CV0-004 Practice Test 34 — 15 Questions

Question 1

Which TWO of the following are valid considerations when deploying a virtual machine in a cloud environment? (Choose two.)

Accepted Answer

The instance size and family. Option C (the instance size and family) is correct because in cloud environments the VM's compute capacity is selected from predefined instance types (e.g., general purpose, compute-optimized, memory-optimized), which determine vCPU count, memory, and network bandwidth, directly affecting performance and cost. Option E (the type of storage, SSD or HDD) is correct because cloud providers offer different volume types with distinct IOPS, throughput, and latency characteristics, and choosing SSD-backed versus HDD-backed storage materially impacts application performance and pricing. Option A (log retention policy) is a governance/compliance setting rather than a VM deployment sizing or configuration consideration. Option B (password complexity requirements) is an identity/security policy concern, not a factor in provisioning the VM itself. Option D (the number of virtual CPUs assigned to the hypervisor) is not a valid consideration because the hypervisor's physical CPU resources are managed by the cloud provider, not selected by the customer deploying a VM.

Answer

The log retention policy

Answer

The password complexity requirements

Answer

The number of virtual CPUs assigned to the hypervisor

Question 2

A cloud engineer is optimizing costs for a data analytics workload that runs periodically. The workload processes large datasets stored in Amazon S3 and runs on EC2 instances. Which THREE strategies should the engineer consider to reduce costs? (Select THREE.)

Accepted Answer

Implement S3 Lifecycle policies to transition older data to S3 Glacier. Option A is correct because S3 Lifecycle policies can automatically transition aging analytics data to lower-cost storage classes such as S3 Glacier, cutting storage costs for data that is no longer frequently accessed. Option C is correct because right-sizing the EC2 instance type to the workload's actual CPU, memory, and I/O needs avoids paying for over-provisioned capacity. Option D is correct because Spot Instances offer steep discounts (up to ~90% off On-Demand) and are well suited to periodic, interruption-tolerant batch analytics jobs. Option B is wrong because simply provisioning larger instances increases hourly cost and does not guarantee proportional time savings. Option E is wrong because On-Demand pricing is the most expensive compute option and provides no cost optimization for a periodic workload.

Answer

Provision large instances to reduce processing time

Answer

Use on-demand instances exclusively

Question 3

A company's application is unable to connect to a managed cloud database. The database is deployed in a VPC with public accessibility disabled. The application runs on an EC2 instance in the same VPC. Which three troubleshooting steps should the administrator take? (Choose three.)

Accepted Answer

Check the network ACL associated with the database subnet for appropriate rules.. Option B is correct because network ACLs are stateless subnet-level firewalls; if the database subnet's NACL lacks an inbound rule allowing the database port (e.g., 3306 for MySQL or 5432 for PostgreSQL) from the EC2 instance's subnet CIDR, and a corresponding outbound rule for the return traffic, connectivity will fail even if security groups are correct. Option C is correct because a misconfigured endpoint (wrong hostname, port, or database name) in the application's connection string is a common cause of connection failures and must be verified before deeper network troubleshooting. Option E is correct because the database's security group must have an inbound rule referencing the EC2 instance's security group (or its CIDR) on the database listener port; since the database is not publicly accessible, this security group reference is the primary stateful access control. Option A is not needed because an internet gateway only enables internet connectivity for public subnets and is irrelevant for instance-to-database traffic within the same VPC. Option D is not needed because a public IP is only required for internet-facing communication, not for private communication between an EC2 instance and a database in the same VPC.

Answer

Ensure the VPC has an internet gateway attached.

Answer

Verify that the EC2 instance has a public IP address.

Question 4

A cloud engineer is deploying a containerized application on Kubernetes. The security team requires that containers run with reduced privileges and that certain capabilities are dropped. Which Kubernetes feature should be used to enforce these requirements?

Accepted Answer

Pod Security Standards. Pod Security Standards (PSS) define three levels (Privileged, Baseline, Restricted) that enforce security controls, including running containers with reduced privileges and dropping capabilities. The Restricted policy specifically requires dropping all capabilities and running as non-root, among other restrictions. Therefore, PSS is the correct feature to enforce these requirements.

Answer

Network policies

Answer

ConfigMap

Answer

Horizontal Pod Autoscaler

Question 5

A cloud administrator is troubleshooting a performance issue where a web application is responding slowly. The application runs on virtual machines in a private cloud. The administrator has verified that CPU and memory utilization are within normal limits. Which TWO additional metrics should the administrator check to diagnose the issue?

