CV0-004 Practice Test 32 — 15 Questions

Question 1

An organization is migrating its on-premises virtualization environment to a public cloud. The current environment uses VMware vSphere with VM templates. The cloud provider supports importing VMs in OVF format. Which step should the cloud administrator take to prepare the VMs for migration?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Export each VM as an OVF template.. The cloud provider supports importing VMs in OVF format, which is an open standard for packaging and distributing virtual appliances. Exporting each VM as an OVF template from VMware vSphere creates the necessary .ovf descriptor file and accompanying disk files (e.g., .vmdk) that the provider can directly import. This is the correct preparation step because it produces the exact format required by the target cloud platform.

Answer

Take a snapshot of each VM and copy the snapshot files.

Answer

Convert each VM to an ISO image.

Answer

Copy the VM's VMDK files and import them as VHDX.

Question 2

A cloud security engineer is hardening a Kubernetes cluster. Which TWO measures should be implemented to improve container security? (Choose two.)

Accepted Answer

Implement runtime security monitoring. A is correct because runtime security monitoring (e.g., using Falco, Sysdig, or Aqua Security) detects and alerts on anomalous behavior within running containers, such as unexpected system calls, privilege escalations, or file system changes. This is a critical layer of defense that complements image scanning by catching threats that bypass static checks, such as zero-day exploits or compromised containers. Without runtime monitoring, malicious activity inside a container can go undetected until significant damage occurs.

Answer

Store secrets in ConfigMaps

Answer

Disable audit logging to reduce overhead

Answer

Use default service accounts for all pods

Question 3

A cloud administrator receives an alert that the CPU utilization on a production web server has exceeded 90% for the past hour. The administrator checks the metrics and sees that the request rate has increased. Which of the following is the MOST appropriate action to resolve the issue in the short term?

Accepted Answer

Increase the number of vCPUs or add additional instances behind a load balancer.. Increasing the number of vCPUs or adding additional instances behind a load balancer directly addresses the high CPU utilization caused by increased request rate. This scales the compute resources horizontally or vertically to handle the load, which is the most immediate and effective short-term action for a production web server under sustained high traffic.

Answer

Increase the memory allocation for the virtual machine.

Answer

Implement rate limiting to reduce incoming requests.

Answer

Optimize the application code to reduce CPU usage.

Question 4

Which THREE of the following are valid methods to automate the deployment of cloud resources?

Accepted Answer

Employing configuration management tools to enforce desired state. Configuration management tools like Ansible, Puppet, or Chef enforce a desired state on cloud resources. They continuously ensure that the system configuration matches the defined state, automatically correcting any drift. This is a valid method for automating deployment and maintenance of cloud resources.

Answer

Using snapshots to clone instances

Answer

Writing scripts that use cloud provider CLI commands

Question 5

A company uses a hybrid cloud model with an AWS Direct Connect connection to its on-premises network. Users report intermittent connectivity to cloud resources. A network engineer finds packet loss on the Direct Connect virtual interface. Which of the following should be checked FIRST to resolve the issue?

Accepted Answer

The BGP session status between the on-premises router and the AWS Direct Connect endpoint. Intermittent packet loss on a Direct Connect virtual interface is most commonly caused by BGP session flapping or misconfiguration, as BGP is the routing protocol that establishes and maintains connectivity between the on-premises router and the AWS Direct Connect endpoint. Checking the BGP session status first allows the engineer to quickly identify if the issue is due to route advertisement problems, hold timer mismatches, or session resets, which are frequent root causes of intermittent packet loss.

Answer

The physical port status of the Direct Connect router

Answer

The MTU setting on the on-premises firewall

Answer

The VPN tunnel status for the Direct Connect link

Question 6

A cloud administrator receives an alert that the CPU usage on a virtual machine has spiked to 100% for 10 minutes. The VM hosts a critical application. What is the best first step?

Accepted Answer

Check the VM's performance metrics for the last hour to identify the process causing the spike.. Checking the VM's performance metrics for the last hour is the best first step because it allows the administrator to identify the specific process or application causing the CPU spike without disrupting service. This diagnostic approach aligns with the ITIL problem management framework, which emphasizes root cause analysis before taking corrective action. In a virtualized environment, tools like vCenter Performance Charts or Hyper-V Performance Monitor can pinpoint whether the spike is due to a runaway process, a memory leak, or a scheduled task, enabling a targeted resolution.

Answer

Immediately reboot the VM.

Answer

Move the VM to a different host.

Answer

Increase the VM's CPU limits.

Question 7

A cloud administrator notices that a web application is experiencing intermittent latency spikes. The application runs on a load-balanced set of virtual machines in a public cloud. Which of the following should the administrator investigate FIRST?

Accepted Answer

Review the application logs for errors or performance issues.. Intermittent latency spikes in a load-balanced web application are most effectively diagnosed by first reviewing application logs for errors or performance issues. Application logs can reveal slow database queries, memory exhaustion, or code-level bottlenecks that cause latency, which is the most direct source of evidence before investigating network or infrastructure components.

Answer

Verify that the VMs are in the same availability zone.

Answer

Inspect the network ACLs for any recent changes.

Answer

Check the load balancer health checks to ensure all instances are healthy.

Question 8

A company deploys a multi-region active-active application on AWS. They use Route 53 with a latency routing policy. Traffic from Europe is routed to the eu-west-1 region, but during a regional failure, some European users experience timeouts. Which routing policy should be added to improve availability?

