CV0-004 Practice Test 34 — 15 Questions

Question 1

An organization uses a cloud-based monitoring service to track CPU utilization across a fleet of virtual machines. The administrator notices that one VM consistently shows 100% CPU utilization at the same time each day. Which of the following should the administrator do NEXT?

Accepted Answer

Check the VM's local task scheduler for any jobs running during the peak times. Option C is correct because the consistent daily spike in CPU utilization at the same time strongly suggests a scheduled task or cron job is triggering the load. Checking the VM's local task scheduler (e.g., Task Scheduler on Windows or cron on Linux) is the logical first step to identify the specific process causing the spike before taking any remediation actions.

Answer

Add the VM to an auto scaling group to distribute the load

Answer

Immediately increase the VM size to accommodate the peak

Answer

Scan the VM for malware that might be causing the activity

Question 2

A cloud operations team is troubleshooting a performance issue with a web application hosted on a cloud platform. The application uses an auto-scaling group behind a load balancer. Users report slow response times during peak hours. Monitoring shows high CPU utilization on all instances. Which of the following should the team do first to improve performance?

Accepted Answer

Adjust the auto-scaling policy to scale out at lower CPU threshold.. The immediate symptom is high CPU utilization on all instances during peak hours, indicating that the current instances are being overwhelmed. Adjusting the auto-scaling policy to scale out at a lower CPU threshold (e.g., from 70% to 50%) will proactively add more instances before CPU becomes saturated, distributing the load and improving response times. This directly addresses the root cause—insufficient compute capacity—without requiring architectural changes or additional services.

Answer

Increase the instance size of the auto-scaling group.

Answer

Add a content delivery network (CDN) in front of the application.

Answer

Enable caching at the database layer.

Question 3

A cloud administrator notices that a cloud-based web application is experiencing intermittent latency during peak hours. The application runs on an auto-scaling group of virtual machines behind a load balancer. Which of the following should the administrator investigate FIRST to resolve the issue?

Accepted Answer

Review the auto-scaling group's scaling policies and thresholds. The intermittent latency during peak hours is most likely caused by the auto-scaling group's scaling policies not reacting quickly enough or being set with thresholds that are too high, leading to insufficient capacity under load. Investigating the scaling policies and thresholds first directly addresses the root cause—whether the group is adding instances too slowly or at too high a utilization trigger—rather than symptoms like health checks or DNS. This aligns with the operational best practice of verifying capacity management before tuning network or load-balancer settings.

Answer

Enable SSL offloading on the load balancer

Answer

Verify the load balancer's health check interval

Answer

Check DNS resolution times for the application domain

Question 4

A developer is using a cloud provider's CLI to manage resources. Which TWO commands are commonly used to troubleshoot instance connectivity?

Accepted Answer

traceroute. D is correct because the `traceroute` command is a standard network diagnostic tool that identifies the path packets take from the source to a destination, revealing each hop's latency and any points of failure. It uses ICMP (or UDP on Linux) with incrementing TTL values to map the route, making it essential for troubleshooting connectivity issues between cloud instances and external endpoints.

Answer

reboot

Answer

ssh

Answer

create-tags

Question 5

A company uses a hybrid cloud model and experiences intermittent connectivity issues between the on-premises network and the public cloud VPC. The administrator has verified that the VPN connection is established. Which of the following should the administrator check next?

Accepted Answer

Routing tables on both sides.. Since the VPN connection is established (tunnel is up), the issue is likely with traffic routing rather than basic connectivity. Routing tables on both the on-premises router and the cloud VPC must have correct routes pointing to the VPN gateway and the remote subnets; a missing or misconfigured route (e.g., a missing static route or incorrect VPC route table entry) will cause intermittent connectivity even when the VPN tunnel itself is active.

Answer

Firewall rules for outbound traffic.

Answer

Public IP address of the VPN gateway.

Answer

DNS resolution of cloud endpoints.

Question 6

Refer to the exhibit. A cloud load balancer is returning 502 Bad Gateway errors to clients. What is the most likely cause?

