CV0-004 Practice Test 22 — 15 Questions

Question 1

A company is migrating on-premises workloads to the cloud. They need to ensure high availability for a stateless web application across two availability zones. Which THREE components should be configured to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An auto scaling group spanning both availability zones. Option A is correct because an auto scaling group spanning both availability zones ensures that instances are distributed across AZs and can automatically replace failed instances, maintaining high availability for the stateless web tier. Option B is correct because a load balancer in front of the web tier distributes incoming traffic across healthy instances in multiple AZs, providing fault tolerance and a single point of entry. Option E is correct because multiple subnets, each in a different availability zone, are required to place the load balancer and auto scaling group across distinct AZs, which is the foundation for AZ-level redundancy. Option C is not correct because a read replica database is a data-tier concern and is not required for a stateless web application's high availability. Option D is not correct because a single large compute instance is a single point of failure and cannot provide high availability across two availability zones.

Answer

A read replica database in a different AZ

Answer

A single large compute instance to handle all traffic

Question 2

A cloud administrator notices that a virtual machine running a critical application is using 95% CPU consistently. The application is single-threaded and performance is degraded. Which action should the administrator take to resolve the issue?

Accepted Answer

Migrate the VM to a host with a higher CPU clock speed.. The application is single-threaded, meaning it can only utilize one CPU core at a time. Increasing the CPU clock speed directly improves the processing speed of that single thread, which resolves the performance degradation. Option C is correct because migrating to a host with a higher CPU clock speed provides a faster core for the single-threaded workload.

Answer

Deploy additional VMs and load balance the application.

Answer

Increase the RAM allocation to the VM.

Answer

Increase the number of vCPUs assigned to the VM.

Question 3

An organization uses CloudFormation to manage resources across multiple AWS accounts. They need to deploy a common set of resources (e.g., logging configuration) to all accounts in an AWS Organization. Which CloudFormation feature should they use?

Accepted Answer

StackSets. CloudFormation StackSets allow you to deploy stacks across multiple accounts and regions in a single operation, ideal for multi-account governance.

Answer

Change sets

Answer

Drift detection

Answer

Nested stacks

Question 4

Which THREE are common reasons why a cloud database instance may become unreachable?

Accepted Answer

Firewall rules blocking the database port. Option A is correct because a cloud database instance listens on a specific port (e.g., 3306 for MySQL, 5432 for PostgreSQL, 1433 for SQL Server), and security group or firewall rules that fail to allow inbound traffic on that port will make the instance unreachable even though it is running. Option B is correct because an incorrect connection string—wrong hostname/endpoint, port, database name, or credentials—prevents the application from establishing a TCP session to the database, which is one of the most common causes of apparent unreachability. Option D is correct because if the database service/daemon (e.g., mysqld, postgresql, sqlservr) is not started or has crashed, the instance will refuse connections on its listening port. Option C is not a typical cause of unreachability; a full storage volume usually causes write failures, errors, or degraded performance rather than making the instance completely unreachable. Option E is not a common reason either, since hypervisor maintenance typically triggers live migration or a planned reboot, and even if a VM reboots, the database would normally come back online automatically rather than remain unreachable.

Answer

Storage volume is full on the database server

Answer

Hypervisor maintenance causing VM reboot

Question 5

A cloud administrator is configuring cost management for a multi-account cloud environment. The company wants to allocate costs by department and project. Which TWO steps should the administrator take to achieve this? (Choose two.)

Accepted Answer

Activate cost allocation tags in the billing console. Option C is correct because activating cost allocation tags in the billing console is the required step that makes user-defined tags (such as Department and Project) appear as line items in the cost and usage reports, enabling cost breakdowns by those dimensions. Option E is correct because applying consistent tags like Department and Project to resources is what actually associates each resource's spend with the desired cost center, and without these tags the allocation data cannot be produced. Together, tagging resources and then activating those tags for billing is the standard mechanism for allocating costs by department and project in a multi-account environment. Option A is not one of the two required steps because enabling cost reporting tools alone provides raw billing data but does not by itself map costs to departments and projects. Option B is unnecessary because separate accounts per department are an isolation/consolidation design choice, not the tagging mechanism needed for cost allocation. Option D is incorrect because budgeting tools set thresholds and alerts on spend; they do not allocate or attribute costs to departments and projects.

Answer

Enable the cloud provider's cost reporting tools

Answer

Create separate cloud accounts for each department

Answer

Use the cloud provider's budgeting tools to set spending limits

Question 6

An Azure administrator needs to deploy a cloud-native application using Azure DevOps. The team wants to define the entire Azure infrastructure as code using a declarative language that is concise and integrated with Azure. Which tool should the administrator use?

Accepted Answer

Bicep. Bicep is a domain-specific language for deploying Azure resources that provides a simpler syntax than ARM templates while being fully integrated with Azure.

Answer

Terraform

Answer

Ansible

Answer

ARM templates (JSON)

Question 7

An organization is designing a VPC with public and private subnets. The web servers must be accessible from the internet, but database servers must not. The architecture also requires high availability across two Availability Zones. What is the minimum number of public subnets and private subnets needed?

Accepted Answer

Two public, two private. High availability across two Availability Zones requires at least one subnet per AZ for each tier. Since the architecture needs both public-facing web servers and private database servers in each AZ, the minimum is two public subnets and two private subnets — one of each per AZ.

