CV0-004 Practice Test 33 — 15 Questions

Question 1

A company is migrating a legacy on-premises application to a cloud VM. The application requires a static private IP address for compliance. During a disaster recovery failover, the VM must automatically retain the same IP address in the secondary region. Which solution should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a load balancer with a fixed IP and point it to the VM's current private IP.. An internal load balancer can be configured with a static private IP address that persists across regions during disaster recovery. The load balancer distributes traffic to the VM in the secondary region without requiring the VM's own private IP to remain the same. This satisfies the compliance requirement for a static private IP endpoint. Option A is incorrect because reserved static private IP addresses are tied to a specific region and cannot be moved across regions; thus, the same IP cannot be retained in the secondary region. Option B is incorrect because a dynamic IP would change after failover, requiring DNS updates. Option D is incorrect because elastic IPs are public, not private, and a VPN does not help retain a private IP.

Answer

Provision a reserved static private IP address that can be reassigned to the new VM.

Answer

Use a dynamic IP address and update DNS after failover.

Answer

Assign an elastic IP (public) and configure a VPN.

Question 2

A company uses a multi-cloud strategy with workloads on AWS and Azure. An application running on an Amazon EC2 instance in a VPC uses an Azure SQL Database as its backend via a site-to-site VPN. Recently, users reported intermittent timeouts when accessing the application. The EC2 instance passes health checks, and the VPN tunnel status shows as 'UP' from both sides. The application logs show 'Cannot open server 'azuresql.database.windows.net' requested by the login. The login failed.' Which of the following is the MOST likely cause of the issue?

Accepted Answer

The Azure SQL Database firewall does not allow traffic from the EC2 instance's IP address or the VPN gateway's IP.. The error message 'Cannot open server 'azuresql.database.windows.net' requested by the login. The login failed.' indicates that the Azure SQL Database server rejected the connection attempt. Since the VPN tunnel is 'UP' and the EC2 instance passes health checks, the most likely cause is that the Azure SQL Database firewall rules do not include the source IP address of the traffic coming from the EC2 instance — either the EC2 instance's private IP (if traffic is routed through the VPN) or the public IP of the VPN gateway. Azure SQL Database uses server-level firewall rules to allow client IP addresses, and without an explicit rule, all connections are blocked.

Answer

The EC2 instance has exhausted its CPU credits, causing the application to become unresponsive.

Answer

The VPN tunnel is not properly routing traffic to Azure, causing intermittent connectivity.

Answer

The EC2 instance does not have sufficient IAM permissions to connect to Azure SQL Database.

Question 3

A cloud administrator is tasked with ensuring that only encrypted connections are used to transfer files to a cloud storage bucket. Which of the following should the administrator enforce?

Accepted Answer

Require HTTPS for all uploads.. HTTPS (HTTP over TLS) encrypts data in transit using TLS, ensuring that files uploaded to a cloud storage bucket are protected from eavesdropping and tampering. By requiring HTTPS for all uploads, the administrator enforces encrypted connections as mandated by the security policy, which is a standard practice for cloud storage services like AWS S3 or Azure Blob Storage.

Answer

Use HTTP with a custom header.

Answer

Allow FTP but restrict to specific IPs.

Answer

Enable SFTP access to the bucket.

Question 4

Match each troubleshooting command to its function.

Accepted Answer

ping: Tests network connectivity to a remote host. Common CLI tools for network troubleshooting: ping tests reachability, traceroute shows the path, nslookup resolves DNS names. Confusing these functions is a typical mistake.

Answer

ping: Traces the route packets take to a destination

Answer

traceroute: Queries DNS to resolve domain names to IP addresses

Answer

nslookup: Tests network connectivity to a remote host

Question 5

A company is implementing a cloud-based SIEM solution. Which TWO of the following are essential data sources that should be integrated to ensure comprehensive security monitoring?