Accepted Answer

The backend web servers are not responding correctly.. A 502 Bad Gateway error indicates that the load balancer (acting as a proxy or gateway) received an invalid or no response from the upstream backend web servers. This typically occurs when the backend servers are overloaded, have crashed, or are misconfigured (e.g., incorrect health check path, application pool failure). The load balancer successfully forwards the request but fails to get a valid HTTP response, triggering the 502 error.

Answer

The load balancer's SSL certificate is invalid.

Answer

The security group allows inbound traffic from the load balancer.

Answer

The DNS record points to the wrong IP.

Question 7

A cloud administrator is troubleshooting a connectivity issue between a web server and a database server in the same VPC but different subnets. The security group for the database server allows inbound traffic from the web server's security group. However, the web server cannot establish a TCP connection to the database. What are two possible causes? (Choose two.)

Accepted Answer

The network ACL of the web server subnet is blocking outbound traffic.. Option B is correct because network ACLs are stateless and apply to subnet boundaries. Even if the web server's security group allows outbound traffic, the subnet's network ACL must explicitly allow outbound traffic to the database server's IP and port. If the outbound rule is missing or denies the traffic, the TCP SYN packet will be dropped before it leaves the subnet. Option C is correct because the database subnet's network ACL must allow inbound traffic from the web server's IP and port; if it blocks the inbound SYN, the connection cannot be established.

Answer

The security group of the web server does not allow outbound traffic to the database.

Answer

The route table of the database subnet does not contain a route to the web server subnet.

Answer

The database server is not listening on the correct port.

Question 8

A cloud administrator is configuring a new virtual private cloud (VPC) for a three-tier application. The web tier must be accessible from the internet, the application tier should only be accessible from the web tier, and the database tier should only be accessible from the application tier. Which network architecture should be used?

Accepted Answer

Place each tier in a separate subnet with appropriate security group rules controlling traffic.. Option C is correct because placing each tier in a separate subnet and using security group rules provides stateful, instance-level traffic control. Security groups act as virtual firewalls at the hypervisor layer, allowing you to specify inbound rules that restrict the application tier to only accept traffic from the web tier's security group, and the database tier to only accept traffic from the application tier's security group. This aligns with the principle of least privilege and ensures that each tier is isolated within the VPC while maintaining necessary connectivity.

Answer

Use one subnet with network ACLs to restrict traffic between tiers.

Answer

Place all tiers in the same subnet and use host-based firewalls.

Answer

Deploy each tier in a different VPC and peer them.

Question 9

A company uses a cloud-based logging service to aggregate logs from multiple servers. Suddenly, the logging service stops receiving logs from several servers. The administrator checks the logging agent status on those servers and finds that the agents are running but not sending data. The network connectivity between the servers and the logging service is verified as working. Which of the following is the MOST likely cause?

Accepted Answer

The logging endpoint configuration on the agents is incorrect.. The logging agents are running but not sending data, and network connectivity is verified as working. This points to a configuration issue where the agents are pointing to an incorrect logging endpoint (e.g., wrong URL, port, or API key). Even if the service is healthy, misconfigured agents will fail to transmit logs, which matches the symptom of agents running but idle.

Answer

The logging service has reached its storage quota.

Answer

The logging agent is out of memory.

Answer

A firewall is blocking the outbound traffic from the servers.

Question 10

A cloud engineer is troubleshooting an issue where a virtual machine (VM) in a VPC cannot communicate with an on-premises database server through a site-to-site VPN. The VPN tunnel status shows 'UP' and the on-premises firewall logs show packets from the VM's public IP (but the VM is in a private subnet with no public IP). What is the MOST likely cause?

Accepted Answer

The route table for the subnet is missing a route to the on-premises network via the VPN.. The VPN tunnel status is 'UP' and the on-premises firewall sees packets from the VM's public IP, but the VM is in a private subnet with no public IP. This indicates that the VM's traffic is being sent to the internet instead of through the VPN tunnel. The most likely cause is that the subnet's route table lacks a specific route directing traffic destined for the on-premises network to the virtual private gateway (VGW) or VPN connection, causing the traffic to be routed to the internet gateway (IGW) and source-NATed to the public IP.

