CV0-004 Practice Test 27 — 15 Questions

Question 1

A company runs a critical e-commerce application on a cloud platform. The architecture includes a load balancer in front of an auto scaling group of compute instances across two availability zones. The instances are in a private subnet and use a NAT gateway for outbound internet access. The application stores session data in a managed Redis cache cluster. During a flash sale, users report that the site is extremely slow and some requests time out. Monitoring shows the load balancer's latency metric is high, and the number of healthy hosts fluctuates. The CPU utilization on the compute instances averages 60% and memory averages 70%. The Redis cluster's CPU utilization is 90%, and its memory usage is 95%. The NAT gateway's metrics show high BytesOutToSource but no errors. Which of the following is the most likely cause of the performance issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The managed Redis cache cluster is overloaded and becoming a bottleneck for session lookups. The managed Redis cache cluster is the most likely bottleneck because its CPU utilization is at 90% and memory usage at 95%, indicating it is near capacity. Since the application stores session data in Redis, high latency and timeouts during a flash sale are consistent with an overloaded session store that cannot keep up with request volume, causing the load balancer to experience increased latency and healthy host fluctuations as sessions fail to be retrieved or written.

Answer

The NAT gateway is throttling traffic due to bandwidth limits

Answer

The auto scaling group is not scaling quickly enough due to cooldown periods

Answer

The load balancer's idle timeout setting is too low, causing premature connection drops

Question 2

During a security audit, a cloud engineer discovers that a container image used in production has a known critical vulnerability in a base layer. Which practice should be implemented to prevent this in the future?

Accepted Answer

Perform container image scanning during CI/CD. Container image scanning during CI/CD integrates security checks into the build pipeline, automatically detecting vulnerabilities in base layers and dependencies before deployment. This shift-left approach prevents vulnerable images from reaching production by failing the build or alerting teams. It is the most effective practice to prevent known vulnerabilities in base layers from being deployed.

Answer

Enable Kubernetes pod security policies

Answer

Use only official images from Docker Hub

Answer

Implement network segmentation

Question 3

A company is migrating its on-premises applications to a public cloud. The security team wants to ensure that the cloud provider is responsible for physical security of data centers, while the company remains responsible for securing guest operating systems. Which concept does this describe?

Accepted Answer

Shared responsibility model. The shared responsibility model defines the division of security responsibilities between the cloud provider and the customer. The provider is responsible for security 'of' the cloud (e.g., physical data centers), while the customer is responsible for security 'in' the cloud (e.g., guest OS, applications). This matches the scenario where the provider handles physical security and the company secures guest operating systems.

Answer

Least privilege principle

Answer

Zero Trust architecture

Answer

Defense in depth

Question 4

A company uses AWS and wants to receive alerts when CPU utilization of an EC2 instance exceeds 90% for 10 minutes. Which AWS service should be used to create this alarm?

Accepted Answer

Amazon CloudWatch Alarms. CloudWatch Alarms monitor metrics and trigger actions based on thresholds and duration.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 5

A developer is deploying a serverless application using AWS Lambda. They want to reuse common code (e.g., database connection logic) across multiple functions without duplicating it. Which Lambda feature should they use?

Accepted Answer

Lambda layers. Lambda Layers allow you to package and share code across multiple functions, enabling code reuse and reducing deployment package size.

Answer

Lambda versions

Answer

Lambda aliases

Answer

Lambda environment variables

Question 6

Which cloud service model provides the customer with the highest level of control over the operating system and middleware?

Accepted Answer

IaaS. IaaS provides virtualized computing resources where the customer manages the OS, middleware, and applications, offering the highest control among the three main service models.

Answer

PaaS

Answer

FaaS

Answer

SaaS

Question 7

Refer to the exhibit. The auto scaling group is fluctuating between 2 and 3 instances every few minutes. What is the most likely cause?

Accepted Answer

The scaling policies are based on metrics that are too sensitive.. The auto scaling group fluctuating between 2 and 3 instances every few minutes indicates a scaling policy that is too sensitive, likely based on a metric such as CPU utilization or request count per target that oscillates rapidly. When the metric crosses the scale-out threshold, a new instance launches, causing the metric to drop below the scale-in threshold, which then terminates an instance, creating a cycle. This is a classic symptom of thrashing due to overly aggressive or poorly configured scaling policies.

Answer

The instances are taking too long to become healthy.

Answer

The launch configuration has incorrect user data.

Answer

The load balancer is not properly distributing traffic.

Question 8

A cloud administrator is tasked with monitoring CPU utilization across a fleet of virtual machines. Which cloud service should be used to collect and visualize this metric?

Accepted Answer

Cloud monitoring service. A cloud monitoring service is specifically designed to collect, aggregate, and visualize performance metrics like CPU utilization from virtual machines and other resources. It provides time-series data storage, dashboards, and alerting capabilities, making it the correct tool for this task. Other services focus on different operational aspects such as logging, configuration, or recommendations, not real-time metric collection and visualization.

