CV0-004 Practice Test 1 — 30 Questions

Question 1

A cloud operations team needs to implement a monitoring solution for a microservices architecture. The solution must provide centralized logging, metrics, and alerting, and must be able to correlate data from multiple services. Which THREE of the following components should the team include?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A centralized logging system (e.g., ELK stack).. A centralized logging system like the ELK stack (Elasticsearch, Logstash, Kibana) aggregates logs from all microservices into a single searchable repository. This enables the team to correlate events across services by timestamp and metadata, which is essential for debugging distributed transactions and identifying root causes of failures.

Answer

A security information and event management (SIEM) system.

Answer

An application performance monitoring (APM) tool.

Question 2

A hybrid cloud deployment connects an on-premises data center to a public cloud. Which TWO components are typically required to establish this connectivity? (Select TWO.)

Accepted Answer

Direct peering or dedicated connection (e.g., AWS Direct Connect). A dedicated connection like AWS Direct Connect provides a private, high-bandwidth, low-latency link between an on-premises data center and a public cloud, bypassing the public internet for consistent performance and security. Option C is correct because a VPN gateway establishes an encrypted tunnel over the public internet (using protocols like IPsec) to securely connect the on-premises network to the cloud VPC, which is a standard requirement for hybrid cloud connectivity.

Answer

Load balancer in the cloud

Answer

Public internet with HTTPS

Answer

Cloud-based DNS resolver

Question 3

Refer to the exhibit. A cloud administrator runs the above command on a Linux virtual machine. What is the effect of the current firewall rules?

Accepted Answer

All incoming traffic is allowed except RDP, which is dropped.. The rules show ACCEPT for SSH (22), HTTP (80), and HTTPS (443), and DROP for RDP (3389). Since the default policy on the INPUT chain is ACCEPT, all other traffic is allowed, which is not secure. The administrator should set the default policy to DROP and only allow necessary ports.

Answer

All outgoing traffic is controlled by these rules.

Answer

The firewall is blocking all traffic by default.

Answer

Only SSH, HTTP, and HTTPS are allowed; all other traffic is dropped.

Question 4

A company's cloud environment uses a shared responsibility model. The security team notices that a data breach occurred due to misconfigured storage buckets in the public cloud. Which party is primarily responsible for this misconfiguration according to the shared responsibility model?

Accepted Answer

The customer. Under the shared responsibility model, the customer is responsible for configuring their cloud resources securely, including storage bucket permissions. The cloud provider is responsible for the security of the cloud (infrastructure) but not for customer misconfigurations. The third-party vendor and cloud auditor are not directly responsible for the misconfiguration.

Answer

The cloud service provider

Answer

The cloud auditor

Answer

A third-party security vendor

Question 5

A company wants to ensure high availability for a stateless web application. Which architecture should be recommended?

Accepted Answer

One VM in each of two availability zones with a load balancer. Deploying one VM in each of two availability zones with a load balancer ensures high availability by eliminating a single point of failure. If one availability zone fails, the load balancer automatically routes traffic to the healthy VM in the other zone, keeping the stateless web application accessible. This architecture aligns with the principle of fault tolerance for stateless applications, where no session state is lost during failover.

Answer

Two VMs in the same availability zone with a load balancer

Answer

Single VM with daily backups

Answer

A single large VM with auto-recovery

Question 6

Refer to the exhibit. This log message is from a cloud security scanner. Which principle did the scanner likely detect?

Accepted Answer

Least privilege. The message indicates that user credentials were stored in user data (such as instance metadata) and are accessible to all users with read access to that metadata. This violates the principle of least privilege because credentials should not be widely accessible.

Answer

Separation of duties

Answer

Defense in depth

Answer

Fail securely

Question 7

A company uses a cloud provider's key management service to encrypt data at rest. The security team wants to ensure that encryption keys are automatically rotated every 90 days to meet compliance requirements. Which feature should be enabled?

Accepted Answer

Key automatic rotation. Automatic rotation replaces key material periodically without manual intervention, meeting compliance needs.

Answer

Key import scheduling

Answer

Key revocation

Answer

Key policy enforcement

Question 8

A cloud architect is designing a multi-tier application that must be resilient to the failure of an entire availability zone. Which of the following strategies BEST meets this requirement?

