CV0-004 Practice Test 26 — 15 Questions

Question 1

A company's IaaS environment has a high rate of failed login attempts to a critical database server. The security team wants to temporarily block the source IPs after 5 failed attempts within 10 minutes. Which security control should be implemented?

Accepted Answer

Deploy a web application firewall (WAF) with rate-limiting rules.. Option C is correct because a web application firewall (WAF) can rate-limit and block IPs based on failed login attempts. Option A is wrong because host-based firewalls are not centrally managed. Option B is wrong because WAF is not for cloud access management. Option D is wrong because TLS encryption does not prevent brute force.

Answer

Enable TLS mutual authentication for the database.

Answer

Implement a cloud access security broker (CASB).

Answer

Configure host-based firewall rules on each database server.

Question 2

Which TWO of the following are common security concerns specific to a public cloud infrastructure?

Accepted Answer

Exposure of insecure application programming interfaces (APIs).. Options A and C are correct. Insecure APIs are a top cloud security concern because they allow programmatic access, and misconfigured storage can lead to data exposure. Option B is wrong because physical security is the provider's responsibility. Option D is wrong because packet sniffing is unlikely in multitenant clouds. Option E is wrong because hypervisor vulnerabilities are rare and quickly patched.

Answer

Physical theft of servers from data centers.

Answer

Packet sniffing on the provider's internal network.

Answer

Hypervisor-level malware.

Question 3

A cloud administrator is troubleshooting a performance issue where users report slow access to a web application hosted in a public cloud. The application uses an auto-scaling group of web servers behind a load balancer. The administrator notices that the CPU utilization on the web servers is low, but the load balancer metrics show a high number of pending requests. What is the most likely cause?

Accepted Answer

The load balancer health checks are misconfigured, causing healthy instances to be removed.. Option A is correct because misconfigured health checks can cause the load balancer to stop sending traffic to healthy instances, leading to pending requests. Option B is wrong because API rate limiting affects API calls, not web traffic. Option C is wrong because DNS would cause total inaccessibility, not just slowness. Option D is wrong because blocking port 80 would cause connection failures, not pending requests.

Answer

The web servers are throttled by the cloud provider's API rate limiting.

Answer

The DNS records point to an incorrect IP address.

Answer

The security group is blocking inbound traffic on port 80.

Question 4

A company is running a database server on a virtual machine in the cloud. The database team reports that write operations are taking longer than expected. The administrator checks the disk performance metrics and sees that the average disk queue length is consistently above 10. Which action would most likely resolve this issue?

Accepted Answer

Upgrade to a higher IOPS tier for the disk.. Option B is correct because high disk queue length indicates insufficient I/O throughput; upgrading IOPS tier increases throughput. Option A is wrong because increasing size does not guarantee higher IOPS. Option C is wrong because compression may reduce I/O but not directly address queue length. Option D is wrong because adding RAM may reduce disk hits but doesn't directly fix queue length.

Answer

Add more RAM to the virtual machine.

Answer

Increase the size of the disk.

Answer

Enable compression on the database.

Question 5

A cloud administrator runs a deployment script that creates multiple resources using Infrastructure as Code (IaC). The script fails with a "400 Bad Request" error when attempting to create a storage account. Which troubleshooting step should the administrator take first?

Accepted Answer

Review the error message details for a specific validation error.. Option C is correct because a 400 error indicates a client error, so the first step is to examine the error details to understand what parameter is invalid. Option A is wrong because 400 is not a network error (would be 5xx). Option B is wrong but plausible; however, the error message would specify the exact issue. Option D is wrong because timeouts result in different errors.

Answer

Check the network connectivity to the cloud API endpoint.

Answer

Increase the timeout value for the API call.

Answer

Verify that the script has the correct region parameter.

Question 6

A company has a three-tier application in a cloud VPC: web servers in a public subnet, application servers in a private subnet, and database servers in a private subnet. The web servers can connect to the application servers, but the application servers cannot connect to the database servers. The security groups are configured as follows:
- Web SG: inbound HTTP from 0.0.0.0/0, outbound all
- App SG: inbound HTTP from Web SG, outbound all
- DB SG: inbound MySQL from App SG, outbound all
What is the most likely cause of the connectivity issue?

