CV0-004 Practice Test 33 — 15 Questions

Question 1

A financial services company is migrating a critical application to a hybrid cloud environment. The application must maintain sub-millisecond latency between the front-end and back-end components. The on-premises data center is located in New York, and the cloud region chosen is AWS us-east-1. The network team has established a dedicated AWS Direct Connect connection. After deploying the application, latency tests show 2 ms on average, which is acceptable. However, during peak hours, latency spikes to 10 ms. The cloud administrator suspects that the spike is due to increased traffic going over the VPN backup link instead of Direct Connect. What should the administrator do to resolve the issue?

Accepted Answer

Configure the cloud resources to use only the Direct Connect connection and disable the VPN.. Option B is correct because the latency spike during peak hours is caused by traffic failing over to the VPN backup link, which introduces higher latency and potential congestion. By configuring cloud resources to use only the Direct Connect connection and disabling the VPN, the administrator ensures all traffic stays on the low-latency, dedicated path. This eliminates the possibility of traffic being routed over the VPN, which is typically slower and less reliable than Direct Connect.

Answer

Move the application to a different AWS region closer to the on-premises data center.

Answer

Increase the bandwidth of the VPN backup link.

Answer

Implement traffic shaping to prioritize application traffic over the Direct Connect link.

Question 2

A cloud administrator is debugging a failed CloudFormation stack creation. The exhibit shows the stack events. What is the most likely cause of the failure?

Accepted Answer

The referenced security group does not exist in the chosen VPC.. The stack creation fails with a 'CREATE_FAILED' status on the security group resource, and the error message indicates that the security group does not exist in the specified VPC. This is a common issue when a CloudFormation template references a security group by ID or name that is not present in the target VPC, causing the resource creation to fail. The stack events show the security group resource as the point of failure, confirming that the referenced security group is missing.

Answer

The instance type is not supported in the region.

Answer

The stack name already exists.

Answer

The AMI ID is incorrect.

Question 3

A company is migrating a legacy database that relies on a specific hardware security module (HSM) that cannot be moved to the cloud. The application must continue to function with minimal redevelopment. Which migration strategy is most appropriate?

Accepted Answer

Replace. The correct answer is B (Replace) because the legacy database depends on a specific hardware security module (HSM) that cannot be migrated to the cloud. Replacing the database with a cloud-native equivalent (e.g., Amazon RDS or Azure SQL Database) that supports a cloud-based HSM (like AWS CloudHSM or Azure Key Vault Managed HSM) allows the application to continue functioning with minimal redevelopment, as the replacement typically maintains SQL compatibility and standard interfaces.

Answer

Refactor

Answer

Rehost

Answer

Rebuild

Question 4

A company is considering a multi-cloud deployment to avoid vendor lock-in. Which TWO factors should they consider? (Select TWO.)

Accepted Answer

Consistent security policies across clouds. Option B is correct because consistent security policies across clouds ensure a unified security posture, which is critical for compliance and risk management in a multi-cloud environment. Without consistent policies, vulnerabilities can arise from misconfigurations or gaps in coverage between providers. Option C is correct because data egress costs between clouds can be significant, as each cloud provider charges for data leaving their network, and these costs must be factored into the total cost of ownership to avoid budget overruns.

Answer

Unified management tools support

Answer

Performance differences between providers

Answer

Software licensing compatibility

Question 5

A company is deploying a stateful application that requires persistent storage. They are using Kubernetes. Which resource should they create to ensure data persists across pod restarts?

Accepted Answer

PersistentVolumeClaim. A PersistentVolumeClaim (PVC) is the correct resource because it abstracts the underlying storage details and allows a pod to request persistent storage that survives pod restarts. When a pod is recreated, the PVC ensures the same volume is reattached, preserving application state. This is essential for stateful applications in Kubernetes, as pods are ephemeral by default.

Answer

Deployment

Answer

Secret

Answer

ConfigMap

Question 6

A cloud security team is investigating a potential data breach. Which THREE actions should be taken immediately?

