CV0-004 Practice Test 5 — 25 Questions

Question 1

A team uses Terraform to manage infrastructure. After running terraform apply, the state file is stored in an S3 backend with DynamoDB locking. During a subsequent terraform plan, the team notices that the state file shows resources that no longer exist in the cloud. Which command should the team run to reconcile the state with the actual cloud resources?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

terraform refresh. The terraform refresh command updates the Terraform state file to match the actual state of cloud resources. When resources are deleted or modified outside of Terraform, the state becomes outdated. Running terraform refresh queries the provider for the real-world status and reconciles the state accordingly. In contrast, terraform plan only shows proposed changes, terraform import is used to bring existing resources under management, and terraform state rm removes entries from the state without syncing with reality. Therefore, terraform refresh is the correct command to reconcile the state with actual cloud resources.

Answer

terraform plan

Answer

terraform import

Answer

terraform state rm

Question 2

A company wants to automate the deployment of cloud resources using code. Which tool is BEST suited for this purpose?

Accepted Answer

Infrastructure as Code (IaC) templates. Infrastructure as Code (IaC) templates (Option C) are the best tool for automating cloud resource deployment because they allow you to define, version, and provision infrastructure through machine-readable definition files. Tools like Terraform, AWS CloudFormation, or Azure Resource Manager templates enable repeatable, consistent deployments without manual intervention, directly aligning with the goal of automating cloud resource deployment using code.

Answer

SSH

Answer

An IP address management tool

Answer

A configuration management database

Question 3

A cloud administrator is configuring an Azure environment for a healthcare application that must comply with HIPAA. Which TWO configurations are required to meet HIPAA security and privacy rules? (Choose two.)

Accepted Answer

Implement audit logging for access to ePHI. Audit logging for access to ePHI is required by HIPAA to track who accessed, modified, or deleted protected health information. In Azure, this is implemented through Azure Monitor and Log Analytics, which capture detailed audit trails for storage accounts, databases, and applications. Without audit logs, the organization cannot demonstrate compliance with the HIPAA Security Rule's requirement for activity monitoring and accountability.

Answer

Configure network security groups to allow only HTTPS traffic

Answer

Enable multi-factor authentication for all administrative accounts

Answer

Configure automatic patching for all virtual machines

Question 4

A cloud administrator manages a multi-tier web application running on AWS. The application consists of a load balancer, web servers in an auto scaling group, and a MySQL RDS database. Recently, users have reported slow page load times during peak hours. The cloud administrator has checked the load balancer metrics and found that response times are high, but CPU utilization on the web servers is below 60%. The RDS instance shows high read IOPS and a high number of database connections. The administrator suspects the database is the bottleneck. Which of the following actions should the administrator take FIRST to resolve the performance issue?

Accepted Answer

Enable an in-memory caching layer such as ElastiCache to reduce database load.. The database is the bottleneck due to high read IOPS and connections. Enabling an in-memory caching layer (e.g., ElastiCache) reduces read queries hitting the database, alleviating the bottleneck with minimal changes. Option A is incorrect because migrating to a larger instance class is more costly and disruptive; caching is a simpler first step. Option B is incorrect because adding read replicas can help distribute read load but requires application changes to route queries; caching is often more immediate. Option C is incorrect because web server CPU is low, so increasing web server size does not address the database bottleneck.

Answer

Migrate the database to a larger instance class.

Answer

Add read replicas to offload read queries from the primary database.

Answer

Increase the size of the web servers to handle more requests faster.

Question 5

An organization wants to migrate its on-premises virtual machines to the cloud with minimal changes. Which deployment model is most appropriate?

Accepted Answer

Lift-and-shift to IaaS. The lift-and-shift (rehost) model migrates on-premises virtual machines to IaaS with minimal changes, preserving the OS, applications, and configurations. This approach avoids refactoring or re-architecting, making it the most appropriate for minimizing modifications during cloud migration.

Answer

Re-platform to PaaS

Answer

Refactor into SaaS

Answer

Re-architect as containerized applications

Question 6

A cloud administrator is configuring a new virtual private cloud (VPC) for a three-tier application. The web tier must be accessible from the internet, the application tier should only be accessible from the web tier, and the database tier should only be accessible from the application tier. Which network architecture should be used?

Accepted Answer

Place each tier in a separate subnet with appropriate security group rules controlling traffic.. Placing each tier in a separate subnet and using security group rules provides stateful, instance-level traffic control. Security groups act as virtual firewalls at the hypervisor layer, allowing you to specify inbound rules that restrict the application tier to only accept traffic from the web tier's security group, and the database tier to only accept traffic from the application tier's security group. This aligns with the principle of least privilege and ensures that each tier is isolated within the VPC while maintaining necessary connectivity.

