CV0-004 Practice Test 1 — 25 Questions

Question 1

A cloud administrator notices that a virtual machine has been running for 180 days without a reboot. The administrator needs to install critical security patches that require a reboot. Which of the following actions should the administrator take FIRST?

Accepted Answer

Check for existing snapshots and create a new snapshot.. Option B is correct because before applying patches that require a reboot, the administrator should first check for existing snapshots and create a new snapshot. This ensures a rollback point is available in case the patching process fails or causes instability. Snapshots capture the virtual machine's state, including disk and memory, allowing the administrator to revert to the pre-patch state without data loss.

Answer

Pause the virtual machine before applying patches.

Answer

Shut down the virtual machine and apply patches offline.

Answer

Migrate the virtual machine to a different host to avoid disruption.

Question 2

A cloud engineer is troubleshooting a connectivity issue between two virtual networks in different regions. The engineer has verified that the virtual networks are peered and the routing tables are correct. Which of the following is the MOST likely cause of the issue?

Accepted Answer

A network security group blocking the traffic. Option C is correct because network security groups (NSGs) operate at the subnet or NIC level and can filter traffic between peered virtual networks even when routing is correctly configured. Since the engineer has verified peering and routing tables, the most likely remaining cause is an NSG rule explicitly or implicitly denying the traffic, as NSGs are stateful and evaluated after routing decisions.

Answer

Incorrect route tables on the virtual network gateway

Answer

A physical cable disconnection in the datacenter

Answer

Incorrect DNS resolution

Question 3

A cloud administrator notices that a virtual machine in a public cloud is running slower than expected. The VM is part of a production web application. The administrator has verified that the VM's CPU and memory utilization are below 50%. What should the administrator check next?

Accepted Answer

Check the network bandwidth and I/O throttling limits.. When CPU and memory are well below capacity, performance degradation in a public cloud VM is often caused by resource throttling at the network or storage layer. Cloud providers enforce bandwidth caps and I/O limits per VM size, and hitting those limits can cause packet loss, queuing, and high latency even when compute resources are idle. Checking network bandwidth and I/O throttling limits is the correct next step to identify if the VM is being rate-limited.

Answer

Migrate the VM to a different availability zone.

Answer

Increase the VM's vCPU count.

Answer

Reboot the VM.

Question 4

A cloud operations team is analyzing a security incident in which an unauthorized user accessed a storage bucket. The bucket was configured with public access. Which three best practices should the team implement to prevent such incidents in the future? (Select THREE).

Accepted Answer

Enable access logging and monitor logs.. Enabling access logging (e.g., AWS S3 server access logs or Azure Storage analytics logs) allows the team to record all requests made to the bucket, including the requester, IP address, and action. Monitoring these logs with a SIEM or log analysis tool helps detect unauthorized access attempts early, providing forensic evidence and enabling proactive threat response. This is a critical detective control for security incidents.

Answer

Enable encryption on the storage bucket.

Answer

Enable versioning on the bucket.

Question 5

Match each cost management concept to its description.

Accepted Answer

Total Cost of Ownership (TCO): Total cost including purchase, operation, and disposal. TCO is lifecycle cost, Pay-as-you-go is usage-based billing, Reserved Instances offer discounts for prepayment, and Cost Allocation tracks departmental spending. Common confusions include mixing TCO with Pay-as-you-go and Pay-as-you-go with Reserved Instances.

Answer

Total Cost of Ownership (TCO): Pay only for what you use

Answer

Pay-as-you-go: Pre-pay for discounted rate

Question 6

A load balancer log entry shows the above for a request. What is the MOST likely cause of the 504 error?

Accepted Answer

The backend server took too long to respond to the request.. A 504 Gateway Timeout error from a load balancer indicates that the load balancer sent the request to a backend server but did not receive a timely response. The load balancer has a configured timeout value (often 30-120 seconds), and if the backend server fails to respond within that window, the load balancer terminates the connection and returns a 504. This is the most common cause of 504 errors in load-balanced environments.

Answer

The DNS resolution for the domain name has failed.

Answer

The requested resource does not exist on the backend server.

Answer

The load balancer's health check is misconfigured.

Question 7

A cloud architect is deploying a web application across multiple availability zones within a single region to achieve high availability. The application requires that if one availability zone fails, traffic should automatically be rerouted to the remaining zones without manual intervention. Which configuration is required?

Accepted Answer

Active-active across availability zones with a load balancer. Option B is correct because deploying an active-active configuration across multiple availability zones with a load balancer ensures that traffic is automatically distributed to healthy instances. If one availability zone fails, the load balancer's health checks detect the failure and reroute traffic to the remaining zones without manual intervention, meeting the high availability requirement.

