CV0-004 Practice Test 2 — 25 Questions

Question 1

A cloud operations team is implementing structured logging for better querying. They have decided to use JSON format. What is a key benefit of structured logging over unstructured logging?

Accepted Answer

Enables querying specific fields. Structured logging (e.g., JSON) enables efficient querying and filtering of log data.

Answer

Easier to read for humans

Answer

Reduced storage costs

Answer

Faster log ingestion

Question 2

An organization uses AWS CloudFormation to deploy resources across multiple AWS accounts. They need to manage a common set of resources in several accounts from a single template. Which CloudFormation feature should they use?

Accepted Answer

StackSets. StackSets allow deploying stacks across multiple accounts and regions. Change sets show changes before execution; Drift Detection detects configuration drift; Nested stacks are for reusability within a single account.

Answer

Change sets

Answer

Nested stacks

Answer

Drift Detection

Question 3

Arrange the steps to configure a VPN connection between an on-premises network and a cloud VPC.

Accepted Answer

Create cloud-side VPN gateway, then create on-premises gateway representation, then configure on-premises VPN device, then create VPN connection, then configure routing.. Start with cloud-side gateway, on-premises gateway representation, configure on-prem device, create connection, then routing.

Answer

Create cloud-side VPN gateway, then create on-premises gateway representation, then create VPN connection, then configure on-premises VPN device, then configure routing.

Answer

Create on-premises gateway representation, then create cloud-side VPN gateway, then configure on-premises VPN device, then create VPN connection, then configure routing.

Answer

Create cloud-side VPN gateway, then configure on-premises VPN device, then create on-premises gateway representation, then create VPN connection, then configure routing.

Question 4

Sequence the steps to set up a cloud storage bucket with versioning and lifecycle policies.

Accepted Answer

Create bucket, then enable versioning, then add lifecycle rules (transitions and deletions), then test. Create bucket, enable versioning, add lifecycle rules for transitions and deletions, then test.

Answer

Enable versioning, then create bucket, then add lifecycle rules, then test

Answer

Create bucket, then add lifecycle rules, then enable versioning, then test

Answer

Create bucket, then enable versioning, then test, then add lifecycle rules

Question 5

Which THREE of the following are valid considerations when selecting a cloud deployment model (public, private, hybrid)? (Choose three.)

Accepted Answer

Regulatory compliance requirements.. Option A (Regulatory compliance requirements) is correct because data-residency, sovereignty, and industry regulations (e.g., HIPAA, GDPR, PCI DSS) often dictate whether workloads can run in a public cloud, must stay in a private cloud, or require a hybrid model to keep sensitive data on-premises. Option B (Budget and total cost of ownership) is correct because deployment models differ significantly in CapEx versus OpEx: public cloud shifts spend to operational pay-as-you-go costs, private cloud requires capital investment in hardware and staffing, and hybrid blends both, so TCO analysis directly drives model selection. Option D (Latency sensitivity of the application) is correct because real-time or low-latency workloads may need private or hybrid placement near users or data sources, since public cloud network round-trip times can violate strict latency SLAs. Option C is not a valid consideration because programming language preference is an application development concern independent of where the infrastructure is deployed. Option E is not a valid consideration because marketing claims are not a technical or business criterion for evaluating deployment models.

Answer

Developers' preferred programming languages.

Answer

Cloud provider's marketing claims.

Question 6

Which THREE of the following are common causes of VM migration failures in a cloud environment? (Choose three.)

Accepted Answer

Incompatible CPU instruction sets or features between source and target hosts. Option B is correct because live or cold migration requires the target host's CPU to expose the same instruction set extensions (e.g., SSE4.2, AVX, VT-x/AMD-V) that the VM's configuration and guest OS expect; a mismatch causes the migration to fail or be blocked by compatibility checks such as those in vSphere EVC or Hyper-V processor compatibility mode. Option D is correct because the target datastore must have enough free capacity to hold the VM's disks, snapshots, swap, and memory files; if provisioning the destination files exceeds available space, the migration aborts with an out-of-space error. Option E is correct because migration traffic (e.g., vMotion over TCP 8000, or shared storage access over iSCSI/NFS) depends on reliable, adequately provisioned network links between source and target hypervisors; packet loss, MTU mismatch, or blocked ports will break the transfer. Option A is not a typical migration failure cause because hypervisor and guest licensing is generally checked at power-on or activation time, not during the migration operation itself. Option C is not a typical cause because stale DNS records for the VM's hostname affect name resolution and connectivity after migration, but they do not prevent the hypervisor-level migration process from completing.

