CV0-004 Practice Test 31 — 15 Questions

Question 1

A cloud architect is deploying a web application across multiple availability zones within a single region to achieve high availability. The application requires that if one availability zone fails, traffic should automatically be rerouted to the remaining zones without manual intervention. Which configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Active-active across availability zones with a load balancer. Deploying an active-active configuration across multiple availability zones with a load balancer ensures that traffic is automatically distributed to healthy instances. If one availability zone fails, the load balancer's health checks detect the failure and reroute traffic to the remaining zones without manual intervention, meeting the high availability requirement.

Answer

Active-passive with a standby instance in a different region

Answer

Vertical scaling of instances in a single availability zone

Answer

Cold standby with daily backups

Question 2

A company is designing a VPC in AWS. They need to host a web application with a public-facing load balancer, web servers in private subnets, and a database in a separate private subnet. Which network architecture is most secure and aligns with best practices?

Accepted Answer

Public subnet for load balancer, private subnet for web servers, separate private subnet for database. A three-tier architecture with a public subnet for the load balancer, private subnets for web servers, and a separate private subnet for the database provides security and isolation.

Answer

Public subnet for load balancer, private subnet for web servers and database together

Answer

All resources in public subnets with security groups restricting access

Answer

All resources in private subnets with a VPN connection

Question 3

Refer to the exhibit. What action should the administrator take to bring the environment into compliance?

Accepted Answer

Resize the non-compliant VMs to t2.medium.. The exhibit shows that the environment has a compliance policy requiring all VMs to be of type t2.medium, but two VMs are running as t2.large and t2.xlarge. Resizing the non-compliant VMs to t2.medium brings them into alignment with the policy, ensuring the environment meets the defined compliance standard. This action directly remediates the violation without unnecessary deletion or ignoring the check.

Answer

Modify the policy file to accept t2.large and t2.xlarge.

Answer

Ignore the compliance check because it is advisory.

Answer

Delete the non-compliant VMs.

Question 4

A cloud administrator runs the command shown in the exhibit on a storage node in a hyper-converged cluster. The node is experiencing intermittent I/O errors and degraded performance. Based on the SMART data, what is the most likely cause of the issue?

Accepted Answer

The disk has developed bad sectors and is likely failing.. The SMART data from the storage node shows attributes such as Reallocated_Sector_Count, Current_Pending_Sector, and Offline_Uncorrectable with non-zero values, which are definitive indicators of physical bad sectors on the disk. These bad sectors cause intermittent I/O errors and degraded performance because the disk must retry reads/writes or remap sectors, increasing latency. Option C is correct because this pattern directly points to a failing disk, not a network, filesystem, or RAID issue.

Answer

The storage network is experiencing high latency.

Answer

The filesystem is corrupted and requires a repair.

Answer

A RAID array is rebuilding, causing performance degradation.

Question 5

A cloud administrator is designing a multi-tier application. The database tier must not be directly accessible from the internet, but the web tier must be able to connect to it. Which of the following should the administrator implement?

Accepted Answer

Place the database servers in a private subnet and configure the security group to allow inbound traffic from the web tier's security group.. Placing the database servers in a private subnet ensures they have no direct internet route, meeting the security requirement. By configuring the security group to allow inbound traffic only from the web tier's security group, you enable the web tier to connect to the database while blocking all other traffic, including from the internet. This leverages AWS security group referencing (or similar cloud provider feature) to create a trusted, internal communication path.

Answer

Implement an application load balancer in front of the database.

Answer

Place the database servers in a public subnet and restrict the security group.

Answer

Use a VPN connection for the web tier to access the database.

Question 6

An organization's cloud environment has a policy that all administrative access must be logged and recorded. Which of the following is the best method to enforce this policy?

Accepted Answer

Use a bastion host with session recording.. A bastion host with session recording provides a centralized, auditable gateway for administrative access. It logs all commands and keystrokes, directly meeting the policy requirement that all administrative access must be logged and recorded. This method captures the full session activity, not just connection metadata.

Answer

Require multifactor authentication.

Answer

Implement a VPN connection for all administrators.

Answer

Configure syslog forwarding for all devices.

Question 7

A cloud operations team is investigating why a batch processing job that runs nightly in a cloud environment has been failing intermittently. The job processes data from an external API and writes results to a database. The error logs show "Connection timed out" when calling the external API. However, manual calls from the same cloud environment succeed. What is the most likely cause?

Accepted Answer

The external API rate limit has been exceeded.. Intermittent timeouts during batch execution suggest the external API is rate-limiting the high volume of automated calls, while manual calls succeed because they are infrequent.

Answer

The database connection pool is exhausted.

Answer

The batch job's service account has been disabled.

Answer

The cloud firewall is blocking outbound traffic during the batch window.

Question 8

An organization is migrating a MySQL database to Amazon RDS using AWS DMS. They want to minimize downtime by using ongoing replication from the source. Which DMS feature should they enable to capture changes as they occur on the source database?

Accepted Answer

Change Data Capture (CDC). Change Data Capture (CDC) captures ongoing changes. Full load transfers existing data; schema conversion converts schemas; validation checks data integrity.