Accepted Answer

Deploy application instances across three availability zones with a load balancer. Deploying across multiple availability zones provides high availability. Option A is wrong because vertical scaling does not address zone failure. Option B is wrong because auto-scaling within a single zone does not help if the zone fails. Option C is wrong because a single load balancer in one zone is a single point of failure.

Answer

Place all instances behind a single load balancer in one zone

Answer

Implement auto-scaling within the same availability zone

Answer

Use larger instance types to handle more load

Question 9

A cloud administrator runs a deployment script that creates multiple resources using Infrastructure as Code (IaC). The script fails with a "400 Bad Request" error when attempting to create a storage account. Which troubleshooting step should the administrator take first?

Accepted Answer

Review the error message details for a specific validation error.. A 400 error indicates a client error, so the first step is to examine the error details to understand what parameter is invalid. Option A is wrong because 400 is not a network error (would be 5xx). Option B is wrong but plausible; however, the error message would specify the exact issue. Option D is wrong because timeouts result in different errors.

Answer

Check the network connectivity to the cloud API endpoint.

Answer

Increase the timeout value for the API call.

Answer

Verify that the script has the correct region parameter.

Question 10

An organization's hybrid cloud environment uses a VPN connection between on-premises and the cloud. Intermittent connectivity drops are reported during peak hours. The VPN logs show rekeying failures. Which configuration is most likely the cause?

Accepted Answer

The IPSec dead peer detection interval is set too high. A dead peer detection (DPD) interval set too high delays detection of lost peers, causing rekeying failures under load. Option A is wrong because pre-shared keys don't expire. Option C is wrong because throughput exceeded would show packet loss or high latency, not rekeying failures. Option D is wrong because blocking IKE packets would prevent the VPN from establishing at all.

Answer

The VPN tunnel is using a pre-shared key that has expired

Answer

The VPN gateway throughput is exceeded

Answer

The on-premises firewall is blocking IKE packets

Question 11

A cloud architect is designing a VPC with public and private subnets. Which component is required to allow instances in the private subnet to access the internet for software updates?

Accepted Answer

NAT gateway. A NAT gateway is required to enable instances in a private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT gateway's Elastic IP address using source network address translation (SNAT). An Internet gateway alone cannot serve private subnets because it requires a route table entry pointing to a public subnet with a public IP address.

Answer

Elastic IP

Answer

VPN connection

Answer

Internet gateway

Question 12

A company is adopting a shared responsibility model for a PaaS cloud deployment. Which THREE responsibilities belong to the customer?

Accepted Answer

Data classification and encryption. In a PaaS shared responsibility model, the customer is responsible for data classification and encryption of data at rest and in transit. The cloud provider manages the underlying infrastructure, but the customer must classify data according to sensitivity and apply encryption mechanisms, such as using TLS 1.2/1.3 for data in transit and AES-256 for data at rest, as the provider cannot access or classify customer data.

Answer

Management of the runtime environment

Answer

Physical security of data centers

Question 13

A cloud architect is designing an auto-scaling policy for a web application that experiences predictable traffic spikes every weekday morning from 8 to 10 AM. The application runs on a group of virtual machines behind a load balancer. Which scaling approach is MOST cost-effective while ensuring performance during the spike?

Accepted Answer

Scheduled scaling to increase capacity before 8 AM and decrease after 10 AM. Scheduled scaling is the most cost-effective approach because the traffic pattern is predictable (every weekday 8–10 AM). By configuring the auto-scaling group to add instances before the spike and remove them after, you avoid paying for idle resources during off-peak hours while ensuring capacity is ready when needed. This approach directly matches the known schedule without relying on reactive metrics or manual intervention.

Answer

Dynamic scaling based on CPU utilization threshold

Answer

Proactive scaling using machine learning to predict spikes

Answer

Manual scaling by the operations team each morning

Question 14

A cloud engineer is troubleshooting a VM that is experiencing high latency. The VM is hosted on a hypervisor with other VMs. Which TWO metrics should the engineer review to identify if resource contention is occurring?

Accepted Answer

Memory ballooning. Memory ballooning (A) is a VMware mechanism where the hypervisor reclaims idle memory from a VM by inflating a balloon driver, forcing the VM to swap. High ballooning indicates memory overcommitment and contention, directly causing latency. CPU ready time (B) measures the time a VM is ready to run but waiting for a physical CPU core; elevated ready time signals CPU contention among VMs on the same hypervisor.