Answer

The on-premises firewall is blocking the VM's private IP address.

Answer

The VM's security group is blocking outbound traffic to the on-premises subnet.

Answer

The VPN tunnel is misconfigured with mismatched pre-shared keys.

Question 11

Refer to the exhibit. What action should the administrator take to bring the environment into compliance?

Accepted Answer

Resize the non-compliant VMs to t2.medium.. Option C is correct because the exhibit shows that the environment has a compliance policy requiring all VMs to be of type t2.medium, but two VMs are running as t2.large and t2.xlarge. Resizing the non-compliant VMs to t2.medium brings them into alignment with the policy, ensuring the environment meets the defined compliance standard. This action directly remediates the violation without unnecessary deletion or ignoring the check.

Answer

Modify the policy file to accept t2.large and t2.xlarge.

Answer

Ignore the compliance check because it is advisory.

Answer

Delete the non-compliant VMs.

Question 12

A cloud administrator is troubleshooting a performance issue in a virtualized environment. Which THREE of the following metrics should the administrator analyze to identify potential resource contention? (Select THREE.)

Accepted Answer

CPU ready time. CPU ready time measures the time a virtual machine is ready to execute instructions but is waiting for the hypervisor to schedule physical CPU resources. High ready time directly indicates CPU contention, as the VM is being starved of CPU cycles by other VMs on the same host.

Answer

Swap file usage

Answer

Network latency

Question 13

An organization is deploying a multi-tier application in the cloud. The web tier uses auto scaling, and the database tier uses a managed database service. During a load test, the web tier scales up correctly, but the database performance degrades significantly, causing timeout errors. The administrator reviews the database metrics and finds that CPU and memory are normal, but the number of connections is high. Which of the following is the BEST action to resolve the issue?

Accepted Answer

Implement connection pooling on the web servers to limit database connections.. The issue is that the database is overwhelmed by a high number of connections, not by CPU or memory pressure. Connection pooling on the web servers reuses a fixed set of database connections, reducing the connection overhead and preventing the database from hitting its maximum connection limit. This directly addresses the symptom of high connection count without changing the database's compute capacity or the web tier's scaling behavior.

Answer

Add read replicas to offload read traffic from the primary database.

Answer

Increase the maximum number of web servers in the auto scaling group.

Answer

Increase the compute size of the database instance.

Question 14

A cloud administrator is troubleshooting an application that fails to connect to a database. The database server is in a private subnet, and the application server is in a public subnet. The security group for the database allows inbound traffic on port 3306 from the application's security group. Which of the following is the MOST likely reason the connection fails?

Accepted Answer

The network ACL for the database subnet is blocking inbound traffic on port 3306. The network ACL (NACL) for the database subnet is the most likely cause because NACLs are stateless and apply to the entire subnet. Even if the database security group allows inbound traffic from the application's security group, the NACL must also allow inbound traffic on port 3306 (MySQL) from the application subnet. By default, custom NACLs deny all inbound traffic, so if the administrator did not explicitly add a rule for port 3306, the connection will be blocked at the subnet boundary.

Answer

The database server's operating system firewall is blocking the connection

Answer

The application's security group does not allow outbound traffic to the database

Answer

The route table for the public subnet does not have a route to the private subnet

Question 15

A cloud administrator is migrating a legacy application to a public cloud IaaS environment. The application requires a static IP address for licensing. Which of the following should the administrator configure to meet this requirement?

Accepted Answer

Reserved public IP. A reserved public IP (also known as a static public IP) ensures the legacy application always has the same public IP address for licensing purposes. In IaaS environments like Azure, this is called a 'reserved IP' or 'static public IP', which persists even after the VM is stopped or deallocated, meeting the licensing requirement.

Answer

NAT gateway

Answer

Virtual IP address

Answer

Elastic IP