CV0-004 Practice Test 26 — 15 Questions

Question 1

A DevOps team is deploying containerized applications on Kubernetes. They want to ensure containers do not run with root privileges and that host filesystem access is restricted. Which Kubernetes feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Pod Security Standards. Pod Security Standards (PSS) define three profiles — Privileged, Baseline, and Restricted — that control whether pods can run as root, use host namespaces, access the host filesystem, or use privileged capabilities. Enforcing the Restricted profile via Pod Security Admission (PSA) directly prevents root execution and restricts hostPath/host filesystem access. This is the native Kubernetes mechanism for pod-level security hardening.

Answer

Service accounts

Answer

ConfigMaps

Answer

Network policies

Question 2

A company is considering using a public cloud provider. Which TWO characteristics are typical of a public cloud deployment? (Select TWO.)

Accepted Answer

Resources are shared among multiple customers. A public cloud is characterized by multi-tenancy (resources shared among multiple customers) and pay-as-you-go pricing, where the customer pays only for the resources they use. Options C and D describe these typical characteristics. Option A is incorrect because the cloud provider manages the physical infrastructure, not the customer. Option B describes a private cloud, which is isolated to a single organization. Option E describes on-premises deployment, not public cloud.

Answer

The customer has full control over the physical infrastructure

Answer

The deployment is isolated to a single organization

Answer

Resources are hosted on-premises

Question 3

A company uses AWS and wants to implement a structured logging format to simplify querying and analysis of application logs. Which three best practices should be followed when implementing structured logging? (Choose THREE.)

Accepted Answer

Include a unique request ID for each transaction. Option B is correct because including a unique request ID for each transaction enables correlation of log entries across distributed services, making it possible to trace a single request through multiple components during querying and analysis. Option C is correct because using consistent key names across all services ensures that queries and dashboards work uniformly, avoiding the need to map different field names for the same data in tools like CloudWatch Logs Insights or Athena. Option D is correct because JSON is a structured, machine-readable format that supports native parsing and filtering of fields, which directly simplifies querying and analysis compared to unstructured text. Option A is not appropriate because plain text logs are unstructured, defeating the purpose of structured logging and making querying harder, even if storage costs are lower. Option E is not appropriate because embedding binary data in log messages bloats log size, harms readability, and is not queryable, so it does not support structured logging best practices.

Answer

Write logs in plain text to reduce storage costs

Answer

Embed binary data in log messages for performance

Question 4

A cloud administrator needs to ensure that a set of AWS EC2 instances can only be accessed via SSH from the corporate office IP range 203.0.113.0/24. Which configuration should the administrator implement?

Accepted Answer

Create a security group with an inbound rule allowing TCP port 22 from 203.0.113.0/24. A security group acts as a stateful virtual firewall for EC2 instances. By specifying the source IP range 203.0.113.0/24 on the inbound SSH rule, only traffic from that range is allowed. Security groups are stateful, so return traffic is automatically permitted.

Answer

Deploy a VPN and require all SSH traffic to go through it

Answer

Configure a network ACL with an inbound allow rule for TCP port 22 from 203.0.113.0/24

Answer

Use AWS WAF to block SSH traffic except from 203.0.113.0/24

Question 5

An organization wants to migrate its on-premises virtual machines to the cloud with minimal changes. Which deployment model is most appropriate?

Accepted Answer

Lift-and-shift to IaaS. The lift-and-shift (rehost) model migrates on-premises virtual machines to IaaS with minimal changes, preserving the OS, applications, and configurations. This approach avoids refactoring or re-architecting, making it the most appropriate for minimizing modifications during cloud migration.

Answer

Re-platform to PaaS

Answer

Refactor into SaaS

Answer

Re-architect as containerized applications

Question 6

A company wants to migrate its on-premises workloads to the cloud but must keep sensitive customer data on-premises due to regulatory compliance. Which cloud deployment model should they use?

Accepted Answer

Hybrid cloud. A hybrid cloud model combines on-premises infrastructure with public cloud services, allowing sensitive data to remain on-premises while other workloads leverage cloud scalability. This meets regulatory compliance by keeping data local while enabling cloud benefits for non-sensitive components.

Answer

Public cloud

Answer

Multi-cloud

Answer

Private cloud

Question 7

A company uses GitLab CI for its CI/CD pipeline. The pipeline includes a 'deploy' job that runs only when a tag is pushed. Which GitLab CI keyword should be used to control job execution based on tags?

Accepted Answer

only. The 'only' keyword in GitLab CI controls when a job runs based on conditions such as tags, branches, or changes. Using 'only: tags' ensures the deploy job executes only when a tag is pushed, which matches the requirement.

Answer

stage

Answer

except

Answer

needs

Question 8

Which THREE are common tasks in a CI/CD pipeline? (Select THREE.)

Accepted Answer

Source code checkout from version control. Option C is correct because a CI/CD pipeline begins by checking out source code from a version control system such as Git, which triggers the automated build and test stages. Option D is correct because the CD portion of the pipeline automates deployment to staging or production environments, often using tools like Jenkins, GitLab CI, or Argo CD. Option E is correct because automated testing (unit, integration, and similar tests) is a core CI activity that validates each code change before it progresses further in the pipeline. Options A and B are not correct: manual code review, while valuable, is a human process rather than an automated pipeline task, and handwritten deployment notes are the opposite of the automation that CI/CD pipelines are designed to provide.

