CV0-004 Practice Test 35 — 15 Questions

Question 1

A cloud administrator is deploying a new application that requires low latency between two virtual machines. The VMs are in the same cloud region but in different availability zones. The administrator notices higher latency than expected. Which of the following is the most effective way to reduce latency?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Move both VMs to the same availability zone.. Moving both VMs to the same availability zone reduces the physical network distance and eliminates the latency introduced by inter-zone routing. In cloud providers, availability zones are distinct data centers with separate power and networking, so traffic between zones traverses additional switches and fiber, adding microseconds to milliseconds of latency. Placing VMs in the same zone keeps traffic within a single data center fabric, minimizing hop count and propagation delay.

Answer

Assign larger instance types to both VMs.

Answer

Use a VPN connection between the VMs.

Answer

Place both VMs in the same placement group.

Question 2

An organization uses a private cloud and wants to implement multifactor authentication (MFA) for administrative access to the hypervisor. However, due to legacy system constraints, the hypervisor does not support MFA directly. What is the BEST alternative to achieve MFA for administrative logins?

Accepted Answer

Deploy a jump host (bastion host) with MFA, and restrict hypervisor access to only that host.. A jump host (bastion host) can be placed in a separate network segment that requires MFA for access. Administrators log into the jump host first and then connect to the hypervisor from it. Direct SSH keys still rely on single-factor authentication. A VPN without MFA is insufficient. Using a certificate alone is also single factor.

Answer

Configure SSH key-based authentication for all hypervisor logins.

Answer

Implement a certificate-based authentication scheme for the hypervisor.

Answer

Set up a VPN that requires MFA and allow only VPN traffic to reach the hypervisor.

Question 3

A company uses a configuration management tool to enforce desired state on cloud servers. During an audit, it is discovered that some servers have deviated from the baseline configuration. The administrator runs a report and finds that the configuration management agent was not running on those servers. Which of the following is the BEST solution to ensure continuous compliance?

Accepted Answer

Implement a periodic compliance scan and auto-remediation job.. It automates the detection and correction of configuration drift without manual intervention. By implementing a periodic compliance scan (e.g., using AWS Config rules or Azure Policy) coupled with an auto-remediation action (e.g., a Lambda function or runbook), the system can restart the configuration management agent or reapply the desired state automatically, ensuring continuous compliance even if the agent stops temporarily.

Answer

Reinstall the configuration management agent on all servers.

Answer

Remove the drifit servers from the environment and rebuild them.

Answer

Manually update the configuration on the deviated servers.

Question 4

A company is migrating a legacy monolithic application to a microservices architecture on the cloud. The application has tight coupling and shared database schemas. Which migration strategy should the company adopt to reduce risk and enable iterative migration?

Accepted Answer

Use the strangler fig pattern to gradually replace components. The strangler fig pattern is the correct migration strategy because it allows the company to incrementally replace specific functionalities of the legacy monolithic application with new microservices, reducing risk by keeping the existing system operational during the transition. This approach directly addresses the tight coupling and shared database schema issues by enabling gradual decomposition without requiring a complete rewrite or a risky big-bang migration.

Answer

Re-platform to a managed service and rewrite later

Answer

Containerize the monolithic application and run it on a cluster

Answer

Lift and shift the entire application, then refactor in-place

Question 5

A cloud administrator needs to ensure that application logs are retained for three years to comply with regulatory requirements. Which of the following is the MOST cost-effective solution?

Accepted Answer

Use a lifecycle policy to transition logs to archive storage after 90 days and delete after three years. The most cost-effective solution because it uses a lifecycle policy to automatically transition logs from hot storage to cheaper archive storage (e.g., Amazon S3 Glacier or Azure Blob Archive tier) after 90 days, then deletes them after three years. This minimizes storage costs by moving infrequently accessed data to lower-cost tiers while still meeting the three-year retention requirement without manual intervention or unnecessary use of expensive block storage.

Answer

Configure log rotation so only the last 30 days of logs are kept in the instance

Answer

Store all logs in block storage for three years

Answer

Compress old logs manually and store them in a separate volume

Question 6

A company wants to deploy a Lambda function that processes objects uploaded to an S3 bucket. Which event trigger should be configured on the Lambda function?

Accepted Answer

S3 bucket event notification. S3 bucket event notifications can be configured to directly invoke a Lambda function when objects are uploaded. This is the native, serverless integration where S3 publishes an event (e.g., s3:ObjectCreated:Put) to Lambda, triggering the function automatically without any intermediary service.

Answer

API Gateway

Answer

CloudWatch Events

Answer

SQS

Question 7

A cloud engineer is managing AWS infrastructure with Terraform and wants to store the state file remotely to enable team collaboration. Which storage option should the engineer configure in the backend block?

Accepted Answer

Amazon S3. Terraform supports multiple remote backends. For AWS, S3 is the recommended backend for storing state files, providing durability and locking via DynamoDB.

Answer

Google Cloud Storage

Answer

Local file system

Answer

Azure Blob Storage

Question 8

A cloud administrator is troubleshooting why web-server-01 is not receiving traffic from an internet-facing load balancer. The load balancer is in the same VPC and subnet. According to the exhibit, what is the most likely reason?

