud security team needs to ensure that all API calls made to the cloud provider are logged and monitored for suspicious activity. Which service should be enabled?

Accepted Answer

Enable cloud audit logging for the management console and API calls.. Cloud audit logging (e.g., AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs) is the native service that records every management console action and API call made against the cloud provider, capturing identity, source IP, timestamp, and request parameters. This directly satisfies the requirement to log and monitor API activity for suspicious behavior. WAF, IDS, and SIEM are complementary controls but do not themselves generate the authoritative API audit trail.

Answer

Deploy a web application firewall (WAF).

Answer

Configure an intrusion detection system (IDS) on the network.

Answer

Implement a security information and event management (SIEM) system.

Question 5

A cloud administrator needs to deploy a web application in a public cloud. The application must automatically scale out based on CPU utilization and scale in during low demand. Which of the following is the BEST approach?

Accepted Answer

Configure an auto scaling group with a scaling policy based on average CPU utilization. An auto scaling group with a scaling policy based on average CPU utilization is the best approach because it dynamically adjusts the number of instances in response to real-time demand. This method uses CloudWatch metrics to trigger scale-out when CPU exceeds a threshold (e.g., 70%) and scale-in when it drops, ensuring the application remains responsive while minimizing cost during low usage.

Answer

Use a script to increase the instance size when CPU exceeds 80%

Answer

Implement scheduled scaling to add instances during business hours

Answer

Create a load balancer and manually add instances during peak hours

Question 6

A company uses a cloud load balancer to distribute traffic to web servers. The load balancer health checks are failing for all instances. The instances are running and can be accessed directly via their private IPs from within the VPC. What is the most likely cause?

Accepted Answer

The security group of the instances is not allowing traffic from the load balancer.. The most likely cause is that the security group attached to the web server instances does not include an inbound rule allowing traffic from the load balancer's source IP addresses or the load balancer's security group. Even though the instances are healthy and reachable via private IPs from within the VPC, the load balancer's health check probes (typically HTTP/HTTPS or TCP) are blocked by the instance-level firewall, causing all health checks to fail.

Answer

The load balancer's cross-zone load balancing is disabled.

Answer

The load balancer's listeners are configured on the wrong ports.

Answer

The instances are not registered with the target group.

Question 7

An organization is using Azure DevOps to implement a CI/CD pipeline. In which stage of the pipeline would automated unit tests typically be executed?

Accepted Answer

Build. In a typical CI/CD pipeline, automated unit tests are executed during the Build stage, immediately after code compilation, to validate that individual components function correctly before any deployment. This early feedback loop catches defects quickly and prevents broken code from progressing to later stages. The Build stage is where code is compiled, packaged, and unit-tested.

Answer

Deploy

Answer

Verify

Answer

Source

Question 8

A company uses a cloud-based load balancer to distribute traffic to web servers. Recently, a new security policy was applied that restricts traffic to certain geographic regions. Users from an allowed region report they cannot access the website. The load balancer status shows health checks are passing. What should the administrator check?

Accepted Answer

The load balancer's access control lists (ACLs). Geographic restrictions on a load balancer are typically implemented via access control lists (ACLs). Since health checks are passing, the web servers are functional, so the issue lies in the load balancer's ACLs blocking traffic from the allowed region. Option A is wrong: DNS resolution would affect all users similarly, not just those from a specific region. Option B is wrong: SSL certificate issues would generate browser warnings or errors, not complete inaccessibility. Option C is wrong: web server logs are irrelevant as the traffic is not reaching the servers due to the ACL block.

Answer

The DNS resolution for the website

Answer

The SSL certificate expiration

Answer

The web server logs for application errors

Question 9

A company wants to deploy a Lambda function that processes objects uploaded to an S3 bucket. Which event trigger should be configured on the Lambda function?

Accepted Answer

S3 bucket event notification. S3 bucket event notifications can be configured to directly invoke a Lambda function when objects are uploaded. This is the native, serverless integration where S3 publishes an event (e.g., s3:ObjectCreated:Put) to Lambda, triggering the function automatically without any intermediary service.

Answer

API Gateway

Answer

CloudWatch Events

Answer

SQS

Question 10

A company has a policy that all cloud resources must be tagged with 'CostCenter' and 'Project' tags. The cloud operations team uses a monitoring tool to alert when untagged resources are created. The team receives an alert for a new EC2 instance that lacks the required tags. The instance was launched two hours ago by a DevOps engineer who is on leave. The instance is critical for production. What should the administrator do to resolve the compliance violation?

Accepted Answer

Apply the required tags to the existing instance using the cloud provider's console or CLI.. The compliance violation is the absence of required tags, not a problem with the instance itself. The administrator can use the AWS Management Console, CLI (e.g., `aws ec2 create-tags`), or SDK to apply the 'CostCenter' and 'Project' tags to the existing EC2 instance without disrupting its operation. This resolves the alert and maintains production continuity.

Answer

Terminate the instance immediately and launch a new one with proper tags.

Answer

Ignore the alert because the instance is critical and the engineer will fix it when back.

Answer

Modify the tag policy to exempt instances launched by senior engineers.

Question 11

A cloud administrator needs to apply a critical security patch to a virtual machine that is part of a production application. The application must remain available during patching. Which of the following is the BEST approach?

