CV0-004 Practice Test 36 — 15 Questions

Question 1

A cloud administrator is tasked with ensuring that all API requests to the cloud management plane are encrypted. Which protocol should be enforced to meet this requirement?

Accepted Answer

TLS. TLS (Transport Layer Security) is the protocol that encrypts API requests to cloud management planes, securing data in transit over HTTPS. All major cloud providers expose their management APIs exclusively over TLS, and enforcing TLS 1.2 or higher is the standard requirement for encrypted control-plane traffic. TLS is the successor to SSL and is the correct modern answer.

Answer

IPsec

Answer

SSL

Answer

SSH

Question 2

A company is experiencing latency issues when accessing a cloud-based application. The cloud administrator runs a traceroute and notices high latency at the ISP's edge router. Which of the following is the MOST likely cause?

Accepted Answer

An internet service provider (ISP) issue is degrading the WAN connection. High latency at the ISP's edge router indicates that the bottleneck is occurring on the WAN link between the company's network and the cloud provider, which is under the ISP's control. This is a classic symptom of an ISP issue, such as congestion, routing problems, or a degraded physical link, directly impacting the WAN connection. The traceroute output localizes the latency to the ISP's infrastructure, not to the company's internal network or the cloud application's resources.

Answer

A misconfigured firewall rule is dropping packets

Answer

The load balancer is sending traffic to unhealthy instances

Answer

The virtual machine hosting the application is under-provisioned

Question 3

A cloud operations team is preparing for a disaster recovery drill for a multi-tier application. Which TWO activities are essential for verifying the effectiveness of the DR plan? (Select TWO.)

Accepted Answer

Verify the RTO and RPO are achieved. Option A is correct because the Recovery Time Objective (RTO) and Recovery Point Objective (RPO) are the measurable targets that define how quickly and how much data the DR plan must restore, so verifying they are actually achieved during the drill is the core proof that the plan meets business requirements. Option D is correct because a failover test to the DR site exercises the real recovery procedures—bringing up the standby environment, redirecting traffic, and validating application functionality—which is the only way to confirm the plan works end to end rather than just on paper. The remaining options, while valuable in other contexts, are not essential DR effectiveness checks: reviewing the incident response plan (B) addresses incident handling rather than recovery validation, updating the asset inventory (C) is a documentation/hygiene task, and conducting a security audit (E) assesses security controls, not recovery capability.

Answer

Review the incident response plan

Answer

Update the asset inventory

Answer

Conduct a security audit

Question 4

A cloud administrator notices that an Auto Scaling group is launching and terminating instances too frequently, causing instability. What should the administrator adjust to reduce this flapping behavior?

Accepted Answer

Increase the cooldown period. Increasing the cooldown period gives instances time to stabilize before additional scaling actions, reducing flapping.

Answer

Disable the cooldown period

Answer

Decrease the cooldown period

Answer

Increase the scale-out threshold

Question 5

Which GCP service provides centralized log management and analysis with the ability to create log-based metrics and alerts?

Accepted Answer

GCP Cloud Logging. Cloud Logging is Google Cloud's centralized log management service, providing ingestion, storage, search, and analysis of logs from all GCP services and custom sources. It supports log-based metrics that convert log entries into time-series data, which can then be used by Cloud Monitoring to create alerts and dashboards. This makes Cloud Logging the correct answer for centralized log management with metric and alert creation capabilities.

Answer

GCP Cloud Monitoring

Answer

GCP Cloud Audit Logs

Answer

GCP Cloud Trace

Question 6

A DevOps team uses CloudFormation to manage multi-account infrastructure. They need to deploy a common set of resources across multiple AWS accounts in an organization. Which CloudFormation feature should they use?

Accepted Answer

Stack sets. CloudFormation StackSets allow a single template to be deployed across multiple AWS accounts and regions from a central administrator account, which is exactly what the DevOps team needs for multi-account infrastructure. StackSets support automatic deployment to new accounts as they join the organization and can use service-managed permissions for Organizations integration. This makes it the correct feature for cross-account, multi-region rollouts.

Answer

Nested stacks

Answer

Drift detection

Answer

Change sets

Question 7

A cloud administrator is deploying a new application in a cloud environment. The application requires high availability and fault tolerance. Which two design principles should the administrator implement? (Select TWO).

Accepted Answer

Place a load balancer in front of the application.. Option A is correct because placing a load balancer in front of the application distributes incoming traffic across multiple healthy backend instances, eliminating a single point of failure and enabling continued service if one instance fails, which directly supports high availability. Option B is correct because an auto-scaling group spanning multiple availability zones automatically replaces failed instances and balances capacity across physically separate data centers, providing both fault tolerance against an AZ outage and elasticity for demand changes. Option C is incorrect because confining all instances to a single availability zone means an AZ-level failure takes down the entire application, defeating fault tolerance. Option D is incorrect because a single instance is a single point of failure with no redundancy, so any instance or host failure causes an outage. Option E is incorrect because a single unreplicated volume is a single point of failure for data, risking permanent data loss and preventing recovery from storage failure.

Answer

Deploy all instances in a single availability zone.

Answer

Use a single instance to reduce costs.

Answer

Store all data on a single volume without replication.

Question 8

A DevOps team uses Ansible to automate cloud resource provisioning. Which of the following best describes Ansible's architecture?

Accepted Answer

It is agentless and uses SSH or WinRM to execute tasks.. Ansible is agentless and uses SSH (for Linux/Unix) or WinRM (for Windows) to execute tasks on managed nodes. The control node pushes modules to target hosts over these standard protocols, executes them, and removes them — no persistent agent or daemon is required on managed nodes.

