CV0-004 Practice Test 35 — 15 Questions

Question 1

During a security audit, it is discovered that a cloud application can be accessed using a shared service account that has elevated privileges. The audit recommends implementing a just-in-time (JIT) access model. What is the primary benefit of JIT access in this scenario?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Reduces the attack surface by minimizing persistent privileged access.. Just-in-time (JIT) access grants privileged permissions only for a limited, approved window and revokes them automatically afterward, rather than leaving standing elevated privileges in place. In this scenario, replacing the shared always-privileged service account with JIT access removes persistent high-privilege credentials that attackers could abuse, directly shrinking the attack surface. This is the core security benefit JIT is designed to deliver.

Answer

Automates auditing of third-party access.

Answer

Allows for easier management of user identities.

Answer

Eliminates the need for user authentication.

Question 2

A DevOps team wants to deploy a Kubernetes application using a package manager that simplifies the deployment process by bundling all Kubernetes resources into a single package. Which tool should the team use?

Accepted Answer

Helm. Helm is the package manager for Kubernetes that uses charts to define, install, and upgrade even the most complex Kubernetes applications.

Answer

Kustomize

Answer

Ansible

Answer

Terraform

Question 3

A cloud administrator needs to apply security patches to a group of Windows servers during a maintenance window to minimize disruption. Which type of service should be used?

Accepted Answer

Patch automation service with maintenance window scheduling. The administrator needs to apply security patches to a group of Windows servers during a specific maintenance window to minimize disruption. A patch automation service with maintenance window scheduling is designed exactly for this purpose: it automates the deployment of patches and allows scheduling within defined windows, ensuring updates occur only during approved times. This directly addresses the requirement to apply patches while controlling when they happen to avoid service interruptions.

Answer

Vulnerability assessment service

Answer

Configuration compliance service

Answer

Configuration management and automation service

Question 4

A cloud engineer deploys the Kubernetes manifest shown in the exhibit. After deployment, the frontend pods are in CrashLoopBackOff state. The engineer checks the logs and finds 'OOMKilled' errors. Which of the following changes would resolve the issue?

Accepted Answer

Increase the memory limit to 1Gi.. The 'OOMKilled' error indicates the container's memory usage exceeded its configured limit, causing the kernel's Out-Of-Memory (OOM) killer to terminate the process. Increasing the memory limit to 1Gi provides the container with more memory headroom, preventing the OOM kill and allowing the pod to run without crashing.

Answer

Increase the number of replicas to 5.

Answer

Reduce the CPU limit to 250m.

Answer

Change the service type to ClusterIP.

Question 5

A cloud administrator is deploying a virtual machine (VM) in a public cloud and must ensure that the VM can be recovered quickly in case of failure. The administrator configures the VM to use a managed disk. What additional deployment step should be taken to meet the recovery objective with minimal cost?

Accepted Answer

Configure automated snapshots of the managed disk on a schedule.. Configuring automated snapshots of the managed disk provides a cost-effective, incremental backup mechanism that enables rapid recovery of the VM in case of failure. Snapshots capture point-in-time copies of the disk and can be used to create a new managed disk or restore the VM quickly, meeting the recovery objective without the expense of maintaining a separate, always-on replica.

Answer

Set the VM's boot diagnostics to store logs in a storage account.

Answer

Deploy a second VM in a different region as a pilot light.

Answer

Attach the VM to multiple managed disks in an availability set.

Question 6

A company's cloud environment uses a shared responsibility model. The security team notices that a data breach occurred due to misconfigured storage buckets in the public cloud. Which party is primarily responsible for this misconfiguration according to the shared responsibility model?

Accepted Answer

The customer. Under the shared responsibility model, the cloud customer is always responsible for securing their own data and configuring their own resources, including storage bucket permissions. Misconfigured storage buckets are a customer-side configuration error, not a provider failure. The provider secures the infrastructure, but the customer secures what they put in it and how they configure access.

Answer

The cloud service provider

Answer

The cloud auditor

Answer

A third-party security vendor

Question 7

A cloud administrator needs to centralize logs from multiple AWS services, including VPC flow logs and application logs, to enable searching and querying. Which solution should be used?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the native centralized log management service that ingests logs from EC2, Lambda, VPC Flow Logs, CloudTrail, and application sources, and provides Logs Insights for searching and querying. It supports metric filters, alarms, and subscription filters for downstream processing, making it the correct choice for centralized search and query across multiple AWS services.

Answer

AWS CloudTrail

Answer

Amazon S3 with Athena

Answer

AWS Config

Question 8

A cloud architect is designing a multi-tier application. The application tier needs to access a database, but the database should not be reachable from the internet. Which network security control should be used?

Accepted Answer

Place the database in a private subnet and use a security group to allow traffic only from the application tier. Placing the database in a private subnet with no direct internet route ensures it is not reachable from the internet. Security groups can then allow inbound traffic only from the application tier's security group.

