CV0-004 Practice Test 29 — 15 Questions

Question 1

A cloud administrator is troubleshooting a failed deployment of a new application version using a continuous integration/continuous deployment (CI/CD) pipeline. The pipeline fails at the 'test' stage. What is the first step the administrator should take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check the test logs for specific errors. When a CI/CD pipeline fails at the test stage, the first diagnostic step is to examine the test logs to identify the specific error — whether it is a failed assertion, a missing dependency, a timeout, or an environment issue. Logs provide the evidence needed to determine root cause before taking any corrective action. Jumping to re-runs or rollbacks without understanding the failure wastes time and may mask a recurring defect.

Answer

Re-run the pipeline

Answer

Increase the timeout of the test stage

Answer

Roll back to the previous version

Question 2

A company uses AWS CloudFormation to manage infrastructure. The operations team needs to be alerted when a stack update fails. Which TWO methods can be used to send notifications? (Choose two.)

Accepted Answer

Configure CloudFormation to send events to an SNS topic. Option C is correct because CloudFormation natively supports associating an SNS topic with stack events, so when a stack update fails CloudFormation publishes the event to that topic and subscribers (email, SMS, Lambda, etc.) receive the notification. Option E is correct because CloudFormation emits stack state-change events to Amazon EventBridge (CloudWatch Events), and a rule matching the StackStatus value UPDATE_FAILED (or UPDATE_ROLLBACK_COMPLETE with failure) can trigger an SNS topic, Lambda, or other target to alert the operations team. Option A is not correct because AWS Trusted Advisor checks cost, security, fault tolerance, performance, and service limits — it does not monitor CloudFormation stack update failures. Option B is not correct because CloudTrail records API calls for auditing, and while its logs can be sent to CloudWatch Logs, this does not by itself generate failure notifications for stack updates. Option D is not correct because AWS Config evaluates resource configuration compliance and does not detect or notify on CloudFormation stack update failures.

Answer

Use AWS Trusted Advisor to monitor CloudFormation

Answer

Enable CloudTrail to log stack updates and send logs to CloudWatch Logs

Answer

Use AWS Config to detect stack failures

Question 3

A cloud administrator notices that a virtual machine in a public cloud is running slower than expected. The VM is part of a production web application. The administrator has verified that the VM's CPU and memory utilization are below 50%. What should the administrator check next?

Accepted Answer

Check the network bandwidth and I/O throttling limits.. When CPU and memory are well below capacity, performance degradation in a public cloud VM is often caused by resource throttling at the network or storage layer. Cloud providers enforce bandwidth caps and I/O limits per VM size, and hitting those limits can cause packet loss, queuing, and high latency even when compute resources are idle. Checking network bandwidth and I/O throttling limits is the correct next step to identify if the VM is being rate-limited.

Answer

Migrate the VM to a different availability zone.

Answer

Increase the VM's vCPU count.

Answer

Reboot the VM.

Question 4

A cloud administrator notices that an IAM user has permissions that are not explicitly assigned. The administrator suspects that the user is inheriting permissions through group membership or role assignment. Which TWO methods can the administrator use to identify all effective permissions for this user? (Choose TWO.)

Accepted Answer

List the user's group memberships and examine the policies attached to those groups and any roles the user can assume.. Group memberships and assumable roles are common sources of inherited permissions. By listing the user's groups and examining the policies attached to those groups, as well as any roles the user can assume, the administrator can trace the origin of the unexpected permissions. This method directly identifies the inheritance chain that grants permissions not explicitly assigned to the user.

Answer

Review the user's recent access logs to see which actions were allowed.

Answer

Check the resource-based policies on each resource the user might access.

Answer

Log in as the root user and run a permissions report.

Question 5

A cloud engineer needs to deploy a serverless function that runs when a new object is uploaded to an S3 bucket. Which AWS service event trigger should be configured?

Accepted Answer

S3. Amazon S3 can directly invoke AWS Lambda when a new object is uploaded by configuring an S3 event notification on the bucket. This native integration allows the S3 service to trigger the function without any intermediary service, making option C the correct choice for a serverless function triggered by an S3 upload event.

Answer

API Gateway

Answer

EventBridge

Answer

SQS

Question 6

A cloud architect is designing a highly available application on AWS. The application must be fault-tolerant and able to withstand the failure of an entire Availability Zone. Which TWO actions should the architect take? (Select TWO.)

Accepted Answer

Deploy EC2 instances across two or more Availability Zones. Deploying across multiple Availability Zones and using an auto scaling group across those zones ensures that if one zone fails, the application continues in the other zones.

Answer

Store application state on the local instance store

Answer

Deploy EC2 instances in a single Availability Zone

Answer

Use a single large EC2 instance

Question 7

A cloud administrator is setting up monitoring for a web application. The application must be highly available across multiple availability zones. Which of the following metrics should be monitored to ensure that the application meets its service level agreement (SLA) for uptime?

Accepted Answer

The result of the load balancer health check for each instance.. The load balancer health check result directly indicates whether each instance is reachable and responding correctly to application traffic. Monitoring these results allows the administrator to detect instance failures and verify that the application remains available across multiple availability zones, which is the core requirement for meeting an uptime SLA. Other metrics like throughput, disk space, or CPU utilization are performance indicators but do not directly confirm application availability.

Answer

Network throughput per minute.