Answer

It uses a declarative language similar to Terraform.

Answer

It uses a master-server architecture with a central controller.

Answer

It requires an agent installed on each managed node.

Question 9

A company wants to implement a tagging strategy for their cloud resources to track costs by department and project. Tags must be applied to resources such as virtual machines and storage buckets. Which of the following is a best practice for cost attribution using tags?

Accepted Answer

Define a set of mandatory tag keys such as CostCenter, Project, and Environment with standardized values.. Standardized, mandatory tag keys with controlled values (e.g., CostCenter, Project, Environment) ensure consistent cost allocation across all resources and prevent drift. This enables reliable grouping in billing reports and enforces governance via policies like AWS Tag Policies or Azure Policy. Without a defined schema, cost attribution becomes unreliable and reports fragment.

Answer

Apply tags to resources only after creation to avoid governance issues.

Answer

Use a single tag key 'Environment' with values 'Production' or 'Development'.

Answer

Use free-form text for tag values to allow flexibility.

Question 10

A cloud administrator needs to detect unusual spikes in CPU usage across a fleet of EC2 instances. Which AWS service should be used to create an alarm that triggers when CPU utilization exceeds an expected baseline?

Accepted Answer

AWS CloudWatch Alarms with anomaly detection. Amazon CloudWatch Alarms supports anomaly detection bands, which use machine learning to establish a normal baseline for a metric such as CPUUtilization and then alarm when the metric falls outside the expected band. This is the correct service for detecting unusual spikes relative to a learned baseline across a fleet of EC2 instances.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

AWS Systems Manager

Question 11

A cloud engineer is troubleshooting a performance issue in a multi-tier application on AWS. The web tier shows high latency, but the application logs indicate no errors. The engineer wants to trace a request end-to-end across services. Which AWS service should be used?

Accepted Answer

AWS X-Ray. AWS X-Ray provides distributed tracing, allowing you to trace requests as they travel through your application and identify performance bottlenecks.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 12

A virtual machine in a cloud environment is experiencing high disk I/O latency. The administrator checks the performance metrics and sees that the disk queue length is consistently above 100. What is the best immediate action?

Accepted Answer

Attach an additional disk and stripe the data. Attach an additional disk and stripe the data. A high disk queue length indicates that the disk is overwhelmed with I/O requests. Stripping data across multiple disks (e.g., RAID 0) distributes the I/O load, reducing queue length and latency. Option B is wrong because network bandwidth does not affect disk I/O. Option C is wrong because migrating to a host with faster disks may help but is not the immediate action; adding disks is quicker and more direct. Option D is wrong because increasing memory does not directly improve disk I/O performance.

Answer

Upgrade the VM's network bandwidth

Answer

Migrate the VM to a host with faster disks

Answer

Increase the VM's memory

Question 13

A cloud engineer is troubleshooting an issue where a virtual machine (VM) in a VPC cannot communicate with an on-premises database server through a site-to-site VPN. The VPN tunnel status shows 'UP' and the on-premises firewall logs show packets from the VM's public IP (but the VM is in a private subnet with no public IP). What is the MOST likely cause?

Accepted Answer

The route table for the subnet is missing a route to the on-premises network via the VPN.. The VPN tunnel status is 'UP' and the on-premises firewall sees packets from the VM's public IP, but the VM is in a private subnet with no public IP. This indicates that the VM's traffic is being sent to the internet instead of through the VPN tunnel. The most likely cause is that the subnet's route table lacks a specific route directing traffic destined for the on-premises network to the virtual private gateway (VGW) or VPN connection, causing the traffic to be routed to the internet gateway (IGW) and source-NATed to the public IP.

Answer

The on-premises firewall is blocking the VM's private IP address.

Answer

The VM's security group is blocking outbound traffic to the on-premises subnet.

Answer

The VPN tunnel is misconfigured with mismatched pre-shared keys.

Question 14

Which THREE of the following are common causes of application performance degradation in a cloud environment? (Choose three.)

Accepted Answer

Network latency and bandwidth limitations. Option B (Network latency and bandwidth limitations) is correct because in cloud environments traffic often traverses multiple network hops, availability zones, or regions, and high round-trip latency or constrained throughput directly slows request/response times for distributed applications. Option C (Application code that is poorly optimized) is correct because inefficient algorithms, unindexed database queries, memory leaks, or excessive synchronous calls consume more CPU, memory, and I/O than necessary, degrading performance regardless of how much infrastructure is provisioned. Option D (Resource exhaustion (CPU, memory, disk I/O)) is correct because when an instance or container saturates its vCPU credits, RAM, or IOPS/throughput limits, requests queue and latency rises sharply, a very common cloud scaling failure mode. Option A is not a cause of performance degradation: security groups are stateful firewalls that filter traffic, and having too few of them affects access control and manageability, not application speed. Option E is not correct because overprovisioned storage provides excess capacity and typically does not degrade performance; performance issues more often stem from underprovisioned IOPS or throughput, not from having more storage than needed.

Answer

Insufficient number of security groups

Answer

Overprovisioned storage

Question 15

A cloud engineer wants to view a dashboard showing cost breakdown by department. Which tool provides pre-built billing dashboards?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer includes pre-built reports and dashboards that break down costs by dimensions such as service, linked account, and tag, which can represent departments. It is the native AWS tool for visualizing and analyzing billing data, including cost by department when tags are used.

Answer

AWS CloudWatch

Answer

AWS Trusted Advisor

Answer

AWS Config