CV0-004 Practice Test 28 — 15 Questions

Question 1

A cloud administrator is starting the nginx web server on a new cloud VM but it fails. According to the exhibit, what is the most likely cause of the failure?

Accepted Answer

Another service is already listening on port 80. The error 'bind() to 0.0.0.0:80 failed (98: Address already in use)' indicates that port 80 is already occupied by another process. Option A is correct. Option B is wrong because SELinux would give a permission denied error, not address in use. Option C is wrong because the error says address in use, not file not found. Option D is wrong because the error is about binding, not about configuration syntax.

Answer

The VM does not have network connectivity

Answer

SELinux is blocking nginx from binding to the port

Answer

The nginx configuration file has a syntax error

Question 2

A cloud application returns HTTP 503 errors during high traffic. The application runs on VMs behind a load balancer. Which action is most likely to resolve the issue?

Accepted Answer

Add additional VMs to the backend pool.. Option C is correct because scaling out adds capacity. Option A is incorrect because it affects only one host. Option B is incorrect as health checks are passing. Option D is incorrect because DNS changes don't add capacity.

Answer

Restart the web server service on one VM.

Answer

Change the DNS TTL to a lower value.

Answer

Increase the health check interval on the load balancer.

Question 3

A company migrated to a hybrid cloud and users report slow access to files stored in the cloud. The on-premises network is 100 Mbps. What troubleshooting step should be taken?

Accepted Answer

Check VPN bandwidth and latency. Option B is correct because slow file access over a hybrid connection is often due to limited VPN bandwidth or high latency. Option A is wrong because increasing storage performance tier may not address network bottlenecks. Option C is wrong because moving files back defeats the hybrid cloud purpose. Option D is wrong because compression may help but isn't the first step to diagnose the issue.

Answer

Enable compression on the cloud storage gateway

Answer

Increase cloud storage performance tier

Answer

Move files to on-premises storage

Question 4

The exhibit shows the health check status for targets in an application load balancer's target group. The target group has a health check on port 80. An administrator notices that one target is unhealthy on port 80 but healthy on port 443. What is the most likely cause?

Accepted Answer

The security group for the target is blocking port 80 from the load balancer.. Option A is correct because the target is healthy on 443 but not on 80, suggesting port 80 is blocked. Option B is wrong because it's healthy on 443, so server is listening. Option C is wrong because if path were wrong, both would fail. Option D is wrong because the same target group is used.

Answer

The web server on the target is not listening on port 443.

Answer

The load balancer is in a different VPC.

Answer

The health check path is incorrect.

Question 5

Refer to the exhibit. An application running on an EC2 instance is failing to connect to an RDS database. What is the most likely issue?

Accepted Answer

The security group for the RDS instance does not allow inbound traffic from the EC2 instance. Option B is correct because a 'connection refused' error typically indicates that the database is reachable but the port is blocked, likely by a security group. Option A is wrong if the database is in a different VPC, the error would be timeout or no route. Option C is wrong because a stopped database would result in a 'no route to host' or timeout. Option D is wrong because port 3306 is standard for MySQL and the error is not about wrong port.

Answer

The database instance is in a different VPC

Answer

The database instance is stopped

Answer

The application is using the wrong database port

Question 6

A cloud architect is designing a multi-tier application that must be resilient to the failure of an entire availability zone. Which of the following strategies BEST meets this requirement?

Accepted Answer

Deploy application instances across three availability zones with a load balancer. Option D is correct because deploying across multiple availability zones provides high availability. Option A is wrong because vertical scaling does not address zone failure. Option B is wrong because auto-scaling within a single zone does not help if the zone fails. Option C is wrong because a single load balancer in one zone is a single point of failure.

Answer

Place all instances behind a single load balancer in one zone

Answer

Implement auto-scaling within the same availability zone

Answer

Use larger instance types to handle more load

Question 7

A cloud administrator is troubleshooting why a newly launched VM did not complete its initialization. According to the exhibit, what is the most likely cause?

Accepted Answer

The package repository is not configured correctly. The error 'E: Unable to locate package python3-pip' indicates that the package name is incorrect or the repository is not configured. Option C is correct. Option A is wrong because cloud-init is running commands. Option B is wrong because the error is about locating a package, not about a syntax issue in cloud-init. Option D is wrong because there is no indication of network issues; the command ran but couldn't find the package.

Answer

Cloud-init is not installed on the VM

Answer

The cloud-init user data script contains a syntax error

Answer

The VM does not have internet access

Question 8

An automated snapshot of a cloud VM is failing with the error 'Quota exceeded for resource snapshots'. What is the most likely cause?

Accepted Answer

The maximum number of snapshots allowed has been reached.. Option D is correct because the snapshot count limit is reached. Option A is incorrect because disk space is separate. Option B is incorrect as policy applies to all snapshots. Option C is incorrect if snapshot creation is automated.

Answer

The snapshot is being created during a backup window.

Answer

The snapshot retention policy is set too high.

Answer

The VM's disk is too full to create a snapshot.

Question 9

After deploying a new application version, users get 503 errors. The application runs on Kubernetes in a private cloud. What is the most likely cause?

