CV0-004 Practice Test 34 — 15 Questions

Question 1

A company has a cloud-based application that uses an auto-scaling group across multiple Availability Zones (AZs). The application experiences periodic spikes in traffic. The auto-scaling policy uses a step scaling policy based on CPU utilization. The operations team notices that during a traffic spike, new instances are launched but take over five minutes to become healthy and begin serving traffic. During this time, existing instances are overloaded and some requests fail. The team wants to reduce the time it takes for new instances to handle traffic. Which action would be most effective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a pre-warmed, customized AMI with the application pre-installed and caches preloaded.. Using a pre-warmed AMI with the application stack already configured and caching enabled significantly reduces the time required for an instance to become healthy because it avoids the need to install dependencies and warm caches on each startup.

Answer

Increase the instance type to a larger size so each instance can handle more traffic.

Answer

Reduce the cooldown period in the scaling policy to launch instances faster.

Answer

Move all instances to a single AZ to avoid cross-AZ latency.

Question 2

An organization has a hybrid cloud environment with resources in both a private cloud and a public cloud. The operations team reports that the cloud management platform cannot collect monitoring data from the public cloud instances. The security team recently updated firewall rules. Which of the following is the MOST likely cause?

Accepted Answer

The public cloud instances cannot reach the management platform's IP address due to firewall changes. The security team's recent firewall rule update is the most likely cause because the cloud management platform typically uses specific ports and protocols (e.g., HTTPS on TCP 443, SSH on TCP 22, or WinRM on TCP 5985/5986) to collect monitoring data from public cloud instances. If the firewall rules block outbound traffic from the public cloud instances to the management platform's IP address, or block inbound traffic from those instances at the platform's side, the data collection will fail. This directly aligns with the reported symptom of the management platform being unable to collect monitoring data after a firewall change.

Answer

The load balancer in front of the management platform is misconfigured

Answer

The SNMP community string was modified on the instances

Answer

The management platform's NAT IP address was changed

Question 3

A cloud engineer deployed the infrastructure shown. The load balancer's health checks are failing for the EC2 instance. Which of the following is the MOST likely cause?

Accepted Answer

The health check endpoint /health does not exist on the web server.. The health check is failing because the load balancer is configured to check the /health endpoint, but the web server does not have that endpoint defined. Without a matching route or file for /health, the server returns a non-2xx/3xx status code (e.g., 404 Not Found), causing the load balancer to mark the instance as unhealthy.

Answer

The web server is not running HTTP.

Answer

The EC2 instance is in the wrong subnet.

Answer

The security group does not allow traffic from the load balancer.

Question 4

An organization is deploying a new application using Infrastructure as Code (IaC) with Terraform. The development team needs to ensure that the same configuration is applied consistently across development, staging, and production environments. What is the best practice for managing these Terraform configurations?

Accepted Answer

Maintain separate Terraform workspaces or directories for each environment.. Using separate Terraform workspaces or directories for each environment enforces isolation of state files and configuration, preventing accidental cross-environment changes. This approach aligns with Infrastructure as Code best practices by allowing environment-specific variables and resources while maintaining a single source of truth for the core configuration.

Answer

Hardcode environment-specific values within the main configuration file.

Answer

Manually update the configuration for each environment before deployment.

Answer

Use a single Terraform configuration with different variable files for each environment.

Question 5

A cloud administrator needs to design a storage solution that provides block-level access for a database server and must be highly durable. Which storage type should be used?

Accepted Answer

Block storage. Block storage is the correct choice because it provides raw, low-latency block-level access that database servers require for high-performance read/write operations. It also supports features like RAID, snapshots, and replication to achieve high durability, making it ideal for transactional databases.

Answer

File storage

Answer

Archive storage

Answer

Object storage

Question 6

A company is migrating its on-premises application to a public cloud. The application requires low-latency access to a legacy database that cannot be moved to the cloud. The cloud deployment must use a hybrid architecture. Which network connectivity solution should the cloud architect recommend to minimize latency and provide secure, reliable communication?

