CV0-004 Practice Test 36 — 15 Questions

Question 1

A cloud administrator is troubleshooting a performance issue with a relational database hosted on a cloud provider. The application team reports that queries are taking much longer than usual. The administrator checks the database monitoring dashboard and sees that the queries per second are within normal ranges, but the average query latency has doubled. The database is running on a VM with 4 vCPUs and 16 GB RAM. The storage type is SSD-backed General Purpose (GP2) with provisioned 3000 IOPS. The administrator notices that the Disk I/O Wait metric is consistently above 20%. What should the administrator do to improve query performance?

Accepted Answer

Increase the provisioned IOPS or upgrade to a higher-performance storage class like Provisioned IOPS SSD.. High I/O Wait indicates that the CPU is spending significant time waiting for disk I/O to complete. Increasing storage IOPS or switching to a higher-performance storage class (e.g., Provisioned IOPS SSD) will reduce I/O latency and improve query performance. Option B directly addresses the bottleneck.

Answer

Shrink the database by archiving old data.

Answer

Add more memory to the VM to increase the database cache.

Answer

Add more vCPUs to the database VM.

Question 2

A company has a cloud-based application that uses an auto-scaling group across multiple Availability Zones (AZs). The application experiences periodic spikes in traffic. The auto-scaling policy uses a step scaling policy based on CPU utilization. The operations team notices that during a traffic spike, new instances are launched but take over five minutes to become healthy and begin serving traffic. During this time, existing instances are overloaded and some requests fail. The team wants to reduce the time it takes for new instances to handle traffic. Which action would be most effective?

Accepted Answer

Use a pre-warmed, customized AMI with the application pre-installed and caches preloaded.. Using a pre-warmed AMI with the application stack already configured and caching enabled significantly reduces the time required for an instance to become healthy because it avoids the need to install dependencies and warm caches on each startup.

Answer

Increase the instance type to a larger size so each instance can handle more traffic.

Answer

Reduce the cooldown period in the scaling policy to launch instances faster.

Answer

Move all instances to a single AZ to avoid cross-AZ latency.

Question 3

A company has a hybrid cloud environment with an on-premises data center and Microsoft Azure. The on-premises infrastructure includes a VPN gateway connected to an Azure virtual network via site-to-site VPN. The network team reports that traffic from on-premises to Azure is experiencing high latency and packet loss. The VPN tunnel status shows as connected. The team has verified that the on-premises firewall is not dropping packets. The Azure administrator checks the virtual network gateway metrics and sees high inbound packet drops and a high number of VPN tunnel rekeys. What is the MOST likely cause of the issue?

Accepted Answer

The VPN gateway SKU is too small for the traffic volume.. Option A is correct because a VPN gateway SKU that is too small for the traffic volume causes packet drops and frequent rekeys, leading to high latency and loss. Option B is wrong because a misconfigured local network gateway address space would cause connectivity failure, not just high latency. Option C is wrong because mismatched encryption algorithms would prevent the tunnel from establishing or cause constant renegotiation, not just increased rekeys. Option D is wrong because overlapping address spaces would cause routing conflicts and connectivity issues, not specifically packet drops and rekeys.

Answer

The on-premises VPN device does not support the same encryption algorithms.

Answer

The Azure virtual network has overlapping address space with on-premises.

Answer

There is a misconfiguration in the local network gateway address space.

Question 4

A cloud administrator notices that a virtual machine (VM) hosting a web application is consistently running at 95% CPU utilization during business hours. End users complain that the application is slow. The application is stateless and can scale horizontally. The VM is part of an auto-scaling group configured with a target tracking scaling policy based on average CPU utilization. The administrator checks CloudWatch metrics and sees that the CPU utilization has been above the target of 70% for the last two hours, but no new instances have been launched. What should the administrator do FIRST to resolve the issue?

Accepted Answer

Verify that the CloudWatch agent is sending CPU metrics and that the metric names match the scaling policy configuration.. The auto-scaling policy is not triggering despite sustained high CPU. The most likely cause is that the metric collection is not functioning correctly. Checking the CloudWatch agent and metrics will reveal if data is being sent properly. Option B is the correct first step because without valid metrics, auto-scaling cannot adjust capacity.

Answer

Manually increase the desired capacity of the auto-scaling group.

Answer

Reduce the target tracking value to 50% so scaling happens sooner.

Answer

Replace the instance with a larger instance type that has more vCPUs.

Question 5

A cloud administrator receives an alert that a storage bucket containing sensitive customer data has been accessed from an unknown IP address at 3:00 AM. The bucket policy is configured to allow access only from the corporate VPN CIDR block (10.0.0.0/8). The administrator checks the access logs and sees that the request originated from 203.0.113.50, which is not within the allowed range. The bucket policy also includes a condition that restricts access to Secure Transport (SSL). What is the most likely reason the request succeeded despite the policy?

Accepted Answer

The policy has an Allow statement that permits all accesses using SSL, without restricting the source IP.. If the bucket policy has a condition that checks only for Secure Transport (aws:SecureTransport) but does not explicitly deny IP addresses, a Deny statement with a Null condition on IP address might be misconfigured, or the IP address condition is not applied correctly. The most common error is that the policy allows all requests that use SSL, overriding the IP restriction. Option C correctly identifies that the SSL condition might be too permissive.

Answer

The access logs are spoofed; the request actually came from a corporate IP.

