CV0-004 Practice Test 25 — 15 Questions

Question 1

Which of the following is a key benefit of using a Cloud Access Security Broker (CASB)?

Accepted Answer

Discovers and controls use of unauthorized cloud applications. CASBs provide visibility and control over SaaS applications, including shadow IT discovery.

Answer

Automates resource provisioning

Answer

Provides DDoS protection

Answer

Manages encryption keys for on-premises data

Question 2

A company is moving a legacy monolithic application to the cloud. The application has interdependencies that make it difficult to refactor. The architect needs to minimize changes while gaining cloud benefits like elasticity and pay-as-you-go. Which migration strategy is BEST?

Accepted Answer

Rehost (Lift and shift). Rehosting (lift and shift) is the best strategy because it moves the monolithic application to the cloud with minimal changes, preserving existing interdependencies. This allows the company to immediately gain cloud benefits like elasticity and pay-as-you-go pricing without refactoring the tightly coupled codebase. The application runs on cloud infrastructure (e.g., EC2 instances) as-is, leveraging auto-scaling and resource optimization.

Answer

Retire

Answer

Repurchase

Answer

Refactor / Re-architect

Question 3

A company is performing a disaster recovery test for a critical application. The test reveals that the application's RTO of 1 hour is not being met due to slow database restoration. Which THREE actions could help improve the restoration time? (Select THREE.)

Accepted Answer

Implement continuous replication to a standby database. Option A (Implement continuous replication to a standby database) is correct because continuous replication keeps a standby copy nearly in sync with the primary, so failover requires little or no data restoration, drastically cutting the time to recover within the 1-hour RTO. Option B (Pre-warm standby database instances in the recovery region) is correct because pre-warming keeps compute, cache, and database processes already running and initialized, eliminating the startup and warm-up latency that would otherwise delay recovery. Option E (Use provisioned IOPS storage for the database volumes) is correct because restoring or replaying data is I/O-bound, and provisioned IOPS delivers guaranteed, higher disk throughput and lower latency, directly accelerating database restoration. Option C is not appropriate because disabling encryption weakens security and encryption overhead is not the primary bottleneck in slow restores. Option D is not appropriate because increasing backup retention only keeps backups longer; it does not make restoring any single backup faster.

Answer

Disable encryption on the database to reduce overhead

Answer

Increase the retention period of automated backups

Question 4

A company needs to connect its on-premises data center to a public cloud provider with a dedicated, consistent network connection that bypasses the internet. Which connectivity method should be used?

Accepted Answer

Direct Connect or ExpressRoute. Direct Connect (AWS) and ExpressRoute (Azure) are dedicated private network connections from on-premises infrastructure to a cloud provider that bypass the public internet entirely. They provide consistent latency, higher bandwidth, and more predictable performance than internet-based options, which is exactly what the scenario requires.

Answer

VPC peering

Answer

Internet gateway

Answer

Site-to-Site VPN

Question 5

A cloud engineer is tasked with automating the deployment of a new web application. Which of the following tools is BEST suited for managing infrastructure as code in a hybrid cloud environment?

Accepted Answer

Terraform. Terraform is the best choice because it is a cloud-agnostic Infrastructure as Code (IaC) tool that uses a declarative configuration language (HCL) to manage resources across multiple providers, including AWS, Azure, and on-premises systems. This makes it ideal for hybrid cloud environments where consistent provisioning and state management are required across disparate platforms.

Answer

AWS CloudFormation

Answer

Ansible

Answer

Docker

Question 6

A cloud administrator is configuring a web application hosted on a public cloud VM. The application must be accessible over HTTPS, and the administrator needs to ensure that all traffic between the client and the server is encrypted. The cloud provider offers a managed certificate service. Which of the following is the BEST practice for securing the application?

Accepted Answer

Use the cloud provider's managed certificate service to provision and attach the certificate to the load balancer.. The cloud provider's managed certificate service automatically handles certificate provisioning, renewal, and attachment to the load balancer, ensuring HTTPS traffic is encrypted with a trusted certificate from a public CA. This is the best practice because it offloads TLS termination to the load balancer, reducing the VM's CPU overhead and centralizing certificate management. It also ensures the certificate is automatically renewed before expiry, preventing service disruptions.

Answer

Generate a self-signed certificate and configure the web server to use it.

Answer

Disable HTTPS and rely on network-level encryption provided by the cloud provider.

Answer

Create a certificate signing request (CSR) and submit it to a public CA, then install the certificate and private key on the VM.

Question 7

A cloud administrator needs to protect a web application from common attacks such as SQL injection and cross-site scripting (XSS). Which cloud service should be implemented?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) is specifically designed to filter and monitor HTTP traffic, blocking common web exploits like SQL injection and XSS. Cloud providers offer WAF services (e.g., AWS WAF, Azure WAF, Cloud Armor).

Answer

DDoS protection service

Answer

Network ACL

Answer

Security group

Question 8

Which THREE of the following are common causes of cloud resource provisioning failures?

Accepted Answer

Insufficient service quotas.. Insufficient service quotas (A) are a common cause of provisioning failures because cloud providers cap the number of resources or capacity per region/project, and requests beyond the quota are rejected until an increase is approved. Policy restrictions such as organization policies (B) block resource creation when the request violates constraints (for example, allowed regions, machine types, or public IP rules), causing the provisioning operation to fail. Exceeded resource limits like vCPU or memory (C) also cause failures when the requested instance size or aggregate capacity surpasses the account's or region's available limits. Disk encryption settings (D) and incorrect resource tagging (E) are not typical causes of provisioning failure; encryption is usually a configuration choice that is supported, and tagging is generally optional metadata that does not prevent resource creation.