Answer

Active-passive with a standby instance in a different region

Answer

Vertical scaling of instances in a single availability zone

Answer

Cold standby with daily backups

Question 8

A cloud architect is designing a cost-optimized architecture for a batch processing workload that runs every hour for 10 minutes. The workload is fault-tolerant and can be interrupted. Which TWO pricing models should the architect consider to minimize costs? (Select TWO.)

Accepted Answer

On-demand instances. On-demand instances (C) are correct because they allow the architect to pay only for the compute capacity used per hour, with no upfront commitment, which is ideal for a short-duration (10-minute) batch workload that runs every hour. Spot instances (D) are correct because the workload is fault-tolerant and can be interrupted, enabling the use of spare cloud capacity at significantly discounted rates (often 60-90% off on-demand), further minimizing costs for this interruptible batch processing task.

Answer

Dedicated hosts

Answer

Savings plans

Answer

Reserved instances

Question 9

A company wants to reduce its cloud storage costs for infrequently accessed data that must be retained for 7 years. Which two storage lifecycle policies should they implement? (Select TWO.)

Accepted Answer

Transition data to a lower-cost infrequent access tier after 30 days. Option C is correct because transitioning data to a lower-cost infrequent access tier after 30 days aligns with the requirement to reduce costs for infrequently accessed data. This lifecycle policy moves objects from a standard tier to a cheaper tier (e.g., Amazon S3 Standard-IA or Azure Cool Blob Storage) after a specified period, reducing storage costs while maintaining low-latency retrieval. Option D is correct because archiving data to cold storage after 1 year (e.g., Amazon S3 Glacier or Azure Archive Blob Storage) further reduces costs for data that is rarely accessed but must be retained for 7 years, as cold storage offers the lowest storage cost at the expense of longer retrieval times.

Answer

Move data from object storage to block storage after 30 days

Answer

Use reserved capacity for object storage

Answer

Delete all data older than 1 year

Question 10

A company uses a hybrid cloud model with an on-premises data center and a public cloud. The network team reports that traffic between the cloud and on-premises is experiencing high latency and packet loss. The cloud administrator verifies that the VPN connection is up. What is the most likely cause?

Accepted Answer

The VPN tunnel has a mismatched MTU size.. When a VPN tunnel is up but traffic experiences high latency and packet loss, a mismatched Maximum Transmission Unit (MTU) size is a common cause. This occurs because packets larger than the tunnel's MTU must be fragmented, and if fragmentation is not properly handled (e.g., due to the DF bit being set), packets are dropped, leading to retransmissions and increased latency. The symptoms align with MTU issues rather than simple connectivity or throttling problems.

Answer

A firewall rule is blocking ICMP packets.

Answer

VMs are placed in different cloud regions.

Answer

The cloud provider is throttling bandwidth.

Question 11

A cloud operations team receives an alert that the CPU usage of a VM has exceeded 90% for the past 30 minutes. The VM is part of an auto-scaling group configured to scale out when CPU exceeds 80% for 5 minutes. However, no new instances have been launched. What is the MOST likely reason the auto-scaling failed to trigger?

Accepted Answer

The auto-scaling group is in a cooldown period after a previous scaling action.. The auto-scaling group failed to trigger because it was in a cooldown period after a previous scaling action. Cooldown periods are designed to prevent rapid, successive scaling events that could destabilize the environment. During this time, the auto-scaling group ignores new alarms, even if the CPU threshold is exceeded, until the cooldown timer expires.

Answer

The VM failed a health check and is being replaced.

Answer

The auto-scaling group has reached the minimum instance count.

Answer

The CPU threshold is set too high.

Question 12

A cloud engineer is troubleshooting a web application that is not responding. The engineer examines the serial console output of the web-server instance and finds the error shown in the exhibit. What is the MOST likely cause of this issue?

Accepted Answer

A firewall rule is blocking traffic to the metadata server IP address 169.254.169.254.. The error shown in the serial console output indicates that the instance cannot reach the metadata server at 169.254.169.254. This IP address is a link-local address used by cloud providers (e.g., AWS, GCP, Azure) to serve instance metadata, including user data scripts. If a firewall rule blocks traffic to this IP, the instance cannot retrieve its user data, causing the web application to fail to start or respond.

Answer

The service account associated with the instance is missing the required permissions.

Answer

The instance is in a STOPPED state and cannot execute user data scripts.

Answer

The instance does not have a public IP address assigned.

Question 13

A company has a cloud environment with multiple VPCs that need to communicate with each other using private IP addresses. The company wants a centrally managed solution that simplifies routing and security. Which networking architecture should the architect implement?