Accepted Answer

DNS query logs from the cloud DNS service.. DNS query logs from the cloud DNS service (Option D) are essential because they provide visibility into domain resolution activities, which can reveal command-and-control (C2) communications, data exfiltration via DNS tunneling, or connections to malicious domains. In a cloud-based SIEM, these logs are critical for detecting threats that leverage DNS as a covert channel, as they capture the source IP, queried domain, and response codes in real time.

Answer

Physical access logs from the data center.

Answer

Firewall configuration backup files.

Answer

Employee vacation schedule.

Question 6

A company is deploying a new web application in a hybrid cloud environment. The application must be highly available and able to handle traffic spikes. The cloud team decides to use an auto-scaling group across multiple availability zones with a load balancer. Which additional step should the team take to ensure session persistence during scaling events?

Accepted Answer

Enable sticky sessions on the load balancer. Sticky sessions (also known as session affinity) ensure that all requests from a user during a session are directed to the same backend instance. In an auto-scaling group, instances are added or removed dynamically; without sticky sessions, a load balancer using a default algorithm could route a user to a different instance after a scale-out event, losing the in-memory session state. Enabling sticky sessions on the load balancer preserves session persistence across scaling events by binding the user's session to a specific instance for its duration.

Answer

Implement a stateless application design

Answer

Increase the instance size to handle more sessions

Answer

Configure the load balancer to use a round-robin algorithm

Question 7

A cloud architect is designing a disaster recovery plan. Which TWO strategies ensure minimal data loss?

Accepted Answer

Synchronous replication across regions. Synchronous replication across regions (B) ensures that every write is committed to both the primary and secondary sites before acknowledging the client, resulting in zero data loss (RPO=0) in the event of a failover. Application-level multi-region writes (D) allow the application to write directly to multiple independent databases simultaneously, ensuring that all regions have the latest data and no data is lost if one region fails.

Answer

Daily backups stored in the same data center

Answer

Asynchronous replication with hourly snapshots

Answer

Periodic manual exports to on-premises storage

Question 8

Which TWO metrics should be monitored to determine if a cloud database is experiencing a memory bottleneck?

Accepted Answer

Swap usage. Swap usage (B) is a direct indicator of memory pressure; when the operating system moves memory pages to disk, it signals that the database cannot fit its working set in RAM, causing severe performance degradation. Page faults per second (E) measures how often the database must retrieve memory pages from disk; a sustained high rate indicates the buffer pool is too small for the workload, confirming a memory bottleneck.

Answer

Network bytes sent

Answer

Average disk queue length

Answer

Disk latency

Question 9

A cloud architect is designing a solution to ensure that data at rest in an object storage bucket is encrypted. The company requires that the encryption keys are managed by an on-premises hardware security module (HSM) to maintain control. Which encryption approach should the architect choose?

Accepted Answer

Client-side encryption using a local library.. Client-side encryption allows the customer to encrypt data before sending it to the cloud, using keys managed on-premises. Server-side encryption with cloud-managed keys would have the cloud provider control the keys, negating the requirement. SSE-C allows the customer to provide their own encryption keys, but the keys must be sent to the cloud each time, which may not satisfy the on-premises management requirement. Client-side encryption ensures data is encrypted before leaving the on-premises environment.

Answer

Server-side encryption with cloud-managed keys (SSE).

Answer

Disable encryption at rest to rely on network encryption.

Answer

Server-side encryption with customer-provided keys (SSE-C).

Question 10

A company runs a critical application on a single VM in a public cloud. The VM uses a 500 GB managed disk. The company takes daily snapshots of the disk for backup. The operations team notices that the snapshot creation time has increased from 5 minutes to over an hour over the past month. The VM's disk usage has remained stable at around 200 GB. The VM runs a database that writes logs to a separate data disk (100 GB) which is not snapshotted. Which of the following is the MOST likely cause of the increasing snapshot time?

Accepted Answer

High write activity (churn) on the OS disk causing more data to be captured in each snapshot.. The snapshot creation time has increased because of high write activity (churn) on the OS disk. Azure and other cloud platforms use a block-level incremental snapshot mechanism; when a disk has high churn, many blocks change between snapshots, forcing the snapshot process to read and store a large number of changed blocks even if the total used space remains stable. Since the VM runs a database that writes logs to a separate data disk (not snapshotted), the OS disk still experiences frequent writes from the database's log flushing or other system operations, causing the snapshot to capture many changed blocks and thus take longer.

