CV0-004 Practice Test 2 — 30 Questions

Question 1

A cloud administrator is reviewing the security posture of a cloud deployment. The company has a policy of least privilege and must ensure that only authorized services can access storage buckets. Which THREE mechanisms should the administrator configure to enforce this policy? (Choose three.)

Accepted Answer

Bucket policies that restrict access to specific AWS services. Option B is correct because bucket policies, such as AWS S3 bucket policies, can explicitly grant or deny access to specific AWS services (e.g., AWS CloudTrail or AWS Config) using the `Principal` element with a service principal (e.g., `Service: cloudtrail.amazonaws.com`). This aligns with the least privilege policy by ensuring only authorized services can access the storage buckets, without relying on network-level controls.

Answer

Network ACLs that block unauthorized IP ranges

Answer

Security groups that allow traffic from authorized services

Question 2

A cloud administrator receives an alert that a virtual machine (VM) is unresponsive. The VM is hosted on a hypervisor that shows high CPU ready time. Which of the following is the most likely cause?

Accepted Answer

Over-provisioning of vCPUs on the hypervisor. High CPU ready time indicates that the VM is ready to execute instructions but is waiting for the hypervisor to schedule physical CPU time. This is a classic symptom of over-provisioning vCPUs, where the total number of vCPUs assigned to all VMs exceeds the available physical cores, causing contention at the hypervisor scheduler level.

Answer

Insufficient memory allocated to the VM

Answer

Network latency between the VM and storage

Answer

Disk I/O contention from other VMs

Question 3

A company is migrating on-premises workloads to the cloud. They need to ensure high availability for a stateless web application across two availability zones. Which THREE components should be configured to meet this requirement?

Accepted Answer

An auto scaling group spanning both availability zones. An auto scaling group spanning both availability zones (Option A) ensures that the stateless web application can automatically replace failed instances and maintain the desired capacity across multiple AZs, which is essential for high availability. By distributing instances across AZs, the application can tolerate an entire AZ failure without losing all compute capacity.

Answer

A read replica database in a different AZ

Answer

A single large EC2 instance to handle all traffic

Question 4

A cloud engineer notices that an application is running slower than expected. Monitoring shows that the CPU utilization is consistently below 30%, but memory usage is at 95%. Which of the following is the most likely cause of the performance issue?

Accepted Answer

Insufficient memory causing swapping to disk. When memory usage is at 95% and CPU utilization is low, the system is likely thrashing—the operating system is forced to page memory to disk (swap) to free RAM. Disk I/O is orders of magnitude slower than RAM, so even with idle CPU, the application stalls waiting for swap operations. This explains the performance degradation despite low CPU load.

Answer

Insufficient disk space for application logs

Answer

Network bandwidth saturation

Answer

CPU contention due to overprovisioning

Question 5

A company is deploying a critical financial application on a private cloud. The compliance team requires that all data at rest be encrypted with a key managed by the company's hardware security module (HSM). The cloud architect must select a storage solution that supports customer-managed keys and integrates with the existing HSM. Which storage option should the architect choose?

Accepted Answer

Encrypted volumes on a software-defined storage (SDS) cluster. Option C is correct because a software-defined storage (SDS) cluster can be configured to use customer-managed encryption keys that integrate directly with the company's existing hardware security module (HSM) via standard interfaces like PKCS#11 or KMIP. This allows the company to maintain full control over key management and meet the compliance requirement for data-at-rest encryption with HSM-managed keys.

Answer

Object storage with server-side encryption using a cloud provider key

Answer

Instance store volumes on the compute nodes

Answer

Network-attached storage (NAS) appliance with built-in encryption

Question 6

A cloud administrator is troubleshooting connectivity issues between two virtual networks in different regions. The VNets are peered, but instances cannot communicate. The administrator verifies that the peering status is 'Connected' and route tables appear correct. Which of the following should be checked next?

Accepted Answer

Network Security Group (NSG) rules on the instances and subnets. Even when VNet peering status shows 'Connected' and route tables are correct, Network Security Group (NSG) rules can still block traffic. NSGs act as a stateful firewall at the subnet or NIC level, and by default they deny all inbound traffic unless explicitly allowed. Since the administrator has already verified routing, the next logical step is to check NSG rules for any implicit deny or missing allow rules that could be dropping the inter-region traffic.

