CV0-004 Practice Test 4 — 25 Questions

Question 1

Which of the following is a stateless network access control that requires explicit allow rules for both inbound and outbound traffic?

Accepted Answer

Network ACL. Network ACLs (NACLs) are stateless; security groups are stateful.

Answer

Security group

Answer

DDoS protection

Answer

Web application firewall

Question 2

A cloud architect is selecting a storage solution for a database that requires low-latency reads and writes. The database will run on a single VM and must support consistent performance. Which storage type is most appropriate?

Accepted Answer

Block storage. Block storage (e.g., EBS, Azure Disk) provides low-latency, consistent performance suitable for databases running on a single VM.

Answer

Archive storage

Answer

Object storage

Answer

File storage

Question 3

Which cloud deployment model connects an on-premises data center to a public cloud using VPN or dedicated connections like AWS Direct Connect?

Accepted Answer

Hybrid cloud. A hybrid cloud deployment model combines on-premises infrastructure with public cloud services, connected via VPN or dedicated connections like AWS Direct Connect. This allows workloads to span both environments, providing flexibility and scalability. It is the standard term for such integrated architectures.

Answer

Private cloud

Answer

Multi-cloud

Answer

Public cloud

Question 4

A company wants to migrate its on-premises virtualized workloads to the cloud while maintaining control over the operating system and middleware. Which cloud service model should they choose?

Accepted Answer

IaaS. IaaS (Infrastructure as a Service) provides virtualized compute, storage, and networking where the customer retains control over the operating system, middleware, and runtime, while the provider manages the underlying physical infrastructure. This matches the requirement to migrate virtualized workloads while keeping OS and middleware control.

Answer

SaaS

Answer

FaaS

Answer

PaaS

Question 5

An organization needs to connect its on-premises data center to a public cloud with a dedicated, low-latency, and consistent network connection. Which connectivity option should they use?

Accepted Answer

Direct Connect. Direct Connect (AWS) or ExpressRoute (Azure) provides dedicated private connectivity from on-premises to cloud.

Answer

Internet gateway

Answer

VPC peering

Answer

Site-to-site VPN

Question 6

A company uses Azure RBAC to manage access to resources. A user is assigned a Contributor role at the subscription scope. Which of the following is true regarding the scope of this role?

Accepted Answer

The user will have Contributor permissions on all resources within the subscription.. RBAC roles in Azure are inherited from higher scopes to lower scopes (management group → subscription → resource group → resource).

Answer

The user will have Contributor permissions only on resources created after the assignment.

Answer

The user will have Contributor permissions on the subscription itself but not its resources.

Answer

The user will have Contributor permissions only on resource groups within the subscription.

Question 7

A cloud administrator needs to grant a developer read-only access to a specific storage bucket in AWS. Which IAM component should the administrator modify?

Accepted Answer

IAM policy. To grant a developer read-only access to a specific S3 bucket, the administrator must modify an IAM policy. IAM policies are JSON documents that define permissions (Allow/Deny) for actions on AWS resources, and they can be attached to IAM users, groups, or roles. By creating a policy that allows s3:GetObject, s3:ListBucket, etc., on the specific bucket ARN, the administrator can grant least-privilege read-only access.

Answer

Security group

Answer

AWS WAF

Answer

Network ACL

Question 8

Which cloud service model provides the customer with the ability to deploy and manage custom applications without managing the underlying operating system or runtime environment?

Accepted Answer

PaaS. PaaS provides a managed platform where customers deploy their code while the provider manages the OS, runtime, and infrastructure.

Answer

SaaS

Answer

IaaS

Answer

FaaS

Question 9

A company uses AWS and needs to enforce that all S3 buckets are encrypted at rest with customer-managed keys stored in AWS KMS. Which IAM policy condition would ensure this?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The 'aws:RequestTag' condition (or similar) can enforce that resources are created with specific tags, but to enforce encryption key usage, the condition 's3:x-amz-server-side-encryption-aws-kms-key-id' is used.

Answer

s3:x-amz-server-side-encryption with value AES256

Answer

aws:SourceVpce

Answer

s3:versioning

Question 10

A company uses AWS CloudFormation to manage its infrastructure. After updating a stack, a developer notices that the actual infrastructure differs from the expected template. Which CloudFormation feature should be used to identify these differences?

Accepted Answer

Drift detection. Drift detection allows you to detect whether a stack's actual configuration differs from its expected template configuration.

Answer

Stack sets

Answer

Change sets

Answer

Rollback triggers

Question 11

Which TWO of the following are best practices for securing access to a cloud management console?

Accepted Answer

Restrict access based on IP address ranges. Restricting access based on IP address ranges (B) is a best practice because it limits the attack surface by allowing only trusted network sources to reach the management console. This is often implemented via security group rules, network ACLs, or cloud provider-specific features like AWS Security Groups or Azure NSGs, reducing exposure to brute-force and unauthorized access attempts.

Answer

Use complex passwords and rotate them every 30 days

Answer

Use the root account for daily administration

Answer

Enable guest access for external auditors

Question 12

An organization is moving sensitive data to the cloud and must ensure it is encrypted while stored on disk. Which type of encryption should be implemented?

Accepted Answer

Encryption at rest. Encryption at rest protects data stored on disk, typically using AES-256.

