CV0-004 Practice Test 3 — 25 Questions

Question 1

An organization uses multiple cloud providers and wants to centralize secrets management. Which solution would best meet this requirement?

Accepted Answer

HashiCorp Vault. HashiCorp Vault is a multi-cloud secrets management solution that can store and rotate secrets across different providers.

Answer

Azure Key Vault

Answer

AWS Secrets Manager

Answer

Google Cloud Secret Manager

Question 2

A company wants to migrate its on-premises workloads to the cloud and requires full control over the operating system, installed software, and security configurations. Which cloud service model should they choose?

Accepted Answer

IaaS. IaaS provides virtualized computing resources where the customer manages the OS and above, giving full control.

Answer

FaaS

Answer

PaaS

Answer

SaaS

Question 3

A cloud database cluster is experiencing replication lag. The primary node shows high write activity, and the replicas are on different availability zones. Which of the following is the most likely cause?

Accepted Answer

Network latency between the primary and replica zones is high.. Network latency between availability zones is a common cause of replication lag in asynchronous replication setups, especially when the primary has high write activity. Option A is incorrect because synchronous replication would cause the primary to wait for acknowledgment from replicas, leading to write slowdown rather than lag on replicas. Option C is incorrect because insufficient storage on replicas would typically cause disk-full errors, not replication lag. Option D is incorrect because vCPU over-allocation on the primary primarily affects compute performance, not the replication process which is more sensitive to network and disk I/O.

Answer

Replication is configured as synchronous.

Answer

The replica nodes have insufficient storage.

Answer

The primary node's vCPU is over-allocated.

Question 4

An organization wants to audit all API calls made in their AWS account. Which AWS service should be enabled to capture these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity for governance, compliance, and auditing.

Answer

Amazon CloudWatch

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 5

A company manages a multi-account AWS environment and wants to deploy consistent infrastructure across several accounts using CloudFormation. The solution must support updates to the infrastructure and detect configuration drift. Which TWO CloudFormation features should be used?

Accepted Answer

StackSets. StackSets (B) is correct because it is the CloudFormation feature designed to deploy and update the same template across multiple AWS accounts and Regions from a single administrator account, which directly satisfies the requirement for consistent infrastructure across several accounts. Drift detection (E) is correct because it lets CloudFormation compare a stack's actual resource configuration against its expected template configuration and report resources that have been modified outside CloudFormation, satisfying the drift-detection requirement. Change sets (A) only preview how proposed changes would affect a single stack before execution, so they do not provide multi-account deployment or drift detection. Outputs (C) merely export values from a stack for cross-stack references and do not deploy or monitor infrastructure. Nested stacks (D) help organize reusable templates within a single account/stack hierarchy but do not natively roll out stacks across multiple accounts or detect drift.

Answer

Change sets

Answer

Outputs

Answer

Nested stacks

Question 6

A cloud administrator is designing network security for a three-tier application. The web tier must be accessible from the internet, but the application and database tiers should only be reachable from the web tier. Which security group configuration should be used?

Accepted Answer

Use separate security groups: web allows HTTP/HTTPS from 0.0.0.0/0; app allows traffic from web security group; db allows traffic from app security group. It uses separate security groups for each tier, implementing the principle of least privilege. The web tier security group allows HTTP/HTTPS from 0.0.0.0/0 for internet access, while the app tier security group references the web tier security group as its source, ensuring only traffic from the web tier can reach the application tier. Similarly, the database tier security group references the app tier security group, restricting access exclusively to the application tier. This configuration enforces strict east-west traffic control and prevents direct internet access to the internal tiers.

Answer

Assign the same security group to all tiers and use a single inbound rule

Answer

Place all tiers in the same subnet and use a network ACL to permit all traffic

Answer

Configure a network ACL for each subnet with allow rules for the required traffic

Question 7

A company wants to migrate its on-premises workloads to the cloud but must keep sensitive data on-premises due to regulatory requirements. Which cloud deployment model should the company use?

Accepted Answer

Hybrid cloud. A hybrid cloud deployment model combines on-premises infrastructure with public cloud services, allowing sensitive data to remain on-premises while other workloads leverage cloud scalability. This directly meets the regulatory requirement to keep sensitive data local while still benefiting from cloud resources for other components.

Answer

Multi-cloud

Answer

Public cloud

Answer

Private cloud

Question 8

A cloud administrator is troubleshooting why a newly launched VM did not complete its initialization. According to the exhibit, what is the most likely cause?