Accepted Answer

The security group attached to the instance does not allow traffic from the load balancer. The exhibit likely shows the instance's security group 'web-sg' but no inbound rule allowing HTTP traffic from the load balancer. Since the load balancer is internet-facing and in the same VPC, it can route traffic to the instance via private IP. However, the instance's security group must explicitly allow inbound traffic from the load balancer (or its security group). Without that rule, traffic is blocked. Therefore, the most likely reason is the security group not allowing traffic from the load balancer, making option A correct.

Answer

The instance is in a stopped state

Answer

The instance is not in the same VPC as the load balancer

Answer

The instance does not have a public IP address

Question 9

A company is migrating a 50 TB on-premises database to AWS RDS with minimal downtime. They plan to use AWS DMS with ongoing change data capture (CDC). Which additional AWS service should be used to handle the initial full load efficiently before enabling CDC replication?

Accepted Answer

AWS Snowball Edge. AWS DMS can use Snowball Edge for large initial loads to avoid lengthy network transfers. S3 Transfer Acceleration speeds up uploads but is not optimal for 50 TB initial load. Database Migration Service is the tool itself. DataSync is for file storage, not databases.

Answer

Amazon S3 Transfer Acceleration

Answer

AWS DataSync

Answer

AWS Database Migration Service (DMS)

Question 10

An organization wants to ensure that only authorized personnel can access the cloud management console. Which of the following is the BEST method to achieve this?

Accepted Answer

Enable multi-factor authentication (MFA) for all console users.. Multi-factor authentication (MFA) is the best method because it adds an additional layer of security beyond just a password, requiring a second factor (e.g., a time-based one-time password from an authenticator app or a hardware token). This significantly reduces the risk of unauthorized access even if credentials are compromised, as the attacker would also need the second factor. In cloud environments like AWS, Azure, or GCP, MFA is a fundamental security best practice for protecting the management console.

Answer

Implement strong password policies with complex passwords.

Answer

Disable the web console and require API access only.

Answer

Restrict console access to a specific IP address range.

Question 11

Match each disaster recovery term to its definition.

Accepted Answer

RTO: Maximum allowed downtime. Key disaster recovery terms: RTO focuses on downtime, RPO on data loss, failover is automatic, and cold site has minimal setup. Common confusions involve swapping RTO and RPO definitions or mischaracterizing failover as manual.

Answer

RTO: Maximum acceptable data loss

Answer

Failover: Manual process to restore service

Question 12

Match each acronym to its definition.

Accepted Answer

IaaS: Provides virtualized computing resources over the internet.. IaaS, PaaS, SaaS, and FaaS are common cloud service models. IaaS provides virtualized hardware, PaaS provides a development platform, SaaS provides ready-to-use software, and FaaS provides event-driven code execution. Common confusions include swapping IaaS and PaaS definitions.

Answer

IaaS: Provides a platform for developing and deploying applications.

Answer

PaaS: Provides virtualized computing resources such as virtual machines.

Question 13

Match each compute service to its description.

Accepted Answer

Virtual Machines: Provides virtualized hardware allowing full control over the operating system and software stack.. Correct matches: Virtual Machines provide virtualized hardware; Containers package code and dependencies; Serverless Functions run code on demand; Bare Metal offers dedicated hardware. Common confusions include mixing containers with VMs and serverless with bare metal.

Answer

Virtual Machines: Packages code and dependencies to run consistently across environments.

Answer

Bare Metal: Executes code in response to events without server management.

Question 14

A company recently migrated an application to the cloud. The application uses a load balancer in front of multiple EC2 instances. After the migration, users report that they occasionally receive 'Connection refused' errors. The administrator checks the load balancer health check logs and finds that some instances are marked unhealthy intermittently. The application's health check endpoint returns HTTP 200 when tested manually from the admin's workstation. What is the most likely cause?

Accepted Answer

Security group rules blocking the load balancer health checks. The load balancer health checks are failing intermittently because the security group rules are blocking the health check traffic from the load balancer. When the health checks are blocked, the instances appear unhealthy. Manual testing from the admin's workstation works because the workstation is not subject to those security group rules. Option A (short interval) would cause more frequent health checks, not intermittent failures. Option C (memory exhaustion) would cause persistent failures. Option D (incorrect IP binding) would also cause persistent failures. Therefore, the most likely cause is B.

Answer

The health check interval is too short

Answer

The instances are running out of memory

Answer

The application is not binding to the correct IP address

Question 15

A company is migrating 50 TB of data from an on-premises file server to Amazon S3. The migration must be completed within two weeks and the internet connection is slow. Which TWO AWS services can accelerate the transfer?

Accepted Answer

AWS Snowball. AWS Snowball (Option D) is a petabyte-scale data transport solution that uses secure physical devices to transfer large amounts of data to AWS, bypassing the internet entirely. For a 50 TB migration over a slow connection within a two-week window, Snowball is ideal because it avoids network bandwidth constraints and can transfer data at the speed of shipping, not the internet.

Answer

Amazon S3 multipart upload

Answer

AWS Direct Connect

Answer

AWS DataSync