Answer

Use one subnet with network ACLs to restrict traffic between tiers.

Answer

Place all tiers in the same subnet and use host-based firewalls.

Answer

Deploy each tier in a different VPC and peer them.

Question 7

A developer is using a cloud provider's CLI to manage resources. Which TWO commands are commonly used to troubleshoot instance connectivity?

Accepted Answer

traceroute. D is correct because the `traceroute` command is a standard network diagnostic tool that identifies the path packets take from the source to a destination, revealing each hop's latency and any points of failure. It uses ICMP (or UDP on Linux) with incrementing TTL values to map the route, making it essential for troubleshooting connectivity issues between cloud instances and external endpoints.

Answer

reboot

Answer

ssh

Answer

create-tags

Question 8

A company wants to implement a disaster recovery plan with minimal data loss and fast recovery. Which TWO strategies best achieve an RPO of minutes and RTO of hours?

Accepted Answer

Pilot light environment. Cross-region replication and pilot light can achieve low RPO and moderate RTO.

Answer

Multi-site active-active

Answer

Backup and restore

Answer

Warm standby

Question 9

A cloud engineer is required to set up cost allocation tags. Which THREE standard tag categories are commonly used for cost attribution? (Choose THREE)

Accepted Answer

Project. Environment, project, and team are common tag categories for cost allocation.

Answer

Instance type

Answer

Region

Question 10

A cloud engineer notices that a virtual machine running a critical application is experiencing high CPU usage. The engineer needs to resolve the issue without affecting other VMs on the same host. Which of the following actions should the engineer take first?

Accepted Answer

Migrate the VM to another host in the cluster.. Migrating the VM to another host in the cluster (option C) is the correct first action because it immediately offloads the CPU pressure from the current host without impacting the VM's operation or other VMs. This leverages VMware vMotion or Microsoft Hyper-V Live Migration to move the running VM to a less-utilized host, isolating the performance issue while preserving uptime and avoiding resource contention.

Answer

Restart the VM to clear the high CPU usage.

Answer

Increase the CPU allocation for the VM.

Answer

Add another VM to the same host to distribute load.

Question 11

A cloud administrator is designing a backup strategy for a virtual machine running a critical application. The application stores data on a separate data disk. Which TWO of the following practices should the administrator include to ensure a reliable backup?

Accepted Answer

Ensure the backup includes the system state and data disk.. Backing up both the system state and the data disk ensures the entire virtual machine can be restored, including operating system settings and application data. Option D is correct because guest-level backups with application-aware processing ensure that the application data is consistent and can be recovered properly, minimizing data loss. Option B is incorrect because encryption enhances security but does not directly affect backup reliability. Option C is incorrect because file-level backups for the data disk only may miss system state and lack application consistency. Option E is incorrect because hypervisor-level snapshots are typically crash-consistent and do not guarantee application consistency, making them less reliable for critical applications.

Answer

Encrypt the backup files before storing them off-site.

Answer

Use file-level backups for the data disk only.

Answer

Rely solely on hypervisor-level snapshots.

Question 12

Refer to the exhibit. What is the effect of this bucket policy?

Accepted Answer

It allows anyone to read objects in example-bucket only if they come from the specified IP range.. The policy allows s3:GetObject to any principal (*) but only if the request originates from the IP range 203.0.113.0/24. This is a common way to restrict access to a specific network. It does not deny other IPs explicitly; it just doesn't allow them. It does not require authentication; the principal is *.

Answer

It requires users to authenticate with AWS IAM before accessing the bucket.

Answer

It allows only the specified IP range to write objects.

Answer

It denies all access to the bucket except from the specified IP range.

Question 13

A cloud engineer is deploying a new application that requires high availability. The solution must include automated failover and load balancing. Which TWO of the following should the engineer implement?

Accepted Answer

Configure an auto scaling group with a minimum of two instances across two availability zones.. Deploying an auto scaling group with a minimum of two instances across two availability zones ensures that if one instance or zone fails, the other can continue serving traffic, providing high availability. This setup also supports automated failover by replacing unhealthy instances automatically, and it works with a load balancer to distribute traffic. The combination of multi-AZ placement and auto scaling is a foundational pattern for fault-tolerant architectures in cloud environments.

Answer

Take daily snapshots of the instance and store them in a different region.

Answer

Configure a read replica in a different region for failover.

Answer

Deploy the application on a single large instance with more resources.

