CV0-004 Practice Test 24 — 15 Questions

Question 1

A company hosts its critical applications on a cloud provider's virtual machines within a virtual private cloud. The security team receives an alert from the intrusion detection system indicating that one of the VMs is exhibiting signs of a ransomware infection. The administrator connects to the VM via a bastion host and observes that several important files have been encrypted and a ransom note has been left. The incident response plan is still being developed, but the administrator knows the immediate priority is to contain the threat and prevent it from spreading to other VMs and storage resources. The company has daily backups stored in a separate cloud storage service that is not directly accessible from the production network. Which of the following actions should the administrator take FIRST to contain the incident and minimize further damage?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Immediately disconnect the network interface of the infected VM.. The FIRST action in ransomware containment is to isolate the infected VM from the network by disconnecting its network interface. This immediately stops the malware from spreading laterally to other VMs, shared storage, or command-and-control servers. Restoring from backup, notifying law enforcement, or scanning come after containment, because the infection could continue to spread while those actions are performed.

Answer

Restore the VM from the most recent backup.

Answer

Notify law enforcement about the ransomware attack.

Answer

Run a full antivirus scan on the infected VM.

Question 2

A company is adopting a shared responsibility model for a PaaS cloud deployment. Which THREE responsibilities belong to the customer?

Accepted Answer

Data classification and encryption. In a PaaS shared responsibility model, the customer is responsible for data classification and encryption of data at rest and in transit. The cloud provider manages the underlying infrastructure, but the customer must classify data according to sensitivity and apply encryption mechanisms, such as using TLS 1.2/1.3 for data in transit and AES-256 for data at rest, as the provider cannot access or classify customer data.

Answer

Management of the runtime environment

Answer

Physical security of data centers

Question 3

A security auditor is reviewing the IAM configuration for a cloud account. The auditor finds that a user has permissions to create and delete resources in all services. Which principle of security is being violated?

Accepted Answer

Least privilege. The principle of least privilege is violated because the user has permissions to create and delete resources in all services, which is far more than necessary for their role. Least privilege requires granting only the minimum permissions needed to perform a task.

Answer

Need to know

Answer

Defense in depth

Answer

Separation of duties

Question 4

A cloud engineer is writing a Bicep file to deploy Azure resources. Bicep is a domain-specific language (DSL) that transpiles to ARM templates. Which of the following is a benefit of using Bicep over ARM JSON templates?

Accepted Answer

Bicep reduces code verbosity and supports modules. Bicep provides a simpler syntax with less boilerplate, modularity, and reusable modules. It reduces complexity compared to raw ARM JSON.

Answer

Bicep automatically manages state

Answer

Bicep is natively executed by Azure Resource Manager

Answer

Bicep supports imperative scripting

Question 5

A cloud engineer is planning a disaster recovery drill for a critical application that spans multiple availability zones. The drill must validate RTO and RPO without affecting production. Which THREE actions should the engineer include? (Choose three.)

Accepted Answer

Perform a failover to the secondary environment using production data. Option A is correct because a DR drill must actually exercise the failover to the secondary environment using production data (or a current copy of it) to realistically validate that the standby environment can take over and meet the target RTO and RPO. Option C is correct because validating RPO requires confirming that the recovered data matches the source data as of the last replication point, proving no data loss beyond the defined objective. Option E is correct because measuring the elapsed time from disaster declaration through failover and recovery is the only way to verify the actual RTO against the target. Option B is wrong because terminating production instances would cause a real outage, violating the requirement that the drill not affect production. Option D is wrong because deleting backups destroys recovery capability and is a dangerous, non-standard practice that would undermine rather than validate DR readiness.

Answer

Terminate production instances to simulate a disaster

Answer

Delete all backups to ensure they are not used during the drill

Question 6

A cloud engineer is troubleshooting a performance issue where a web server cluster experiences high latency during peak hours. The cluster uses an auto-scaling group behind a load balancer. Which THREE steps should the engineer take to identify the root cause?

Accepted Answer

Monitor CPU and memory utilization on the web servers. Option A is correct because monitoring CPU and memory utilization on the web servers reveals whether the instances are resource-saturated during peak hours, which is a common cause of high latency in an auto-scaling cluster. Option B is correct because analyzing web server access logs for slow requests helps pinpoint which endpoints, queries, or upstream dependencies are contributing to the latency, providing concrete evidence of the bottleneck. Option C is correct because checking the load balancer's backend instance health status verifies whether unhealthy or failing instances are being served or whether health checks are flapping, which directly impacts response times. Option D is incorrect because reducing the number of instances in the auto-scaling group would decrease capacity and likely worsen latency rather than help diagnose the root cause. Option E is incorrect because reviewing security group rules for the load balancer addresses connectivity and access control, not performance degradation during peak hours.

Answer

Reduce the number of instances in the auto-scaling group

Answer

Review security group rules for the load balancer

Question 7

A cloud engineer is managing infrastructure as code using Terraform. Which command should be run to preview changes before applying them to the cloud environment?

Accepted Answer

terraform plan. The terraform plan command creates an execution plan, showing what actions Terraform will take to change the infrastructure. It is used as a dry run before applying changes.

Answer

terraform apply

Answer

terraform destroy

Answer

terraform init

Question 8

A large enterprise is migrating multiple applications to the cloud. They need to ensure compliance with industry regulations and maintain security during the transition. Which THREE best practices should they follow?