Answer

One public, two private

Answer

Two public, one private

Answer

One public, one private

Question 8

A company is adopting a CI/CD pipeline using Jenkins to deploy a web application. The pipeline must include steps to compile code, run unit tests, package the application, deploy to a test environment, and then deploy to production. Which pipeline stage should be configured immediately after the build stage?

Accepted Answer

Test. In a typical CI/CD pipeline, after build (compile) comes test (e.g., unit tests) to validate the code before proceeding to deploy.

Answer

Verify

Answer

Deploy to production

Answer

Source

Question 9

Which THREE of the following are best practices for deploying applications in a cloud environment? (Choose three.)

Accepted Answer

Use immutable infrastructure patterns.. Option A is correct because immutable infrastructure patterns replace servers rather than patching them in place, which makes cloud deployments reproducible, eliminates configuration drift, and allows rollback by simply redeploying a known-good image. Option B is correct because designing for horizontal scaling (adding/removing instances behind a load balancer) matches the elastic, distributed nature of cloud platforms and avoids the single-instance ceiling and downtime of vertical scaling. Option E is correct because blue/green deployment runs two identical environments and shifts traffic (e.g., via DNS or a load balancer) only after the new version is validated, minimizing downtime and enabling instant rollback. Option C is not a best practice because opening all ports in security groups violates least-privilege network access and exposes resources to attack. Option D is not a best practice because retaining unused resources wastes cost and increases the attack surface; cloud provisioning is fast enough that resources should be released and recreated as needed.

Answer

Open all ports in security groups to simplify connectivity.

Answer

Keep unused resources to avoid reprovisioning delays.

Question 10

A company deploys a stateless web application across two AWS Availability Zones behind a load balancer. This design primarily improves which characteristic?

Accepted Answer

High availability. Deploying a stateless web application across two AWS Availability Zones behind a load balancer primarily improves high availability. If one AZ fails, the load balancer routes traffic to the healthy AZ, ensuring the application remains accessible. This design eliminates a single point of failure.

Answer

Cost efficiency

Answer

Scalability

Answer

Security

Question 11

Which cloud characteristic allows a user to provision additional resources automatically without requiring human intervention?

Accepted Answer

Rapid elasticity. Rapid elasticity is the cloud characteristic that allows resources to be automatically provisioned and released to scale rapidly with demand, often without human intervention. This is enabled by auto-scaling policies and APIs that respond to metrics like CPU utilization or request count. It directly matches the description of automatic provisioning without human intervention.

Answer

Measured service

Answer

Resource pooling

Answer

Broad network access

Question 12

A cloud engineer is designing a disaster recovery plan with an RTO of 2 hours and RPO of 15 minutes. Which strategy best meets these requirements?

Accepted Answer

Warm standby with continuous replication. A warm standby with continuous replication keeps a scaled-down but fully functional copy of the environment running in a secondary region, with data replicated continuously. This allows failover within minutes, easily meeting the 15-minute RPO, and the standby can be scaled up to full capacity within the 2-hour RTO. It balances cost and recovery speed better than the other options for these specific targets.

Answer

Pilot light with hourly snapshots

Answer

Cold standby with daily backups

Answer

Active-active across regions

Question 13

An organization is migrating a MySQL database to Amazon Aurora with minimal downtime. The migration must capture ongoing changes from the source database and apply them to the target during the cutover. Which AWS Database Migration Service (DMS) feature should be used?

Accepted Answer

Change data capture (CDC). Change data capture (CDC) in AWS DMS continuously reads the source database's transaction log (binary log for MySQL) and applies ongoing changes to the target, enabling near-zero-downtime cutover. It is the specific DMS feature designed to replicate changes that occur after the initial full load.

Answer

Validation

Answer

Full load only

Answer

Schema conversion

Question 14

A cloud team is planning a disaster recovery drill for their application running in a public cloud. They want to validate that the recovery process meets the defined RTO and RPO. Which THREE activities should be included in the DR drill? (Select THREE.)

Accepted Answer

Measure the time taken to restore services from backups.. The drill must validate the two key recovery objectives, so option B is correct because measuring the time taken to restore services from backups directly tests whether the actual recovery time meets the defined RTO. Option D is correct because performing a failover to the DR site and verifying application functionality proves that the recovery environment works end-to-end and that services can actually be resumed at the DR location. Option E is correct because checking the timestamp of the most recent backup or replica confirms the data loss window, which is exactly what RPO measures. Option A is not part of validating RTO/RPO; cost optimization is a separate FinOps activity. Option C, chaos engineering, tests resilience to random failures but is not a required DR drill activity for validating recovery time and data currency against RTO and RPO.

Answer

Review cost optimization recommendations for the DR environment.

Answer

Run chaos engineering experiments to introduce random failures.

Question 15

A cloud engineer is designing a VPC in AWS for a three-tier web application. The web servers must be accessible from the internet, the application servers should only be accessible from the web servers, and the database servers should only be accessible from the application servers. What is the most secure VPC design?

Accepted Answer

Public subnet for web servers, private subnet for application servers, and a separate private subnet for database servers, with proper security group rules. The most secure design places each tier in its own subnet with security groups that restrict traffic: web servers in a public subnet (internet-facing), application servers in a private subnet (only accessible from web servers), and database servers in a separate private subnet (only accessible from application servers). This segmentation limits lateral movement and follows the principle of least privilege.

Answer

Public subnet for web and application servers, private subnet for database servers

Answer

Single public subnet with all servers placed in it, using security groups to restrict traffic

Answer

Use a single private subnet and a NAT gateway for internet access