Accepted Answer

Application health check failing. Option C is correct because 503 errors often indicate the application is not responding to health checks, causing the load balancer to remove pods from service. Option A is wrong because insufficient resources would cause OOM or CPU throttling, not necessarily 503. Option B is wrong because incorrect ingress would cause 404 or connection timeouts. Option D is wrong because node port exhaustion is rare and would cause connection refused.

Answer

Incorrect ingress configuration

Answer

Insufficient pod resources

Answer

Node port exhaustion

Question 10

The exhibit shows VPC flow log entries for an EC2 instance (eni-12345678). The administrator is troubleshooting a connectivity problem where an application on 10.0.1.5 occasionally cannot connect to a web server at 10.0.2.10 on port 80. What action should the administrator take?

Accepted Answer

Add a network ACL rule allowing inbound TCP/80 from 10.0.1.5 to the subnet of 10.0.2.10.. Option B is correct because the REJECT entry indicates that traffic is being blocked by a stateless firewall (NACL) because security groups are stateful and would not generate REJECT at network level. The REJECT is from a NACL. Adding an inbound allow rule in NACL for the target subnet would fix it. Option A is wrong because security groups are stateful and allow return traffic; the initial connection may be allowed but not specified; but flow logs show REJECT which is typical from NACL. Option C is wrong because routes are for routing, not filtering. Option D is wrong because MTU doesn't cause reject.

Answer

Increase the MTU on the instance to 9001.

Answer

Add a security group rule allowing inbound TCP/80 from 10.0.1.5.

Answer

Add a route to the VPC route table for 10.0.1.5.

Question 11

A cloud administrator is troubleshooting a failed deployment of a new application version using a continuous integration/continuous deployment (CI/CD) pipeline. The pipeline fails at the 'test' stage. What is the first step the administrator should take?

Accepted Answer

Check the test logs for specific errors. Option B is correct because reviewing test logs provides specific error details. Option A is wrong because rolling back should only happen after understanding the failure. Option C is wrong because increasing timeout is a guess and does not address the root cause. Option D is wrong because re-running without investigation wastes time.

Answer

Re-run the pipeline

Answer

Increase the timeout of the test stage

Answer

Roll back to the previous version

Question 12

A cloud administrator is troubleshooting an application that is experiencing intermittent timeouts. The application runs on a cloud VM and connects to a cloud database. The administrator sees no errors in the application logs but notices high network latency during peak hours. Which of the following is the MOST likely cause?

Accepted Answer

Insufficient provisioned IOPS on the database. Option B is correct because insufficient provisioned IOPS can cause queue buildup and latency. Option A is wrong because database schema issues would cause query errors, not latency. Option C is wrong because a missing route would cause complete failure, not intermittent timeouts. Option D is wrong because SSL misconfiguration would cause handshake failures.

Answer

Incorrect database schema

Answer

SSL certificate mismatch between app and database

Answer

Missing route table entry for the database subnet

Question 13

A cloud administrator is troubleshooting why web-server-01 is not receiving traffic from an internet-facing load balancer. The load balancer is in the same VPC and subnet. According to the exhibit, what is the most likely reason?

Accepted Answer

The security group attached to the instance does not allow traffic from the load balancer. The instance has no public IP address (not shown) and the security group 'web-sg' may not allow HTTP traffic. However, the exhibit does not show security group rules or public IP. The most likely issue is that the instance is in a private subnet without a route to the internet? But the question says load balancer is internet-facing and in same VPC. The load balancer can route to private instances if security groups allow. However, the exhibit shows no public IP, so the load balancer can still reach it via private IP. Actually, the most common issue is security group rules: the load balancer's security group must allow inbound HTTP, and the instance's security group must allow traffic from the load balancer. Without that, traffic is blocked. Option C is correct. Option A is wrong because the load balancer can route to private IPs. Option B is wrong because the instance is running. Option D is wrong because load balancer does not require a public IP on the instance.

Answer

The instance is in a stopped state

Answer

The instance is not in the same VPC as the load balancer

Answer

The instance does not have a public IP address

Question 14

A cloud orchestration template fails to deploy resources with the error 'Resource limit exceeded'. The administrator has enough quota for all services. What is the most likely cause?

Accepted Answer

A specific resource type has reached its service limit.. Option A is correct because some resources have their own limits separate from account quota. Option B is incorrect as permissions would cause a different error. Option C is incorrect because template syntax errors occur early. Option D is incorrect because image corruption would show a different error.

Answer

The template has a syntax error in the JSON.

Answer

The custom image used is corrupted.

Answer

The IAM role used does not have permission to create resources.

Question 15

A cloud administrator is troubleshooting a connectivity issue between two VPCs in the same region. Which TWO actions should the administrator verify? (Choose two.)

Accepted Answer

VPC peering connection status. Options A and C are correct because route tables must have routes to the peering connection, and the VPC peering connection must be in the 'active' state. Option B is wrong because security groups don't block traffic between peered VPCs unless explicitly configured, but they are not the primary check. Option D is wrong because an internet gateway is not required for VPC peering. Option E is wrong because VPN tunnel is a different connectivity method.

Answer

Security group rules

Answer

VPN tunnel configuration

Answer

Internet gateway attachment

CV0-004 Practice Test 28 — 15 Questions

Exhibit

CV0-004 Practice Test 28 — 15 Questions

Exhibit