Answer

Expired software licenses on the target host

Answer

Stale DNS records for the VM's hostname

Question 7

A containerized application deployment fails with an 'ImagePullBackOff' error. What should the administrator verify?

Accepted Answer

The container registry credentials and image tag. ImagePullBackOff means the container runtime cannot pull the image, which is almost always caused by invalid registry credentials, a wrong image tag, or an image that does not exist. Verifying the registry credentials and the exact image tag/name is the correct first troubleshooting step.

Answer

The CPU utilization on the node

Answer

The cluster's DNS configuration

Answer

The firewall rules between nodes and registry

Question 8

A DevOps team uses Jenkins for CI/CD. They want to automatically deploy containerized applications to a Kubernetes cluster. Which Jenkins feature or plugin can integrate with Kubernetes to manage deployments?

Accepted Answer

Kubernetes plugin. The Kubernetes plugin for Jenkins allows Jenkins agents to be dynamically provisioned as pods within a Kubernetes cluster, enabling automated deployment of containerized applications. It integrates directly with the Kubernetes API to manage deployments, services, and other resources, making it the correct choice for this scenario.

Answer

Jenkins Declarative Pipeline

Answer

Jenkins Blue Ocean

Answer

Jenkins Multibranch Pipeline

Question 9

A cloud engineer is configuring a web application that must comply with PCI DSS. The application runs on virtual machines in a public cloud. Which of the following security responsibilities falls under the customer's scope according to the shared responsibility model?

Accepted Answer

Patching the guest operating system of the virtual machines. In the shared responsibility model, the customer is responsible for patching the guest OS, while the cloud provider manages the physical infrastructure and hypervisor.

Answer

Replacing failed physical drives in the storage array

Answer

Configuring the physical network firewall

Answer

Applying hypervisor patches

Question 10

A cloud architect is designing a highly available web application on AWS. The application must continue serving traffic even if an entire AWS Availability Zone fails. Which architecture should the architect implement?

Accepted Answer

Active-active across two Availability Zones. Active-active architecture across multiple Availability Zones ensures that if one zone fails, traffic is routed to the remaining healthy zones, providing high availability.

Answer

Active-passive in a single Availability Zone

Answer

Vertical scaling on a single instance

Answer

Active-passive across two regions

Question 11

A cloud engineer is setting up automated patching for Linux instances in AWS. They need to define a maintenance window during which patches are applied. Which service should they use?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager is specifically designed to automate the process of patching managed nodes, including defining maintenance windows during which patches are applied. It allows you to create patch baselines, specify approved patches, and schedule patching within a maintenance window. This meets the requirement of automated patching with a defined maintenance window.

Answer

AWS Config

Answer

AWS OpsWorks

Answer

Amazon Inspector

Question 12

Match each storage type to its characteristic.

Accepted Answer

Object storage: Data stored as objects with metadata and a unique identifier, highly scalable.. Object storage uses objects with metadata (scalable for unstructured data), block storage uses fixed blocks (low-latency for databases), file storage uses hierarchical files (shared access), and SAN provides block-level access over a high-speed network. Common confusions swap object and block definitions.

Answer

Object storage: Data divided into blocks.

Answer

Block storage: Data stored as objects with metadata.

Question 13

A cloud administrator notices that a virtual machine (VM) is running slowly. The hypervisor shows high CPU ready time for that VM. Which of the following is the most likely cause?

Accepted Answer

Overcommitted physical CPU resources on the host. High CPU ready time indicates that the VM is ready to execute instructions but is waiting for the physical CPU to become available. This is a classic symptom of CPU overcommitment, where the host has more virtual CPUs (vCPUs) assigned to VMs than physical cores, causing contention. Option C correctly identifies this as the most likely cause.

Answer

High disk I/O latency on the datastore

Answer

Insufficient memory allocated to the VM

Answer

Misconfigured virtual switch

Question 14

Match each troubleshooting command to its function.

Accepted Answer

ping: Tests network connectivity to a remote host. Common CLI tools for network troubleshooting: ping tests reachability, traceroute shows the path, nslookup resolves DNS names. Confusing these functions is a typical mistake.

Answer

ping: Traces the route packets take to a destination

Answer

traceroute: Queries DNS to resolve domain names to IP addresses

Answer

nslookup: Tests network connectivity to a remote host

Question 15

A company is designing a hybrid cloud storage solution. Which TWO storage services are suitable for a shared file system accessible from both on-premises and cloud VMs? (Select TWO.)