Accepted Answer

Encrypt data in transit and at rest. Option C is correct because encrypting data in transit (e.g., TLS 1.2/1.3) and at rest (e.g., AES-256) protects sensitive information from interception and unauthorized access, which is a core requirement of regulations such as HIPAA, PCI DSS, and GDPR. Option D is correct because conducting vulnerability assessments on migrated applications identifies misconfigurations, unpatched software, and exploitable weaknesses introduced during the transition, enabling remediation before attackers can leverage them. Option E is correct because implementing identity and access management (IAM) enforces least privilege, role-based access control, and strong authentication, which are essential for maintaining security and meeting compliance audit requirements in a multi-application cloud environment. Option A is not correct because relying on a single cloud provider increases vendor lock-in and concentration risk rather than being a security or compliance best practice. Option B is not correct because disabling logging reduces data exposure but destroys the audit trails and monitoring evidence required for regulatory compliance and incident detection.

Answer

Use a single cloud provider for simplicity

Answer

Disable logging to reduce data exposure

Question 9

A company is moving a 10 TB SQL Server database to Azure SQL Database. They need to migrate with minimal downtime while keeping the source database operational. Which service should they use?

Accepted Answer

Azure Database Migration Service (DMS). Azure Database Migration Service supports online migrations with minimal downtime using continuous sync (CDC) from SQL Server to Azure SQL Database.

Answer

Azure Data Sync

Answer

Azure Import/Export Service

Answer

Azure Data Box

Question 10

A security engineer is configuring a network security group (NSG) in Azure to allow inbound HTTPS traffic to a web server. The engineer creates an inbound rule allowing TCP port 443 from the Internet. What must be done to ensure the web server can respond to clients?

Accepted Answer

No additional rule is needed because the NSG is stateful.. NSGs are stateful; allowing inbound traffic automatically allows the corresponding outbound response traffic.

Answer

Create an outbound rule allowing all traffic to the Internet.

Answer

Create an inbound rule allowing TCP port 443 from the web server.

Answer

Create an outbound rule allowing TCP port 443 to the Internet.

Question 11

A DevOps team is setting up a CI/CD pipeline using GitHub Actions. They want the pipeline to automatically deploy a containerized application to a Kubernetes cluster only when changes are pushed to the main branch. Which GitHub Actions component should they use to trigger the deployment?

Accepted Answer

A workflow with an on.push trigger for the main branch. GitHub Actions workflows are defined in YAML and can include an 'on' trigger specifying events such as push to a branch. This allows automation of the deployment when code is pushed to main.

Answer

A cron job that checks the repository every hour

Answer

A GitHub webhook configured in the repository settings

Answer

A pull request review requirement

Question 12

A cloud engineer is writing a Terraform configuration to deploy an AWS EC2 instance. The engineer wants to pass the AMI ID and instance type into the configuration at runtime without hardcoding them. Which Terraform feature should be used?

Accepted Answer

Variables. Variables in Terraform allow you to define parameters that can be supplied at runtime, making configurations reusable and flexible.

Answer

Locals

Answer

Outputs

Answer

Data sources

Question 13

A cloud engineer is writing Terraform code to provision AWS resources. They need to define the cloud provider and authentication details. Which block should they use in their HCL configuration?

Accepted Answer

provider block. In HashiCorp Configuration Language (HCL), the provider block declares which cloud provider Terraform should use (e.g., aws, azure, google) and supplies the configuration needed to authenticate and target the correct region or account. For AWS, this includes region, access keys, or references to credential profiles/roles. Without a provider block, Terraform cannot know which API to call or how to authenticate.

Answer

resource block

Answer

variable block

Answer

module block

Question 14

A cloud administrator is planning a migration of on-premises workloads to a public cloud. Which THREE factors should the administrator consider to ensure minimal downtime? (Choose three.)

Accepted Answer

Application compatibility. Application compatibility (A) is correct because the administrator must verify that each on-premises workload can run in the target public cloud environment (OS versions, hypervisor/instance types, dependencies, and licensing) so that cutover does not stall on unsupported software and cause extended downtime. Network bandwidth (C) is correct because the available throughput between the on-premises site and the cloud directly determines how quickly data can be replicated or transferred; insufficient bandwidth stretches the migration window and forces longer outages unless offline seeding or continuous replication is used. Transfer time window (D) is correct because the administrator must schedule the bulk data movement and final cutover within an acceptable maintenance period, accounting for replication lag and delta synchronization, to keep the actual service interruption as short as possible. Data compression (B) and cost of data transfer (E) are not among the required factors: compression can reduce payload size and egress/ingress charges can affect budget, but neither is a primary determinant of achieving minimal downtime in the migration plan.

Answer

Data compression

Answer

Cost of data transfer

Question 15

A cloud architect is designing a multi-tier application that must remain available during a single Availability Zone failure. Which TWO design principles should the architect apply?

Accepted Answer

Deploy resources across multiple Availability Zones.. Option B is correct because deploying resources across multiple Availability Zones ensures that if one AZ fails, the application continues running from the remaining AZs, which is the fundamental high-availability design principle for surviving a single-AZ failure. Option E is correct because an Auto Scaling group with a minimum of two instances spread across zones maintains capacity and automatically replaces failed instances, providing both redundancy and resilience against an AZ outage. Option A is not appropriate here because synchronous replication to a DR site addresses regional disaster recovery, not single-AZ fault tolerance, and synchronous replication across regions introduces latency. Option C is insufficient because a single load balancer is itself a single point of failure unless it is also made multi-AZ, and it does not by itself distribute resources across zones. Option D is wrong because placing all servers in one subnet confines them to a single AZ, which directly violates the requirement to survive an AZ failure.

Answer

Implement synchronous replication between the primary site and a DR site.

Answer

Use a single load balancer to distribute traffic across instances.

Answer

Place all application servers in the same subnet for low latency.