Answer

Percentage of disk space used on each instance.

Answer

Average CPU utilization across all instances.

Question 8

A company's cloud environment uses Azure Active Directory for identity management. They want to allow employees to sign in using their existing on-premises Active Directory credentials without synchronizing passwords to the cloud. Which federation protocol should they use?

Accepted Answer

SAML 2.0. SAML 2.0 is the correct choice because it is a federation protocol designed for web-based single sign-on (SSO), allowing Microsoft Entra ID to trust authentication assertions issued by on-premises Active Directory Federation Services (AD FS) without replicating password hashes to the cloud. Microsoft Entra ID supports SAML 2.0 as a federated identity provider, so users authenticate on-premises and receive a signed token that Microsoft Entra ID accepts. This satisfies the requirement of using existing AD credentials without password synchronization.

Answer

LDAP

Answer

Kerberos

Answer

OAuth 2.0

Question 9

A security team needs to enforce multi-factor authentication (MFA) for all users accessing the cloud management console. Which IAM feature should be configured?

Accepted Answer

Condition in IAM policy requiring MFA. A condition in an identity policy can require the presence of multi-factor authentication, enforcing MFA for access to the cloud management console. This is a standard mechanism to mandate MFA at the policy level, ensuring users must authenticate with a second factor before accessing the console.

Answer

IAM role

Answer

Resource-based policy

Answer

Password policy

Question 10

An organization is migrating a MySQL database to Amazon RDS using AWS DMS. They want to minimize downtime by using ongoing replication from the source. Which DMS feature should they enable to capture changes as they occur on the source database?

Accepted Answer

Change Data Capture (CDC). Change Data Capture (CDC) in AWS DMS captures ongoing changes from the source database by reading the transaction logs (e.g., binary log for MySQL) and applying them to the target. This enables near-zero downtime migration because after the initial full load, CDC continuously replicates inserts, updates, and deletes.

Answer

Data validation

Answer

Full load

Answer

Schema conversion

Question 11

A company is designing a highly available architecture for a critical application. The solution must tolerate the failure of an entire availability zone. Which TWO design principles should be implemented? (Choose two.)

Accepted Answer

Use a load balancer with health checks and cross-zone load balancing. To tolerate an AZ failure, deploy across multiple AZs and use active-active or active-passive with failover. So deploying across multiple AZs and using a load balancer with health checks to route traffic away from failed AZ are correct.

Answer

Deploy instances in a single availability zone

Answer

Use RAID 0 for all instance storage

Answer

Use a single load balancer without health checks

Question 12

A cloud administrator is deploying a critical application that requires the lowest possible latency between compute instances. The instances will be running in a private subnet and must communicate with each other using their private IP addresses. Which of the following deployment configurations would best meet these requirements?

Accepted Answer

Deploy instances in a placement group within the same Availability Zone.. Deploying instances in a placement group within the same Availability Zone ensures they are physically close together, often in the same rack or cluster, which minimizes network hops and achieves the lowest possible latency. This configuration is ideal for latency-sensitive applications because it leverages non-blocking, high-bandwidth inter-instance communication without traversing additional network infrastructure.

Answer

Deploy instances in different Availability Zones within the same region.

Answer

Deploy instances in the same subnet behind a NAT gateway.

Answer

Deploy instances in different regions and use inter-region peering.

Question 13

A security engineer is designing a data classification policy for a cloud environment. The policy must identify sensitive data, apply appropriate controls, and monitor access. Which THREE of the following should be included in the policy? (Select THREE.)

Accepted Answer

Encryption at rest for classified data. Data classification includes identifying where data resides, encrypting it, and monitoring access. DLP tools help enforce policies. Security groups are network controls, not data classification. CASB is for SaaS, but not necessarily part of a classification policy.

Answer

Cloud Access Security Broker (CASB) for all data

Answer

Network security groups to isolate data

Question 14

A cloud application is experiencing intermittent high latency. The operations team has enabled distributed tracing using AWS X-Ray but is unable to pinpoint the source. Which additional step should the team take to identify the root cause of the latency?

Accepted Answer

Analyze traces in X-Ray to identify which service segment has the highest duration.. AWS X-Ray provides distributed tracing that captures latency data for each segment of a request. To pinpoint the source of intermittent high latency, the team should analyze the traces to identify which service segment has the highest duration. This directly reveals the bottleneck, whether it's a database call, external API, or compute-intensive operation. Other steps like VPC Flow Logs or application logs may provide additional context but are not as directly actionable for latency root cause.

Answer

Enable VPC Flow Logs to analyze network traffic patterns.

Answer

Increase the auto-scaling group size to handle the load.

Answer

Examine application logs on each virtual machine.

Question 15

A company has a requirement to enforce least privilege for its cloud resources. The cloud engineer is configuring IAM policies. Which of the following best describes least privilege?

Accepted Answer

Granting only the permissions necessary to perform specific tasks. Least privilege means granting each user or service only the minimum permissions required to perform their specific job functions, and nothing more. This limits the blast radius of compromised credentials and reduces accidental or malicious damage. In cloud IAM, this is implemented through fine-grained policies scoped to specific resources and actions.

Answer

Granting permissions based on the user's job title rather than specific needs

Answer

Granting permissions only to senior managers

Answer

Granting full administrator access to all users to simplify management