Accepted Answer

Use a dedicated private connection via a cloud provider's direct connect service.. A dedicated private connection via a cloud provider's direct connect service (e.g., AWS Direct Connect, Azure ExpressRoute, or Google Cloud Interconnect) establishes a private, physical link between the on-premises data center and the cloud VPC. This bypasses the public internet entirely, providing consistent low-latency performance, higher bandwidth, and a more reliable connection for hybrid architectures where the legacy database remains on-premises.

Answer

Route traffic through the public internet with encryption.

Answer

Deploy a CloudFront distribution to cache database queries.

Answer

Establish a site-to-site VPN over the internet.

Question 7

A financial services company is deploying a PCI-DSS compliant workload in a public cloud. The deployment must include a web application (port 443) and a database (port 3306). The security requirements mandate that the web application is internet-facing, but the database must be in a private subnet with no direct internet access. The cloud administrator creates two VPCs: one for the web tier and one for the database tier. The web tier is deployed in VPC-A with a public subnet and an internet gateway. The database tier is deployed in VPC-B with a private subnet and a NAT gateway for outbound updates. The administrator configures VPC peering between VPC-A and VPC-B, and updates route tables accordingly. The web application can connect to the database, but the database cannot initiate outbound connections to the internet for updates. What is the most likely issue?

Accepted Answer

The NAT gateway in VPC-B cannot be used for internet access through a VPC peering connection. The NAT gateway in VPC-B cannot be used for internet access through a VPC peering connection because VPC peering does not support transitive routing. When the database in VPC-B tries to reach the internet via the NAT gateway, traffic must go through the VPC peering connection to VPC-A and then to the internet gateway, but VPC peering does not allow a route that forwards traffic from one VPC to another VPC's internet gateway. The database's outbound traffic to the internet is effectively blocked because the NAT gateway's default route (0.0.0.0/0) points to the internet gateway in VPC-B, but the database's traffic must first traverse the peering connection, which is not a valid path for internet-bound traffic in this architecture.

Answer

The database security group does not allow outbound traffic to the internet

Answer

The route table in VPC-B does not have a default route to the NAT gateway

Answer

The VPC peering connection does not support DNS resolution between VPCs

Question 8

A company runs a containerized application on a Kubernetes cluster. The application logs indicate occasional 'CrashLoopBackOff' errors. The developer says the application works fine locally. What is the most likely cause in the cloud environment?

Accepted Answer

The memory limit set in the pod spec is too low, causing the container to be OOMKilled.. The 'CrashLoopBackOff' error indicates that the container is repeatedly crashing after startup. Since the application works locally, the issue is likely environmental. A memory limit set too low in the pod spec causes the container to exceed its allowed memory, triggering an OOMKill (Out of Memory Kill) by the kubelet. The container restarts, fails again, and enters CrashLoopBackOff, which is a common cloud-specific resource constraint not present in local development.

Answer

The readiness probe is misconfigured and returning false.

Answer

The container image is not being pulled correctly from the registry.

Answer

The persistent volume claim is not bound to a storage class.

Question 9

A company uses a cloud-based logging service to aggregate logs from multiple servers. Suddenly, the logging service stops receiving logs from several servers. The administrator checks the logging agent status on those servers and finds that the agents are running but not sending data. The network connectivity between the servers and the logging service is verified as working. Which of the following is the MOST likely cause?

Accepted Answer

The logging endpoint configuration on the agents is incorrect.. The logging agents are running but not sending data, and network connectivity is verified as working. This points to a configuration issue where the agents are pointing to an incorrect logging endpoint (e.g., wrong URL, port, or API key). Even if the service is healthy, misconfigured agents will fail to transmit logs, which matches the symptom of agents running but idle.

Answer

The logging service has reached its storage quota.

Answer

The logging agent is out of memory.

Answer

A firewall is blocking the outbound traffic from the servers.

Question 10

A company uses a cloud load balancer to distribute traffic to a group of web servers. After a recent update, some users report being redirected to a maintenance page when the application is actually available. What is the most likely cause?

