CV0-004 Practice Test 25 — 15 Questions

Question 1

A security engineer is configuring a network security group (NSG) in Azure to allow inbound HTTPS traffic to a web server. The engineer creates an inbound rule allowing TCP port 443 from the Internet. What must be done to ensure the web server can respond to clients?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

No additional rule is needed because the NSG is stateful.. NSGs are stateful; allowing inbound traffic automatically allows the corresponding outbound response traffic.

Answer

Create an outbound rule allowing all traffic to the Internet.

Answer

Create an inbound rule allowing TCP port 443 from the web server.

Answer

Create an outbound rule allowing TCP port 443 to the Internet.

Question 2

Which of the following is a key benefit of using a Cloud Access Security Broker (CASB)?

Accepted Answer

Discovers and controls use of unauthorized cloud applications. CASBs provide visibility and control over SaaS applications, including shadow IT discovery.

Answer

Automates resource provisioning

Answer

Provides DDoS protection

Answer

Manages encryption keys for on-premises data

Question 3

A company is migrating a financial application to the cloud and must comply with PCI DSS. Which of the following cloud compliance programs is most relevant to demonstrate compliance?

Accepted Answer

PCI DSS Level 1. PCI DSS Level 1 is the highest level of compliance for organizations handling credit card data. Cloud providers offer PCI DSS attestations to support customer compliance.

Answer

ISO 27001

Answer

SOC 2 Type II

Answer

HIPAA BAA

Question 4

A cloud engineer is troubleshooting a performance issue in a microservices application. Which THREE tools can help with distributed tracing and latency diagnosis?

Accepted Answer

GCP Cloud Trace. AWS X-Ray, Azure Application Insights, and GCP Cloud Trace are distributed tracing services.

Answer

AWS CloudTrail

Answer

VPC Flow Logs

Question 5

A cloud administrator needs to monitor CPU utilization for a fleet of EC2 instances and receive notifications when utilization exceeds 80%. Which AWS service should be used to create a metric alarm that triggers an SNS notification?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the AWS service for monitoring metrics and creating alarms. CloudWatch Alarms can be configured to trigger SNS notifications when a metric crosses a threshold.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 6

A cloud administrator is planning to migrate a large on-premises database (several TB) to Amazon RDS with minimal downtime. Which TWO AWS services should be considered for this migration?

Accepted Answer

AWS Database Migration Service. AWS Database Migration Service (DMS) can perform online migrations with minimal downtime using CDC. Schema Conversion Tool helps convert database schema if needed.

Answer

AWS DataSync

Answer

AWS Snowball

Answer

S3 Transfer Acceleration

Question 7

A cloud engineer is using Terraform to manage infrastructure and wants to store the state file remotely for team collaboration. Which THREE backends support state locking and encryption at rest?

Accepted Answer

Azure Blob Storage. AWS S3 with DynamoDB locks, Azure Blob Storage with leasing, and GCS with object versioning all support locking and encryption. Terraform Cloud also does, but it's not listed. Git and Consul are not recommended for production state.

Answer

HashiCorp Consul

Answer

Git repository

Question 8

A development team is adopting Kubernetes for container orchestration. They need to ensure that a new deployment can handle rolling updates and automatically recover from pod failures. Which THREE Kubernetes concepts should be included in the deployment manifest?

Accepted Answer

Readiness probe. Deployment resource manages rolling updates. Readiness probes ensure traffic is sent only to ready pods. Liveness probes restart unhealthy pods.

Answer

Service

Answer

StatefulSet

Question 9

A cloud engineer is writing a Terraform configuration to provision an AWS EC2 instance. They need to pass the AMI ID as a variable to make the configuration reusable. Which Terraform block should be used to define the variable?

Accepted Answer

variable. Variables are defined using the 'variable' block. 'resource' declares resources; 'provider' configures providers; 'output' defines outputs.

Answer

output

Answer

provider

Answer

resource

Question 10

A company is migrating to the cloud and needs to transfer 200 TB of data from an on-premises data center to GCP. The network bandwidth is limited, so they want to use a physical appliance for offline transfer. Which GCP service should they use?

Accepted Answer

Transfer Appliance. Storage Transfer Service is for online transfers; Transfer Appliance is Google's offline physical device; DataSync is AWS; Azure Data Box is Microsoft's offline device.

Answer

Azure Data Box

Answer

AWS DataSync

Answer

Storage Transfer Service

Question 11

A cloud architect is designing a CI/CD pipeline for a containerized application. The pipeline must include stages for building, testing, and deploying to a Kubernetes cluster. Which TWO of the following are common stages in a CI/CD pipeline for containerized applications? (Select TWO.)

Accepted Answer

Build. Source, build, test, deploy, and verify are common stages. Monitoring and alerting are not pipeline stages; capacity planning is not a stage.

Answer

Monitoring

Answer

Alerting

Answer

Capacity planning

Question 12

A cloud engineer is deploying a web application to a Kubernetes cluster. The application requires zero downtime during updates, and the team wants to test new versions with a small percentage of users before full rollout. Which deployment strategy should the engineer use?

Accepted Answer

Canary deployment. A canary deployment routes a small percentage of traffic to the new version, allowing monitoring and automatic rollback if issues arise, meeting the requirements.

Answer

Rolling deployment

Answer

Blue/green deployment

Answer

Immutable deployment

Question 13

A cloud engineer is deploying a serverless function using AWS Lambda. The function needs to process messages from an SQS queue. Which event source should be configured to trigger the Lambda function?

Accepted Answer

Amazon SQS. Lambda can be triggered by SQS, S3, API Gateway, etc. For SQS, the trigger is SQS. S3 triggers on object events; API Gateway for HTTP; EventBridge for events.

Answer

Amazon S3

Answer

Amazon API Gateway

Answer

Amazon EventBridge

Question 14

A company manages a multi-account AWS environment and wants to deploy consistent infrastructure across several accounts using CloudFormation. The solution must support updates to the infrastructure and detect configuration drift. Which TWO CloudFormation features should be used?

Accepted Answer

StackSets. StackSets allow deploying stacks across multiple accounts and regions. Drift detection identifies changes made outside CloudFormation. Change sets preview changes but are not specific to multi-account.

Answer

Change sets

Answer

Outputs

Answer

Nested stacks

Question 15

An organization uses CloudFormation to manage infrastructure across multiple AWS accounts. The team wants to deploy a common set of resources, such as VPCs and security groups, to all accounts in a consistent manner. Which CloudFormation feature should they use?

Accepted Answer

StackSets. StackSets allow deploying stacks across multiple accounts and regions. Change sets preview changes, drift detection checks for manual changes, and nested stacks organize templates within a single account.

Answer

Change sets

Answer

Drift detection

Answer

Nested stacks