Accepted Answer

The package repository is not configured correctly. The error 'E: Unable to locate package python3-pip' indicates that the package repository is not configured correctly or the package does not exist in the configured sources. This prevents cloud-init from installing the specified package, so the most likely cause is an incorrect repository configuration. Therefore, option B is correct. Option A is incorrect because cloud-init is executing commands, showing it is installed. Option C is incorrect because the error is about a missing package, not a syntax error. Option D is incorrect because the command ran successfully, indicating no network issues; the problem is repository configuration.

Answer

Cloud-init is not installed on the VM

Answer

The cloud-init user data script contains a syntax error

Answer

The VM does not have internet access

Question 9

A cloud administrator needs to design a storage solution that provides block-level access for a database server and must be highly durable. Which storage type should be used?

Accepted Answer

Block storage. Block storage is the correct choice because it provides raw, low-latency block-level access that database servers require for high-performance read/write operations. It also supports features like RAID, snapshots, and replication to achieve high durability, making it ideal for transactional databases.

Answer

File storage

Answer

Archive storage

Answer

Object storage

Question 10

Which of the following is a characteristic of serverless computing (FaaS)?

Accepted Answer

You are charged per execution or compute time. Serverless computing (FaaS) abstracts all infrastructure management and bills based on actual consumption — typically per invocation and per GB-second of compute time. This means you pay only when your function executes, not for idle capacity. This consumption-based model is the defining economic characteristic of FaaS platforms like AWS Lambda, Azure Functions, and Google Cloud Functions.

Answer

You pay for allocated resources regardless of usage

Answer

You must manage the underlying servers

Answer

You have to provision capacity in advance

Question 11

A DevOps team is implementing a CI/CD pipeline using Jenkins. They want to ensure that code is automatically built, tested, and deployed to a staging environment before manual approval for production. Which stage should include the deployment to staging?

Accepted Answer

Deploy. In a Jenkins CI/CD pipeline, the Deploy stage is responsible for taking the built and verified artifact and releasing it to an environment — in this case, the staging environment. The pipeline flow is typically Source → Build → Test/Verify → Deploy (staging) → Manual Approval → Deploy (production). Placing staging deployment in the Deploy stage correctly separates it from build and test activities.

Answer

Build

Answer

Source

Answer

Verify

Question 12

A company uses Azure DevOps to deploy a critical application. They need to implement a deployment strategy that ensures zero downtime by directing all traffic to the new environment after validation, while keeping the old environment as a fallback. Which deployment strategy should be configured in the Azure Pipelines release pipeline?

Accepted Answer

Blue/green deployment. Blue/green deployment is the correct strategy because it maintains two identical environments (blue and green) and switches the router or load balancer to direct all traffic to the new (green) environment only after validation is complete. The old (blue) environment remains untouched and can serve as an immediate fallback if issues arise, ensuring zero downtime during the cutover.

Answer

Canary deployment

Answer

In-place deployment

Answer

Rolling deployment

Question 13

Which THREE of the following are valid methods to manage identity and access in a multi-cloud environment?

Accepted Answer

Implement a federation using SAML 2.0 between the corporate identity provider and each cloud.. Option B is correct because SAML 2.0 federation lets the corporate identity provider act as the authoritative IdP, issuing signed assertions that each cloud provider's STS trusts, enabling single sign-on and centralized identity lifecycle management across clouds. Option C is correct because tagging resources and referencing those tags in ABAC policies allows a single, consistent authorization model (for example, 'allow if resource tag owner == user.department') to be evaluated across heterogeneous cloud IAM engines. Option E is correct because a CASB sits between users and multiple cloud services to enforce authentication, authorization, DLP, and shadow-IT policies uniformly, which is a recognized way to govern access in multi-cloud environments. Option A is not an identity or access management method; a site-to-site VPN only provides encrypted network connectivity between on-premises and cloud networks. Option D is not valid because a single shared API key is a static, non-attributable credential that cannot be scoped per user or cloud, breaks least privilege and auditability, and is an anti-pattern for identity management.

Answer

Set up a site-to-site VPN between the on-premises network and each cloud.

Answer

Use a single shared API key for all clouds to simplify automation.

Question 14

A cloud security team needs to ensure that all API calls made to the cloud provider are logged and monitored for suspicious activity. Which service should be enabled?

Accepted Answer

Enable cloud audit logging for the management console and API calls.. Cloud audit logging (e.g., AWS CloudTrail, Azure Activity Log, GCP Cloud Audit Logs) is the native service that records every management console action and API call made against the cloud provider, capturing identity, source IP, timestamp, and request parameters. This directly satisfies the requirement to log and monitor API activity for suspicious behavior. WAF, IDS, and SIEM are complementary controls but do not themselves generate the authoritative API audit trail.