Question 14

A cloud architect is designing a highly available web application. Which THREE of the following components should be configured in at least two availability zones? (Choose THREE.)

Accepted Answer

Web server instances. To achieve high availability across AZs, the load balancer, application servers, and database should be multi-AZ. Auto-scaling groups can launch instances across AZs, but they are not a component themselves; they are a management service. The DNS service is globally redundant by nature, not usually limited to AZs.

Answer

DNS service (e.g., Route 53)

Answer

Auto-scaling group

Question 15

A team is using Kubernetes for container orchestration. They want to ensure that a new deployment does not cause downtime by gradually updating pods with a rolling update strategy. Which parameter in a Deployment manifest controls the number of pods that can be unavailable during the update?

Accepted Answer

spec.strategy.rollingUpdate.maxUnavailable. The `spec.strategy.rollingUpdate.maxUnavailable` parameter in a Kubernetes Deployment manifest specifies the maximum number of pods that can be unavailable during a rolling update. This ensures that a controlled number of pods are taken down at a time, preventing downtime by maintaining a minimum number of available pods throughout the update process.

Answer

spec.minReadySeconds

Answer

spec.replicas

Answer

spec.strategy.rollingUpdate.maxSurge

Question 16

A cloud architect reviews the above IAM policy attached to a user. What is the effect of this policy on the user's ability to stop or terminate instances?

Accepted Answer

The user can stop only production-tagged instances and cannot terminate any instances. The policy uses a Condition block with StringNotEquals to explicitly deny ec2:StopInstances and ec2:TerminateInstances when the resource tag 'environment' is not equal to 'production'. Since the Deny effect overrides any Allow, the user can only stop instances tagged with 'environment=production' and cannot terminate any instances because the TerminateInstances action is also denied for non-production tags and there is no Allow for termination.

Answer

The user can stop any instance but cannot terminate any instance

Answer

The user can stop only production-tagged instances and terminate only production-tagged instances

Answer

The user can stop any instance and terminate any instance

Question 17

A cloud administrator is troubleshooting connectivity issues between two virtual networks in a public cloud. The networks are in the same region but different VPCs. Both VPCs have route tables and security groups configured. Instances in VPC A cannot ping instances in VPC B. Which of the following is the most likely cause?

Accepted Answer

VPC peering is not established between the two VPCs.. VPC peering is a direct network connection between two VPCs that enables routing of traffic using private IPv4 or IPv6 addresses. Without an established VPC peering connection, instances in different VPCs cannot communicate, even if they are in the same region. Since the question states the VPCs are separate and no peering is mentioned, this is the most likely root cause of the connectivity failure.

Answer

The instances are not assigned public IP addresses.

Answer

Security groups are blocking ICMP traffic.

Answer

Network ACLs are not configured to allow the traffic.

Question 18

A cloud engineer is troubleshooting performance issues in a virtualized environment. Which of the following tools would BEST help identify CPU contention on a hypervisor?

Accepted Answer

esxtop. 'esxtop' (on VMware) provides real-time performance data including CPU ready time, which directly indicates CPU contention. Option A is incorrect because 'iperf' measures network throughput. Option C is incorrect because 'ping' tests basic connectivity. Option D is incorrect because 'nslookup' is for DNS resolution.

Answer

iperf

Answer

ping

Answer

nslookup

Question 19

A cloud engineer needs to ensure that a web application can scale out automatically during traffic spikes. Which design best practice should be implemented?

Accepted Answer

Configure an auto scaling group with a load balancer.. An auto scaling group combined with a load balancer automatically adds or removes VM instances based on predefined metrics (e.g., CPU utilization, request count), ensuring the web application scales out horizontally during traffic spikes without manual intervention. This aligns with cloud elasticity best practices for handling variable workloads.

Answer

Deploy a larger instance size.

Answer

Use a single powerful VM with more vCPUs.

Answer

Manually provision additional VMs during peak times.

Question 20

Refer to the exhibit. An administrator created this policy and attached it to a user. When the user attempts to terminate an instance from an IP address outside the 10.0.0.0/8 range, what will happen?

Accepted Answer

The user will be denied because the condition fails.. The policy includes a condition that restricts the allowed source IP addresses to the 10.0.0.0/8 range. When the user attempts to terminate an instance from an IP address outside this range, the condition fails, and the default implicit deny in IAM (or equivalent policy engine) denies the action. The explicit Allow effect is only applied when the condition is met, so a failed condition results in denial.

Answer

The user will be denied because the action is not allowed.

Answer

The effect will be evaluated as Deny.

Answer

The user will be allowed to terminate instances.