Accepted Answer

The load balancer health check is misconfigured and marking healthy instances as unhealthy.. The most likely cause is that the load balancer's health check is misconfigured, causing it to incorrectly mark healthy web servers as unhealthy. When all instances are marked unhealthy, the load balancer has no available targets and may route traffic to a fallback maintenance page or return an error. This explains why users see a maintenance page despite the application being available.

Answer

The load balancer's SSL certificate has expired.

Answer

The DNS record for the load balancer has a short TTL.

Answer

The web servers are not configured with the same security group.

Question 11

A cloud architect is designing a deployment strategy for a web application that must handle unpredictable traffic spikes. The application runs in containers on a Kubernetes cluster. The architect wants to minimize costs while ensuring that the cluster can scale out rapidly during spikes. Which deployment strategy best meets these requirements?

Accepted Answer

Implement horizontal pod autoscaling based on CPU utilization.. Horizontal Pod Autoscaling (HPA) automatically adjusts the number of pod replicas based on observed CPU utilization (or custom metrics), enabling rapid scale-out during traffic spikes without manual intervention. This minimizes costs by running only the necessary pods during low traffic while ensuring the cluster can react quickly to increased demand, which aligns with the requirement for unpredictable spikes.

Answer

Pre-provision a fixed number of pods to handle peak load at all times.

Answer

Manually scale the deployment when monitoring alerts indicate high traffic.

Answer

Use vertical pod autoscaling to increase resource limits on existing pods.

Question 12

A company is migrating its on-premises application to the cloud and wants to ensure high availability across multiple geographic regions. The application consists of stateless web servers and a stateful database. Which architecture should the company implement?

Accepted Answer

Active-active web servers in two regions with a multi-region database replication. The application requires high availability across multiple geographic regions for both stateless web servers and a stateful database. Active-active web servers in two regions ensure traffic distribution and failover, while multi-region database replication (e.g., using synchronous or asynchronous replication such as MySQL Group Replication or Aurora Global Database) keeps the stateful database synchronized across regions, enabling read/write capabilities and automatic failover without data loss.

Answer

Active-passive web servers in two regions with a single database in the primary region

Answer

Active-active web servers in two regions with read replicas in each region

Answer

Active-active web servers in one region with a standby database in another region

Question 13

A cloud security team is investigating a potential data breach. Which THREE actions should be taken immediately?

Accepted Answer

Isolate the affected systems from the network. Isolating affected systems from the network (B) is a critical immediate action to contain a potential data breach. This prevents lateral movement by an attacker and stops further data exfiltration, aligning with incident response best practices such as NIST SP 800-61. In a cloud environment, this could involve applying a security group rule to deny all traffic or disconnecting a virtual network interface.

Answer

Delete all logs to prevent further evidence exposure

Answer

Notify all users via email

Question 14

A cloud administrator is tasked with ensuring that all API requests to the cloud management plane are encrypted. Which protocol should be enforced to meet this requirement?

Accepted Answer

TLS. TLS (Transport Layer Security) encrypts data in transit and is the standard protocol for securing API communications. SSH is for remote shell access, SSL (deprecated) is similar but newer is TLS, and IPsec is used for VPN tunnels.

Answer

IPsec

Answer

SSL

Answer

SSH

Question 15

A company uses a public cloud provider and has a requirement that all data must be encrypted in transit and at rest. The architect notices that the cloud provider's load balancer terminates TLS and forwards traffic to backend instances over HTTP. Which design change should the architect make?

Accepted Answer

Configure end-to-end encryption using HTTPS between load balancer and backend. The requirement mandates encryption in transit for all data paths. By configuring end-to-end HTTPS between the load balancer and backend instances, the architect ensures that traffic is encrypted from the client to the backend, even after the load balancer terminates the initial TLS connection. This prevents plaintext HTTP traffic from flowing over the internal network, satisfying the encryption-at-rest and in-transit compliance needs.

Answer

Implement a web application firewall (WAF) on the backend

Answer

Enable TLS termination at the backend instances only

Answer

Use a VPN tunnel between the load balancer and backend