Accepted Answer

Network latency between the application and database servers. Network latency between the application and database servers is a critical metric because slow database queries or network congestion can cause the web application to respond slowly even when CPU and memory on the VMs are normal. High latency increases round-trip time for SQL queries, directly impacting page load times. Disk I/O wait time on the hypervisor is also essential because excessive I/O wait indicates storage contention, which can throttle read/write operations for the VMs, leading to application sluggishness.

Answer

Number of running processes

Answer

Virtual machine snapshot size

Answer

Hypervisor version

Question 6

A load balancer log entry shows the above for a request. What is the MOST likely cause of the 504 error?

Accepted Answer

The backend server took too long to respond to the request.. A 504 Gateway Timeout error from a load balancer indicates that the load balancer sent the request to a backend server but did not receive a timely response. The load balancer has a configured timeout value (often 30-120 seconds), and if the backend server fails to respond within that window, the load balancer terminates the connection and returns a 504. This is the most common cause of 504 errors in load-balanced environments.

Answer

The DNS resolution for the domain name has failed.

Answer

The requested resource does not exist on the backend server.

Answer

The load balancer's health check is misconfigured.

Question 7

A cloud administrator runs a deployment script that creates multiple resources using Infrastructure as Code (IaC). The script fails with a "400 Bad Request" error when attempting to create a storage account. Which troubleshooting step should the administrator take first?

Accepted Answer

Review the error message details for a specific validation error.. A '400 Bad Request' from a cloud API indicates a client-side validation error, such as an invalid parameter, missing required property, or malformed request body. The fastest and most accurate first step is to read the error message details, which typically name the exact field or constraint that failed. This avoids guessing at network, timeout, or region issues that would produce different error codes.

Answer

Check the network connectivity to the cloud API endpoint.

Answer

Increase the timeout value for the API call.

Answer

Verify that the script has the correct region parameter.

Question 8

A cloud engineer is configuring an auto-scaling group with a lifecycle hook to run a custom script when instances are launched. The script installs software and registers the instance with a load balancer. The engineer wants to ensure the instance does not receive traffic until the script completes successfully. What should the engineer do?

Accepted Answer

Use a lifecycle hook with a 'pending:wait' state and then send a 'complete-lifecycle-action' signal after the script succeeds.. Using a lifecycle hook with a 'pending:wait' state allows you to pause the instance launch process until the custom script completes. After the script succeeds, you send a 'complete-lifecycle-action' signal to the auto-scaling group, which then proceeds to put the instance into service. This ensures the instance does not receive traffic until the script is done.

Answer

Set the lifecycle hook to 'terminating:wait' to delay termination.

Answer

Configure the load balancer health check to fail until the script runs.

Answer

Configure the launch configuration with a user-data script that runs after the instance is in service.

Question 9

A cloud administrator is troubleshooting network connectivity issues between two VPCs in AWS. The administrator wants to examine traffic flow logs to identify dropped packets. Which AWS feature provides detailed network traffic logs for VPCs?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, action) for network interfaces in a VPC, and can be published to CloudWatch Logs or S3. They are the correct tool for diagnosing dropped packets and connectivity issues between VPCs, showing ACCEPT and REJECT records. CloudTrail, X-Ray, and CloudWatch Logs serve different observability purposes.

Answer

AWS X-Ray

Answer

AWS CloudTrail

Answer

Amazon CloudWatch Logs

Question 10

A company is designing a cloud network architecture for a three-tier application. The web tier must be accessible from the internet, the application tier should only be accessible from the web tier, and the database tier should only be accessible from the application tier. The company uses a single VPC with multiple subnets. The security team requires that all traffic between tiers be encrypted in transit. The architect proposes using security groups and network ACLs. Which combination of security group rules meets these requirements while following the principle of least privilege?

Accepted Answer

Web: inbound 443 from 0.0.0.0/0, outbound to app SG:8443. App: inbound from web SG:8443, outbound to db SG:3306. DB: inbound from app SG:3306.. It uses security group (SG) references to enforce strict, stateful traffic flow between tiers: the web SG allows inbound HTTPS (443) from the internet and outbound to the app SG on port 8443; the app SG allows inbound only from the web SG on port 8443 and outbound to the DB SG on port 3306; the DB SG allows inbound only from the app SG on port 3306. This follows least privilege by restricting each tier’s communication to only the necessary ports and source/destination SGs, and the use of TLS/SSL on port 443 and 8443 ensures encryption in transit as required.

