CV0-004 Practice Test 28 — 15 Questions

Question 1

A company is adopting Infrastructure as Code (IaC) to manage its cloud resources. Which THREE statements are true about IaC? (Select THREE.)

Accepted Answer

IaC allows for automated provisioning of infrastructure. Option A is correct because IaC tools such as Terraform, AWS CloudFormation, and Ansible automate the provisioning of infrastructure by declaring resources in code and applying them through APIs, removing manual click-through provisioning. Option D is correct because IaC configuration files (e.g., .tf, YAML templates, playbooks) are text-based and are normally committed to a version control system like Git, enabling change tracking, peer review, and rollback. Option E is correct because the same declarative or idempotent IaC code produces the same resulting infrastructure state on every run, giving repeatable and consistent deployments across environments. Option B is not marked correct because IaC does not eliminate manual configuration changes entirely; out-of-band or drift changes can still occur and must be detected and reconciled. Option C is not marked correct because IaC supports both mutable and immutable infrastructure models, so it is not limited to immutable infrastructure.

Answer

IaC eliminates the need for manual configuration changes

Answer

IaC is only applicable for immutable infrastructure

Question 2

A cloud architect is designing a deployment pipeline using GitHub Actions. They want to automatically run tests on every push to the main branch. Which GitHub Actions component defines the automation workflow?

Accepted Answer

Workflow. A GitHub Actions workflow is the top-level YAML file (in .github/workflows) that defines when automation runs and what jobs it contains. It is the component that binds triggers (like push to main) to jobs and steps, so it is the correct answer for 'defines the automation workflow.'

Answer

Job

Answer

Step

Answer

Action

Question 3

Match each cloud deployment model to its description.

Accepted Answer

Public cloud: Owned by third-party provider, accessible over internet, multi-tenant. Deployment models define ownership and access scope. Public is third-party multi-tenant; private is single-tenant; hybrid combines models; community is shared by like-minded organizations. Common errors include swapping definitions between hybrid and community.

Answer

Private cloud: Owned by third-party provider, accessible over internet, multi-tenant

Answer

Hybrid cloud: Shared by several organizations with common concerns

Question 4

A DevOps engineer is configuring a Kubernetes deployment for a microservices application. The application requires that new pods receive traffic only after a health check endpoint returns HTTP 200. Which Kubernetes feature should be configured on the pods?

Accepted Answer

Readiness probe. A readiness probe determines whether a pod is ready to receive traffic. If the readiness probe fails, the pod is removed from the endpoints of the service, preventing traffic from being sent to it until it passes. This matches the requirement that new pods receive traffic only after a health check endpoint returns HTTP 200.

Answer

Startup probe

Answer

Liveness probe

Answer

Resource limits

Question 5

A cloud engineer runs the commands shown in the exhibit. Based on the output, which security issue is present?

Accepted Answer

The firewall rule allows SSH access from any source IP.. The exhibit shows a firewall rule permitting TCP/22 (SSH) with source 0.0.0.0/0, meaning any host on the internet can attempt SSH to the web servers. This violates least privilege and exposes the instances to brute-force and exploitation attempts. The correct remediation is to restrict the source to a bastion host or corporate CIDR.

Answer

The bastion host is not used for SSH access.

Answer

The web servers are not running.

Answer

There are too many firewall rules allowing SSH.

Question 6

Refer to the exhibit. A cloud administrator runs the command to inspect an instance and notices that it is running, but the web application hosted on it is unreachable from the internet. The instance is in a public subnet with an internet gateway attached to the VPC. Which of the following is the most likely cause?

Accepted Answer

The instance's security group does not allow inbound HTTP/HTTPS traffic from 0.0.0.0/0.. The most likely cause is that the instance's security group does not allow inbound HTTP/HTTPS traffic from 0.0.0.0/0. Even if the instance is running and in a public subnet with an internet gateway, security groups act as virtual firewalls that must permit the traffic. Without the appropriate inbound rules, the web application is unreachable.

Answer

The instance type t2.medium does not support public IP addresses.

Answer

The subnet subnet-abc is not associated with a route table that has a route to the internet gateway.

Answer

The volume vol-111 is not encrypted.

Question 7

A cloud administrator needs to monitor CPU utilization for a fleet of EC2 instances and receive notifications when utilization exceeds 80%. Which AWS service should be used to create a metric alarm that triggers an SNS notification?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the AWS service for monitoring metrics and creating alarms. CloudWatch Alarms can be configured to trigger SNS notifications when a metric crosses a threshold.

Answer

AWS Config

Answer

AWS Trusted Advisor

Answer

AWS CloudTrail

Question 8

A cloud administrator runs the `iostat` command on a Linux VM experiencing slow performance. Based on the exhibit, what is the most likely bottleneck?

Accepted Answer

Disk I/O is saturated.. The `iostat` command reports CPU and I/O statistics. The exhibit shows high `%util` (e.g., 99.9%) and elevated `await` or `svctm` values, indicating that the disk device is operating at or near its maximum capacity. This means the disk I/O subsystem is saturated, causing requests to queue and slowing overall VM performance.

Answer

Network bandwidth is limited.

Answer

CPU is overloaded.

Answer

Memory is insufficient.

Question 9

A cloud administrator is troubleshooting an issue where a user in the finance department cannot access a critical application hosted on a private cloud. The user can access other applications in the same subnet. The security team recently implemented a new network security policy. Which of the following is MOST likely causing the issue?