Answer

Audit logging service

Answer

Configuration management service

Answer

Advisor or optimization service

Question 9

An architect is designing a cloud application that must handle unpredictable spikes in traffic. The application should automatically add resources during peak demand and remove them when demand decreases to minimize costs. Which scaling strategy should be used?

Accepted Answer

Horizontal auto-scaling based on CPU utilization. Horizontal auto-scaling based on CPU utilization is the correct strategy because it dynamically adds or removes instances in response to real-time demand, ensuring the application can handle unpredictable traffic spikes while minimizing costs. This approach aligns with cloud elasticity principles, where resources scale out (add instances) during high CPU load and scale in (remove instances) when load decreases, without manual intervention.

Answer

Scheduled scaling based on historical patterns

Answer

Vertical scaling of existing instances

Answer

Manual scaling by operations team

Question 10

A cloud engineer is implementing a tagging strategy for cost allocation. Which tags should be applied to resources to track costs by business unit and environment?

Accepted Answer

BusinessUnit and Environment. BusinessUnit and Environment are the two dimensions explicitly required to track costs by business unit and environment, so tagging resources with these keys directly enables cost allocation reports filtered on those values. Cloud providers' cost explorers and billing dashboards group spend by tag key/value, making these the correct tag pair.

Answer

Owner and Department

Answer

Project and Application

Answer

Location and Region

Question 11

A company has a cloud-based application that uses a relational database. The database team performs daily backups to an on-premises storage system using a VPN connection. Recently, backups have been failing with timeout errors. The network team confirms the VPN is up and stable. Which of the following is the MOST likely cause?

Accepted Answer

The VPN bandwidth is insufficient for the backup data volume. The VPN connection is confirmed stable, so tunnel configuration and firewall issues are unlikely. Backup timeout errors with large data volumes typically indicate insufficient bandwidth, causing the transfer to exceed the timeout threshold. The database service itself is responding (backups are attempted), ruling out service unavailability.

Answer

The database service is not responding

Answer

The VPN tunnel is not properly configured

Answer

The on-premises firewall is blocking the backup port

Question 12

A security administrator is deploying a web application firewall (WAF) to protect a public-facing web application. The application experiences a high volume of traffic from a specific geographic region that is not part of the target customer base. Which WAF feature would best reduce the attack surface without impacting legitimate users?

Accepted Answer

Geo-blocking. Geo-blocking allows the administrator to block traffic from specific regions, reducing the attack surface by eliminating traffic from non-target areas.

Answer

IP whitelisting

Answer

Rate limiting

Answer

OWASP rule set

Question 13

A cloud administrator receives an alert that a virtual machine's disk usage is at 95%. The VM hosts a database. Which of the following troubleshooting steps should the administrator take FIRST?

Accepted Answer

Check the disk to identify which files are consuming space. When a VM's disk usage reaches 95%, the first step is to identify what is consuming the space. Checking the disk to identify which files are consuming space (Option D) allows the administrator to determine whether the issue is caused by database logs, temporary files, or other data, and to plan an appropriate remediation without unnecessary risk or downtime.

Answer

Expand the virtual disk by resizing the volume in the cloud console

Answer

Reboot the virtual machine to free up temporary files

Answer

Query the database for active connections to determine if there are long-running transactions

Question 14

A company wants to be notified when their monthly AWS spending exceeds $10,000. Which AWS service should they use to set up this alert?

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom cost budgets and configure alerts when actual or forecasted spending exceeds a defined threshold, such as $10,000 per month. It sends notifications via email or SNS when the threshold is breached, directly satisfying the requirement to be notified about monthly spending exceeding a specific amount.

Answer

AWS Trusted Advisor

Answer

AWS Cost Explorer

Answer

AWS CloudWatch Alarms

Question 15

Which THREE of the following are best practices when deploying a cloud application using Infrastructure as Code (IaC)? (Choose three.)

Accepted Answer

Store IaC templates in a version control system.. Option A is correct because storing IaC templates in a version control system (e.g., Git) provides change history, peer review via pull requests, rollback capability, and auditability, which are foundational to reliable, repeatable deployments. Option B is correct because decomposing complex deployments into reusable modules (e.g., Terraform modules or CloudFormation nested stacks) reduces duplication, enforces consistency, and makes templates easier to test and maintain. Option E is correct because immutable infrastructure patterns—replacing rather than mutating running resources, often via new machine images or fresh stack deployments—eliminate configuration drift and make rollbacks deterministic. Option C is not appropriate because embedding credentials directly in templates exposes secrets in version control and logs; secrets should be referenced from a secrets manager or parameter store. Option D is not appropriate because manually modifying resources after deployment creates configuration drift, breaks reproducibility, and means the IaC templates no longer reflect the actual environment.

Answer

Embed credentials directly in the IaC templates.

Answer

Manually modify resources after deployment to tune performance.