Answer

Manual code review by a senior developer

Answer

Handwritten notes for deployment steps

Question 9

A cloud administrator needs to apply security patches to a fleet of EC2 instances running Windows Server. The patches must be applied during a maintenance window to minimize downtime. Which AWS service can automate patching?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager automates the process of patching EC2 instances, including Windows Server, and supports maintenance windows to control when patches are applied. It can scan for missing patches and install them on a schedule, minimizing downtime.

Answer

AWS CloudFormation

Answer

AWS Config

Answer

Amazon Inspector

Question 10

A cloud security team is reviewing audit logs and notices that a service account has been used to launch several high-risk API calls that are not part of its normal behavior. Which security control should be implemented to detect such anomalies in real time?

Accepted Answer

Implement an anomaly detection service. Anomaly detection services (such as Amazon GuardDuty, Azure Defender, or Google Cloud Security Command Center) use machine learning and behavioral baselines to identify unusual API activity from service accounts in near real time. Since the question specifies detecting deviations from normal behavior, a behavioral analytics control is required rather than passive logging or static policy enforcement.

Answer

Enable API audit logging

Answer

Use a static IAM policy

Answer

Configure a network ACL

Question 11

A company runs a web application on three virtual machines behind a load balancer. During a traffic spike, one VM becomes unresponsive. The load balancer continues sending traffic to it, causing errors. Which configuration change would prevent this issue in the future?

Accepted Answer

Configure health checks on the load balancer.. Health checks allow the load balancer to periodically probe the status of each backend VM (e.g., via HTTP GET or TCP SYN). If a VM fails a configurable number of consecutive checks, the load balancer automatically marks it as unhealthy and stops routing traffic to it, preventing errors during a spike. This is the standard mechanism in AWS ELB, Azure Load Balancer, and HAProxy to detect and isolate failed instances.

Answer

Set a longer connection timeout on the load balancer.

Answer

Increase the number of VMs to five.

Answer

Change the load balancing algorithm to round-robin.

Question 12

A developer is deploying a serverless function that processes images uploaded to an S3 bucket. The function should be triggered automatically whenever a new object is created in the bucket. Which event source should be configured to invoke the Lambda function?

Accepted Answer

Amazon S3. Amazon S3 is the correct event source because it natively supports event notifications that can directly invoke AWS Lambda functions when objects are created, deleted, or modified in a bucket. This integration is built into the S3 service and requires no additional services or polling. The developer simply configures an S3 bucket notification to trigger the Lambda function on 's3:ObjectCreated:*' events, which is the standard serverless pattern for processing uploaded files.

Answer

Amazon SQS

Answer

Amazon EventBridge

Answer

API Gateway

Question 13

A cloud administrator is troubleshooting a performance issue in a virtualized environment. Which TWO metrics should the administrator monitor to identify CPU contention? (Choose two.)

Accepted Answer

CPU ready time. CPU ready time (B) is the correct metric because it measures the amount of time a virtual machine was ready to run but could not be scheduled on a physical CPU, which directly indicates CPU contention or overcommitment on the host. CPU co-stop time (C) is also correct because it reflects the time a vCPU was ready but had to wait for other vCPUs in the same virtual machine to be co-scheduled, a symptom of CPU contention in multi-vCPU VMs. CPU usage percentage (A) only shows how busy a CPU is and can be high without contention, so it does not specifically identify contention. CPU frequency (D) is a hardware characteristic and does not indicate scheduling delays or contention. CPU load average (E) is a host-level metric that may suggest demand but does not isolate per-VM scheduling latency like ready and co-stop times do.

Answer

CPU usage percentage

Answer

CPU frequency

Answer

CPU load average

Question 14

A cloud administrator receives an alert that the CPU usage on a virtual machine has spiked to 100% for 10 minutes. The VM hosts a critical application. What is the best first step?

Accepted Answer

Check the VM's performance metrics for the last hour to identify the process causing the spike.. Checking the VM's performance metrics for the last hour is the best first step because it allows the administrator to identify the specific process or application causing the CPU spike without disrupting service. This diagnostic approach aligns with the ITIL problem management framework, which emphasizes root cause analysis before taking corrective action. In a virtualized environment, tools like vCenter Performance Charts or Hyper-V Performance Monitor can pinpoint whether the spike is due to a runaway process, a memory leak, or a scheduled task, enabling a targeted resolution.

Answer

Immediately reboot the VM.

Answer

Move the VM to a different host.

Answer

Increase the VM's CPU limits.

Question 15

A developer deployed a new version of a cloud function, but the function is returning 500 errors. The previous version worked fine. What is the most likely cause?

Accepted Answer

The new code contains a runtime error.. The most likely cause of 500 errors after deploying a new version of a cloud function is a runtime error in the new code. A 500 Internal Server Error indicates that the function's code executed but threw an unhandled exception or logic error, which did not exist in the previous working version. Since the environment (runtime, memory, timeout) remained unchanged, the introduction of faulty code is the primary suspect.

Answer

The function is using an outdated runtime.

Answer

The function's memory allocation is too low.

Answer

The function's timeout is set too short.