Answer

Encryption in transit

Answer

Hashing

Answer

Tokenization

Question 13

A company is migrating to AWS and needs to meet PCI DSS compliance. Which THREE of the following should be implemented? (Choose three.)

Accepted Answer

Encrypting cardholder data at rest and in transit. PCI DSS requires encryption of cardholder data, regular security testing (like vulnerability scanning), and audit logging. Using default VPC settings may not be secure. Single-factor authentication is insufficient.

Answer

Using single-factor authentication for all administrative access

Answer

Using default VPC settings without changes

Question 14

A cloud architect is designing a multi-tenant SaaS application on AWS. Which of the following security responsibilities is the CUSTOMER responsible for under the shared responsibility model?

Accepted Answer

Configuring security groups. Under the shared responsibility model, the customer is responsible for data encryption, OS patching, and IAM configuration, while the provider secures the physical infrastructure.

Answer

Global network infrastructure

Answer

Patching the hypervisor

Answer

Physical security of data centers

Question 15

A company uses CloudFormation to manage infrastructure across multiple AWS accounts. They want to deploy a common set of resources (e.g., VPC, IAM roles) to all accounts in their organization. Which CloudFormation feature should they use?

Accepted Answer

Stack sets. CloudFormation StackSets allow you to deploy a single template across multiple AWS accounts and regions in one operation, using either self-managed permissions or AWS Organizations integration. This is the designed feature for organization-wide resource deployment like VPCs and IAM roles. StackSets handle the orchestration, rollback, and drift detection across all target accounts.

Answer

Change sets

Answer

Nested stacks

Answer

Drift detection

Question 16

A cloud operations team is setting up log-based alerting for security events. They want to use structured logging to facilitate querying. Which TWO practices support effective log-based alerting? (Choose TWO.)

Accepted Answer

Centralize logs in a log management system. Option B is correct because centralizing logs in a log management system (such as a SIEM, ELK/Elasticsearch, or cloud-native service like CloudWatch Logs or Cloud Logging) aggregates events from multiple sources into one queryable store, which is essential for correlating security events and defining alert rules across services. Option E is correct because outputting logs in JSON format produces structured, machine-parseable records with consistent key-value fields, enabling precise queries and filters (e.g., level:ERROR AND event:login_failure) that drive reliable log-based alerts. Option A is not appropriate because enabling verbose logging for all services generates excessive noise and cost, obscuring the security events that alerts should target. Option C is wrong because random, inconsistent log formats break parsing and make querying and alerting unreliable. Option D is not the best practice here because blindly sending all logs to syslog servers lacks the structured, centralized querying and alerting capabilities required, and syslog alone does not provide the structured format needed for effective log-based alerting.

Answer

Enable verbose logging for all services

Answer

Use random log formats for different applications

Answer

Send all logs to syslog servers

Question 17

Match each networking concept to its definition.

Accepted Answer

VPC: A logically isolated network within a cloud provider.. Correct matches: VPC (isolated network), VPN (secure tunnel). Common confusions involve swapping Subnet and CDN, or Load Balancer and CDN. Understanding each component's role in cloud networking is key.

Answer

Subnet: A distributed network of servers that caches content closer to users.

Answer

Load Balancer: A segmented portion of a VPC that can contain resources.

Answer

CDN: Distributes incoming network traffic across multiple targets to improve performance.

Question 18

A cloud architect is designing an auto-scaling policy for a web application that experiences predictable traffic spikes every weekday morning from 8 to 10 AM. The application runs on a group of virtual machines behind a load balancer. Which scaling approach is MOST cost-effective while ensuring performance during the spike?

Accepted Answer

Scheduled scaling to increase capacity before 8 AM and decrease after 10 AM. Scheduled scaling is the most cost-effective approach because the traffic pattern is predictable (every weekday 8–10 AM). By configuring the auto-scaling group to add instances before the spike and remove them after, you avoid paying for idle resources during off-peak hours while ensuring capacity is ready when needed. This approach directly matches the known schedule without relying on reactive metrics or manual intervention.

Answer

Dynamic scaling based on CPU utilization threshold

Answer

Proactive scaling using machine learning to predict spikes

Answer

Manual scaling by the operations team each morning

Question 19

A cloud engineer receives an alert that the root filesystem (/) is at 93% usage. The /data volume has plenty of free space. The application stores logs in /var/log/app/ on the root filesystem. Which of the following is the BEST long-term solution?

Accepted Answer

Move the /var/log/app directory to the /data partition and create a symlink. Moving the /var/log/app directory to the /data partition and creating a symlink is the best long-term solution because it permanently relocates the log data to a volume with ample free space without requiring application reconfiguration. The symlink (/var/log/app -> /data/app) makes the application continue to write to the same logical path, while the actual storage is on the /data filesystem. This resolves the root filesystem capacity issue without altering the application's logging behavior or risking data loss.

Answer

Increase the size of the root filesystem

Answer

Delete the /data partition and merge it with root

Answer

Configure log rotation to delete logs more frequently

Question 20

A cloud engineer is deploying a serverless function using AWS Lambda. The function needs to process messages from an SQS queue. Which event source should be configured to trigger the Lambda function?

Accepted Answer

Amazon SQS. Lambda can be triggered by SQS, S3, API Gateway, etc. For SQS, the trigger is SQS. S3 triggers on object events; API Gateway for HTTP; EventBridge for events.

Answer

Amazon S3

Answer

Amazon API Gateway

Answer

Amazon EventBridge