CV0-004 Practice Test 4 — 25 Questions

Question 1

A cloud administrator needs to protect a web application from common attacks such as SQL injection and cross-site scripting (XSS). Which cloud service should be implemented?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) is specifically designed to filter and monitor HTTP traffic, blocking common web exploits like SQL injection and XSS. Cloud providers offer WAF services (e.g., AWS WAF, Azure WAF, Cloud Armor).

Answer

DDoS protection service

Answer

Network ACL

Answer

Security group

Question 2

A cloud administrator is troubleshooting a performance issue in a virtualized environment. Which THREE of the following metrics should the administrator analyze to identify potential resource contention? (Select THREE.)

Accepted Answer

CPU ready time. CPU ready time measures the time a virtual machine is ready to execute instructions but is waiting for the hypervisor to schedule physical CPU resources. High ready time directly indicates CPU contention, as the VM is being starved of CPU cycles by other VMs on the same host.

Answer

Swap file usage

Answer

Network latency

Question 3

A company is deploying a web application on GCP and needs to protect against OWASP Top 10 threats and DDoS attacks. Which THREE services should be combined to provide comprehensive protection?

Accepted Answer

Cloud Load Balancing. Cloud Load Balancing (A) is correct because it distributes incoming traffic across multiple backend instances, providing inherent DDoS resilience by absorbing and scaling with attack traffic. It also integrates directly with Cloud Armor to enforce OWASP Top 10 web application firewall (WAF) rules, such as SQL injection and XSS protections, at the edge before traffic reaches the application.

Answer

Cloud NAT

Answer

Cloud VPN

Question 4

A DevOps team is implementing a canary deployment for a microservice running on Amazon ECS. They want to gradually shift 10% of traffic to the new version and automatically roll back if error rates exceed 1% in 5 minutes. Which combination of services should they use?

Accepted Answer

AWS CodeDeploy with CloudWatch alarms. AWS CodeDeploy natively supports canary deployments for Amazon ECS, allowing you to specify a traffic shift percentage (e.g., 10%) and integrate with CloudWatch alarms to automatically trigger a rollback when error rates exceed a defined threshold (e.g., 1% over 5 minutes). This combination directly fulfills the gradual traffic shifting and automated rollback requirements without custom scripting.

Answer

AWS CloudFormation and SSM

Answer

AWS Lambda and Step Functions

Answer

AWS Elastic Beanstalk and Route 53

Question 5

A deployment of a new application version fails with a '503 Service Unavailable' error after a rolling update. The previous version was working. What is the most likely cause?

Accepted Answer

New version missing a required dependency. A 503 Service Unavailable error during a rolling update typically indicates that the new application version cannot start or serve traffic. The most likely cause is a missing required dependency (e.g., a library, module, or runtime component) that the previous version did not need, causing the new pods or containers to fail readiness probes and be removed from the load balancer pool.

Answer

Database connection pool exhausted

Answer

DNS propagation delay

Answer

SSL certificate expired

Question 6

A company uses Azure and wants to centrally audit all management operations across subscriptions. Which service should be used to collect and analyze these logs?

Accepted Answer

Azure Monitor. Azure Monitor is the correct service because it provides a centralized platform for collecting, analyzing, and acting on telemetry data from Azure resources, including management operations across subscriptions. Specifically, the Azure Activity Log within Azure Monitor captures all control-plane events (e.g., resource creation, deletion, policy changes) at the subscription level, enabling auditing and alerting. This directly meets the requirement for centrally auditing management operations across multiple subscriptions.

Answer

GCP Cloud Audit Logs

Answer

AWS CloudTrail

Answer

Azure Security Center

Question 7

Which TWO of the following are best practices for securing access to a cloud management console?

Accepted Answer

Restrict access based on IP address ranges. Restricting access based on IP address ranges (B) is a best practice because it limits the attack surface by allowing only trusted network sources to reach the management console. This is often implemented via security group rules, network ACLs, or cloud provider-specific features like AWS Security Groups or Azure NSGs, reducing exposure to brute-force and unauthorized access attempts.

Answer

Use complex passwords and rotate them every 30 days

Answer

Use the root account for daily administration

Answer

Enable guest access for external auditors

Question 8

A company needs to transfer 200 TB of data from an on-premises NAS to Amazon S3 over the internet within 5 days. The available bandwidth is 1 Gbps. Which AWS service should be used to accelerate the transfer?

Accepted Answer

AWS DataSync. AWS DataSync can accelerate transfers over the internet using parallel multi-threading and compression. Snowball would be faster for 200 TB, but the question specifies over the internet. DataSync is optimized for network transfers.