Answer

Network packet drops

Answer

Swap usage

Answer

Disk queue length

Question 15

A company has deployed a multi-tier application on a public cloud platform. The security team discovers that a Compute Instance is communicating with an external IP address known for malicious activity. The instance is part of an auto scaling group. What is the BEST immediate action to contain the threat while minimizing downtime?

Accepted Answer

Remove the instance from the auto scaling group and attach a security group that blocks all traffic.. Isolating the compromised instance by detaching it from the auto scaling group and applying a security group that denies all traffic can quickly contain the threat. Network ACLs are attached to subnets and changing them could affect other instances. Suspending the auto scaling group alone may not stop the current instance. Updating routing tables is complex and could disrupt legitimate traffic.

Answer

Suspend the auto scaling group to prevent additional instances from being launched.

Answer

Use a routing table blackhole to drop traffic from the instance.

Answer

Modify the network ACL for the subnet to deny traffic to the malicious IP.

Question 16

A cloud architect is designing a VPC with multiple tiers. The web servers must be accessible from the internet, but the database servers must not be directly accessible. Which subnet design should the architect implement?

Accepted Answer

Place web servers in a public subnet and database servers in a private subnet. Public subnets for web servers and private subnets for databases, with a load balancer in the public subnet routing to web servers in a private subnet if needed; but typically web servers are in public subnets.

Answer

Place all servers in public subnets and restrict access via security groups

Answer

Place web servers in a private subnet and database servers in a public subnet

Answer

Place all servers in private subnets and use a bastion host for access

Question 17

An organization uses a cloud-based load balancer to distribute traffic to a web application across multiple availability zones. Users report that the application is intermittently unavailable. The cloud administrator finds that the load balancer health checks are failing on instances in one availability zone. What is the most likely cause?

Accepted Answer

The availability zone is experiencing a partial outage.. When health checks fail for all instances in a single availability zone (AZ) while other AZs remain healthy, the most likely cause is a partial outage or degradation within that AZ. Cloud providers like AWS, Azure, or GCP isolate AZs to prevent single points of failure, but an AZ can experience issues such as network connectivity loss, power disruption, or hardware failures that affect all instances in that zone. The load balancer's health checks are designed to detect such zone-level failures by probing each instance; if an entire AZ is impaired, all its instances will fail the health check simultaneously.

Answer

A single instance in the failing AZ has a misconfigured web server.

Answer

The DNS settings for the application domain are misconfigured.

Answer

The load balancer's listener configuration is incorrect.

Question 18

A cloud administrator is configuring a CASB (Cloud Access Security Broker) for SaaS applications. Which TWO capabilities should the administrator expect from the CASB? (Choose two.)

Accepted Answer

Discover and control shadow IT usage. CASBs provide visibility into shadow IT, enforce data loss prevention policies, and control access to SaaS applications.

Answer

Manage on-premises server patches

Answer

Provide local DNS resolution

Answer

Replace the cloud provider's infrastructure

Question 19

A company is migrating a legacy application to the cloud using a replatforming strategy. The application uses a proprietary logging framework that writes logs to local disk. The cloud architecture uses ephemeral storage for the application servers. The operations team notices that logs are lost when servers are replaced during auto-scaling events. What is the best solution to ensure logs are preserved?

Accepted Answer

Configure the logging framework to write to a central log server over the network.. The core issue is that ephemeral storage is lost when instances are terminated or replaced during auto-scaling events. By configuring the logging framework to write to a central log server over the network (e.g., using syslog, HTTP, or a dedicated log aggregation service), logs are persisted independently of the application server's lifecycle. This decouples log storage from compute resources, ensuring logs survive scaling events.

Answer

Increase the size of the ephemeral storage.

Answer

Use memory-only logging to speed up disk I/O.

Answer

Disable auto-scaling for the application servers.

Question 20

A company is migrating a legacy database that relies on a specific hardware security module (HSM) that cannot be moved to the cloud. The application must continue to function with minimal redevelopment. Which migration strategy is most appropriate?

Accepted Answer

Replace. (Replace) because the legacy database depends on a specific hardware security module (HSM) that cannot be migrated to the cloud. Replacing the database with a cloud-native equivalent (e.g., Amazon RDS or Azure SQL Database) that supports a cloud-based HSM (like AWS CloudHSM or Azure Key Vault Managed HSM) allows the application to continue functioning with minimal redevelopment, as the replacement typically maintains SQL compatibility and standard interfaces.

Answer

Refactor

Answer

Rehost

Answer

Rebuild