CV0-004 Practice Test 33 — 15 Questions

Question 1

A company wants to optimize cloud costs by identifying underutilized EC2 instances. Which AWS service provides rightsizing recommendations?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer is the dedicated service that analyzes historical utilization metrics (CPU, memory, network, disk) from CloudWatch to generate rightsizing recommendations for EC2 instances, Auto Scaling groups, EBS volumes, and Lambda functions. It uses machine learning to identify over-provisioned or under-provisioned resources and provides specific instance type recommendations. Unlike other cost tools, Compute Optimizer is purpose-built for resource optimization and rightsizing, making it the correct choice for identifying underutilized EC2 instances.

Answer

AWS Trusted Advisor

Answer

AWS Cost Explorer

Answer

AWS Budgets

Question 2

In the shared responsibility model, which of the following is the cloud customer responsible for?

Accepted Answer

Operating system patching on virtual machines. In the shared responsibility model, the cloud customer is responsible for security 'in' the cloud, which includes the operating system, applications, and data. For IaaS, the customer manages the guest OS, including patching, while the cloud provider manages the hypervisor, network infrastructure, and physical hardware. Therefore, operating system patching on virtual machines is the customer's responsibility.

Answer

Network infrastructure under the hypervisor

Answer

Hypervisor security

Answer

Physical hardware maintenance

Question 3

A cloud administrator needs to apply security patches to a fleet of 50 Linux servers running on AWS without interrupting business hours. Which approach should the administrator use to schedule patching during a maintenance window?

Accepted Answer

Use AWS Systems Manager Patch Manager with a maintenance window. AWS Systems Manager Patch Manager is designed to automate the process of patching fleets of instances. It integrates with Maintenance Windows, allowing administrators to define a schedule (e.g., outside business hours) during which patching tasks run. This approach is scalable, auditable, and does not require manual intervention or custom scripting, making it the correct choice for patching 50 Linux servers without interrupting business hours.

Answer

Create a Lambda function that stops instances, patches them, and restarts

Answer

Manually SSH into each server and run yum update

Answer

Use AWS Config to apply patch baselines

Question 4

A company hosts a web application on AWS and wants to improve latency for global users. Which service should they use to cache static content at edge locations?

Accepted Answer

AWS CloudFront. AWS CloudFront is a content delivery network (CDN) that caches static content at edge locations worldwide, reducing latency for global users. It integrates with AWS services like S3 and EC2, and supports dynamic content acceleration. The other options do not provide edge caching for static content.

Answer

Application Load Balancer

Answer

AWS Global Accelerator

Answer

Amazon Route 53

Question 5

A DevOps team sets up a CI/CD pipeline for a containerized application on Kubernetes. They want to test a new version with a small subset of users before full rollout. Which deployment method should they use?

Accepted Answer

Canary. A canary deployment releases the new version to a small subset of users (e.g., 5-10% of traffic) while the rest continue using the stable version. This allows the team to monitor performance, errors, and user feedback before gradually increasing the rollout. Kubernetes supports canary deployments natively through techniques like multiple Deployments with shared labels and service mesh traffic splitting (e.g., Istio or Linkerd).

Answer

Recreate

Answer

Rolling update

Answer

Blue/green

Question 6

A company is migrating its on-premises application to a public cloud. The application requires low-latency access to a legacy database that cannot be moved to the cloud. The cloud deployment must use a hybrid architecture. Which network connectivity solution should the cloud architect recommend to minimize latency and provide secure, reliable communication?

Accepted Answer

Use a dedicated private connection via a cloud provider's direct connect service.. A dedicated private connection via a cloud provider's direct connect service (e.g., AWS Direct Connect, Azure ExpressRoute, or Google Cloud Interconnect) establishes a private, physical link between the on-premises data center and the cloud VPC. This bypasses the public internet entirely, providing consistent low-latency performance, higher bandwidth, and a more reliable connection for hybrid architectures where the legacy database remains on-premises.

Answer

Route traffic through the public internet with encryption.

Answer

Deploy a CloudFront distribution to cache database queries.

Answer

Establish a site-to-site VPN over the internet.

Question 7

A company is deploying a containerized microservices application on a cloud platform. The operations team needs to manage secrets, such as database credentials and API keys, securely without embedding them in container images. Which solution should they use?

Accepted Answer

Use a cloud-native secrets management service to inject secrets at runtime. A cloud-native secrets management service (e.g., AWS Secrets Manager, GCP Secret Manager, Azure Key Vault) injects secrets at runtime via API calls or sidecar/mounted volumes, so credentials never live in the image or the orchestrator's static config. This enables rotation, fine-grained IAM access, and audit trails without rebuilding images when a credential changes.

Answer

Include secrets in the container image at build time and encrypt the image

Answer

Encrypt secrets and store them in a cloud storage bucket

Answer

Store secrets as environment variables in the container orchestration platform

Question 8

During a penetration test, a cloud security engineer discovers that a storage bucket is publicly accessible because of a misconfigured block public access setting. The bucket contains encrypted data. Which of the following is the primary risk?

Accepted Answer

Unauthorized users can list and download objects, but encryption at rest protects content if the key is also not accessible.. Unauthorized users can list and download encrypted objects, even if the data is encrypted at rest. The primary risk is data exfiltration if the encryption key is compromised or the data is not properly encrypted.

Answer

The bucket name is exposed to enumeration.

Answer

Data is unreadable because it is encrypted.

Answer

The encryption key is exposed.