Answer

AWS Snowball

Answer

S3 Transfer Acceleration

Answer

AWS Direct Connect

Question 9

Refer to the exhibit. A developer is trying to upload an object to S3 bucket 'example-bucket' using the IAM policy shown. The upload fails with an AccessDenied error. Which of the following is the MOST likely reason?

Accepted Answer

The bucket policy has a deny that overrides this IAM policy.. The IAM policy grants the s3:PutObject action, but an explicit deny in the bucket policy overrides any allow from an IAM policy. Since AWS evaluates all policies (identity-based and resource-based) and an explicit deny always takes precedence, the upload fails with AccessDenied even though the IAM policy appears sufficient.

Answer

The IAM policy requires server-side encryption with AES256, but the upload request did not specify that header.

Answer

The developer's user is not in the same account as the bucket.

Answer

The IAM policy does not grant the s3:ListBucket permission.

Question 10

A cloud engineer is tasked with automating the deployment of a new web application. Which of the following tools is BEST suited for managing infrastructure as code in a hybrid cloud environment?

Accepted Answer

Terraform. Terraform is the best choice because it is a cloud-agnostic Infrastructure as Code (IaC) tool that uses a declarative configuration language (HCL) to manage resources across multiple providers, including AWS, Azure, and on-premises systems. This makes it ideal for hybrid cloud environments where consistent provisioning and state management are required across disparate platforms.

Answer

AWS CloudFormation

Answer

Ansible

Answer

Docker

Question 11

An organization is migrating workloads to the cloud and after migration, users complain about slow application response times. The administrator reviews the cloud provider's dashboard and sees no resource bottlenecks. Which three factors could still cause poor performance? (Choose three.)

Accepted Answer

DNS resolution delays due to on-premises DNS server. Correct options are B, C, and E. Option B is correct because DNS resolution delays caused by an on-premises DNS server can increase response times without appearing as a resource bottleneck on the cloud provider's dashboard. Option C is correct because geographic latency between the cloud region and the users' location is a network issue, not a resource bottleneck, so it won't show on the dashboard. Option E is correct because a TCP window scaling mismatch can degrade network throughput transparently, without affecting resource metrics. Option A is incorrect because an application not optimized for the cloud would typically cause high resource usage, which would appear as a bottleneck on the dashboard. Option D is incorrect because insufficient CPU cores would result in high CPU utilization, visible as a resource bottleneck on the dashboard.

Answer

The application is not optimized for the cloud infrastructure

Answer

Insufficient number of CPU cores in the VM

Question 12

During a penetration test, a cloud security engineer discovers that a storage bucket is publicly accessible because of a misconfigured block public access setting. The bucket contains encrypted data. Which of the following is the primary risk?

Accepted Answer

Unauthorized users can list and download objects, but encryption at rest protects content if the key is also not accessible.. Unauthorized users can list and download encrypted objects, even if the data is encrypted at rest. The primary risk is data exfiltration if the encryption key is compromised or the data is not properly encrypted.

Answer

The bucket name is exposed to enumeration.

Answer

Data is unreadable because it is encrypted.

Answer

The encryption key is exposed.

Question 13

A cloud administrator is designing a secure multi-tenant environment. Which THREE of the following are best practices for isolating tenant workloads?

Accepted Answer

Deploy tenant workloads on dedicated hypervisors.. Deploying tenant workloads on dedicated hypervisors provides strong physical isolation, preventing a compromised hypervisor from affecting other tenants. This approach eliminates the risk of side-channel attacks or resource contention that could cross tenant boundaries, ensuring each tenant's virtual machines run on separate hardware with no shared compute resources.

Answer

Use a single virtual switch for all tenants.

Answer

Place all tenants on the same storage array for efficiency.

Question 14

An Azure administrator runs the command and gets the output shown. The virtual machine 'web-01' is not accessible over the network. Which of the following is the MOST likely reason?

Accepted Answer

The VM is stopped and deallocated.. The command output shows the VM 'web-01' with a 'PowerState' of 'Stopped (deallocated)'. When a VM is deallocated, it releases its assigned public IP and underlying compute resources, making it unreachable over the network. The VM must be in a 'Running' state to accept network traffic.

Answer

The VM name is incorrect.

Answer

The VM failed to provision.

Answer

The VM is in the wrong region.

Question 15

A company needs to back up a critical database with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 2 hours. Which disaster recovery strategy should be implemented?

Accepted Answer

Cross-region replication with a read replica. Continuous replication (such as using database replication) can achieve a very low RPO like 15 minutes.

Answer

Weekly backups to an external tape library

Answer

Daily snapshots stored in the same region

Answer

Cold standby with hourly snapshots

Question 16

A cloud administrator is troubleshooting a connectivity issue between two virtual networks in different cloud regions. The networks are connected via a VPN gateway. The administrator can ping resources in one network but not the other. Which of the following should the administrator check FIRST?