Answer

DNS resolution settings

Answer

Gateway subnet configuration

Answer

Service endpoint status

Question 7

Refer to the exhibit. A cloud engineer is troubleshooting network connectivity to a server with IP 10.0.0.5. The server is on the same subnet. Based on the iptables rules shown, what is the most likely cause of the connectivity failure?

Accepted Answer

The INPUT chain drops all traffic destined to the 10.0.0.0/8 network. Option D is correct because the INPUT chain has a rule that drops all traffic destined to the 10.0.0.0/8 network, which includes the target server at 10.0.0.5. Since the server is on the same subnet, traffic to it must traverse the INPUT chain on the local system, and this DROP rule will match and discard packets before any other rule can accept them. The rule's position and destination match make it the most direct cause of the connectivity failure.

Answer

The FORWARD chain policy drops all traffic

Answer

The OUTPUT chain rejects all traffic to the server

Answer

The DROP rule in INPUT has zero packet count, so it is not effective

Question 8

A cloud administrator is troubleshooting a performance issue where an application running on a VM in a private cloud is experiencing high latency. The VM is connected to a virtual switch that uses SR-IOV. The administrator suspects network bottlenecks. Which of the following is the MOST likely cause of the latency?

Accepted Answer

The physical network interface card (NIC) is saturated.. SR-IOV allows a physical NIC to present multiple virtual functions (VFs) directly to VMs, bypassing the virtual switch for data plane traffic. When the physical NIC reaches its bandwidth capacity, all VFs sharing that NIC experience increased latency and packet drops, making NIC saturation the most likely cause of the high latency.

Answer

The virtual switch is dropping packets due to buffer exhaustion.

Answer

The VM's virtual NIC is not using the correct driver.

Answer

The hypervisor's CPU is overloaded due to SR-IOV emulation.

Question 9

A company runs a critical e-commerce application on AWS. The architecture includes an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances across two Availability Zones. The instances are in a private subnet and use a NAT Gateway for outbound internet access. The application stores session data in an ElastiCache Redis cluster. During a flash sale, users report that the site is extremely slow and some requests time out. Monitoring shows the ALB's latency metric is high, and the number of healthy hosts fluctuates. The CPU utilization on the EC2 instances averages 60% and memory averages 70%. The Redis cluster's CPU utilization is 90%, and its memory usage is 95%. The NAT Gateway's metrics show high BytesOutToSource but no errors. Which of the following is the most likely cause of the performance issue?

Accepted Answer

The ElastiCache Redis cluster is overloaded and becoming a bottleneck for session lookups. The ElastiCache Redis cluster is the most likely bottleneck because its CPU utilization is at 90% and memory usage at 95%, indicating it is near capacity. Since the application stores session data in Redis, high latency and timeouts during a flash sale are consistent with an overloaded session store that cannot keep up with request volume, causing the ALB to experience increased latency and healthy host fluctuations as sessions fail to be retrieved or written.

Answer

The NAT Gateway is throttling traffic due to bandwidth limits

Answer

The Auto Scaling group is not scaling quickly enough due to cooldown periods

Answer

The ALB's idle timeout setting is too low, causing premature connection drops

Question 10

A company is migrating a legacy on-premises application to a public cloud. The application currently uses a single monolithic architecture and relies on a local file system for storage. The cloud architect needs to redesign the application to take advantage of cloud-native features. Which design principle should the architect prioritize to ensure scalability and resilience?

Accepted Answer

Refactor the application into microservices deployed across multiple instances. Option C is correct because refactoring the monolithic application into microservices enables independent scaling of components, improves fault isolation, and aligns with cloud-native patterns like containerization and orchestration (e.g., Kubernetes). This approach leverages horizontal scaling across multiple instances, which is essential for achieving elasticity and resilience in a public cloud environment, unlike the legacy single-point-of-failure monolithic design.

