CV0-004 Practice Test 5 — 25 Questions

Question 1

A cloud administrator needs to provide external partners with access to a cloud application using their existing corporate credentials. Which federation protocol should be used?

Accepted Answer

SAML. SAML (Security Assertion Markup Language) is the standard federation protocol for web-based single sign-on, allowing external partners to authenticate with their own corporate identity provider and access a cloud application via trust relationships. It exchanges XML-based assertions between an identity provider and a service provider. This matches the requirement of using existing corporate credentials for external access.

Answer

RADIUS

Answer

Kerberos

Answer

LDAP

Question 2

A company is designing a VPC in AWS. They need to host a web application with a public-facing load balancer, web servers in private subnets, and a database in a separate private subnet. Which network architecture is most secure and aligns with best practices?

Accepted Answer

Public subnet for load balancer, private subnet for web servers, separate private subnet for database. A three-tier architecture with a public subnet for the load balancer, private subnets for web servers, and a separate private subnet for the database provides security and isolation.

Answer

Public subnet for load balancer, private subnet for web servers and database together

Answer

All resources in public subnets with security groups restricting access

Answer

All resources in private subnets with a VPN connection

Question 3

A cloud engineer needs to store database backups that must be retained for seven years. The backups are rarely accessed. Which storage type is most cost-effective for this use case?

Accepted Answer

Archive storage. Archive storage (also called cold or archival tier) is purpose-built for data that is rarely accessed and must be retained for long periods, offering the lowest per-gigabyte storage cost among storage classes. It trades off higher retrieval costs and longer retrieval times (minutes to hours) for minimal storage cost, which is exactly the profile of seven-year database backups that are rarely accessed. Object storage is a storage architecture, not a cost tier, and standard object storage tiers are more expensive than archive.

Answer

Object storage

Answer

Block storage

Answer

File storage

Question 4

An organization is subject to PCI DSS compliance and must demonstrate that it is meeting security requirements. Which cloud service can aggregate compliance findings and provide a dashboard?

Accepted Answer

AWS Security Hub. AWS Security Hub aggregates security findings from multiple AWS services and provides a compliance dashboard.

Answer

AWS CloudTrail

Answer

AWS Shield

Answer

AWS Config

Question 5

A cloud administrator needs to automate the process of patching multiple virtual machines in a private cloud. Which of the following is the best tool for this purpose?

Accepted Answer

Ansible playbook. An Ansible playbook is the best tool for automating patching across multiple VMs because it is agentless, uses SSH for Linux or WinRM for Windows, and supports idempotent execution. This allows the administrator to define the desired patch state declaratively and apply it consistently across the entire fleet without manual intervention.

Answer

Virtual machine templates

Answer

SSH with manual commands

Answer

Scheduled tasks in the hypervisor management console

Question 6

A cloud engineer is deploying a web application that requires SSL termination and content-based routing. Which type of load balancer should be used?

Accepted Answer

Application Load Balancer. An Application Load Balancer (layer 7) can perform SSL termination and route based on content such as URL paths or host headers.

Answer

Gateway Load Balancer

Answer

Classic Load Balancer

Answer

Network Load Balancer

Question 7

An organization requires that all cloud resources be tagged with the cost center and environment (e.g., production, development). A compliance checker runs weekly to report untagged resources. The cloud administrator notices that newly created resources are often missing tags. What is the most effective long-term solution?

Accepted Answer

Configure a cloud governance policy that prevents resource creation without required tags.. The most effective long-term solution is to prevent non-compliant resource creation in the first place, which is what a governance policy (e.g., AWS Organizations SCP, Azure Policy, or GCP Org Policy) does by denying creation of resources without required tags. Detection and remediation after the fact are reactive and leave gaps. Prevention enforces the standard at the control plane, so untagged resources never exist.

Answer

Create a custom dashboard to show untagged resources.

Answer

Run a script daily to tag any untagged resources.

Answer

Send an email reminder to all users about tagging policies.

Question 8

An organization is designing a disaster recovery plan with a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 1 hour. Which disaster recovery strategy best meets these requirements while minimizing cost?

Accepted Answer

Warm standby. Warm standby maintains a partially running environment that can be fully activated quickly, meeting an RTO of 4 hours and RPO of 1 hour at a lower cost than hot standby.

Answer

Cold standby

Answer

Backup and restore

Answer

Hot standby

Question 9

Which TWO of the following are key components of a disaster recovery plan in the cloud? (Select TWO.)

Accepted Answer

Recovery point objective (RPO). Option C (Recovery point objective, RPO) is correct because a disaster recovery plan must define the maximum acceptable amount of data loss measured in time, which directly drives backup frequency and replication strategy in the cloud. Option E (Cross-region replication) is correct because replicating data and workloads to a geographically separate region is a core mechanism for surviving a regional outage and meeting the plan's recovery targets. Options A (Network performance monitoring), B (Billing alerts), and D (Load balancing) are not key components of a DR plan: monitoring and load balancing support availability and performance within normal operations, and billing alerts are cost-management controls, none of which define or enable recovery from a disaster.