Accepted Answer

Review the route tables on both sides for the remote network prefix. The correct first step is to review the route tables on both sides for the remote network prefix. Since the administrator can ping resources in one direction but not the other, the issue is likely asymmetric routing or a missing route for the return traffic. Route tables control how traffic is forwarded between virtual networks, and a missing or incorrect route for the remote network prefix would prevent bidirectional communication, even if the VPN tunnel is up.

Answer

Confirm the local network gateways have the correct NIC IP addresses

Answer

Verify the VPN tunnel status on both gateways

Answer

Check network security groups for blocking ICMP

Question 17

A financial services company has a disaster recovery (DR) plan for its cloud infrastructure that includes a secondary region 500 miles away. The plan uses synchronous replication for the primary database. During a scheduled DR test, the administrator triggers a failover to the secondary region. The application comes up, but the database is missing the last three minutes of transactions. The RPO requirement is 5 seconds. The administrator finds that the network latency between regions is 40 milliseconds. What is the most likely cause of the data loss, and what should the administrator do?

Accepted Answer

Switch to asynchronous replication and accept a longer RPO, or choose a DR region with lower network latency.. Synchronous replication requires the primary database to wait for acknowledgment from the secondary before committing a transaction. With 40ms network latency, this introduces significant delays, causing timeouts and dropped transactions, resulting in data loss exceeding the 5-second RPO. To meet the RPO, the administrator should either switch to asynchronous replication (which does not wait for acknowledgment, reducing latency impact but requiring a higher RPO) or choose a DR region with lower latency to support synchronous replication. Option A correctly identifies these solutions.

Answer

Reduce the RPO requirement to 30 seconds.

Answer

Enable compression on the replication link to reduce data transfer time.

Answer

Increase the instance size in the secondary region to handle more transactions.

Question 18

A small business uses a public cloud IaaS to host a single Windows virtual machine (VM) running a line-of-business application. The VM has a public IP address and is in a network security group that allows RDP (port 3389) from the internet (0.0.0.0/0). The administrator frequently connects from home and various client sites. The administrator is concerned about brute force attacks on the RDP service. The business does not have a VPN server. What is the best way to secure the RDP access without changing the public IP address or blocking all external access?

Accepted Answer

Remove the public IP address and use a bastion service like Azure Bastion or AWS Systems Manager Session Manager to access the VM via RDP over HTTPS.. The best because using Azure Bastion or AWS Systems Manager Session Manager eliminates public RDP exposure entirely. Instead of opening port 3389 to the internet, the administrator connects through a bastion service that authenticates and tunnels RDP over HTTPS. This prevents brute force attacks since no direct RDP port is exposed. Option B (changing port) is security through obscurity and does not stop automated scans. Option C (MFA on local accounts) is not practical without domain join and still leaves the port open. Option D (smart card certificates) still exposes the port to potential attacks on the certificate authentication process.

Answer

Change the RDP port to a non-standard port (e.g., 3390).

Answer

Enable multi-factor authentication (MFA) on the local Windows user accounts.

Answer

Disable password authentication and require smart card certificates for RDP.

Question 19

During a security assessment, a cloud auditor discovers that a virtual machine has a publicly accessible SSH port (22) open to the entire internet (0.0.0.0/0). The VM is a bastion host intended for administration. What should be done to reduce risk?

Accepted Answer

Remove the network security group rule allowing SSH from 0.0.0.0/0 and add a rule allowing only the corporate VPN's public IP range.. A bastion host should only be accessible from trusted IPs, typically the corporate VPN or a specific IP range, to minimize exposure. Option A is incorrect because removing the security group rule and relying solely on the OS firewall does not address the network-level exposure and may not be as manageable in a cloud environment. Option B is incorrect because disabling SSH entirely would prevent necessary administrative access; serial console is not a scalable alternative. Option C is incorrect because while SSH key authentication improves security, it does not restrict the IP addresses that can attempt to connect, leaving the host exposed to brute-force attacks from the entire internet.

Answer

Remove the security group rule for SSH and rely on the operating system firewall.

Answer

Disable SSH and use a serial console for administration.

Answer

Enable SSH key authentication and disable password login.

Question 20

Which TWO of the following are common vulnerabilities in cloud environments that can lead to unauthorized access? Select two.

Accepted Answer

Lack of encryption for data in transit. Options B and E are correct because lack of encryption for data in transit exposes sensitive data to interception, and misconfigured security groups allowing overly permissive inbound rules can grant unauthorized access. Options A, C, and D are security best practices that help prevent vulnerabilities.

Answer

Enabling automatic patching

Answer

Using multi-factor authentication

Answer

Properly scoped IAM roles