CV0-004 Practice Test 3 — 10 Questions

Question 1

A DevOps team is implementing a canary deployment for a microservice running on Amazon ECS. They want to gradually shift 10% of traffic to the new version and automatically roll back if error rates exceed 1% in 5 minutes. Which combination of services should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CodeDeploy with CloudWatch alarms. AWS CodeDeploy natively supports canary deployments for Amazon ECS, allowing you to specify a traffic shift percentage (e.g., 10%) and integrate with CloudWatch alarms to automatically trigger a rollback when error rates exceed a defined threshold (e.g., 1% over 5 minutes). This combination directly fulfills the gradual traffic shifting and automated rollback requirements without custom scripting.

Answer

AWS CloudFormation and SSM

Answer

AWS Lambda and Step Functions

Answer

AWS Elastic Beanstalk and Route 53

Question 2

A cloud administrator is troubleshooting a web application hosted on a cloud virtual machine (VM) that is experiencing intermittent high latency during peak traffic hours. The application is deployed on a single VM instance with 4 vCPUs and 8 GB RAM, running a Linux OS. The VM is connected to a virtual network with a public IP. The administrator has verified that the application code is optimized and there are no memory leaks. CPU utilization remains below 50% during peaks, but network outbound traffic shows periodic spikes up to 500 Mbps. The VM's network interface is configured with a 1 Gbps bandwidth cap. The administrator suspects that the issue is related to network throttling or packet loss. Which of the following actions should the administrator take to resolve the issue?

Accepted Answer

Upgrade the VM to a larger instance size with higher network bandwidth cap (e.g., 2 Gbps).. The VM's network bandwidth cap of 1 Gbps is being saturated during peak traffic (spikes up to 500 Mbps, but with overhead and burst behavior, the cap can cause throttling and packet loss). Upgrading to a larger instance size with a higher network bandwidth cap (e.g., 2 Gbps) directly addresses the bottleneck by providing more headroom for outbound traffic, reducing latency caused by queueing and drops. The administrator has already ruled out CPU and memory issues, so the network cap is the likely culprit.

Answer

Increase the VM's vCPU count to 8 to improve processing capacity.

Answer

Configure the firewall to allow all traffic to reduce processing overhead.

Answer

Enable DDoS protection on the public IP to filter malicious traffic.

Question 3

Which TWO of the following are common vulnerabilities in cloud environments that can lead to unauthorized access? Select two.

Accepted Answer

Lack of encryption for data in transit. Options B and E are correct because lack of encryption for data in transit exposes sensitive data to interception, and misconfigured security groups allowing overly permissive inbound rules can grant unauthorized access. Options A, C, and D are security best practices that help prevent vulnerabilities.

Answer

Enabling automatic patching

Answer

Using multi-factor authentication

Answer

Properly scoped IAM roles

Question 4

A company is deploying a containerized microservices architecture on Azure Kubernetes Service (AKS). The security team requires that all container images are scanned for vulnerabilities before deployment. Which deployment approach should the DevOps team implement to ensure only approved images are used?

Accepted Answer

Enable Azure Container Registry tasks for automatic vulnerability scanning and enforce with Azure Policy.. Azure Container Registry (ACR) Tasks can automatically scan images for vulnerabilities using Microsoft Defender for Cloud, and Azure Policy can enforce that only images from approved registries or with passing scan results are deployed to AKS. This ensures that all container images are scanned before deployment and that only compliant images are used, meeting the security team's requirement.

Answer

Store all images in a private registry without any scanning.

Answer

Use Docker Content Trust to sign images and verify signatures during deployment.

Answer

Deploy an admission controller that checks image signatures only.

Question 5

A cloud administrator is configuring an Azure environment for a healthcare application that must comply with HIPAA. Which TWO configurations are required to meet HIPAA security and privacy rules? (Choose two.)

Accepted Answer

Implement audit logging for access to ePHI. Audit logging for access to ePHI is required by HIPAA to track who accessed, modified, or deleted protected health information. In Azure, this is implemented through Azure Monitor and Log Analytics, which capture detailed audit trails for storage accounts, databases, and applications. Without audit logs, the organization cannot demonstrate compliance with the HIPAA Security Rule's requirement for activity monitoring and accountability.

Answer

Configure network security groups to allow only HTTPS traffic

Answer

Enable multi-factor authentication for all administrative accounts

Answer

Configure automatic patching for all virtual machines

Question 6

A cloud operations team is implementing structured logging for better querying. They have decided to use JSON format. What is a key benefit of structured logging over unstructured logging?

Accepted Answer

Enables querying specific fields. Structured logging (e.g., JSON) enables efficient querying and filtering of log data.

Answer

Easier to read for humans

Answer

Reduced storage costs

Answer

Faster log ingestion

Question 7

An organization uses AWS CloudFormation to deploy resources across multiple AWS accounts. They need to manage a common set of resources in several accounts from a single template. Which CloudFormation feature should they use?

Accepted Answer

StackSets. StackSets allow deploying stacks across multiple accounts and regions. Change sets show changes before execution; Drift Detection detects configuration drift; Nested stacks are for reusability within a single account.

Answer

Change sets

Answer

Nested stacks

Answer

Drift Detection

Question 8

Arrange the steps to configure a VPN connection between an on-premises network and a cloud VPC.

Accepted Answer

Create cloud-side VPN gateway, then create on-premises gateway representation, then configure on-premises VPN device, then create VPN connection, then configure routing.. Start with cloud-side gateway, on-premises gateway representation, configure on-prem device, create connection, then routing.

Answer

Create cloud-side VPN gateway, then create on-premises gateway representation, then create VPN connection, then configure on-premises VPN device, then configure routing.

Answer

Create on-premises gateway representation, then create cloud-side VPN gateway, then configure on-premises VPN device, then create VPN connection, then configure routing.

Answer

Create cloud-side VPN gateway, then configure on-premises VPN device, then create on-premises gateway representation, then create VPN connection, then configure routing.

Question 9

Sequence the steps to set up a cloud storage bucket with versioning and lifecycle policies.

Accepted Answer

Create bucket, then enable versioning, then add lifecycle rules (transitions and deletions), then test. Create bucket, enable versioning, add lifecycle rules for transitions and deletions, then test.

Answer

Enable versioning, then create bucket, then add lifecycle rules, then test

Answer

Create bucket, then add lifecycle rules, then enable versioning, then test

Answer

Create bucket, then enable versioning, then test, then add lifecycle rules

Question 10

Which THREE of the following are valid considerations when selecting a cloud deployment model (public, private, hybrid)? (Choose three.)

Accepted Answer

Regulatory compliance requirements.. Option A (Regulatory compliance requirements) is correct because data-residency, sovereignty, and industry regulations (e.g., HIPAA, GDPR, PCI DSS) often dictate whether workloads can run in a public cloud, must stay in a private cloud, or require a hybrid model to keep sensitive data on-premises. Option B (Budget and total cost of ownership) is correct because deployment models differ significantly in CapEx versus OpEx: public cloud shifts spend to operational pay-as-you-go costs, private cloud requires capital investment in hardware and staffing, and hybrid blends both, so TCO analysis directly drives model selection. Option D (Latency sensitivity of the application) is correct because real-time or low-latency workloads may need private or hybrid placement near users or data sources, since public cloud network round-trip times can violate strict latency SLAs. Option C is not a valid consideration because programming language preference is an application development concern independent of where the infrastructure is deployed. Option E is not a valid consideration because marketing claims are not a technical or business criterion for evaluating deployment models.

Answer

Developers' preferred programming languages.

Answer

Cloud provider's marketing claims.