CV0-004 Practice Test 2 — 30 Questions

Question 1

A cloud administrator is troubleshooting a performance issue where an application running on a VM in a private cloud is experiencing high latency. The VM is connected to a virtual switch that uses SR-IOV. The administrator suspects network bottlenecks. Which of the following is the MOST likely cause of the latency?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The physical network interface card (NIC) is saturated.. SR-IOV allows a physical NIC to present multiple virtual functions (VFs) directly to VMs, bypassing the virtual switch for data plane traffic. When the physical NIC reaches its bandwidth capacity, all VFs sharing that NIC experience increased latency and packet drops, making NIC saturation the most likely cause of the high latency.

Answer

The virtual switch is dropping packets due to buffer exhaustion.

Answer

The VM's virtual NIC is not using the correct driver.

Answer

The hypervisor's CPU is overloaded due to SR-IOV emulation.

Question 2

A company uses a multi-cloud strategy with both AWS and Azure. The cloud operations team needs to centrally monitor all cloud resources and receive alerts when resource usage exceeds predefined thresholds. Which of the following solutions should the team implement?

Accepted Answer

A third-party monitoring tool that supports both AWS and Azure. A third-party monitoring tool (e.g., Datadog, Splunk, or Dynatrace) can natively ingest metrics and logs from both AWS and Azure APIs, providing a single pane of glass for alerting across a multi-cloud environment. This avoids the vendor lock-in and integration gaps that arise when using native tools from only one cloud provider.

Answer

Azure Monitor with Log Analytics

Answer

AWS CloudWatch with cross-account monitoring

Answer

Custom scripts that log to a central syslog server

Question 3

A company hosts a critical application on a single virtual machine in a public cloud. The virtual machine has been running without issues for months. Recently, the application became unresponsive, and users report a '500 Internal Server Error'. The cloud administrator checks the virtual machine's status and finds it is 'Running'. The administrator can successfully ping the virtual machine's public IP address. The administrator then attempts to SSH into the virtual machine but receives 'Connection timed out'. The virtual machine's security group allows SSH (port 22) from the administrator's IP address. The operating system firewall is enabled and configured to allow SSH. What should the administrator do next to troubleshoot the issue?

Accepted Answer

Use a serial console or out-of-band management to access the virtual machine's console.. The administrator can ping the VM (ICMP works) but SSH (TCP/22) times out, indicating the application is running but the SSH service or network stack is not responding to new connections. Since the cloud security group and OS firewall are correctly configured, the issue is likely at the OS level (e.g., SSH daemon crashed, kernel panic, or network service hung). Using a serial console or out-of-band management (e.g., AWS EC2 Serial Console, Azure Serial Console) provides direct, network-independent access to the VM's console, bypassing the broken network stack to diagnose and fix the OS-level problem.

Answer

Reset the virtual machine from the cloud provider's management console.

Answer

Create a new virtual machine and migrate the application.

Answer

Check the application logs from the cloud provider's monitoring service.

Question 4

A cloud administrator is troubleshooting a network connectivity issue between two subnets. They suspect a security group or NACL is blocking traffic. Which tool should they use to analyze the traffic flow?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture network traffic metadata, helping identify dropped packets.

Answer

AWS X-Ray

Answer

AWS CloudTrail

Answer

AWS Config

Question 5

A cloud architect is designing a container security strategy. Which TWO of the following should be implemented to secure containers? (Choose two.)

Accepted Answer

Runtime security monitoring for anomalous behavior. Image scanning detects vulnerabilities in container images, and runtime security monitors containers for anomalous behavior. Network ACLs are not container-specific. Using the latest base image reduces vulnerabilities. Disabling security controls is wrong.

Answer

Disabling all security contexts in Kubernetes

Answer

Using the latest base images without scanning

Answer

Implementing network ACLs at the hypervisor level

Question 6

A company migrated to a hybrid cloud and users report slow access to files stored in the cloud. The on-premises network is 100 Mbps. What troubleshooting step should be taken?

Accepted Answer

Check VPN bandwidth and latency. Slow file access over a hybrid connection is often due to limited VPN bandwidth or high latency. Option A is wrong because increasing storage performance tier may not address network bottlenecks. Option C is wrong because moving files back defeats the hybrid cloud purpose. Option D is wrong because compression may help but isn't the first step to diagnose the issue.

