CV0-004 Practice Test 21 — 15 Questions

Question 1

A cloud architect is designing a serverless application using Azure Functions. The function must process messages from an Azure Storage Queue. How should the architect configure the trigger?

Accepted Answer

Queue trigger. Azure Functions natively supports a Queue trigger that automatically polls an Azure Storage Queue for new messages and executes the function code when a message is detected. This is the simplest and most efficient way to process messages from a Storage Queue without custom polling logic.

Answer

Blob trigger

Answer

Event Grid trigger

Answer

HTTP trigger with queue polling

Question 2

A company deploys a multi-tier application in a public cloud. The web tier uses an auto scaling group across multiple availability zones. The database tier runs on a single large VM. The application experiences intermittent slowdowns during peak load. Which of the following is the BEST long-term solution?

Accepted Answer

Migrate the database to a managed database service with read replicas. The database tier is a single point of failure and a performance bottleneck during peak load. Migrating to a managed database service with read replicas offloads read-heavy traffic, improves scalability, and provides automatic failover, addressing both performance and availability issues. This is a long-term solution that aligns with cloud best practices for multi-tier applications.

Answer

Add a load balancer in front of the database tier

Answer

Upgrade the database VM to a larger instance type

Answer

Increase the number of web servers in the auto scaling group

Question 3

A DevOps team wants to deploy a containerized application to a Kubernetes cluster with zero downtime. The team needs to gradually shift traffic from the old version to the new version, monitoring error rates and automatically rolling back if errors exceed a threshold. Which deployment strategy should the team implement?

Accepted Answer

Canary deployment. Canary deployment is correct because it introduces the new version to a small subset of users/traffic first, allowing the team to monitor error rates and metrics in production before progressively shifting more traffic. If error thresholds are breached, traffic can be instantly routed back to the stable version, achieving zero-downtime with automated rollback. This matches the requirement for gradual traffic shifting with monitoring and automatic rollback.

Answer

Blue/green deployment

Answer

Rolling deployment

Answer

Recreate deployment

Question 4

A cloud administrator is reviewing the security posture of a cloud deployment. The company has a policy of least privilege and must ensure that only authorized services can access storage buckets. Which THREE mechanisms should the administrator configure to enforce this policy? (Choose three.)

Accepted Answer

Bucket policies that restrict access to specific cloud services. Bucket policies (B) are resource-based policies attached directly to the storage bucket that can explicitly allow or deny access to specific cloud services or principals, enforcing least privilege at the bucket level. Organizational policies (C) apply service control policies (SCPs) or similar guardrails at the account/organization level, restricting the maximum permissions any principal can have, which prevents unauthorized services from ever gaining bucket access. IAM roles (D) grant scoped, temporary credentials to the specific services that need access, so only those services receive the permissions required, aligning with least privilege. Network ACLs (A) and security groups (E) are network-layer controls that filter IP traffic; they do not govern identity-based or resource-based authorization to storage buckets, so they cannot enforce which services are authorized to access the buckets.

Answer

Network ACLs that block unauthorized IP ranges

Answer

Security groups that allow traffic from authorized services

Question 5

A cloud engineer needs to deploy a Lambda function that processes objects uploaded to an S3 bucket. The function code is stored in a .zip file. Which event trigger should the engineer configure to invoke the function automatically?

Accepted Answer

S3 event notification. S3 event notifications can be configured on a bucket to invoke a Lambda function when objects are created (e.g., s3:ObjectCreated:*), which directly satisfies the requirement to process uploaded objects automatically. This is the native, serverless integration between S3 and Lambda. API Gateway, SQS, and EventBridge are not triggered by S3 PUT events without additional configuration.

Answer

API Gateway

Answer

SQS

Answer

EventBridge

Question 6

A company uses a hybrid cloud environment with workloads in AWS and on-premises. They want to use a single monitoring dashboard to view metrics from both environments. Which solution should they implement?

Accepted Answer

Install the CloudWatch agent on on-premises servers and send metrics to CloudWatch, then create a CloudWatch dashboard. The CloudWatch agent can be installed on on-premises servers to collect OS-level and application metrics and push them to CloudWatch over the public internet or a VPN/Direct Connect. Once the metrics are in CloudWatch, they appear alongside AWS-native metrics and can be visualized in a single CloudWatch dashboard, satisfying the hybrid monitoring requirement. This is the native, lowest-friction way to unify metrics from both environments.

Answer

Deploy a third-party monitoring tool in AWS and replicate all logs to it

Answer

Set up a VPN connection and use VPC Flow Logs for on-premises traffic

Answer

Use AWS CloudTrail to log on-premises activity

Question 7

A cloud administrator needs to ensure that log data is retained for one year to meet compliance requirements. Which action should be taken for the log group in CloudWatch Logs?

Accepted Answer

Set the log group's retention policy to 365 days. CloudWatch Logs log groups have a retention setting that controls how long log events are kept before automatic deletion. Setting the retention policy to 365 days ensures logs are retained for exactly one year, meeting the compliance requirement without manual intervention.

Answer

Create a CloudWatch Events rule to delete logs after one year

Answer

Increase the log group's data durability by enabling encryption

Answer

Export logs to Amazon S3 and delete the log group

Question 8

Which TWO of the following are common causes of performance degradation in a cloud-based application?