Answer

Network performance monitoring

Answer

Billing alerts

Answer

Load balancing

Question 10

A cloud engineer needs to deploy a containerized application on Amazon EKS. The application requires a persistent storage volume that can be dynamically provisioned. Which Kubernetes resource should be used to request storage?

Accepted Answer

PersistentVolumeClaim. A PersistentVolumeClaim (PVC) is the correct Kubernetes resource to request storage because it acts as a request for storage by a pod, specifying size, access modes, and optionally a StorageClass. In Amazon EKS, a PVC can trigger dynamic provisioning of an EBS or EFS volume via a StorageClass, decoupling the storage request from the underlying PersistentVolume. This allows the cloud engineer to deploy the containerized application without manually pre-provisioning storage.

Answer

PersistentVolume

Answer

StorageClass

Answer

ConfigMap

Question 11

A company is deploying a web application on GCP and needs to protect against OWASP Top 10 threats and DDoS attacks. Which THREE services should be combined to provide comprehensive protection?

Accepted Answer

Cloud Load Balancing. Cloud Load Balancing (A) is correct because it distributes incoming traffic across multiple backend instances, providing inherent DDoS resilience by absorbing and scaling with attack traffic. It also integrates directly with Cloud Armor to enforce OWASP Top 10 web application firewall (WAF) rules, such as SQL injection and XSS protections, at the edge before traffic reaches the application.

Answer

Cloud NAT

Answer

Cloud VPN

Question 12

Which THREE design principles are fundamental to building a highly available cloud architecture?

Accepted Answer

Eliminate single points of failure. Option A (Eliminate single points of failure) is correct because high availability requires that no individual component's failure can take down the whole system, so redundant components (multiple instances, load balancers, redundant network paths) must be designed in. Option B (Deploy across multiple availability zones) is correct because AZs are isolated failure domains within a region; distributing workloads across at least two AZs ensures that the loss of one data center does not cause an outage. Option C (Implement health checks and auto-recovery) is correct because health checks detect unhealthy instances and auto-recovery/auto-scaling mechanisms replace or restart them automatically, maintaining service continuity without manual intervention. Option D (Scale vertically) is not a high-availability principle because increasing the size of a single resource still leaves a single point of failure and often requires downtime to resize. Option E (Use a single, powerful database instance) is not correct because a single database instance is itself a single point of failure; high availability instead calls for replication, multi-AZ failover, or clustering.

Answer

Scale vertically to increase capacity

Answer

Use a single, powerful database instance

Question 13

Which TWO design patterns can help a cloud architect achieve a Recovery Time Objective (RTO) of less than 5 minutes for a critical application?

Accepted Answer

Multi-site active-active. Multi-site active-active (B) is correct because traffic is served simultaneously from two or more independent regions, so if one site fails, the remaining site already runs at full capacity and can absorb the load immediately, yielding an RTO near zero (well under 5 minutes). Hot standby (active/passive) with automatic failover (E) is correct because the passive environment is fully provisioned and continuously running, so automated health checks and DNS/load-balancer failover can redirect traffic in seconds to a few minutes, meeting an RTO under 5 minutes. Warm standby (A) keeps a scaled-down but running copy that must be scaled up and validated before cutover, and pilot light (D) keeps only core services running so the full stack must be provisioned at failover, both typically exceeding 5 minutes. Backup and restore (C) requires restoring data and rebuilding infrastructure from backups, giving the longest RTO (hours), so it cannot meet the target.

Answer

Warm standby

Answer

Backup and restore

Answer

Pilot light

Question 14

A cloud administrator is troubleshooting a performance issue in a virtualized environment. Which THREE of the following metrics should the administrator analyze to identify potential resource contention? (Select THREE.)

Accepted Answer

CPU ready time. CPU ready time (A) is correct because it measures the percentage of time a vCPU is ready to run but is waiting for a physical CPU to become available, which directly indicates CPU overcommitment and contention in a virtualized host. Disk queuing (B) is correct because queue depth and latency on the storage path reveal contention for shared datastore or LUN IOPS, showing when VMs are waiting on storage resources. Memory ballooning (E) is correct because the balloon driver reclaims guest memory when the host is under memory pressure, so active ballooning signals memory contention and overcommitment on the ESXi host. Swap file usage (C) is not the best indicator of contention since it reflects paging activity that may occur for reasons other than host-level resource contention, and network latency (D) points to network path or congestion issues rather than contention for CPU, memory, or storage resources.

