CV0-004 Practice Test 30 — 15 Questions

Question 1

A cloud operations team is implementing a tagging strategy for cost attribution. They need to track costs by environment (dev, test, prod), project, and team. Which approach should they use?

Accepted Answer

Apply tags such as Environment, Project, and Team to all resources. Tags are key-value pairs that can be applied to resources. Using a consistent set of tags for all resources enables cost breakdown by those dimensions. Resource groups are Azure-specific and not universal. Naming conventions are less reliable. Separate accounts add overhead.

Answer

Use resource groups to organize resources by environment

Answer

Use resource naming conventions to encode environment and project

Answer

Create separate cloud accounts for each environment

Question 2

During a security audit, it is discovered that a cloud application can be accessed using a shared service account that has elevated privileges. The audit recommends implementing a just-in-time (JIT) access model. What is the primary benefit of JIT access in this scenario?

Accepted Answer

Reduces the attack surface by minimizing persistent privileged access.. JIT access grants temporary elevated privileges only when needed, reducing the risk of standing privileged access. It enables real-time approval workflows. It does not directly manage identities nor automate audits of third-party access; those are secondary benefits.

Answer

Automates auditing of third-party access.

Answer

Allows for easier management of user identities.

Answer

Eliminates the need for user authentication.

Question 3

A security analyst is reviewing logs and finds that an unauthorized user accessed a storage blob in a cloud environment. The analyst needs to determine which permissions allowed the access. Which cloud feature provides a detailed view of effective permissions for a user?

Accepted Answer

Role-Based Access Control (RBAC) with effective permissions analysis. Role-Based Access Control (RBAC) systems often provide an 'effective permissions' or 'check access' feature that allows an administrator to evaluate the cumulative permissions assigned to a specific user, group, or service principal for a given resource scope. This feature calculates the net effect of all role assignments, including inherited permissions from higher-level scopes such as management groups, subscriptions, and resource groups, enabling the analyst to pinpoint exactly which role granted the unauthorized access.

Answer

Privileged Identity Management (PIM)

Answer

Blueprints/Service Catalog

Answer

Policy Enforcement

Question 4

A cloud administrator receives an alert that a virtual machine is unresponsive. The hypervisor shows the VM status as 'running'. Which of the following should the administrator check FIRST to diagnose the issue?

Accepted Answer

Access the VM's console to view the operating system screen.. When a VM is unresponsive but the hypervisor shows its status as 'running', the most direct way to determine if the guest OS has crashed or is stuck in a boot loop is to access the VM's console. This provides a direct view of the OS screen, allowing the administrator to see if the OS is hung, at a login prompt, or displaying an error, which is the first step in isolating the issue before checking network or resource configurations.

Answer

Verify the security group rules for the VM's subnet.

Answer

Review the hypervisor's CPU and memory utilization for the VM.

Answer

Check the virtual network interface for disconnection.

Question 5

A cloud architect manages a hybrid cloud environment where on-premises workloads are being migrated to a public cloud provider. The company uses a cloud-native container orchestration platform (e.g., Amazon EKS) for microservices. Recently, a critical application experienced intermittent connectivity failures between microservices during peak hours. The architect observes that the Kubernetes cluster uses a Calico network plugin with BGP peering to on-premises routers. The cluster nodes are spread across three Availability Zones, and the application pods communicate across zones. The architect also notes that the BGP session between the cluster and on-premises routers uses a single physical interface per node, and the on-premises routers have equal-cost multipath (ECMP) configured for the cluster node IPs. During peak hours, the on-premises routers experience high CPU utilization, and some BGP flaps occur. Which of the following is the MOST effective solution to improve connectivity reliability?

Accepted Answer

Add a second physical interface on each cluster node and peer with multiple on-premises routers.. Adding a second physical interface per node enables redundant BGP peering with multiple on-premises routers, eliminating the single point of failure. This reduces BGP flap impact during peak hours by distributing control-plane load and providing failover paths, directly addressing the high CPU utilization and intermittent connectivity caused by ECMP instability.