Accepted Answer

The network access control list (NACL) on the database subnet is blocking inbound traffic from the application subnet.. Option D is correct because security groups are stateful and allow outbound traffic automatically, so outbound rules are not the issue. The inbound rule on DB SG allows MySQL from App SG, so A is not the issue. B is not needed because outbound is all. C is irrelevant. The issue likely is a NACL on the private subnet blocking the traffic, as NACLs are stateless and need explicit rules.

Answer

The database security group is missing an inbound rule for MySQL.

Answer

The application security group is missing an outbound rule for MySQL.

Answer

The web security group is blocking traffic to the database.

Question 7

A cloud administrator manages a web application that uses an auto scaling group (ASG) with a minimum of 2 and maximum of 10 instances. The CPU utilization for the ASG averages 40%. However, during peak hours, users experience intermittent timeouts. The administrator reviews the scaling policy, which is set to scale out when CPU exceeds 70% for 5 minutes. What is the most likely cause of the timeouts?

Accepted Answer

The scale-out cooldown period is too long, delaying the addition of new instances.. Option A is correct because during spikes, if the cooldown is long, the ASG may not add instances quickly enough, causing timeouts even though average CPU is 40%. Option B is wrong because threshold is 70%, not low. Option C is wrong because max is 10 and only 2 instances might be running if not scaled. Option D is wrong because that would cause instance replacement but not necessarily timeouts.

Answer

The maximum number of instances is too low.

Answer

The health checks are marking healthy instances as unhealthy.

Answer

The CPU threshold is too low, causing premature scaling.

Question 8

An organization has a site-to-site VPN connection between its on-premises network and a cloud VPC. Users report intermittent connectivity to applications hosted in the cloud. The administrator checks the VPN tunnel status and sees it is up. However, ping tests from on-premises to a cloud instance fail at random times. Which factor should the administrator investigate first?

Accepted Answer

The VPN tunnel is experiencing packet loss due to a mismatch in the IPSec parameters.. Option C is correct because intermittent connectivity despite tunnel being up suggests packet loss or misconfiguration in IPSec (e.g., mismatched phase 2 parameters). Option A is wrong because routes would cause complete failure. Option B is wrong but could cause failure; however, it's intermittent. Option D is wrong because it would cause consistent failure.

Answer

The on-premises firewall is blocking outbound ICMP.

Answer

The security group on the cloud instance is blocking ICMP.

Answer

The routing tables on the cloud VPC are missing routes for the on-premises network.

Question 9

A cloud administrator deploys a new application that writes logs to a block storage volume attached to a virtual machine. The application's performance degrades after a few hours. Monitoring shows that the volume's read latency is low, but write latency spikes periodically. The administrator discovers that the volume type is standard HDD. What should the administrator do to improve write performance without changing the application?

Accepted Answer

Migrate to a volume type with provisioned IOPS (SSD).. Option B is correct because standard HDD has limited burst IOPS, and sustained writes will degrade; provisioned IOPS SSD provides consistent performance. Option A is wrong because increasing HDD size increases baseline IOPS but still limited and burst-based. Option C is wrong because write caching on a data volume is not recommended and may cause data loss. Option D is wrong because object storage is not block-level and may require application changes.

Answer

Increase the volume size to gain higher baseline IOPS.

Answer

Move the logs to an object storage service.

Answer

Enable write caching on the volume.

Question 10

A company uses a cloud provider's IAM service to manage access. An administrator creates a new IAM role for an application running on an EC2 instance to access an S3 bucket. The application is unable to read objects from the bucket, even though the role has an attached policy that allows s3:GetObject on the bucket. The administrator verifies that the instance is correctly associated with the role. What is the most likely cause?