Answer

Maintain the monolithic architecture and connect via VPN to on-premises storage

Answer

Use vertical scaling by increasing vCPU and RAM on a single large VM

Answer

Deploy the entire application in a single availability zone to reduce latency

Question 11

A cloud administrator is deploying a critical application that requires the lowest possible latency between compute instances. The instances will be running in a private subnet and must communicate with each other using their private IP addresses. Which of the following deployment configurations would best meet these requirements?

Accepted Answer

Deploy instances in a placement group within the same Availability Zone.. Deploying instances in a placement group within the same Availability Zone ensures they are physically close together, often in the same rack or cluster, which minimizes network hops and achieves the lowest possible latency. This configuration is ideal for latency-sensitive applications because it leverages non-blocking, high-bandwidth inter-instance communication without traversing additional network infrastructure.

Answer

Deploy instances in different Availability Zones within the same region.

Answer

Deploy instances in the same subnet behind a NAT gateway.

Answer

Deploy instances in different regions and use inter-region peering.

Question 12

A company uses an automated patching solution that reboots instances after applying patches. After a recent patching cycle, several web servers failed to rejoin the load balancer pool. The administrator checks the application logs and finds that the web service failed to start because a required dependency was removed during patching. Which of the following should the administrator implement to prevent this issue in the future?

Accepted Answer

Configure a pre-patch health check and verify critical dependencies.. Option D is correct because implementing a pre-patch health check that verifies critical dependencies ensures that the patching process does not remove or break required components. This proactive validation can detect missing dependencies before the reboot, allowing the administrator to remediate or halt the patching cycle, preventing the web service from failing to start.

Answer

Require manual approval before each patching operation.

Answer

Increase the patching frequency to reduce the number of patches per cycle.

Answer

Implement a rolling update strategy for the web servers.

Question 13

A cloud administrator is deploying a web application that must be highly available across two availability zones. The deployment includes an application load balancer and multiple EC2 instances. Which TWO configurations are required to meet the high availability requirement?

Accepted Answer

Launch EC2 instances in at least two availability zones. Option A is correct because launching EC2 instances in at least two availability zones ensures that if one AZ fails, the application continues to serve traffic from the other AZ. This is a fundamental requirement for achieving high availability across AZs, as it distributes the compute capacity across physically separate data centers.

Answer

Use a single EC2 instance with an auto-recovery policy

Answer

Set up health checks to automatically replace unhealthy instances

Answer

Enable cross-zone load balancing on the ALB

Question 14

An organization is migrating its on-premises virtualization environment to a public cloud. The current environment uses VMware vSphere with VM templates. The cloud provider supports importing VMs in OVF format. Which step should the cloud administrator take to prepare the VMs for migration?

Accepted Answer

Export each VM as an OVF template.. The cloud provider supports importing VMs in OVF format, which is an open standard for packaging and distributing virtual appliances. Exporting each VM as an OVF template from VMware vSphere creates the necessary .ovf descriptor file and accompanying disk files (e.g., .vmdk) that the provider can directly import. This is the correct preparation step because it produces the exact format required by the target cloud platform.

Answer

Take a snapshot of each VM and copy the snapshot files.

Answer

Convert each VM to an ISO image.

Answer

Copy the VM's VMDK files and import them as VHDX.

Question 15

Which TWO of the following are valid considerations when deploying a virtual machine in a cloud environment? (Choose two.)

Accepted Answer

The instance size and family. Option C is correct because the instance size and family directly determine the virtual machine's compute capacity, including vCPUs, memory, and network performance. Selecting the appropriate size and family ensures the workload has sufficient resources without over-provisioning, which is a fundamental deployment consideration in cloud environments like AWS EC2 or Azure VMs.

Answer

The log retention policy

Answer

The password complexity requirements

Answer

The number of virtual CPUs assigned to the hypervisor

Question 16

A company has a hybrid cloud environment with on-premises servers and AWS. They deploy a new application using AWS Elastic Beanstalk with a load balancer and auto scaling group. The application is a Node.js API that connects to an RDS MySQL database. After deployment, users report that the API returns a '500 Internal Server Error' intermittently. The application logs show 'ETIMEDOUT' errors when connecting to the database. The database is deployed in a private subnet with a security group that allows inbound traffic from the Elastic Beanstalk environment's security group. The database connection string uses the RDS endpoint. The same application works perfectly when deployed on-premises. What is the most likely cause?