Answer

Reduce the number of ECMP paths on the on-premises routers to lower CPU utilization.

Answer

Increase the number of ECMP paths to improve traffic distribution.

Answer

Replace BGP with static routes between the cluster and on-premises network.

Question 6

A company wants to connect its on-premises data center to a public cloud provider with a dedicated, high-bandwidth, low-latency connection. The connection must be private and not traverse the internet. Which connectivity option should be used?

Accepted Answer

Direct Connect or ExpressRoute. Direct Connect (AWS) or ExpressRoute (Azure) provides a dedicated private connection from on-premises to the cloud. VPN uses the internet and has lower performance. Internet gateway is for internet access. VPC peering connects VPCs within the cloud.

Answer

Site-to-Site VPN

Answer

Internet gateway

Answer

VPC peering

Question 7

Which TWO factors should be considered when selecting a cloud region for deploying a globally distributed application to minimize latency?

Accepted Answer

Geographic proximity to target user base. Geographic proximity to the target user base (A) minimizes physical distance, directly reducing round-trip time. Edge caching services like CDNs (E) bring content closer to users, further lowering latency. Availability Zones (C) improve fault tolerance and high availability but do not reduce latency. VM sizes (B) and local tax rates (D) are unrelated to latency optimization.

Answer

Number of available virtual machine sizes

Answer

Presence of multiple Availability Zones

Answer

Local tax rate for cloud services

Question 8

An organization uses multiple SaaS applications and wants to enforce data loss prevention policies and gain visibility into user activity. Which technology should they implement?

Accepted Answer

Cloud Access Security Broker (CASB). A Cloud Access Security Broker (CASB) provides visibility, compliance, data security, and threat protection for SaaS applications. WAF protects web applications, VPN provides remote access, and SIEM aggregates logs.

Answer

Security information and event management (SIEM)

Answer

Web Application Firewall (WAF)

Answer

Virtual private network (VPN)

Question 9

A company runs a critical e-commerce application on a private cloud using OpenStack. The application consists of web servers, application servers, and a MySQL database running on separate VMs. Recently, users have reported intermittent 502 Bad Gateway errors during peak hours. The operations team notices that the web server VMs show high CPU ready times and the application server VMs have increased network latency. Storage performance also shows high await times on the SSD-based Ceph cluster. The team suspects resource contention. Which of the following is the BEST course of action to diagnose and resolve the issue?

Accepted Answer

Review the hypervisor's CPU and memory allocation ratios and adjust overcommitment settings.. High CPU ready times and overall contention indicate overcommitment on the hypervisors. Adjusting overcommitment ratios can reduce contention across CPU, memory, and storage. Option A is incorrect because migrating VMs to a different host is a temporary workaround that does not address the root cause of overcommitment. Option B is incorrect because adding more vCPUs can worsen contention by increasing scheduling overhead. Option C is incorrect because QoS policies on storage only address storage contention and do not resolve CPU or network issues.

Answer

Migrate the web server VMs to a different compute host using live migration.

Answer

Increase the number of vCPUs for each web server VM to reduce CPU ready time.

Answer

Implement quality of service (QoS) policies on the Ceph cluster to guarantee IOPS for the database.

Question 10

Arrange the steps to configure a VPN connection between an on-premises network and a cloud VPC.

Accepted Answer

Create cloud-side VPN gateway, then create on-premises gateway representation, then configure on-premises VPN device, then create VPN connection, then configure routing.. Start with cloud-side gateway, on-premises gateway representation, configure on-prem device, create connection, then routing.

Answer

Create cloud-side VPN gateway, then create on-premises gateway representation, then create VPN connection, then configure on-premises VPN device, then configure routing.

Answer

Create on-premises gateway representation, then create cloud-side VPN gateway, then configure on-premises VPN device, then create VPN connection, then configure routing.

Answer

Create cloud-side VPN gateway, then configure on-premises VPN device, then create on-premises gateway representation, then create VPN connection, then configure routing.