Answer

Web: inbound 443 from 0.0.0.0/0, outbound to 0.0.0.0/0:0-65535. App: inbound from web SG:443, outbound to 0.0.0.0/0:0-65535. DB: inbound from app SG:3306, outbound to 0.0.0.0/0:0-65535.

Answer

Web: inbound 443 from 0.0.0.0/0 and 22 from 0.0.0.0/0, outbound to app SG:443. App: inbound from web SG:443, outbound to db SG:3306. DB: inbound from app SG:3306.

Answer

Web: inbound 443 from 0.0.0.0/0, outbound to app subnet CIDR:1433. App: inbound from web subnet CIDR:443, outbound to db subnet CIDR:3306. DB: inbound from app subnet CIDR:3306.

Question 11

A startup is deploying a web application on a public cloud and expects variable traffic throughout the day. The team wants to minimize costs while ensuring that the application can handle sudden spikes in demand. Which scaling strategy best meets these requirements?

Accepted Answer

Auto scaling based on CPU utilization thresholds. Auto scaling based on CPU utilization thresholds is the correct strategy because it dynamically adjusts the number of compute instances in response to real-time demand, ensuring the application can handle sudden spikes while minimizing costs during low-traffic periods. This approach aligns with the startup's requirement for variable traffic and cost efficiency, as it only provisions resources when needed, unlike fixed schedules or manual interventions that cannot react to unpredictable spikes.

Answer

Horizontal scaling using a fixed schedule

Answer

Vertical scaling during off-peak hours

Answer

Manual scaling based on historical data

Question 12

Arrange the steps to deploy a new virtual machine in a public cloud environment (e.g., AWS, Azure, GCP) in the correct order.

Accepted Answer

Define VM specifications, choose operating system, configure network, launch the VM, configure public access.. VM deployment typically starts with specs, then OS, network, launch, and finally public access configuration.

Answer

Define VM specifications, configure network, choose operating system, launch the VM, configure public access.

Answer

Launch the VM, define VM specifications, choose operating system, configure network, configure public access.

Answer

Configure public access, define VM specifications, choose operating system, configure network, launch the VM.

Question 13

A company uses a multi-cloud environment with AWS and Azure. They want to centralize log collection and enable advanced querying for troubleshooting. Which combination of services should they use?

Accepted Answer

AWS CloudWatch Logs and Azure Log Analytics. AWS CloudWatch Logs and Azure Log Analytics are the native log aggregation and querying services in their respective clouds. CloudWatch Logs centralizes logs from AWS resources and supports Logs Insights for querying, while Azure Log Analytics provides a powerful KQL-based query engine over data collected in a Log Analytics workspace. Using both together gives centralized collection and advanced querying across the multi-cloud environment.

Answer

AWS CloudTrail and Azure Monitor

Answer

AWS S3 and Azure Blob Storage

Answer

AWS CloudWatch and Azure Application Insights

Question 14

A cloud engineer is troubleshooting an issue where users cannot connect to a web application hosted on a cloud VM. The VM's security group allows HTTP (port 80) from 0.0.0.0/0, and the VM's OS firewall is disabled. The engineer can ping the VM's public IP from the internet. What is the most likely cause of the issue?

Accepted Answer

Web server service is not running on the VM. Since the OS firewall is disabled and the security group allows HTTP from 0.0.0.0/0, the only remaining layer that could block connectivity is the application itself. If the web server service (e.g., Apache, Nginx, IIS) is not running on the VM, it will not listen on TCP port 80, so HTTP requests will be refused even though network-level access is permitted. The ability to ping the VM confirms IP-level reachability, isolating the issue to the application layer.

Answer

OS firewall is blocking port 80

Answer

Incorrect routing table on the VM

Answer

Security group rule is applied to the wrong subnet

Question 15

A cloud engineer is deploying a web application to a Kubernetes cluster. The application requires zero downtime during updates, and the team wants to test new versions with a small percentage of users before full rollout. Which deployment strategy should the engineer use?

Accepted Answer

Canary deployment. A canary deployment routes a small percentage of traffic to the new version, allowing monitoring and automatic rollback if issues arise, meeting the requirements.

Answer

Rolling deployment

Answer

Blue/green deployment

Answer

Immutable deployment