CV0-004 Practice Test 30 — 15 Questions

Question 1

A global company runs a SaaS application in multiple cloud regions. They use DNS-based global load balancing to route users to the nearest region. Recently, users in Asia are experiencing high latency and timeouts. The administrator checks the health of the Asian region's resources and finds everything operational. Latency measurements from a monitoring tool show that traffic from Asian users is being routed to the European region. What should the administrator investigate first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The latency-based routing policy. The symptom — Asian users being routed to the European region despite healthy Asian resources — points directly to a misconfigured or misbehaving latency-based routing policy. Latency-based routing relies on measured latency between the user's resolver and each regional endpoint, so if the policy is misconfigured or the measurements are stale, traffic will be sent to the wrong region.

Answer

The DNS TTL settings

Answer

The geo-location records in the DNS provider

Answer

The load balancer configuration in the Asian region

Question 2

A cloud administrator is configuring auto-scaling for a batch processing application that uses an SQS queue. The number of jobs varies unpredictably. Which metric is most appropriate for scaling the worker instances?

Accepted Answer

SQS queue depth (ApproximateNumberOfMessages). SQS queue depth (ApproximateNumberOfMessages) is the most appropriate metric because it directly reflects the backlog of work. For a batch processing application with unpredictable job volumes, scaling based on queue depth ensures that worker instances are added when there are many messages waiting and removed when the queue is empty. This provides responsive scaling that matches the actual workload.

Answer

Memory utilization of workers

Answer

Network throughput

Answer

CPU utilization of workers

Question 3

A cloud engineer is deploying a containerized application using Kubernetes. The application consists of a frontend, a backend API, and a database. The engineer needs to ensure that the backend API can be reached by the frontend but not from outside the cluster. Which Kubernetes resource should the engineer use to expose the backend API?

Accepted Answer

ClusterIP service. A ClusterIP service exposes the backend API on a cluster-internal IP address, making it reachable only from within the Kubernetes cluster. This meets the requirement that the frontend can communicate with the backend API, but external traffic is blocked. ClusterIP is the default service type and is ideal for internal service-to-service communication.

Answer

NodePort service

Answer

Ingress resource

Answer

LoadBalancer service

Question 4

A financial services company is subject to strict compliance requirements. They need to ensure that all cloud storage objects are written to a write-once-read-many (WORM) state for a defined retention period. Which feature should be enabled?

Accepted Answer

Object lock. Object Lock is the correct feature for WORM compliance because it enforces a write-once-read-many (WORM) state on objects, preventing modification or deletion until the specified retention period expires. Lifecycle policies manage data transitions and deletions but do not provide immutability guarantees required for strict compliance.

Answer

Versioning

Answer

Replication

Answer

Lifecycle policies

Question 5

A cloud engineer is using Ansible to automate the configuration of cloud resources. The engineer needs to ensure that the automation does not require any agent software to be installed on the target nodes. Which characteristic of Ansible makes this possible?

Accepted Answer

It is agentless. Ansible is agentless because it communicates with managed nodes over standard SSH (Linux/Unix) or WinRM (Windows) rather than requiring a persistent agent daemon to be installed and maintained on each target. The control node pushes Python-based modules to the target at runtime, executes them, and removes them afterward. This is why option C directly answers the requirement that no agent software be installed on target nodes.

Answer

It uses PowerShell Desired State Configuration

Answer

It uses a master-agent architecture

Answer

It requires a pull-based model

Question 6

After deploying a new application version, users get 503 errors. The application runs on Kubernetes in a private cloud. What is the most likely cause?

Accepted Answer

Application health check failing. After deploying a new application version, users get 503 errors. In Kubernetes, a 503 Service Unavailable error often indicates that the service has no healthy endpoints. The most likely cause is that the application's health check (readiness probe) is failing, causing Kubernetes to remove the pod from the service's endpoints. This can happen if the new version has a bug, misconfiguration, or takes longer to start than the probe's thresholds allow.

Answer

Incorrect ingress configuration

Answer

Insufficient pod resources

Answer

Node port exhaustion

Question 7

A cloud engineer notices that an auto-scaling group is adding and removing instances too frequently, causing instability. Which configuration parameter should be adjusted to reduce this behavior?

Accepted Answer

Increase the cooldown period. Increasing the cooldown period is the correct adjustment because cooldown is the waiting time after a scaling activity before the auto-scaling group can perform another scaling action. A longer cooldown lets newly launched instances stabilize and metrics to reflect the new capacity, preventing the rapid add/remove oscillation known as thrashing. This directly reduces the instability described.

Answer

Increase the health check grace period

Answer

Disable lifecycle hooks

Answer

Lower the scaling metric thresholds

Question 8

A cloud security team is implementing a secrets management solution for applications running on AWS. They need to automatically rotate database credentials every 30 days and avoid hardcoding secrets. Which service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager allows automatic rotation of secrets (e.g., database credentials) and integration with AWS services. Parameter Store can store secrets but does not natively support automatic rotation. KMS is for encryption keys. IAM roles are for AWS service permissions.