Answer

Data validation

Answer

Full load

Answer

Schema conversion

Question 9

A cloud engineer needs to deploy a virtual machine with a specific configuration that includes a custom script to install software after boot. The deployment must be repeatable and version-controlled. Which approach should be used?

Accepted Answer

Use an Infrastructure as Code template with a user data script. Infrastructure as Code (IaC) templates, such as AWS CloudFormation or Azure Resource Manager, allow you to define the entire VM configuration declaratively, including a user data script that runs custom software installation commands at first boot. This approach ensures repeatability, version control through template files stored in Git, and automated deployment without manual intervention.

Answer

Run a shell script after the VM is deployed

Answer

Create a golden image with the software pre-installed

Answer

Manually install software after creating the VM

Question 10

A cloud administrator is reviewing a security audit report that shows an instance has been sending outbound traffic to a known malicious IP address. The instance hosts a production application. Which action should the administrator take first?

Accepted Answer

Isolate the instance by modifying the security group to deny all traffic.. The first priority in a confirmed security incident is containment. Modifying the security group to deny all traffic immediately stops the outbound communication to the malicious IP, preventing data exfiltration or further compromise while preserving the instance for forensic analysis. This aligns with the incident response process, where isolation precedes investigation.

Answer

Run an antivirus scan on the instance.

Answer

Immediately shut down the instance.

Answer

Review the application logs to understand the traffic.

Question 11

A company is migrating a legacy application that requires static public IP addresses for licensing. The cloud provider assigns public IPs dynamically by default. Which solution should the administrator recommend while minimizing cost?

Accepted Answer

Assign elastic IP addresses (or static public IPs) to the instances.. Elastic IP addresses (or static public IPs) provide persistent public IPv4 addresses that can be associated with instances, meeting the licensing requirement for static public IPs. This is the most cost-effective solution as it only incurs charges for allocated but unused Elastic IPs, whereas other options introduce additional infrastructure costs or fail to address the requirement.

Answer

Use a NAT gateway with a static IP.

Answer

Use static private IPs.

Answer

Use a VPN connection.

Question 12

A company is migrating its on-premises application to a public cloud. The application consists of a web server, an application server, and a database. They want to minimize management overhead while ensuring the application can scale automatically. Which THREE cloud service models should they consider for each component to achieve this goal? (Select THREE.)

Accepted Answer

PaaS for database. For web server: PaaS (e.g., AWS Elastic Beanstalk) can manage the runtime and scaling. For application server: PaaS also works. For database: PaaS (e.g., Amazon RDS) provides managed database with auto-scaling. IaaS would require more management of OS and scaling. SaaS is complete application, not appropriate for custom components. FaaS could be used but is more granular.

Answer

SaaS for database

Answer

IaaS for web server

Question 13

A cloud administrator manages a web application that uses an auto scaling group (ASG) with a minimum of 2 and maximum of 10 instances. The CPU utilization for the ASG averages 40%. However, during peak hours, users experience intermittent timeouts. The administrator reviews the scaling policy, which is set to scale out when CPU exceeds 70% for 5 minutes. What is the most likely cause of the timeouts?

Accepted Answer

The scale-out cooldown period is too long, delaying the addition of new instances.. During peak hours, CPU utilization may spike quickly, but the scaling policy requires CPU to exceed 70% for 5 minutes before triggering a scale-out. If the scale-out cooldown period is too long, additional instances are delayed, causing the existing instances to become overloaded and leading to timeouts. Option A is incorrect because the maximum of 10 instances is likely sufficient; the problem is the speed of scaling. Option B is incorrect because health check failures would cause instance replacement, not timeouts from overload. Option C is incorrect because a 70% threshold is not too low; a lower threshold would cause premature scaling, not timeouts.

Answer

The maximum number of instances is too low.

Answer

The health checks are marking healthy instances as unhealthy.

Answer

The CPU threshold is too low, causing premature scaling.

Question 14

A cloud administrator is troubleshooting a performance issue in a virtualized environment. Which TWO metrics should be monitored to identify CPU contention on the hypervisor?

Accepted Answer

CPU ready time. CPU ready time (B) measures the time a virtual machine is ready to execute but must wait for the hypervisor to schedule it on a physical core. High ready time directly indicates CPU contention, as the VM is being starved of CPU cycles. CPU co-stopping time (E) occurs when multiple vCPUs in a single VM must wait to be scheduled simultaneously, which also signals CPU overcommitment and contention on the hypervisor.

Answer

Swap rate

Answer

Memory ballooning

Answer

CPU utilization per core

Question 15

A cloud administrator is tasked with reducing costs for a development environment that runs 24/7. The environment consists of several virtual machines and a load balancer. Which action would most effectively reduce costs without affecting developer access during business hours?

Accepted Answer

Schedule the VMs to shut down during nights and weekends.. Scheduling VMs to shut down during nights and weekends directly reduces compute costs by eliminating runtime charges when the development environment is not needed. This approach preserves full availability during business hours without requiring architectural changes, and it is the most straightforward way to cut costs for a 24/7-running environment that only needs daytime access.

Answer

Implement auto-scaling to run only one instance during off-hours.

Answer

Use reserved instances for all VMs.

Answer

Change all VMs to burstable instance types.