Answer

Enable compression on the cloud storage gateway

Answer

Increase cloud storage performance tier

Answer

Move files to on-premises storage

Question 7

A cloud application returns HTTP 503 errors during high traffic. The application runs on VMs behind a load balancer. Which action is most likely to resolve the issue?

Accepted Answer

Add additional VMs to the backend pool.. Adding VMs increases the overall capacity to handle high traffic, directly addressing the 503 errors caused by overload. Option A is incorrect because restarting only one VM does not increase capacity; it might briefly disrupt service. Option B is incorrect because lowering the DNS TTL affects how clients resolve the domain, not the backend capacity. Option C is incorrect because increasing the health check interval only delays detection of unhealthy VMs, which does not prevent overload.

Answer

Restart the web server service on one VM.

Answer

Change the DNS TTL to a lower value.

Answer

Increase the health check interval on the load balancer.

Question 8

A cloud administrator is configuring an auto-scaling group for a web application. The application experiences predictable traffic spikes every weekday at 9 AM. Which scaling policy is most appropriate?

Accepted Answer

Scheduled scaling to add instances before 9 AM. Scheduled scaling allows you to increase capacity at specific times. Target tracking and step scaling are reactive. Cooldown periods are settings within policies.

Answer

Step scaling with a cool-down period

Answer

Simple scaling with a 300-second cooldown

Answer

Target tracking scaling based on average CPU utilization

Question 9

A company needs to migrate 50 TB of data from an on-premises file server to a cloud storage service. The network bandwidth is limited and the migration must be completed within one week. Which cloud service is specifically designed for offline data transfer of large datasets?

Accepted Answer

Offline data transfer via physical device. Offline data transfer via physical device is specifically designed for offline data transfer of large datasets, such as 50 TB, when network bandwidth is limited. It provides physical storage devices that are shipped to the customer, loaded with data, and returned to the cloud provider for ingestion into the cloud storage service, bypassing network constraints entirely. This makes it the ideal choice for completing a 50 TB migration within one week over a limited bandwidth connection.

Answer

Online data transfer service

Answer

Batch processing service

Answer

Data transfer acceleration

Question 10

A developer is deploying a serverless function that processes images uploaded to an S3 bucket. The function should be triggered automatically whenever a new object is created in the bucket. Which event source should be configured to invoke the Lambda function?

Accepted Answer

Amazon S3. S3 can send events to Lambda when objects are created, enabling automatic processing without polling.

Answer

Amazon SQS

Answer

Amazon EventBridge

Answer

API Gateway

Question 11

A company is migrating a legacy application to the cloud. The application has a stateful design and requires low-latency access to a shared file system. The application must scale horizontally to handle increased load. Which THREE of the following architectural changes should be recommended to enable horizontal scaling?

Accepted Answer

Refactor the application to be stateless. Horizontal scaling requires that any instance can handle any request without depending on local state. By refactoring the application to be stateless, session data is externalized, allowing new instances to be added or removed without affecting ongoing transactions. This eliminates the coupling between a client and a specific server, which is essential for elastic scaling in cloud environments.

Answer

Increase the size of the existing virtual machines (vertical scaling)

Answer

Use sticky sessions (session affinity) on the load balancer

Question 12

A cloud engineer needs to ensure that an auto-scaling group does not launch new instances immediately after a scale-in event to allow metrics to stabilize. Which feature should they configure?

Accepted Answer

Cooldown periods. Cooldown periods prevent premature scaling by allowing metrics to stabilize.

Answer

Health checks

Answer

Scheduled scaling

Answer

Lifecycle hooks

Question 13

A company is experiencing high latency in their cloud-based database. The database is provisioned with SSD storage. Which THREE factors should the administrator investigate? (Choose three.)

Accepted Answer

Network bandwidth between application and database. Options A, B, and D are correct because network bandwidth limitations between application and database can cause high latency, unoptimized database queries increase response time, and exceeding IOPS limits leads to throttling and higher latency. Option C is incorrect because the number of database replicas primarily affects read throughput and fault tolerance, not latency directly. Option E is incorrect because region latency is a fixed infrastructure property that typically does not change suddenly, so it is less likely to be the cause of a sudden latency spike.

Answer

Number of database replicas

Answer

Region latency

Question 14

A company wants to implement automated patching for their cloud resources. Which TWO services are designed for patch management?

Accepted Answer

Azure Update Management. AWS Systems Manager Patch Manager and Azure Update Management are dedicated patch management services.

Answer

Amazon Inspector

Answer

GCP Cloud Audit Logs

Answer

AWS Config

Question 15

A KVM host has three VMs. The db-server VM is in a paused state. Which of the following is the most likely cause?