Answer

Encrypt the database connection using TLS

Answer

Use a VPN to connect the application tier to the database

Answer

Place the database in a public subnet with restrictive security groups

Question 9

A company is migrating a legacy monolithic application to the cloud. The application currently runs on a single server with 16 vCPUs and 64 GB RAM. The cloud architect recommends redesigning the application to be stateless and horizontally scalable. What is the primary benefit of this approach?

Accepted Answer

Improved fault tolerance and elasticity. Redesigning a monolithic application to be stateless and horizontally scalable primarily improves fault tolerance and elasticity. Stateless components can be replicated across multiple instances, so if one fails, others continue to serve requests. Horizontal scaling allows the application to handle varying loads by adding or removing instances dynamically.

Answer

Lower storage costs

Answer

Simpler licensing costs

Answer

Reduced network latency

Question 10

An organization wants to deploy a new microservice to a Kubernetes cluster with zero downtime. The deployment should update pods gradually by replacing old pods with new ones, and if the new pods fail health checks, the rollout should stop. Which Kubernetes deployment strategy meets these requirements?

Accepted Answer

Rolling update. A rolling update strategy in Kubernetes replaces pods incrementally and can be configured to pause on failed health checks.

Answer

Canary

Answer

Recreate

Answer

Blue/green

Question 11

A cloud engineer is troubleshooting a network connectivity issue between two VPCs in AWS. To analyze traffic patterns and identify dropped packets, which feature should be enabled?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC, useful for troubleshooting connectivity and security issues.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS X-Ray

Question 12

After deploying a new cloud application, users report that they cannot connect to the application. The cloud administrator checks the security group rules and finds that the inbound rule for HTTP traffic is missing. What is the best practice to prevent this issue in future deployments?

Accepted Answer

Use an Infrastructure as Code (IaC) template to define security group rules.. Using an Infrastructure as Code (IaC) template to define security group rules ensures that the required inbound HTTP rule is codified, version-controlled, and automatically applied in every deployment. This eliminates human error and enforces consistency across environments. IaC tools like Terraform, CloudFormation, or ARM templates allow you to declare the desired state, so missing rules are caught during deployment or CI/CD validation.

Answer

Create a checklist for manual review before each deployment.

Answer

Clone a security group that already has the correct rules.

Answer

Configure the security group to allow all traffic by default.

Question 13

A cloud engineer needs to implement a solution to automatically scale an application based on the number of messages in an SQS queue. The goal is to keep the queue length short. Which Auto Scaling policy type should the engineer use?

Accepted Answer

Target tracking scaling. Target tracking scaling is ideal when you want to maintain a metric at a target value — here, keeping SQS queue length (ApproximateNumberOfMessagesVisible) at a low target. Auto Scaling automatically adjusts capacity to keep the metric near the target, which directly satisfies the goal of keeping the queue short. It's the recommended policy for queue-depth-driven scaling.

Answer

Step scaling

Answer

Simple scaling

Answer

Scheduled scaling

Question 14

A company wants to track cloud spending by department and project. Which strategy should be implemented to enable cost attribution?

Accepted Answer

Implement a resource tagging strategy. Resource tagging is the foundational mechanism for cost attribution in cloud environments. By applying consistent key-value tags (e.g., Department=Finance, Project=Alpha) to every resource, billing systems can group and filter costs along those dimensions. AWS Cost Explorer, Azure Cost Management, and GCP Billing all support grouping by tag, which directly answers the requirement to track spending by department and project.

Answer

Use a single account for all workloads

Answer

Enable detailed billing reports

Answer

Use AWS Organizations only

Question 15

A cloud administrator is setting up auto-scaling for a web application that uses an SQS queue for incoming requests. The administrator wants to scale the number of EC2 instances based on the queue depth. Which two metrics are appropriate for this auto-scaling policy? (Choose TWO.)

Accepted Answer

ApproximateNumberOfMessagesVisible (queue depth). Option B, ApproximateNumberOfMessagesVisible (queue depth), is correct because it is the native CloudWatch metric that reports how many messages are available in the SQS queue, directly reflecting the incoming workload that the EC2 fleet must process. Option E, BacklogPerInstance (queue depth per instance), is correct because it is a custom metric that divides the queue backlog by the number of running instances, giving a per-instance workload signal that is ideal for target-tracking scaling policies on an SQS-backed web tier. Options A (CPU utilization) and C (memory utilization) are not appropriate here because the workload is driven by queue depth rather than instance-level compute or memory pressure, and memory utilization is not even a default CloudWatch EC2 metric. Option D (network throughput) is also unsuitable because it measures data transfer volume, not the amount of pending work in the queue, so it would not reliably track the backlog the application must drain.

Answer

CPU utilization of instances

Answer

Memory utilization of instances

Answer

Network throughput