Answer

Disk encryption settings.

Answer

Incorrect resource tagging.

Question 9

Which of the following is a key benefit of using object storage like Amazon S3 over block storage?

Accepted Answer

Unlimited scalability for unstructured data. Amazon S3 is designed for unlimited scalability, allowing you to store and retrieve any amount of unstructured data (e.g., images, videos, backups) without provisioning storage in advance. Unlike block storage, which has fixed size limits per volume, S3 automatically scales to accommodate petabytes of data, making it ideal for modern cloud-native applications.

Answer

Direct attachment to a single VM

Answer

Supports file-level locking

Answer

Lower latency for database workloads

Question 10

A cloud architect is designing identity and access management (IAM) for a multi-cloud environment. The architect wants to enforce least privilege and support federation with an on-premises Active Directory. Which TWO of the following should be implemented? (Select TWO).

Accepted Answer

Using service accounts for application authentication. Federation with SAML allows SSO from on-prem AD, and service accounts provide non-human identities for applications, both supporting least privilege by granting only necessary permissions.

Answer

Storing shared credentials in application code

Answer

Assigning full administrator roles to all users

Answer

Disabling multi-factor authentication (MFA)

Question 11

A company uses AWS and wants to optimize costs by receiving recommendations to downsize over-provisioned EC2 instances. Which tool provides rightsizing recommendations?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer is the service specifically designed to analyze resource utilization metrics (such as CPU, memory, network, and disk) and generate rightsizing recommendations for EC2 instances, Auto Scaling groups, EBS volumes, and Lambda functions. It uses machine learning to identify over-provisioned or under-provisioned resources and provides actionable recommendations to downsize or upsize, directly addressing the goal of cost optimization. Unlike other tools that focus on billing or budgets, Compute Optimizer delivers instance-type-level guidance based on actual usage patterns.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Cost Explorer

Question 12

A company migrated to a hybrid cloud and users report slow access to files stored in the cloud. The on-premises network is 100 Mbps. What troubleshooting step should be taken?

Accepted Answer

Check VPN bandwidth and latency. The most likely bottleneck in a hybrid cloud scenario where users access cloud-stored files over a 100 Mbps on-premises connection is the VPN tunnel used to connect to the cloud. VPN bandwidth and latency directly affect file access speed, and issues such as insufficient tunnel capacity, high latency, or packet loss can cause slow transfers. Checking these metrics is the logical first troubleshooting step to identify whether the network path is the limiting factor.

Answer

Enable compression on the cloud storage gateway

Answer

Increase cloud storage performance tier

Answer

Move files to on-premises storage

Question 13

During a cloud migration, a database server is moved from on-premises to a cloud-managed database service. After migration, the application team reports that some queries are running slower than before. The database CPU utilization is low. What is the most likely cause?

Accepted Answer

The network latency between the application and the database has increased. When a database is moved to a cloud-managed service and queries slow down while CPU utilization is low, the most likely cause is increased network latency between the application and the database. Low CPU indicates the database is not compute-bound, so the delay is likely in the round-trip time for queries. This is common when the application and database are in different regions or availability zones.

Answer

The database is not indexed properly

Answer

The database connection pooling is misconfigured

Answer

The cloud database instance type has insufficient memory

Question 14

A cloud architect is evaluating a multi-cloud strategy to improve resilience. Which THREE factors should be considered when designing multi-cloud architecture? (Select THREE.)

Accepted Answer

Data transfer costs between clouds. Option B (Data transfer costs between clouds) is correct because multi-cloud designs frequently move data across provider boundaries, and egress charges plus inter-cloud transfer fees can significantly erode the cost benefits of a multi-cloud strategy, so they must be modeled during design. Option D (Application portability and interoperability) is correct because resilience in a multi-cloud architecture depends on workloads being able to run on more than one provider, which requires avoiding proprietary APIs and using portable formats such as containers, Kubernetes, and open standards. Option E (Consistent security and compliance policies across clouds) is correct because each provider implements identity, encryption, and logging differently, so a unified policy framework and controls such as federated IAM and centralized logging are needed to maintain a consistent security posture. Option A (Increased vendor lock-in) is not a valid factor because multi-cloud is generally adopted to reduce dependence on a single vendor, not to increase lock-in. Option C (Ability to manage all clouds with a single API) is not a required design factor because no single universal API natively manages AWS, Azure, and GCP; management is typically achieved through abstraction layers, IaC tools like Terraform, or multi-cloud platforms rather than one provider API.

Answer

Increased vendor lock-in

Answer

Ability to manage all clouds with a single API

Question 15

A cloud architect is designing a VPC for a three-tier web application. The web servers must be accessible from the internet, the application servers should only be reachable from the web tier, and the database servers should not have any public IP addresses and should be isolated. Which subnet design meets these requirements?

Accepted Answer

Web tier in public subnet, app tier in private subnet, database tier in a separate private subnet with no internet gateway. A three-tier architecture requires strict network segmentation: the web tier in a public subnet with a route to an Internet Gateway for inbound traffic, the app tier in a private subnet reachable only from the web tier (via security groups or NACLs), and the database tier in a separate private subnet with no route to an Internet Gateway or NAT Gateway, ensuring complete isolation. This design enforces least-privilege network access and satisfies the stated requirements.

Answer

Web tier in public subnet, app and database tiers in the same private subnet

Answer

All servers in private subnets with a NAT gateway for inbound traffic

Answer

All servers in the same public subnet with security groups