CV0-004 Practice Test 31 — 15 Questions

Question 1

A cloud architect is designing a container security strategy. Which TWO of the following should be implemented to secure containers? (Choose two.)

Accepted Answer

Runtime security monitoring for anomalous behavior. Option A (Runtime security monitoring for anomalous behavior) is correct because containers can be compromised after deployment, and runtime monitoring detects suspicious activity such as unexpected process execution, privilege escalation, or unauthorized file access, enabling rapid response to threats that static controls miss. Option C (Image scanning for vulnerabilities) is correct because container images often include outdated OS packages and libraries with known CVEs; scanning images in the CI/CD pipeline and registry before deployment prevents vulnerable artifacts from reaching production. Option B is wrong because disabling all security contexts removes controls like runAsNonRoot, readOnlyRootFilesystem, and dropped capabilities, weakening rather than strengthening container isolation. Option D is wrong because using the latest base images without scanning provides no assurance that known vulnerabilities are absent and can introduce unreviewed changes. Option E is wrong because network ACLs at the hypervisor level do not address container-specific risks such as image vulnerabilities or runtime compromise, and container network policy is typically enforced via Kubernetes NetworkPolicy or service mesh rather than hypervisor ACLs.

Answer

Disabling all security contexts in Kubernetes

Answer

Using the latest base images without scanning

Answer

Implementing network ACLs at the hypervisor level

Question 2

A cloud architect is designing a serverless application on AWS Lambda. The function needs to process messages from an SQS queue. Which event trigger should be configured for the Lambda function?

Accepted Answer

SQS trigger. AWS Lambda can be triggered by SQS messages. By configuring an SQS trigger, Lambda automatically polls the queue and invokes the function with each message.

Answer

API Gateway

Answer

S3 bucket event

Answer

EventBridge rule

Question 3

A company is implementing a secrets management solution. The security team wants to ensure that secrets are protected and rotated regularly. Which THREE of the following are best practices for secrets management?

Accepted Answer

Audit access to secrets to detect unauthorized usage.. Best practices include using a dedicated vault, rotating secrets, avoiding hard-coded secrets, and auditing access.

Answer

Hard-code secrets in application source code for simplicity.

Answer

Store secrets in environment variables for easy access by applications.

Question 4

A cloud administrator wants to ensure that patches are applied to cloud workloads with minimal risk. Which TWO practices should the administrator follow? (Choose two.)

Accepted Answer

Automate patch deployment using orchestration tools.. Automating patch deployment using orchestration tools ensures consistent, repeatable, and scheduled patching across cloud workloads, reducing human error and manual overhead. Option E is correct because testing patches in a staging environment first validates compatibility and identifies regressions before production deployment, which is a critical risk mitigation practice in cloud operations.

Answer

Skip patches for legacy systems to avoid regression.

Answer

Patch in production during peak hours to save time.

Answer

Always apply patches manually to ensure control.

Question 5

Which cloud service model gives the customer the most control over the operating system and applications, while the provider manages the physical hardware, network, and storage?

Accepted Answer

IaaS. IaaS (Infrastructure as a Service) provides virtualized compute, storage, and networking resources, but the customer is responsible for managing the guest operating system, middleware, runtime, and applications. The provider only manages the physical hardware, network fabric, and storage infrastructure. This gives the customer the highest level of control among the listed models without owning the physical data center.

Answer

FaaS

Answer

PaaS

Answer

SaaS

Question 6

A company is migrating a legacy application that requires static public IP addresses for licensing. The cloud provider assigns public IPs dynamically by default. Which solution should the administrator recommend while minimizing cost?

Accepted Answer

Assign elastic IP addresses (or static public IPs) to the instances.. Elastic IP addresses (or static public IPs) provide persistent public IPv4 addresses that can be associated with instances, meeting the licensing requirement for static public IPs. This is the most cost-effective solution as it only incurs charges for allocated but unused Elastic IPs, whereas other options introduce additional infrastructure costs or fail to address the requirement.

Answer

Use a NAT gateway with a static IP.

Answer

Use static private IPs.

Answer

Use a VPN connection.

Question 7

A developer wants to deploy a containerized application on a Kubernetes cluster using a package manager that simplifies deployment and management. Which tool should be used?

Accepted Answer

Helm. Helm is the package manager for Kubernetes. It uses charts to define, install, and upgrade complex Kubernetes applications.

Answer

Docker Compose

Answer

Terraform

Answer

Ansible

Question 8

A company has a cloud-based application that uses an auto-scaling group across multiple Availability Zones (AZs). The application experiences periodic spikes in traffic. The auto-scaling policy uses a step scaling policy based on CPU utilization. The operations team notices that during a traffic spike, new instances are launched but take over five minutes to become healthy and begin serving traffic. During this time, existing instances are overloaded and some requests fail. The team wants to reduce the time it takes for new instances to handle traffic. Which action would be most effective?

Accepted Answer

Use a pre-warmed, customized AMI with the application pre-installed and caches preloaded.. The bottleneck is instance warm-up time: new instances must boot the OS, install/patch the application, and populate caches before passing health checks, which takes over five minutes. A pre-warmed, customized AMI with the application pre-installed and caches preloaded eliminates most of that bootstrapping, so new instances pass health checks and serve traffic in a fraction of the time. This directly addresses the root cause — slow time-to-healthy — rather than scaling capacity or tuning policy timing.