Accepted Answer

The role's permissions policy has a condition key that restricts access to a specific IP range.. Option D is correct because a condition (e.g., ipAddress) could restrict access if the instance's IP is not in the allowed range. Option A is wrong but plausible; bucket policy could deny, but the stem doesn't indicate that. Option B is wrong because if the trust policy were wrong, the instance wouldn't get the role credentials. Option C is wrong because S3 uses HTTPS, and security groups outbound all is default.

Answer

The S3 bucket policy denies access to the role.

Answer

The role's trust policy does not allow the EC2 service to assume the role.

Answer

The instance's security group is blocking outbound traffic to S3.

Question 11

A web application is deployed across multiple availability zones behind an application load balancer (ALB). The administrator notices that all traffic is being routed to instances in only one availability zone, causing performance issues. The ALB cross-zone load balancing is enabled. What is the most likely cause?

Accepted Answer

The instances in the other zones are marked as unhealthy due to failing health checks.. Option A is correct because if health checks fail, instances are deregistered, and ALB only sends traffic to healthy targets. Option B is wrong because a single target group can have instances from multiple zones. Option C is wrong because security groups are not zone-specific. Option D is wrong because route tables affect instance outbound, not ALB traffic distribution.

Answer

The security group for the ALB only allows traffic from one zone.

Answer

The route table for the subnets in the other zones is missing a default route.

Answer

The listener rules are configured to forward traffic to a single target group.

Question 12

A cloud administrator is troubleshooting a virtual machine that is experiencing high memory usage. The VM is running a web server. Which two metrics should the administrator monitor to determine if the VM needs additional memory? (Choose two.)

Accepted Answer

Swap usage. Options A and C are correct. Available memory directly shows free memory, and swap usage indicates the OS is using disk as memory, which is a sign of insufficient RAM. Option B (CPU ready time) is a CPU metric. Option D (disk I/O wait) is disk-related. Option E (page fault rate) indicates paging but is not as direct as swap usage.

Answer

Disk I/O wait

Answer

Page fault rate

Answer

CPU ready time

Question 13

A company is experiencing intermittent network connectivity issues between two cloud subnets. The cloud provider's monitoring shows no packet loss. Which troubleshooting step should be taken first?

Accepted Answer

Review the security group rules for both subnets. Option B is correct because security group rules can cause intermittent connectivity issues by selectively dropping traffic. Option A is wrong because virtual routers are typically managed by the provider and are unlikely to cause issues without alerts. Option C is wrong because physical cabling is not relevant in the cloud. Option D is wrong because increasing bandwidth does not address the underlying cause of intermittent drops.

Answer

Replace the virtual routers

Answer

Increase the bandwidth between subnets

Answer

Check the physical cabling

Question 14

An administrator deployed a new web application using an auto-scaling group. Users report that the application becomes slow after a few hours. The administrator examines the scaling policy and notices that the CPU utilization threshold is set to 80% for scale-out and 20% for scale-in. What is the most likely issue?

Accepted Answer

The scale-out threshold is too high, causing delayed scaling. Option B is correct because a scale-out threshold of 80% delays the addition of new instances, causing performance degradation. Option A is wrong because a 20% scale-in threshold is low, but not the primary cause of slowness. Option C is wrong because the symptoms point to scaling configuration rather than a memory leak. Option D is wrong because load balancer misconfiguration would likely cause direct failures, not gradual slowdown.

Answer

The scale-in threshold is too low, causing instances to be terminated prematurely

Answer

The load balancer is misconfigured

Answer

The application has a memory leak

Question 15

A cloud administrator is troubleshooting a failed backup job that was supposed to back up a database to a cloud storage bucket. The job fails with an access denied error. Which two likely causes should the administrator investigate? (Choose two.)

Accepted Answer

The IAM role assigned to the backup service lacks write permissions to the bucket. Correct options are B and C. Option B is likely because missing IAM permissions cause access denied. Option C is likely because a deleted bucket would also produce an access denied error. Option A is wrong because version incompatibility would cause a different error. Option D is wrong because an offline database would cause a connection error, not access denied. Option E is wrong because schedule misconfiguration would prevent the job from running, not cause access denied.

Answer

The database is offline during backup

Answer

The backup schedule is misconfigured

Answer

The backup software version is incompatible