Accepted Answer

Remove the VM from the load balancer, apply the patch, then return it to service during a maintenance window. Removing the VM from the load balancer ensures that no new traffic is sent to it while the patch is applied, maintaining application availability for users. After the patch is applied and the VM is verified as healthy, it can be returned to the load balancer pool. This approach aligns with a rolling update strategy, which is the standard method for applying patches to production VMs without downtime.

Answer

Postpone the patch until the next scheduled update cycle

Answer

Patch all VMs simultaneously to minimize the time to full deployment

Answer

Apply the patch during peak usage hours to ensure immediate deployment

Question 12

A cloud engineer is troubleshooting a connectivity issue between two virtual networks in different regions. The engineer has verified that the virtual networks are peered and the routing tables are correct. Which of the following is the MOST likely cause of the issue?

Accepted Answer

A network security group blocking the traffic. Network security groups (NSGs) operate at the subnet or NIC level and can filter traffic between peered virtual networks even when routing is correctly configured. Since the engineer has verified peering and routing tables, the most likely remaining cause is an NSG rule explicitly or implicitly denying the traffic, as NSGs are stateful and evaluated after routing decisions.

Answer

Incorrect route tables on the virtual network gateway

Answer

A physical cable disconnection in the datacenter

Answer

Incorrect DNS resolution

Question 13

A web application is deployed across multiple availability zones behind a load balancer. The administrator notices that all traffic is being routed to instances in only one availability zone, causing performance issues. The load balancer is configured to distribute traffic across all zones evenly. What is the most likely cause?

Accepted Answer

The instances in the other zones are marked as unhealthy due to failing health checks.. If the load balancer is configured to distribute traffic evenly across all availability zones but traffic only reaches one zone, the most likely cause is that instances in the other zones are failing health checks and are marked unhealthy. Load balancers only route to healthy backends, so unhealthy instances in other zones are excluded, concentrating traffic in the one healthy zone. This matches the symptom of uneven distribution despite even configuration.

Answer

The firewall rules for the load balancer only allow traffic from one zone.

Answer

The route table for the subnets in the other zones is missing a default route.

Answer

The listener rules are configured to forward traffic to a single backend pool.

Question 14

A cloud architect is choosing a compute pricing model for a batch processing job that runs for 2 hours every night. The job can be interrupted. Which option is most cost-effective?

Accepted Answer

Spot instances. Spot instances are the most cost-effective option because the batch processing job is fault-tolerant (can be interrupted) and runs for a fixed, short duration (2 hours nightly). Spot instances offer significant discounts (often 60-90% off on-demand pricing) by leveraging unused cloud capacity, which can be reclaimed with a 2-minute warning. This aligns perfectly with the workload's tolerance for interruption and its predictable but non-critical schedule.

Answer

Reserved instances for 1 year

Answer

On-demand instances

Answer

Dedicated hosts

Question 15

A company uses AWS and Azure for redundancy. They deploy the same application on both clouds to avoid vendor lock-in and improve disaster recovery. Which cloud deployment model is this?

Accepted Answer

Multi-cloud. Multi-cloud uses multiple public cloud providers for redundancy and best-of-breed services.

Answer

Community cloud

Answer

Hybrid cloud

Answer

Private cloud

Question 16

Which of the following is a stateless network access control that requires explicit allow rules for both inbound and outbound traffic?

Accepted Answer

Network ACL. Network ACLs (NACLs) are stateless; security groups are stateful.

Answer

Security group

Answer

DDoS protection

Answer

Web application firewall

Question 17

A cloud architect is selecting a storage solution for a database that requires low-latency reads and writes. The database will run on a single VM and must support consistent performance. Which storage type is most appropriate?

Accepted Answer

Block storage. Block storage (e.g., EBS, Azure Disk) provides low-latency, consistent performance suitable for databases running on a single VM.

Answer

Archive storage

Answer

Object storage

Answer

File storage

Question 18

Which cloud deployment model connects an on-premises data center to a public cloud using VPN or dedicated connections like AWS Direct Connect?

Accepted Answer

Hybrid cloud. A hybrid cloud deployment model combines on-premises infrastructure with public cloud services, connected via VPN or dedicated connections like AWS Direct Connect. This allows workloads to span both environments, providing flexibility and scalability. It is the standard term for such integrated architectures.

Answer

Private cloud

Answer

Multi-cloud

Answer

Public cloud

Question 19

A company wants to migrate its on-premises virtualized workloads to the cloud while maintaining control over the operating system and middleware. Which cloud service model should they choose?

Accepted Answer

IaaS. IaaS (Infrastructure as a Service) provides virtualized compute, storage, and networking where the customer retains control over the operating system, middleware, and runtime, while the provider manages the underlying physical infrastructure. This matches the requirement to migrate virtualized workloads while keeping OS and middleware control.

Answer

SaaS

Answer

FaaS

Answer

PaaS

Question 20

An organization needs to connect its on-premises data center to a public cloud with a dedicated, low-latency, and consistent network connection. Which connectivity option should they use?

Accepted Answer

Direct Connect. Direct Connect (AWS) or ExpressRoute (Azure) provides dedicated private connectivity from on-premises to cloud.

Answer

Internet gateway

Answer

VPC peering

Answer

Site-to-site VPN