Answer

Increase the instance type to a larger size so each instance can handle more traffic.

Answer

Reduce the cooldown period in the scaling policy to launch instances faster.

Answer

Move all instances to a single AZ to avoid cross-AZ latency.

Question 9

An organization needs to recover its critical database within 15 minutes and lose at most 1 minute of data. Which configuration meets these requirements?

Accepted Answer

Hot standby with synchronous replication. Hot standby with synchronous replication ensures that every write to the primary database is also written to the standby before the transaction is acknowledged. This guarantees zero data loss (RPO=0) and, combined with automatic failover, can achieve a recovery time of under 15 minutes (RTO<15 min).

Answer

Active-active with asynchronous replication

Answer

Warm standby with hourly backups

Answer

Cold standby with daily backups

Question 10

A cloud administrator is investigating why a virtual machine is running slowly. The administrator checks the hypervisor performance metrics. Which TWO of the following metrics indicate CPU contention? (Choose TWO.)

Accepted Answer

High CPU ready time. CPU ready time (option A) and co-stop time (option C) are both indicators of CPU contention. Ready time is time a VM is ready to run but waiting for CPU; co-stop time is time a VM is stopped because another vCPU in the same VM is contending. Option E (High CPU usage percentage) is normal utilization, not contention. Option B (High disk queue depth) is storage-related. Option D (High memory ballooning) is memory-related.

Answer

High disk queue depth

Answer

High memory ballooning

Answer

High CPU usage percentage

Question 11

A cloud engineer is migrating a legacy application to AWS. The application requires minimal downtime during the database migration from SQL Server to Aurora MySQL. Which TWO AWS services should the engineer use to achieve this?

Accepted Answer

AWS Schema Conversion Tool (SCT). The AWS Schema Conversion Tool (SCT) is used to convert the source SQL Server database schema and code to be compatible with Aurora MySQL, handling differences in data types, stored procedures, and other database objects. The AWS Database Migration Service (DMS) then performs the actual data migration with minimal downtime by continuously replicating changes from the source to the target database until a cutover is performed. Together, SCT and DMS enable a heterogeneous migration with near-zero downtime.

Answer

AWS Snowball

Answer

AWS Direct Connect

Answer

AWS DataSync

Question 12

A financial services firm requires a cloud deployment that keeps sensitive customer data on-premises while bursting compute-intensive risk analysis workloads to a public cloud during peak times. Which deployment model best meets this requirement?

Accepted Answer

Hybrid cloud. A hybrid cloud model combines on-premises infrastructure (private cloud) with public cloud services, allowing data and applications to be shared between them. This exactly matches the requirement to keep sensitive customer data on-premises while bursting compute-intensive workloads to a public cloud during peak times. Hybrid cloud provides the necessary integration, orchestration, and security controls to move workloads securely between environments.

Answer

Public cloud

Answer

Multi-cloud

Answer

Private cloud

Question 13

A security administrator is configuring a web application firewall (WAF) to protect against SQL injection attacks. Which WAF feature should be enabled?

Accepted Answer

OWASP rule set. The OWASP rule set (also called OWASP Core Rule Set, CRS) is a collection of generic attack detection rules specifically designed to protect web applications against the OWASP Top 10, including SQL injection, cross-site scripting, and command injection. Enabling it on a WAF provides immediate, well-tested signatures for SQLi patterns. This directly addresses the requirement to protect against SQL injection.

Answer

Geo-blocking

Answer

Rate limiting

Answer

DDoS protection

Question 14

A cloud administrator is troubleshooting connectivity issues between two virtual networks in a public cloud. The networks are in the same region but different VPCs. Both VPCs have route tables and security groups configured. Instances in VPC A cannot ping instances in VPC B. Which of the following is the most likely cause?

Accepted Answer

VPC peering is not established between the two VPCs.. VPC peering is a direct network connection between two VPCs that enables routing of traffic using private IPv4 or IPv6 addresses. Without an established VPC peering connection, instances in different VPCs cannot communicate, even if they are in the same region. Since the question states the VPCs are separate and no peering is mentioned, this is the most likely root cause of the connectivity failure.

Answer

The instances are not assigned public IP addresses.

Answer

Security groups are blocking ICMP traffic.

Answer

Network ACLs are not configured to allow the traffic.

Question 15

A company is migrating a legacy stateful application to the cloud. The application currently runs on a single server and stores session data locally. To enable horizontal scaling, which two design changes should the architect recommend? (Select TWO.)

Accepted Answer

Move session state to a shared database or cache. Option C is correct because moving session state to a shared database or cache (e.g., Redis, Memcached, or DynamoDB) externalizes the state so any instance behind the load balancer can serve any request, which is essential for horizontal scaling. Option E is correct because refactoring the application to be stateless removes local session dependencies entirely, allowing instances to be added or removed freely and making the tier truly horizontally scalable. Options A and D are incorrect because adding storage or using a larger instance are vertical scaling approaches that do not enable horizontal scaling and leave the stateful single-server bottleneck in place. Option B is incorrect because sticky sessions only pin a client to one instance, which preserves the stateful coupling, can cause uneven load, and does not solve the underlying need to share or eliminate session state.

Answer

Add more storage to the existing instance

Answer

Implement sticky sessions on the load balancer

Answer

Use a larger instance type for the application server