Accepted Answer

Latency-based routing with health checks and failover. Combining latency with failover routing provides automatic failover to a healthy region.

Answer

Geolocation routing

Answer

Failover routing

Answer

Weighted routing

Question 9

A mid-sized company is migrating its on-premises applications to a public cloud. The security team has implemented a cloud access security broker (CASB) to monitor and enforce policies for sensitive data. The company uses a multi-cloud environment with both AWS and Azure. After deployment, the security team receives alerts that a developer accidentally exposed a set of credentials in a public GitHub repository. The credentials were associated with a service account that has read-write access to an AWS S3 bucket containing customer PII (personally identifiable information). The team immediately revokes the credentials and rotates the access keys. The security team wants to prevent such incidents in the future and ensure that any exposed credentials are promptly detected without relying solely on manual GitHub scans. The company also wants to maintain a least-privilege model for all cloud resources. Given this scenario, which of the following actions should the security team take FIRST to reduce the risk of credential exposure and improve detection?

Accepted Answer

Configure the CASB to integrate with the GitHub API to continuously scan for exposed secrets and automatically trigger alerts.. A CASB is designed to integrate with cloud services like GitHub via APIs to provide continuous monitoring and policy enforcement. By configuring the CASB to scan GitHub repositories in real-time, the security team can detect exposed credentials immediately upon commit, rather than relying on periodic scans or manual reviews. This aligns with the requirement for prompt detection without manual intervention and leverages the existing CASB investment for multi-cloud environments.

Answer

Implement a periodic secret scanning tool that runs every 24 hours and reports any found credentials to the security team.

Answer

Disable all public repositories and require all code to be stored in private repositories with strict branch protection rules.

Answer

Require all developers to use a password manager to store secrets and set up a process to manually review GitHub commits.

Question 10

A company wants to protect data in transit between its on-premises data center and a public cloud environment. Which technology should be used to create a secure encrypted tunnel over the internet?

Accepted Answer

VPN. A VPN (Virtual Private Network) creates an encrypted tunnel over the internet. TLS is used for web traffic, not for site-to-site tunnels. SSH is for remote admin, and a firewall is for filtering, not encrypting tunnels.

Answer

SSH

Answer

Firewall

Answer

TLS

Question 11

During a security audit, an organization discovers their cloud-based database is accessible from any public IP address due to a firewall rule allowing 0.0.0.0/0 on port 3306 (MySQL). The database must remain accessible to remote developers working from home. What is the most effective remediation?

Accepted Answer

Change the firewall rule to allow only specific known developer IP ranges.. Restricting to specific trusted IP ranges reduces exposure while maintaining remote access.

Answer

Remove the firewall rule entirely and rely on database IAM authentication.

Answer

Enable encryption in transit using TLS and keep the rule as is.

Answer

Move the database to a private subnet without a NAT gateway.

Question 12

Which TWO of the following are effective methods to protect data in transit within a cloud environment? Select two.

Accepted Answer

VPN overlay networks. Options D and E are correct because VPN overlay networks and TLS/SSL encryption both protect data in transit by encrypting the communication channel. Option A (object-level ACLs) controls access to data but does not encrypt it in transit. Option B (server-side encryption with AES-256) protects data at rest. Option C (data masking) obscures data but does not protect it during transmission.

Answer

Object-level ACLs

Answer

Server-side encryption with AES-256

Answer

Data masking

Question 13

Match each high-availability concept to its description.

Accepted Answer

Failover: Automatic switching to a redundant system upon failure. Correct matches: Failover (auto-switch to standby), Load Balancing (distribute workload), Clustering (group as one system), Redundancy (duplicate components). Common confusions: swapping failover and load balancing definitions.

Answer

Failover: Distributing workloads across multiple resources

Answer

Load Balancing: Automatic switching to a redundant system upon failure

Question 14

A cloud engineer is designing a disaster recovery plan for a critical application. The application requires a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 hour. Which replication strategy should be used?

Accepted Answer

Asynchronous replication with snapshots every 30 minutes.. Asynchronous replication with snapshots every 30 minutes meets the RPO of 1 hour because data loss is limited to at most 30 minutes of changes, which is within the 1-hour window. The RTO of 15 minutes is achievable because the replicated data is readily available in the secondary region, allowing for rapid failover without the delay of restoring from backups.

Answer

Daily backups stored in a different region.

Answer

No replication; rely on infrastructure rebuild.

Answer

Synchronous replication between two regions.

Question 15

Arrange the steps to implement a cloud security group that allows only specific IPs to access an application.

Accepted Answer

Step 1: Identify IPs, Step 2: Create security group with rule, Step 3: Set source (IP range), Step 4: Associate security group with resource, Step 5: Test connectivity. The correct sequence ensures that the security group is properly configured with the known allowed IPs before being attached to the resource, and then tested. Identifying IPs first prevents misconfiguration, and setting the source within the rule during creation ensures the rule is complete before association.

Answer

Step 1: Create security group with rule, Step 2: Identify IPs, Step 3: Set source (IP range), Step 4: Associate security group with resource, Step 5: Test connectivity

Answer

Step 1: Identify IPs, Step 2: Create security group with rule, Step 3: Associate security group with resource, Step 4: Set source (IP range), Step 5: Test connectivity

Answer

Step 1: Identify IPs, Step 2: Set source (IP range), Step 3: Create security group with rule, Step 4: Associate security group with resource, Step 5: Test connectivity