Answer

The VM's used disk space has increased significantly, requiring larger snapshots.

Answer

The data disk is consuming space on the OS disk due to log file growth.

Answer

The backup software is compressing snapshots, causing CPU overhead and longer times.

Question 11

Refer to the exhibit. An application in a cloud environment logs multiple database connection errors. The database is a managed MySQL instance in the same VPC. The timeouts and connection refused errors occur intermittently. Which of the following is the most likely cause?

Accepted Answer

The database is hitting its maximum connections limit.. Intermittent connection refused and timeouts indicate that the database is reaching its maximum connections limit, causing new connections to be refused or timeout.

Answer

The database instance is out of storage.

Answer

The security group for the database is not allowing inbound traffic from the application.

Answer

The database's DNS resolves to multiple IP addresses.

Question 12

A company wants to deploy a cloud application that requires predictable performance and dedicated resources for a critical database. Which cloud service model is MOST appropriate?

Accepted Answer

Infrastructure as a Service (IaaS). Infrastructure as a Service (IaaS) provides virtualized computing resources, such as dedicated virtual machines, storage, and networking, that can be configured to meet the predictable performance and dedicated resource requirements of a critical database. With IaaS, the company can provision a dedicated server instance with guaranteed CPU, memory, and I/O, avoiding the resource contention common in shared platforms. This model offers full control over the operating system, database software, and security settings, which is essential for a critical database workload.

Answer

Function as a Service (FaaS)

Answer

Software as a Service (SaaS)

Answer

Platform as a Service (PaaS)

Question 13

A cloud administrator is reviewing cost reports and notices that a development environment is incurring high costs due to idle compute resources. The environment is used only during business hours on weekdays. Which of the following actions would MOST effectively reduce costs?

Accepted Answer

Implement an auto-scaling schedule to shut down instances during off-hours.. An auto-scaling schedule allows you to define time-based rules to automatically scale in (terminate) instances during off-hours and scale out (launch) them during business hours. This directly addresses the idle compute waste by ensuring resources are only running when needed, which is the most effective cost reduction strategy for a predictable usage pattern like weekdays 9-to-5.

Answer

Move the development environment to a different region with lower costs.

Answer

Change all instances to smaller instance types.

Answer

Use spot instances for all development servers.

Question 14

A company uses AWS for its production environment. The company has deployed a web application behind an Application Load Balancer (ALB) with a target group containing two EC2 instances in different Availability Zones. The application is stateless and stores session data in an external Redis cluster. Recently, users report that they are occasionally logged out during a session. The load balancer health checks pass for both instances. The application logs show no errors. Which of the following is the most likely cause of the issue?

Accepted Answer

The Redis cluster is not configured for replication.. The application is stateless and stores session data in an external Redis cluster. If the Redis cluster lacks replication, a failure of the primary node will cause all session data to be lost, logging users out. The ALB health checks pass and application logs show no errors because the EC2 instances themselves are healthy; the issue lies entirely in the Redis layer's lack of high availability.

Answer

The instances are using different AMI versions.

Answer

The target group is configured with slow start.

Answer

Sticky sessions are not enabled on the ALB.

Question 15

A security engineer is reviewing a cloud storage bucket policy. Which of the following best describes the security issue present in the exhibit?

Accepted Answer

The bucket policy allows public read access to all objects, creating a data exposure risk.. The bucket policy grants read access to any anonymous user (Principal: "*"), which is a common misconfiguration that can lead to data exposure. The correct action is to remove the wildcard principal or restrict it to authenticated users.

Answer

The bucket policy correctly limits access to read-only operations, which is secure by default.

Answer

The bucket policy should be modified to allow write access for full functionality.

Answer

The bucket policy should include an IP address restriction to limit access to corporate IPs.