Question 9

A cloud administrator is troubleshooting a VM whose performance metrics show high 'CPU ready' (or 'CPU steal') time, even though the VM's own CPU utilization is only 20%. The VM runs a latency-sensitive database and is hosted on a shared hypervisor. Which action is the MOST appropriate first step to resolve the performance issue?

Accepted Answer

Migrate the VM to a dedicated host or a host with lower oversubscription.. High CPU ready time indicates the VM is waiting for physical CPU resources due to host oversubscription. The most effective first step is to reduce contention by moving the VM to a dedicated host or a host with lower oversubscription. Increasing vCPUs or enabling hot-add does not address the host-level bottleneck and can worsen scheduling delays. CPU affinity is not a reliable fix for oversubscription.

Answer

Configure CPU affinity to pin the VM to a specific physical core.

Answer

Enable CPU hot-add and dynamically add more cores during peak hours.

Answer

Increase the number of vCPUs assigned to the VM.

Question 10

Arrange the steps to configure auto-scaling for a group of virtual machines based on CPU utilization.

Accepted Answer

1. Define the VM template, 2. Define the auto-scaling group, 3. Define the CPU-based scaling policy, 4. Attach the policy to the group, 5. Test the configuration. First define the template, then the group, then the scaling policy, attach it, and test.

Answer

1. Define the VM template, 2. Define the CPU-based scaling policy, 3. Define the auto-scaling group, 4. Attach the policy to the group, 5. Test the configuration

Answer

1. Define the auto-scaling group, 2. Define the VM template, 3. Define the CPU-based scaling policy, 4. Attach the policy to the group, 5. Test the configuration

Answer

1. Define the VM template, 2. Define the auto-scaling group, 3. Define the CPU-based scaling policy, 4. Test the configuration, 5. Attach the policy to the group

Question 11

A cloud engineer needs to troubleshoot network connectivity issues between two subnets. Which feature can help capture and analyze network traffic metadata?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, bytes, packets, action) for traffic flowing through ENIs, subnets, or VPCs. This metadata is exactly what's needed to diagnose connectivity issues between subnets, since it shows whether traffic is being accepted or rejected by security groups and NACLs. It can be published to CloudWatch Logs or S3 for analysis.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail

Question 12

A company is migrating to the cloud and needs to transfer 200 TB of data from an on-premises data center to GCP. The network bandwidth is limited, so they want to use a physical appliance for offline transfer. Which GCP service should they use?

Accepted Answer

Transfer Appliance. Storage Transfer Service is for online transfers; Transfer Appliance is Google's offline physical device; DataSync is AWS; Azure Data Box is Microsoft's offline device.

Answer

Azure Data Box

Answer

AWS DataSync

Answer

Storage Transfer Service

Question 13

Which THREE of the following are essential components of a cloud incident response plan? Select three.

Accepted Answer

Root cause analysis. Root cause analysis (C) is essential because a cloud incident response plan must include a post-incident phase that determines the underlying cause of the event to prevent recurrence and improve controls. A communication plan (D) is essential because incident response requires defined notification paths and escalation procedures for stakeholders, customers, regulators, and internal teams, especially given cloud shared-responsibility and breach-notification obligations. Containment procedures (E) are essential because the plan must specify how to limit the scope and impact of an incident, such as isolating compromised instances, revoking credentials, or restricting network access, before eradication and recovery. Data backup schedule (A) is a recovery or business continuity concern rather than a core incident response component, and cost optimization strategies (B) relate to financial management of cloud resources, not incident handling.

Answer

Data backup schedule

Answer

Cost optimization strategies

Question 14

A company has a hybrid cloud environment with an on-premises data center and Microsoft Azure. The on-premises infrastructure includes a VPN gateway connected to an Azure virtual network via site-to-site VPN. The network team reports that traffic from on-premises to Azure is experiencing high latency and packet loss. The VPN tunnel status shows as connected. The team has verified that the on-premises firewall is not dropping packets. The Azure administrator checks the virtual network gateway metrics and sees high inbound packet drops and a high number of VPN tunnel rekeys. What is the MOST likely cause of the issue?

Accepted Answer

The VPN gateway SKU is too small for the traffic volume.. The high inbound packet drops and frequent VPN tunnel rekeys indicate that the VPN gateway is overwhelmed by traffic. A VPN gateway SKU that is too small for the traffic volume cannot handle the throughput, leading to packet drops and forcing the tunnel to rekey more often as it struggles to maintain the connection. This explains the high latency and packet loss despite the tunnel showing as connected. Option A (incorrect encryption algorithms) would prevent tunnel establishment or cause constant renegotiation, not just increased rekeys and drops. Option B (overlapping address space) would cause routing conflicts, not specifically packet drops and rekeys. Option C (misconfigured local network gateway address space) would result in connectivity failure or traffic not being routed correctly, not packet drops and rekeys within a functioning tunnel.

Answer

The on-premises VPN device does not support the same encryption algorithms.

Answer

The Azure virtual network has overlapping address space with on-premises.

Answer

There is a misconfiguration in the local network gateway address space.

Question 15

A cloud administrator wants to troubleshoot network connectivity issues between two VPCs. Which AWS feature provides detailed logs of IP traffic for analysis?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, action) for network interfaces in a VPC, and can be published to CloudWatch Logs or S3 for analysis. This is the specific AWS feature designed for troubleshooting connectivity and analyzing traffic patterns at the network layer.

Answer

AWS CloudTrail

Answer

VPC Route Tables

Answer

AWS CloudWatch Logs