Accepted Answer

The Elastic Beanstalk environment is in a different VPC or subnet that cannot reach the RDS instance. The intermittent 'ETIMEDOUT' errors indicate a network connectivity issue between the Elastic Beanstalk environment and the RDS database. Since the application works on-premises, the problem is specific to the AWS networking configuration. The most likely cause is that the Elastic Beanstalk environment is deployed in a different VPC or subnet that lacks routing or a VPC peering connection to reach the RDS instance's private subnet, causing timeouts when the load balancer or auto scaling group instances attempt to connect.

Answer

The database connection string uses the wrong port number

Answer

The security group attached to the RDS instance does not allow traffic from the Elastic Beanstalk environment

Answer

The RDS instance is in a failed state and needs to be rebooted

Question 17

A cloud architect must design a deployment for a containerized microservices application. The requirements include automated scaling based on CPU utilization, rolling updates with zero downtime, and service discovery. Which orchestration feature should be used?

Accepted Answer

Kubernetes with Horizontal Pod Autoscaler. Kubernetes with Horizontal Pod Autoscaler (HPA) is the correct choice because HPA automatically scales the number of pod replicas based on observed CPU utilization (or custom metrics), meeting the automated scaling requirement. Kubernetes also supports rolling updates with zero downtime via its Deployment controller, which gradually replaces old pods with new ones while maintaining service availability. Additionally, Kubernetes provides built-in service discovery through DNS (CoreDNS) and Services, allowing microservices to find each other by name without external dependencies.

Answer

Docker Compose with a reverse proxy

Answer

Ansible playbooks with Docker modules

Answer

AWS ECS with Fargate

Question 18

A cloud administrator is managing a hybrid cloud environment where on-premises servers connect to a public cloud VPC via a site-to-site VPN. Users report intermittent connectivity issues to cloud resources. The administrator examines the VPN tunnel logs and sees 'Phase 2 negotiation failed' errors. Which of the following is the MOST likely cause?

Accepted Answer

Mismatched encryption domain definitions (traffic selectors) between on-premises and cloud VPN gateways.. Phase 2 negotiation failures in IPsec VPNs indicate that the two gateways cannot agree on the security associations (SAs) for encrypting data traffic. This is most commonly caused by mismatched encryption domain definitions (traffic selectors), such as differing local/remote subnets, protocols, or ports. When the on-premises and cloud VPN gateways define the allowed traffic differently, they cannot establish the Phase 2 SA, leading to intermittent connectivity.

Answer

Dead Peer Detection (DPD) is disabled on one side.

Answer

Incorrect pre-shared key used for the VPN tunnel.

Answer

Packet loss due to high latency on the internet link.

Question 19

A company is migrating its on-premises database to a cloud-based managed database service. The database is currently 500 GB and is expected to grow by 10% monthly. Which TWO factors should the company consider when selecting the storage type?

Accepted Answer

Encryption at rest requirements.. Encryption at rest is a critical consideration when selecting storage for a cloud-based managed database service, as it ensures data is encrypted when stored on disk. Many cloud providers offer transparent data encryption (TDE) or server-side encryption with customer-managed keys (CMKs), and the storage type must support these features to meet compliance requirements.

Answer

Backup frequency and retention.

Answer

Physical location of the data center.

Answer

Operating system compatibility with the storage.

Question 20

A cloud engineer notices that a virtual machine (VM) in a public cloud environment is consistently running at 90% CPU during business hours. The VM hosts a customer-facing web application. Which of the following is the BEST initial troubleshooting step?

Accepted Answer

Review the VM's performance metrics and application logs.. Option B is correct because the initial step in troubleshooting high CPU usage is to gather diagnostic data. Reviewing the VM's performance metrics (e.g., CPU utilization, memory, disk I/O) and application logs helps identify whether the issue is caused by a legitimate workload spike, a memory leak, or a misconfiguration. This aligns with the 'identify before act' principle in cloud operations, ensuring the engineer understands the root cause before making changes.

Answer

Migrate the VM to a different availability zone.

Answer

Reboot the VM to reset resource usage.

Answer

Scale up the VM to a larger instance size.