Answer

AWS Identity and Access Management (IAM) roles

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 9

A team is developing a serverless application on AWS Lambda. The application uses several third-party libraries that are large in size. To reduce deployment package size and enable reuse across functions, the team wants to include these libraries as a separate layer. However, the total unzipped size of all layers exceeds the Lambda limits. What should the team do to resolve this?

Accepted Answer

Use a container image for the Lambda function instead of layers. AWS Lambda has a hard limit of 250 MB unzipped for the combined deployment package and all layers. When layers exceed this, packaging the function as a container image (up to 10 GB) is the supported workaround. Container images can include large third-party libraries directly in the image, bypassing the layer size limit while still allowing reuse via shared base images.

Answer

Increase the Lambda function's reserved concurrency

Answer

Reduce the number of layers by combining libraries into fewer custom layers

Answer

Request a service limit increase from AWS for layer size

Question 10

A cloud architect is designing a multi-tier application on a public cloud. The application must be highly available and fault-tolerant within a single region. Which three items should be included in the architecture? (Select THREE.)

Accepted Answer

Deploy resources in multiple availability zones. High availability within a region requires distributing resources across availability zones, using load balancers for traffic distribution, and implementing health checks for automatic failover.

Answer

Use a single instance in one availability zone

Answer

Use a single database instance without replication

Question 11

A company is designing stateless application tiers to support horizontal scaling. Which TWO design principles support statelessness? (Select TWO.)

Accepted Answer

Persist all application state in a shared database. Option A is correct because persisting all application state in a shared database externalizes state from the compute instances, so any instance can serve any request and instances can be added or replaced freely for horizontal scaling. Option C is correct because storing session state in a shared external cache such as Redis keeps session data outside the instance, allowing any instance to read the session and remain interchangeable, which is the essence of statelessness. Option B is not correct because storing configuration files locally on each instance creates per-instance state that must be synchronized and makes instances non-interchangeable. Option D is not correct because local instance storage for session data ties a user's session to a specific instance, preventing free horizontal scaling. Option E is not correct because sticky sessions (session affinity) on the load balancer deliberately pin a client to one instance, which is the opposite of stateless design and hinders horizontal scaling.

Answer

Store configuration files on each instance locally

Answer

Use local instance storage for session data

Answer

Use sticky sessions (session affinity) on the load balancer

Question 12

A company is deploying a multi-tier application in a cloud environment. The application must comply with PCI DSS, which requires encryption of data at rest and in transit. The database tier must be isolated from direct internet access, while the web tier must be accessible from the internet. Which of the following deployment architectures best meets these requirements?

Accepted Answer

Deploy web tier in a public subnet, database tier in a private subnet, and use SSL/TLS for encryption.. It separates the web tier into a public subnet for internet accessibility and the database tier into a private subnet for isolation, meeting PCI DSS requirements. SSL/TLS encryption ensures data in transit is protected, and encryption at rest can be applied to the database storage. This architecture aligns with cloud best practices for multi-tier applications requiring compliance.

Answer

Place all tiers in the same subnet and use security groups to restrict traffic.

Answer

Use a single instance for web and database, and place it behind a load balancer.

Answer

Use a VPN connection from the web tier to the database tier and disable encryption.

Question 13

A cloud user is unable to connect to a web server VM from the internet after a security group rule was modified. The VM is running and can be pinged from other VMs in the same subnet. What is the most likely cause?

Accepted Answer

The inbound rule for HTTP/HTTPS was removed or misconfigured.. The most likely cause is that the inbound security group rule for HTTP/HTTPS was removed or misconfigured, as security groups act as virtual firewalls controlling traffic to the VM. Since the VM can be pinged from other VMs in the same subnet, the network path and VM's OS are functional, isolating the issue to the security group's inbound rules. Modifying the security group likely removed the rule allowing HTTP/HTTPS traffic from the internet.

Answer

The VM's local firewall is blocking the traffic.

Answer

The VM's routing table is missing a default gateway.

Answer

The VM's DNS settings are incorrect.

Question 14

A cloud administrator needs to centralize logs from multiple cloud provider accounts and on-premises servers for security analysis. Which approach should be used?

Accepted Answer

Configure each account's API activity logging to deliver logs to a central storage bucket, and use a log collection agent on on-premises servers to send logs to a central log service. The correct approach is to configure each cloud account's API activity logging (e.g., AWS CloudTrail, Azure Activity Log, GCP Audit Logs) to deliver logs to a central storage bucket, and use a log collection agent on on-premises servers to forward logs to a central log service. This centralizes logs from both cloud and on-premises sources for unified security analysis.

Answer

Create a serverless function that copies logs from each account to a central storage bucket in a management account

Answer

Enable virtual network flow logs in each account and store them locally

Answer

Use configuration compliance rules to aggregate logs into a single account

Question 15

A cloud team is implementing a CI/CD pipeline for a containerized application. They want to automatically build a Docker image, push it to a registry, and deploy it to a Kubernetes cluster. Which TWO tools from the options below are commonly used as part of this pipeline? (Select 2)

Accepted Answer

Jenkins. Jenkins and GitLab CI are both CI/CD tools that can build Docker images, push to registries, and deploy to Kubernetes. Terraform and CloudFormation are IaC tools, not CI/CD. Docker Compose is for local development.

Answer

CloudFormation

Answer

Terraform

Answer

Docker Compose