Answer

Swap file usage

Answer

Network latency

Question 15

During a disaster recovery test, a cloud administrator discovers that the standby database in a different region is not synchronized with the primary. The primary database uses asynchronous replication. What is the MOST likely reason for the sync failure?

Accepted Answer

Network latency causing replication lag. Asynchronous replication does not wait for the standby to acknowledge each write, so the standby can lag behind the primary. Cross-region replication is especially sensitive to network latency, which directly increases replication lag and can cause the standby to fall out of sync during a DR test. This is the most likely cause given the asynchronous, cross-region setup.

Answer

License expiration on the standby database

Answer

Firewall rules blocking port 3306 between regions

Answer

Incorrect replication configuration using a read replica instead of a standby

Question 16

An administrator is writing an Ansible playbook to provision cloud resources across multiple cloud providers. The playbook must manage instances in AWS, Azure, and GCP. Which Ansible concept should the administrator use to interact with each cloud provider's API?

Accepted Answer

Modules. Ansible modules are the units of code that perform specific tasks, such as interacting with cloud provider APIs. For multi-cloud provisioning, the administrator would use modules like `amazon.aws.ec2_instance`, `azure.azcollection.azure_rm_virtualmachine`, and `google.cloud.gcp_compute_instance` to manage resources in AWS, Azure, and GCP respectively. Modules abstract the underlying API calls, allowing the playbook to execute tasks across providers.

Answer

Roles

Answer

Inventories

Answer

Playbooks

Question 17

A cloud security engineer is hardening a Kubernetes cluster. Which TWO measures should be implemented to improve container security? (Choose two.)

Accepted Answer

Implement runtime security monitoring. A is correct because runtime security monitoring (e.g., using Falco, Sysdig, or Aqua Security) detects and alerts on anomalous behavior within running containers, such as unexpected system calls, privilege escalations, or file system changes. This is a critical layer of defense that complements image scanning by catching threats that bypass static checks, such as zero-day exploits or compromised containers. Without runtime monitoring, malicious activity inside a container can go undetected until significant damage occurs.

Answer

Store secrets in ConfigMaps

Answer

Disable audit logging to reduce overhead

Answer

Use default service accounts for all pods

Question 18

A company is planning to migrate to AWS and wants to achieve the lowest possible compute costs for a steady-state workload that will run 24/7. Which purchasing option should be recommended?

Accepted Answer

Reserved Instances. Reserved Instances provide a significant discount (up to 72%) compared to On-Demand pricing in exchange for a one- or three-year commitment, making them ideal for steady-state workloads that run 24/7. Because the workload is predictable and continuous, the commitment is easily justified and the effective hourly cost is minimized. This is the standard AWS recommendation for long-running, stable compute.

Answer

Spot Instances

Answer

On-Demand Instances

Answer

Dedicated Hosts

Question 19

A cloud administrator manages a hybrid cloud environment where on-premises servers connect to a VPC in AWS via a VPN connection. The on-premises network uses IP range 10.0.0.0/16. The VPC uses 172.16.0.0/16. The VPN is established and the tunnel status is UP. However, on-premises hosts cannot ping EC2 instances in the VPC. The administrator logs into an EC2 instance and can ping the on-premises VPN gateway IP. The security groups and network ACLs are configured to allow all traffic. The route tables in the VPC have a route to the on-premises network via the virtual private gateway. The on-premises firewall logs show that packets from the VPC are being dropped. What is the most likely cause?

Accepted Answer

The on-premises firewall is blocking traffic from the VPC CIDR range.. The on-premises firewall logs explicitly show that packets from the VPC are being dropped, indicating the firewall is filtering traffic from the VPC CIDR range (172.16.0.0/16). Since the VPN tunnel is UP, the EC2 instance can ping the on-premises VPN gateway IP, and security groups/network ACLs allow all traffic, the only remaining point of failure is the on-premises firewall blocking the return traffic.

Answer

The VPN tunnel is misconfigured and not passing traffic.

Answer

The security group attached to the EC2 instance is blocking inbound ICMP.

Answer

The VPC route table does not have a route to the on-premises network.

Question 20

A cloud engineer is troubleshooting a storage performance issue. The storage is backed by a SAN with a mix of SSD and HDD drives. Which of the following metrics would BEST indicate that the storage subsystem is the bottleneck?

Accepted Answer

High disk queue depth and latency. High disk queue depth and latency directly indicate that I/O requests are waiting, which is a classic sign of a storage bottleneck. Low memory usage (A) does not indicate a storage issue. High network utilization (B) could be caused by storage traffic but does not confirm the storage subsystem is the bottleneck; it could be normal. High CPU utilization (D) points to compute, not storage.

Answer

Low memory usage on the hypervisor

Answer

High network utilization on storage network links

Answer

High CPU utilization on all application servers