Accepted Answer

Resource contention from other tenants on the same hypervisor (noisy neighbor). Resource contention, commonly known as the 'noisy neighbor' effect, occurs when multiple virtual machines (VMs) on the same hypervisor compete for shared physical resources such as CPU caches, memory bandwidth, and disk I/O. This contention can cause unpredictable performance degradation in a cloud-based application, as one tenant's heavy workload starves others of resources. Cloud providers often mitigate this using CPU pinning, I/O throttling, or dedicated instances, but without such controls, noisy neighbors remain a common cause of performance issues.

Answer

Over-provisioned virtual machines

Answer

Load balancer distributing traffic evenly

Answer

Insufficient bandwidth to the cloud provider

Question 9

A cloud team uses Azure Bicep for deploying resources. They need to create a modular deployment that includes a virtual network and a subnet. Which THREE best practices should they follow when authoring Bicep files? (Choose three.)

Accepted Answer

Use modules to encapsulate and reuse resource definitions.. Using parameters for configurable values, using modules for reuse, and using symbolic names for resource references are best practices.

Answer

Use hard-coded resource names to ensure consistency.

Answer

Define all resources in a single file for simplicity.

Question 10

Which of the following is a benefit of using a Web Application Firewall (WAF)?

Accepted Answer

Filtering malicious HTTP/HTTPS traffic to a web application. WAFs protect web applications from common attacks like SQL injection, cross-site scripting, and other OWASP Top 10 threats by filtering and monitoring HTTP/HTTPS traffic.

Answer

Encrypting data at rest in a database

Answer

Protecting against DDoS attacks at the network layer

Answer

Managing user identities and access

Question 11

A company is migrating to a public cloud and wants to understand security responsibilities. According to the shared responsibility model, which of the following is the customer responsible for in an IaaS deployment?

Accepted Answer

Patching the guest operating system. In an IaaS deployment, the customer is responsible for patching the guest operating system (A). Under the shared responsibility model, the cloud provider manages the physical security, network infrastructure, and hypervisor, while the customer is responsible for the security of everything they deploy on the infrastructure, including the guest OS, applications, and data. Patching the guest OS is a customer task because the customer has control over the OS and its configuration.

Answer

Network infrastructure security

Answer

Physical security of data centers

Answer

Hypervisor security

Question 12

Which of the following is a best practice for managing secrets in cloud applications?

Accepted Answer

Use a cloud secrets manager with automatic rotation. Using a cloud secrets manager with automatic rotation is the best practice because it centralizes secret storage, encrypts secrets at rest and in transit, and automates rotation to reduce the risk of credential leakage. Services like AWS Secrets Manager, Azure Key Vault, and Google Secret Manager provide fine-grained access control and audit logging, ensuring secrets are not exposed in code or configuration files.

Answer

Embed secrets in application code

Answer

Store secrets in environment variables

Answer

Share secrets via email

Question 13

A security engineer is configuring an AWS IAM policy for a new application. The policy must allow the application to read objects from a specific S3 bucket. Which IAM policy element determines whether the action is allowed or denied?

Accepted Answer

Effect. The Effect element in an IAM policy specifies whether the statement allows or denies access. It is a required element that can be set to 'Allow' or 'Deny'. In this case, to allow the application to read objects, the Effect must be 'Allow'. Therefore, the Effect element determines whether the action is allowed or denied.

Answer

Action

Answer

Resource

Answer

Condition

Question 14

A healthcare organization uses a cloud-based virtual private cloud (VPC) to host a web application that processes protected health information (PHI). The application consists of a public-facing load balancer, a web server tier in a public subnet, and a database tier in a private subnet. The database runs on a managed relational database service with encryption at rest enabled using a cloud provider-managed key. The security auditor requires that the database encryption key must be controlled by the organization and rotated every 90 days. Additionally, the database must only be accessible from the web server tier. The database is currently accessible from the entire VPC CIDR block. What should the cloud administrator do to meet these requirements?

Accepted Answer

Re-encrypt the database using a customer-managed key in the cloud provider's key management service, and update the database security group to only allow traffic from the web server security group.. It addresses both requirements: re-encrypting the database with a customer-managed key in the cloud provider's KMS allows the organization to control and rotate the key every 90 days, and updating the database security group to only allow traffic from the web server security group restricts access to only the web server tier. Option A is incorrect because exporting and re-importing the database is unnecessary and disabling encryption is not recommended; re-encrypting in place is the proper approach. Option B is incorrect because provider-managed keys do not give the organization control or the ability to rotate the key as required. Option D is incorrect because encrypting the web server's storage does not address database encryption or access control requirements.

Answer

Export the database, disable encryption, and import into a new database with a customer-managed key.

Answer

Enable encryption with a provider-managed key and restrict database access using a network ACL.

Answer

Encrypt the web server's storage with a customer-managed key and keep the database encryption as is.

Question 15

A company runs a critical application on a cloud VM that must achieve a 99.99% monthly uptime SLA. The VM is deployed in a single availability zone. The current architecture has no redundancy. What is the most effective design change to meet the SLA requirement?

Accepted Answer

Deploy the application across two availability zones with a load balancer. Deploying the application across two availability zones with a load balancer provides high availability by eliminating a single point of failure. A 99.99% monthly uptime SLA requires a design that can withstand an entire availability zone failure, which a single-zone deployment cannot achieve. The load balancer distributes traffic to healthy VMs, automatically failing over if one zone becomes unavailable, thus meeting the SLA target.

Answer

Schedule daily backups to a different region

Answer

Upgrade the VM to a larger instance type for better reliability

Answer

Add a second VM in the same availability zone with a load balancer