Accepted Answer

Storage I/O error on the VM disk. Storage I/O errors on the VM disk can cause the hypervisor to pause the VM to prevent data corruption. CPU overcommitment (Option B) typically leads to performance degradation, not pausing. Insufficient memory (Option C) can cause swapping or OOM, but not directly pausing. A network interface being down (Option D) would affect connectivity, not cause the VM to enter a paused state.

Answer

CPU overcommitment on the host

Answer

Insufficient memory on the host

Answer

Network interface is down

Question 16

A global company runs a SaaS application in multiple cloud regions. They use DNS-based global load balancing to route users to the nearest region. Recently, users in Asia are experiencing high latency and timeouts. The administrator checks the health of the Asian region's resources and finds everything operational. Latency measurements from a monitoring tool show that traffic from Asian users is being routed to the European region. What should the administrator investigate first?

Accepted Answer

The latency-based routing policy. The latency-based routing policy. Since the Asian region's resources are operational but traffic is being routed to Europe, the issue is likely that the latency-based routing policy is misconfigured or not accurately measuring latency from Asian users. This policy uses latency measurements to route users to the closest region; if it's flawed, traffic may be sent to a distant region. Investigate the latency routing policy first. Option B (DNS TTL) affects caching duration, not routing decisions. Option C (geo-location records) is used for geographic routing, not latency-based routing. Option D (load balancer in Asia) is operational, so the problem is at the DNS level, not the load balancer.

Answer

The DNS TTL settings

Answer

The geo-location records in the DNS provider

Answer

The load balancer configuration in the Asian region

Question 17

A company is migrating on-premises workloads to a public cloud. The disaster recovery plan requires an RTO of 15 minutes and an RPO of 5 minutes. Which replication strategy should be used for a critical database?

Accepted Answer

Continuous replication to a standby instance in another region. Continuous replication with synchronous or near-synchronous updates can achieve very low RPO (minutes) and low RTO. Cross-region replication may have higher latency, and snapshot-based backup typically has higher RPO and RTO.

Answer

Weekly full backups with daily incrementals stored in the same region

Answer

Scheduled snapshots every hour with cross-region copy

Answer

Daily snapshots replicated cross-region

Question 18

A cloud administrator is troubleshooting a connectivity issue between two VPCs in the same region. Which TWO actions should the administrator verify? (Choose two.)

Accepted Answer

VPC peering connection status. The correct answers are A and B. The VPC peering connection must be in the 'active' state (A), and the route tables in both VPCs must have routes pointing to the peering connection (B). Security group rules (C) are not the primary check because security groups are stateful and allow return traffic by default; they can be configured to block traffic but are not the first thing to verify in this scenario. VPN tunnel configuration (D) is a different connectivity method. Internet gateway attachment (E) is for internet access, not VPC peering.

Answer

Security group rules

Answer

VPN tunnel configuration

Answer

Internet gateway attachment

Question 19

A company is deploying a critical application in the cloud and needs to ensure that it can automatically recover from an intent—a failure of an entire cloud provider region. Which of the following architectures should be implemented?

Accepted Answer

Active-passive deployment across two regions with DNS-based failover. An active-passive deployment across two regions with DNS-based failover ensures that if one entire region fails, traffic is routed to the passive region, providing disaster recovery at the region level. Option B is wrong because multiple availability zones within a single region cannot survive the failure of the entire region. Option C is wrong because auto-scaling groups in a single region do not protect against region failure. Option D is wrong because active-active across AZs within one region also cannot survive a region-level failure.

Answer

Active-passive deployment across multiple availability zones in the same region

Answer

Single-region deployment with auto-scaling groups

Answer

Active-active deployment across multiple availability zones in the same region

Question 20

A cloud operations team wants to implement automated patching for their fleet of virtual machines. They need to minimize disruption during business hours and ensure that critical security patches are applied within 48 hours of release. The team also requires a rollback plan in case a patch causes issues. Which THREE actions should the team take? (Choose three.)

Accepted Answer

Define maintenance windows that occur during off-peak hours.. Automated patching requires defining maintenance windows to avoid disruption, enabling automated patching tools like AWS Systems Manager Patch Manager, and having a rollback procedure in place. Testing patches in a staging environment first is wise but not a direct action for the described requirements.

Answer

Disable automatic updates to maintain control over patch deployment.

Answer

Apply all patches immediately upon release regardless of maintenance windows.