Accepted Answer

A host-based firewall rule is blocking the specific application port on the user's VM.. The user can access other applications in the same subnet, indicating network connectivity is intact, but a specific application is blocked. A host-based firewall rule on the user's VM (e.g., Windows Firewall or iptables) can filter traffic by port or protocol, and a newly implemented security policy likely added a rule blocking the port used by the critical application. This explains why only that application is inaccessible while others work.

Answer

The user's VM is isolated from the subnet due to a misconfigured VLAN.

Answer

The user's account has been disabled due to a failed login attempt.

Answer

The hypervisor is denying access to the application due to a resource quota violation.

Question 10

A company uses a hybrid cloud model with an on-premises data center and a public cloud. The network team reports that traffic between the cloud and on-premises is experiencing high latency and packet loss. The cloud administrator verifies that the VPN connection is up. What is the most likely cause?

Accepted Answer

The VPN tunnel has a mismatched MTU size.. When a VPN tunnel is up but traffic experiences high latency and packet loss, a mismatched Maximum Transmission Unit (MTU) size is a common cause. This occurs because packets larger than the tunnel's MTU must be fragmented, and if fragmentation is not properly handled (e.g., due to the DF bit being set), packets are dropped, leading to retransmissions and increased latency. The symptoms align with MTU issues rather than simple connectivity or throttling problems.

Answer

A firewall rule is blocking ICMP packets.

Answer

VMs are placed in different cloud regions.

Answer

The cloud provider is throttling bandwidth.

Question 11

A company runs a stateless web application on virtual machines. To handle increased traffic, they add more virtual machines and distribute incoming requests among them. What is this scaling method called?

Accepted Answer

Horizontal scaling. Horizontal scaling (scaling out) adds more instances — in this case, more virtual machines — and distributes incoming requests among them, typically via a load balancer. This increases capacity by adding parallel resources rather than making a single resource larger. The scenario explicitly describes adding more VMs and distributing requests, which is the definition of horizontal scaling.

Answer

Right-sizing

Answer

Vertical scaling

Answer

Auto-scaling

Question 12

A hybrid cloud deployment connects an on-premises data center to a public cloud. Which TWO components are typically required to establish this connectivity? (Select TWO.)

Accepted Answer

Direct peering or dedicated connection (e.g., AWS Direct Connect). Option B is correct because a hybrid cloud requires a private, high-bandwidth, low-latency link between the on-premises data center and the public cloud, which is exactly what a dedicated connection such as AWS Direct Connect (or Azure ExpressRoute, or direct peering) provides, bypassing the public internet. Option C is correct because a VPN gateway (e.g., an IPsec site-to-site VPN terminating on an AWS virtual private gateway or Azure VPN gateway) is the other standard mechanism for securely extending the on-premises network into the cloud over an encrypted tunnel. Together, dedicated connections and VPN gateways are the two canonical connectivity components for hybrid cloud architectures. Option A is not required for connectivity itself; a load balancer distributes traffic to workloads but does not establish the hybrid link. Option D is incorrect because plain public internet with HTTPS is not the typical secure hybrid connectivity method and lacks the private/encrypted tunnel characteristics of a VPN or dedicated circuit. Option E is incorrect because a DNS resolver only resolves names and plays no role in establishing network connectivity between the data center and the cloud.

Answer

Load balancer in the cloud

Answer

Public internet with HTTPS

Answer

Cloud-based DNS resolver

Question 13

A cloud engineer is troubleshooting performance issues in a virtualized environment. Which of the following tools would BEST help identify CPU contention on a hypervisor?

Accepted Answer

esxtop. esxtop is VMware's real-time performance monitoring tool for ESXi hosts, and it exposes CPU metrics such as %RDY (ready time), which directly indicates CPU contention when VMs are waiting for physical CPU cycles. It is the standard tool for diagnosing hypervisor-level CPU scheduling issues.

Answer

iperf

Answer

ping

Answer

nslookup

Question 14

Which TWO factors should be considered when selecting a cloud region for deploying a globally distributed application to minimize latency?

Accepted Answer

Geographic proximity to target user base. Option A is correct because network round-trip time is dominated by physical distance; placing the region geographically close to the target user base reduces propagation delay and thus latency for those users. Option E is correct because edge caching services (CDN) push content to points of presence near end users, so the availability of such services in or around a region lets static and cacheable content be served from the edge rather than traversing back to the origin region, further minimizing perceived latency. Options B, C, and D do not belong: the number of available VM sizes (B) affects compute flexibility and cost, not network latency; multiple Availability Zones (C) provide fault tolerance and high availability within a region, not latency reduction; and the local tax rate (D) is a cost/compliance consideration with no bearing on network performance.

Answer

Number of available virtual machine sizes

Answer

Presence of multiple Availability Zones

Answer

Local tax rate for cloud services

Question 15

A cloud engineer needs to ensure that an auto-scaling group does not launch new instances immediately after a scale-in event to allow metrics to stabilize. Which feature should they configure?

Accepted Answer

Cooldown periods. Cooldown periods are specifically designed to prevent an Auto Scaling group from launching or terminating additional instances immediately after a scaling activity. This allows metrics to stabilize and prevents rapid, unnecessary scaling actions. By configuring a cooldown period, the engineer ensures that new instances are not launched until the cooldown expires, giving the system time to reflect the effect of the previous scaling event.

Answer

Health checks

Answer

Scheduled scaling

Answer

Lifecycle hooks