Accepted Answer

Isolate the affected systems from the network. Isolating affected systems from the network (B) is a critical immediate action to contain a potential data breach. This prevents lateral movement by an attacker and stops further data exfiltration, aligning with incident response best practices such as NIST SP 800-61. In a cloud environment, this could involve applying a security group rule to deny all traffic or disconnecting a virtual network interface.

Answer

Delete all logs to prevent further evidence exposure

Answer

Notify all users via email

Question 7

A multinational corporation is deploying a new application across multiple cloud regions for disaster recovery. The application requires consistent low latency for users globally. The architect decides to use a content delivery network (CDN) for static assets and a global load balancer for API traffic. After deployment, some users in Asia report occasional timeouts when accessing the API. The API servers are deployed in the US East and Europe regions. The load balancer is configured with latency-based routing. What is the most likely cause of the timeouts?

Accepted Answer

The DNS TTL is set too high, causing cached resolution to a failed server.. Option D is correct because a high DNS TTL causes clients to cache the IP address of a failed or unhealthy API server for an extended period. When that server becomes unavailable, clients continue to send requests to the cached IP instead of querying DNS for a healthy endpoint, resulting in timeouts. This is a common issue with latency-based routing, where DNS resolution is critical for directing traffic to the optimal region.

Answer

The latency-based routing is directing traffic to the farthest region due to routing table issues.

Answer

The API servers in Europe have insufficient capacity.

Answer

The CDN is misconfigured for the API endpoints.

Question 8

A systems administrator is troubleshooting a network connectivity issue between two peered VPCs in different regions. The VPC peering connection is established and the route tables are configured. However, instances cannot communicate. What should be checked NEXT?

Accepted Answer

The security group rules on the instances. Since the VPC peering connection is established and route tables are configured, the next likely cause is that security group rules on the instances are blocking traffic. Security groups act as virtual firewalls at the instance level, and by default they deny all inbound traffic; explicit rules must allow traffic from the peered VPC's CIDR or security group. This is a common oversight when peering VPCs across regions, as security groups do not automatically permit cross-peering traffic.

Answer

The route propagation of the peering connection

Answer

The network ACLs at the subnet level

Answer

The MTU settings on the instances

Question 9

Refer to the exhibit. A cloud administrator launched a CloudFormation stack to deploy an EC2 instance, but the stack is rolling back. What is the MOST likely cause?

Accepted Answer

The AMI ID is invalid or has been deregistered.. Option C is correct because CloudFormation validates the AMI ID during stack creation. If the AMI ID is invalid (e.g., mistyped, belongs to a different region, or has been deregistered), the EC2 instance launch fails, causing CloudFormation to roll back the stack. This is a common misconfiguration when copying templates across regions without updating AMI IDs.

Answer

The security group referenced in the template does not exist.

Answer

The subnet ID is in a different VPC.

Answer

The instance type is not available in the selected region.

Question 10

A storage administrator needs to ensure data durability for a critical database. Which approach provides the highest durability?

Accepted Answer

Replicate data to a different geographic region.. Replicating data to a different geographic region provides the highest durability by ensuring that even if an entire data center or region experiences a catastrophic failure (e.g., natural disaster, power outage), a complete copy of the database remains available in another region. This approach leverages asynchronous or synchronous replication to maintain data consistency across geographically separated sites, achieving a Recovery Point Objective (RPO) and Recovery Time Objective (RTO) that single-site solutions cannot match. In cloud environments, this is often implemented using services like AWS Cross-Region Replication or Azure Geo-Redundant Storage, which guarantee 99.9999999999% (12 nines) durability.

Answer

Store data on a single SSD volume.

Answer

Enable encryption at rest.

Answer

Use RAID 0 across multiple volumes.

Question 11

A DevOps engineer is designing a CI/CD pipeline for a microservices application. The team wants to isolate each build job to avoid interference. Which cloud concept should be utilized?