Question 11

A company recently migrated its on-premises e-commerce application to a public cloud using lift-and-shift. After the migration, users report that the application is slower than before. The application consists of a web server, an application server, and a database server, all deployed on separate virtual machines. The cloud architecture uses the same instance sizes as the on-premises servers. The cloud administrator notices that the database server's disk I/O latency is higher than expected. What is the most likely cause of the performance degradation?

Accepted Answer

The database server is using standard HDD storage instead of SSD.. The database server's disk I/O latency is higher than expected because the lift-and-shift migration likely retained the same storage type as on-premises, but the cloud environment's standard HDD (hard disk drive) storage has significantly lower IOPS and higher latency compared to SSD (solid-state drive) storage. In a public cloud, standard HDD is optimized for sequential workloads and infrequent access, not for the random I/O patterns typical of a database server, causing performance degradation. The administrator should have provisioned SSD-backed storage (e.g., AWS gp3 or Azure Premium SSD) for the database VM to match or exceed on-premises performance.

Answer

The cloud provider's network has high latency.

Answer

The application server is not load-balanced.

Answer

The web server has too many vCPUs allocated.

Question 12

A cloud architect is planning a disaster recovery (DR) strategy for a mission-critical application. The RTO must be under 1 hour and RPO under 15 minutes. The primary site is in a different region. Which DR pattern meets these requirements?

Accepted Answer

Pilot light. The pilot light pattern meets the RTO under 1 hour and RPO under 15 minutes because it keeps a minimal core set of services (e.g., database replicating via asynchronous replication) running in the DR region, allowing rapid scale-up of the full application stack during failover. This pattern balances cost and recovery speed, as the replicated data ensures an RPO of seconds to minutes, and the pre-provisioned core infrastructure enables failover within minutes, satisfying the strict RTO.

Answer

Backup and restore

Answer

Cold standby

Answer

Multi-site active-active

Question 13

A cloud administrator is deploying a new application in a cloud environment. The application requires high availability and fault tolerance. Which two design principles should the administrator implement? (Select TWO).

Accepted Answer

Place a load balancer in front of the application.. Placing a load balancer in front of the application distributes incoming traffic across multiple healthy instances, ensuring that if one instance fails, traffic is redirected to others, which provides high availability and fault tolerance. Option B is correct because deploying an auto-scaling group across multiple Availability Zones (AZs) ensures that if an entire AZ fails, the application continues running in another AZ, and the auto-scaling group automatically replaces failed instances to maintain capacity.

Answer

Deploy all instances in a single availability zone.

Answer

Use a single instance to reduce costs.

Answer

Store all data on a single volume without replication.

Question 14

A DevOps team is implementing a CI/CD pipeline to deploy a microservices application on Kubernetes. The team wants to ensure that the deployment automatically rolls back if the new version fails health checks after the update. Which Kubernetes feature should be configured in the deployment manifest?

Accepted Answer

A readiness probe with a low failure threshold. A readiness probe determines if a pod is ready to serve traffic. If it fails, the rolling update pauses or rolls back depending on the deployment strategy's progressDeadlineSeconds and revisionHistoryLimit.

Answer

A startup probe with a long initial delay

Answer

A ConfigMap for health check endpoints

Answer

A liveness probe with a high failure threshold

Question 15

A developer deployed a new version of a cloud function, but the function is returning 500 errors. The previous version worked fine. What is the most likely cause?

Accepted Answer

The new code contains a runtime error.. The most likely cause of 500 errors after deploying a new version of a cloud function is a runtime error in the new code. A 500 Internal Server Error indicates that the function's code executed but threw an unhandled exception or logic error, which did not exist in the previous working version. Since the environment (runtime, memory, timeout) remained unchanged, the introduction of faulty code is the primary suspect.

Answer

The function is using an outdated runtime.

Answer

The function's memory allocation is too low.

Answer

The function's timeout is set too short.