Accepted Answer

Azure Files. Azure Files (B) is correct because it provides fully managed SMB and NFS file shares that can be mounted simultaneously from on-premises Windows/Linux machines and Azure VMs, making it a true shared file system for hybrid scenarios. Amazon EFS (E) is correct because it is a managed NFS file system that supports mounting from on-premises servers via AWS Direct Connect or VPN as well as from EC2 instances in multiple Availability Zones. Azure Blob (A) is object storage accessed via HTTP/REST rather than a mountable shared file system, so it does not meet the requirement. Amazon S3 (C) is also object storage with a REST API, not a POSIX/NFS/SMB file system. Amazon EBS (D) provides block storage volumes attached to a single EC2 instance and cannot be shared across on-premises and cloud VMs.

Answer

Azure Blob

Answer

Amazon S3

Answer

Amazon EBS

Question 16

A company is migrating a legacy on-premises application to a public cloud. The application currently uses a single monolithic architecture and relies on a local file system for storage. The cloud architect needs to redesign the application to take advantage of cloud-native features. Which design principle should the architect prioritize to ensure scalability and resilience?

Accepted Answer

Refactor the application into microservices deployed across multiple instances. Refactoring the monolithic application into microservices enables independent scaling of components, improves fault isolation, and aligns with cloud-native patterns like containerization and orchestration (e.g., Kubernetes). This approach leverages horizontal scaling across multiple instances, which is essential for achieving elasticity and resilience in a public cloud environment, unlike the legacy single-point-of-failure monolithic design.

Answer

Maintain the monolithic architecture and connect via VPN to on-premises storage

Answer

Use vertical scaling by increasing vCPU and RAM on a single large VM

Answer

Deploy the entire application in a single availability zone to reduce latency

Question 17

A cloud administrator is troubleshooting connectivity to a web server running on a Linux VM. The web server is configured to listen on ports 80 (HTTP) and 443 (HTTPS). The administrator runs the iptables command shown in the exhibit. Based on the output, what is the MOST likely reason that external users cannot access the web server on port 443?

Accepted Answer

The iptables rule for port 443 only allows traffic from the 10.0.0.0/8 subnet, which does not include external IP addresses.. The iptables rule for port 443 specifies a source IP range of 10.0.0.0/8, which is a private RFC 1918 address space. External users have public IP addresses that do not fall within this subnet, so their HTTPS traffic is implicitly dropped by the rule's match condition. The default policy being ACCEPT does not override the explicit rule that only permits traffic from the 10.0.0.0/8 subnet.

Answer

The web server is not configured to listen on port 443, so iptables rules are irrelevant.

Answer

The iptables default policy is ACCEPT, but the rule for port 443 explicitly drops traffic from external sources.

Answer

The rule for port 80 is placed before the rule for port 443, causing all HTTPS traffic to be evaluated as HTTP and dropped.

Question 18

A company is migrating its on-premises database to a cloud-managed database service. The database contains sensitive financial data. Which of the following is the MOST important security configuration to implement after migration?

Accepted Answer

Enable encryption at rest using a customer-managed key. Enabling encryption at rest with a customer-managed key is the most important security configuration for sensitive financial data in a cloud-managed database, because it protects data confidentiality even if the underlying storage is compromised and gives the organization control over key lifecycle and access. Customer-managed keys (via KMS or equivalent) allow granular access policies, rotation, and revocation, which are critical for regulatory compliance such as PCI DSS. This directly addresses the protection of data at rest, the primary security concern after migration.

Answer

Configure automated patching schedule

Answer

Enable public read access for monitoring tools

Answer

Set up cross-region replication for high availability

Question 19

A company uses GCP and wants to ensure that log entries from Compute Engine instances are automatically exported to BigQuery for analysis. The logs must include structured JSON data. Which GCP service should be configured to route logs?

Accepted Answer

Cloud Logging using sinks. Cloud Logging can route logs to BigQuery using sinks. It accepts structured logs in JSON format.

Answer

Cloud Audit Logs

Answer

Cloud Functions

Answer

Cloud Monitoring

Question 20

A cloud administrator needs to centrally collect, search, and retain application and system logs from hundreds of Amazon EC2 instances and AWS services for troubleshooting and compliance. The administrator wants a managed service that stores logs in durable storage and allows ad hoc queries using a query language. Which AWS service should the administrator use?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the managed AWS service for centralizing log data from EC2 instances and AWS services. The CloudWatch agent ships instance logs to log groups, and CloudWatch Logs Insights provides a purpose-built query language to search and analyze events. CloudTrail captures API activity, Config tracks resource configuration, and Trusted Advisor offers recommendations, none of which provide general log ingestion and querying.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

AWS Config