Accepted Answer

Containerization with orchestration. Containerization with orchestration (e.g., Docker and Kubernetes) provides isolated runtime environments for each build job by packaging the application and its dependencies into lightweight containers. This ensures that build processes do not interfere with each other, as each container runs in its own isolated user space with dedicated resources, and orchestration manages scheduling, scaling, and lifecycle. This approach is ideal for CI/CD pipelines in microservices architectures where build isolation is critical.

Answer

Dedicated hosts

Answer

Virtual private cloud (VPC)

Answer

Serverless functions

Question 12

A cloud administrator receives an alert that the CPU usage on a virtual machine has spiked to 100% for 10 minutes. The VM hosts a critical application. What is the best first step?

Accepted Answer

Check the VM's performance metrics for the last hour to identify the process causing the spike.. Checking the VM's performance metrics for the last hour is the best first step because it allows the administrator to identify the specific process or application causing the CPU spike without disrupting service. This diagnostic approach aligns with the ITIL problem management framework, which emphasizes root cause analysis before taking corrective action. In a virtualized environment, tools like vCenter Performance Charts or Hyper-V Performance Monitor can pinpoint whether the spike is due to a runaway process, a memory leak, or a scheduled task, enabling a targeted resolution.

Answer

Immediately reboot the VM.

Answer

Move the VM to a different host.

Answer

Increase the VM's CPU limits.

Question 13

A cloud operations team is investigating a security breach where an unauthorized user accessed a storage bucket containing sensitive data. The logs show that the access occurred using valid access keys from an IP address outside the company's network. The administrator checks the IAM policies and finds that the keys belong to a service account that has read access to the bucket. Which of the following actions would be MOST effective in preventing a recurrence?

Accepted Answer

Rotate the compromised keys and implement multi-factor authentication on the account.. Option D is correct because rotating the compromised keys immediately invalidates the stolen credentials, while implementing multi-factor authentication (MFA) on the service account adds an additional layer of security. Even though service accounts typically don't support interactive MFA, using IAM conditions to require MFA for API calls or using workload identity federation can enforce MFA-like controls. This directly addresses the root cause—compromised static keys—and prevents reuse of the stolen access keys.

Answer

Remove the bucket and restore from backup to a new bucket.

Answer

Delete the service account and create a new one with the same permissions.

Answer

Change the bucket policy to deny access from outside the company's IP range.

Question 14

A cloud administrator is designing a multi-tier application. The database tier must not be directly accessible from the internet, but the web tier must be able to connect to it. Which of the following should the administrator implement?

Accepted Answer

Place the database servers in a private subnet and configure the security group to allow inbound traffic from the web tier's security group.. Option D is correct because placing the database servers in a private subnet ensures they have no direct internet route, meeting the security requirement. By configuring the security group to allow inbound traffic only from the web tier's security group, you enable the web tier to connect to the database while blocking all other traffic, including from the internet. This leverages AWS security group referencing (or similar cloud provider feature) to create a trusted, internal communication path.

Answer

Implement an application load balancer in front of the database.

Answer

Place the database servers in a public subnet and restrict the security group.

Answer

Use a VPN connection for the web tier to access the database.

Question 15

A cloud administrator is setting up monitoring for a web application. The application must be highly available across multiple availability zones. Which of the following metrics should be monitored to ensure that the application meets its service level agreement (SLA) for uptime?

Accepted Answer

The result of the load balancer health check for each instance.. The load balancer health check result directly indicates whether each instance is reachable and responding correctly to application traffic. Monitoring these results allows the administrator to detect instance failures and verify that the application remains available across multiple availability zones, which is the core requirement for meeting an uptime SLA. Other metrics like throughput, disk space, or CPU utilization are performance indicators but do not directly confirm application availability.

Answer

Network throughput per minute.

Answer

Percentage of disk space used on each instance.

Answer

Average CPU utilization across all instances.