Accepted Answer

Transit VPC with a VPN appliance. Option D is correct because a Transit VPC with a VPN appliance provides a centrally managed hub-and-spoke architecture that simplifies routing and security for multiple VPCs. The VPN appliance (e.g., a software VPN or AWS Marketplace appliance) establishes encrypted tunnels between the transit VPC and each spoke VPC, allowing private IP communication without the need for full-mesh peering or complex route tables. This design centralizes traffic inspection, policy enforcement, and routing, meeting the requirement for simplified management.

Answer

VPC peering between all VPCs

Answer

Direct Connect to each VPC

Answer

VPN connections between all VPCs

Question 14

A cloud administrator is troubleshooting connectivity to a virtual machine with IP address 10.10.10.10 from another VM on the same subnet. The output of ping and traceroute commands is shown. What is the most likely cause of the connectivity issue?

Accepted Answer

The destination VM's network interface is disabled.. The correct answer is A because a disabled network interface on the destination VM would cause the VM to be unreachable from the same subnet, even though the VM itself is powered on. Ping and traceroute would fail with no response, as the NIC is not operational at Layer 2, preventing ARP resolution and frame delivery. This matches the symptom of no connectivity despite being on the same subnet, where routing and security groups are not factors.

Answer

The destination VM is powered off.

Answer

The source VM's routing table does not have a default gateway.

Answer

The destination VM's security group is blocking ICMP.

Question 15

An organization maintains a private cloud using OpenStack and also uses AWS for additional capacity. They have a critical application that must remain available even if one cloud provider goes offline. The application is deployed in both environments with active load balancing. Which cloud deployment model best describes this architecture?

Accepted Answer

Hybrid cloud. The architecture uses both a private cloud (OpenStack) and a public cloud (AWS) with active load balancing to ensure availability even if one provider fails. This is the defining characteristic of a hybrid cloud, which integrates private and public cloud resources while maintaining orchestration between them.

Answer

Multi-cloud

Answer

Public cloud

Answer

Private cloud

Question 16

An organization needs to recover its critical database within 15 minutes and lose at most 1 minute of data. Which configuration meets these requirements?

Accepted Answer

Hot standby with synchronous replication. Hot standby with synchronous replication ensures that every write to the primary database is also written to the standby before the transaction is acknowledged. This guarantees zero data loss (RPO=0) and, combined with automatic failover, can achieve a recovery time of under 15 minutes (RTO<15 min).

Answer

Active-active with asynchronous replication

Answer

Warm standby with hourly backups

Answer

Cold standby with daily backups

Question 17

A cloud architect is designing a VPC with public and private subnets. Which component is required to allow instances in the private subnet to access the internet for software updates?

Accepted Answer

NAT gateway. A NAT gateway is required to enable instances in a private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT gateway's Elastic IP address using source network address translation (SNAT). An Internet gateway alone cannot serve private subnets because it requires a route table entry pointing to a public subnet with a public IP address.

Answer

Elastic IP

Answer

VPN connection

Answer

Internet gateway

Question 18

Which of the following is a key benefit of using object storage like Amazon S3 over block storage?

Accepted Answer

Unlimited scalability for unstructured data. Amazon S3 is designed for unlimited scalability, allowing you to store and retrieve any amount of unstructured data (e.g., images, videos, backups) without provisioning storage in advance. Unlike block storage, which has fixed size limits per volume, S3 automatically scales to accommodate petabytes of data, making it ideal for modern cloud-native applications.

Answer

Direct attachment to a single VM

Answer

Supports file-level locking

Answer

Lower latency for database workloads

Question 19

A company is migrating a legacy application to the cloud. The application has a stateful design and requires low-latency access to a shared file system. The application must scale horizontally to handle increased load. Which THREE of the following architectural changes should be recommended to enable horizontal scaling?

Accepted Answer

Refactor the application to be stateless. Option C is correct because horizontal scaling requires that any instance can handle any request without depending on local state. By refactoring the application to be stateless, session data is externalized, allowing new instances to be added or removed without affecting ongoing transactions. This eliminates the coupling between a client and a specific server, which is essential for elastic scaling in cloud environments.

Answer

Increase the size of the existing virtual machines (vertical scaling)

Answer

Use sticky sessions (session affinity) on the load balancer

Question 20

A company uses a public cloud IaaS model to host a database. They want to ensure the database remains available if an entire availability zone fails. Which configuration would provide the highest availability with automatic failover?

Accepted Answer

Deploy the database with a stand-by replica in a different availability zone using synchronous replication. Option D is correct because deploying a database with a stand-by replica in a different availability zone using synchronous replication ensures that all committed transactions are written to both the primary and the stand-by before acknowledging the client. This provides automatic failover with zero data loss (RPO=0) and high availability, as the stand-by replica can immediately take over if the entire availability zone fails.

Answer

Use a single database instance with automated snapshots to a different region

Answer

Deploy the database in a single availability zone with multiple EC2 instances

Answer

Use a read replica in a different region with asynchronous replication