Answer

Deploy a web application firewall (WAF).

Answer

Configure an intrusion detection system (IDS) on the network.

Answer

Implement a security information and event management (SIEM) system.

Question 15

A cloud administrator needs to deploy a web application in a public cloud. The application must automatically scale out based on CPU utilization and scale in during low demand. Which of the following is the BEST approach?

Accepted Answer

Configure an auto scaling group with a scaling policy based on average CPU utilization. An auto scaling group with a scaling policy based on average CPU utilization is the best approach because it dynamically adjusts the number of instances in response to real-time demand. This method uses CloudWatch metrics to trigger scale-out when CPU exceeds a threshold (e.g., 70%) and scale-in when it drops, ensuring the application remains responsive while minimizing cost during low usage.

Answer

Use a script to increase the instance size when CPU exceeds 80%

Answer

Implement scheduled scaling to add instances during business hours

Answer

Create a load balancer and manually add instances during peak hours

Question 16

A company uses a cloud load balancer to distribute traffic to web servers. The load balancer health checks are failing for all instances. The instances are running and can be accessed directly via their private IPs from within the VPC. What is the most likely cause?

Accepted Answer

The security group of the instances is not allowing traffic from the load balancer.. The most likely cause is that the security group attached to the web server instances does not include an inbound rule allowing traffic from the load balancer's source IP addresses or the load balancer's security group. Even though the instances are healthy and reachable via private IPs from within the VPC, the load balancer's health check probes (typically HTTP/HTTPS or TCP) are blocked by the instance-level firewall, causing all health checks to fail.

Answer

The load balancer's cross-zone load balancing is disabled.

Answer

The load balancer's listeners are configured on the wrong ports.

Answer

The instances are not registered with the target group.

Question 17

An organization is using Azure DevOps to implement a CI/CD pipeline. In which stage of the pipeline would automated unit tests typically be executed?

Accepted Answer

Build. In a typical CI/CD pipeline, automated unit tests are executed during the Build stage, immediately after code compilation, to validate that individual components function correctly before any deployment. This early feedback loop catches defects quickly and prevents broken code from progressing to later stages. The Build stage is where code is compiled, packaged, and unit-tested.

Answer

Deploy

Answer

Verify

Answer

Source

Question 18

A company uses a cloud-based load balancer to distribute traffic to web servers. Recently, a new security policy was applied that restricts traffic to certain geographic regions. Users from an allowed region report they cannot access the website. The load balancer status shows health checks are passing. What should the administrator check?

Accepted Answer

The load balancer's access control lists (ACLs). Geographic restrictions on a load balancer are typically implemented via access control lists (ACLs). Since health checks are passing, the web servers are functional, so the issue lies in the load balancer's ACLs blocking traffic from the allowed region. Option A is wrong: DNS resolution would affect all users similarly, not just those from a specific region. Option B is wrong: SSL certificate issues would generate browser warnings or errors, not complete inaccessibility. Option C is wrong: web server logs are irrelevant as the traffic is not reaching the servers due to the ACL block.

Answer

The DNS resolution for the website

Answer

The SSL certificate expiration

Answer

The web server logs for application errors

Question 19

A company wants to deploy a Lambda function that processes objects uploaded to an S3 bucket. Which event trigger should be configured on the Lambda function?

Accepted Answer

S3 bucket event notification. S3 bucket event notifications can be configured to directly invoke a Lambda function when objects are uploaded. This is the native, serverless integration where S3 publishes an event (e.g., s3:ObjectCreated:Put) to Lambda, triggering the function automatically without any intermediary service.

Answer

API Gateway

Answer

CloudWatch Events

Answer

SQS

Question 20

A company has a policy that all cloud resources must be tagged with 'CostCenter' and 'Project' tags. The cloud operations team uses a monitoring tool to alert when untagged resources are created. The team receives an alert for a new EC2 instance that lacks the required tags. The instance was launched two hours ago by a DevOps engineer who is on leave. The instance is critical for production. What should the administrator do to resolve the compliance violation?

Accepted Answer

Apply the required tags to the existing instance using the cloud provider's console or CLI.. The compliance violation is the absence of required tags, not a problem with the instance itself. The administrator can use the AWS Management Console, CLI (e.g., `aws ec2 create-tags`), or SDK to apply the 'CostCenter' and 'Project' tags to the existing EC2 instance without disrupting its operation. This resolves the alert and maintains production continuity.

Answer

Terminate the instance immediately and launch a new one with proper tags.

Answer

Ignore the alert because the instance is critical and the engineer will fix it when back.

Answer

Modify the tag policy to exempt instances launched by senior engineers.