Answer

The unknown IP address is part of a misconfigured VPN client that still appears as the corporate CIDR.

Answer

The bucket policy is missing an explicit Deny statement for IP addresses outside the allowed range.

Question 6

A multinational corporation runs a critical application on a private cloud hosted in their data center. The application uses virtual machines (VMs) that are attached to a storage area network (SAN) for block storage. The company is migrating the application to a public cloud IaaS model to reduce on-premises costs. The security team mandates that all data at rest in the cloud must be encrypted using customer-managed keys, and the cloud provider must not have access to the keys. The application requires low-latency block storage for a database. The storage must be replicated within the same region for availability. The cloud architect needs to choose a storage solution that meets these security and performance requirements. The cloud provider offers: (A) Object storage with server-side encryption using provider-managed keys. (B) Ephemeral instance storage with encryption at rest using provider-managed keys. (C) Persistent block storage volumes with encryption using customer-managed keys stored in the provider's key management service (KMS) integrated with hardware security modules (HSM). (D) Network file system (NFS) shares encrypted with customer-managed keys managed on-premises. Which option should the architect choose?

Accepted Answer

Persistent block storage volumes with encryption using customer-managed keys stored in the provider's KMS/HSM.. Option C is correct because it provides persistent block storage for low-latency database needs, and the encryption uses customer-managed keys stored in the provider's KMS/HSM, ensuring the provider cannot access the keys (the keys are encrypted by HSM and the customer retains control). Option A is wrong because object storage is not suitable for low-latency block storage, and the keys are provider-managed. Option B is wrong because ephemeral storage is not persistent and replication is not guaranteed; also provider-managed keys. Option D is wrong because NFS is file storage, not block, and managing keys on-premises would add latency and complexity.

Answer

Object storage with server-side encryption using provider-managed keys.

Answer

Ephemeral instance storage with encryption at rest using provider-managed keys.

Answer

Network file system (NFS) shares encrypted with customer-managed keys managed on-premises.

Question 7

A healthcare organization uses a cloud-based virtual private cloud (VPC) to host a web application that processes protected health information (PHI). The application consists of a public-facing load balancer, a web server tier in a public subnet, and a database tier in a private subnet. The database runs on a managed relational database service with encryption at rest enabled using a cloud provider-managed key. The security auditor requires that the database encryption key must be controlled by the organization and rotated every 90 days. Additionally, the database must only be accessible from the web server tier. The database is currently accessible from the entire VPC CIDR block. What should the cloud administrator do to meet these requirements?

Accepted Answer

Re-encrypt the database using a customer-managed key in the cloud provider's key management service, and update the database security group to only allow traffic from the web server security group.. Option B is correct because enabling encryption using a customer-managed key in the provider's KMS allows the organization to control and rotate the key, and updating the security group to allow traffic only from the web server tier's security group restricts access. Option A is wrong because provider-managed keys do not give the organization control. Option C is wrong because moving to an unencrypted database is not acceptable. Option D is wrong because encrypting the web server does not address database encryption or access control.

Answer

Export the database, disable encryption, and import into a new database with a customer-managed key.

Answer

Enable encryption with a provider-managed key and restrict database access using a network ACL.

Answer

Encrypt the web server's storage with a customer-managed key and keep the database encryption as is.

Question 8

A small business uses a public cloud IaaS to host a single Windows virtual machine (VM) running a line-of-business application. The VM has a public IP address and is in a network security group that allows RDP (port 3389) from the internet (0.0.0.0/0). The administrator frequently connects from home and various client sites. The administrator is concerned about brute force attacks on the RDP service. The business does not have a VPN server. What is the best way to secure the RDP access without changing the public IP address or blocking all external access?

Accepted Answer

Remove the public IP address and use a bastion service like Azure Bastion or AWS Systems Manager Session Manager to access the VM via RDP over HTTPS.. Option C is correct because using Azure Bastion or AWS Systems Manager Session Manager allows RDP access without exposing a public RDP port. Option A is wrong because changing the port is security through obscurity and does not prevent brute force. Option B is wrong because enabling MFA on the VM itself is not straightforward without domain join, and still leaves port open. Option D is wrong because disabling password and using only certificates still leaves the port open to brute force on the certificate challenges.

Answer

Change the RDP port to a non-standard port (e.g., 3390).

Answer

Enable multi-factor authentication (MFA) on the local Windows user accounts.

Answer

Disable password authentication and require smart card certificates for RDP.

Question 9

A company hosts its critical applications on a cloud provider's virtual machines within a virtual private cloud. The security team receives an alert from the intrusion detection system indicating that one of the VMs is exhibiting signs of a ransomware infection. The administrator connects to the VM via a bastion host and observes that several important files have been encrypted and a ransom note has been left. The incident response plan is still being developed, but the administrator knows the immediate priority is to contain the threat and prevent it from spreading to other VMs and storage resources. The company has daily backups stored in a separate cloud storage service that is not directly accessible from the production network. Which of the following actions should the administrator take FIRST to contain the incident and minimize further damage?

Accepted Answer

Immediately disconnect the network interface of the infected VM.. Isolating the infected VM by disconnecting its network interface stops the ransomware from communicating with command-and-control servers and prevents lateral movement. Restoring from backup without verification may reintroduce the infection. Notifying law enforcement is important but not the first step. Running antivirus on the active VM could trigger further encryption or be ineffective.

Answer

Restore the VM from the most recent backup.

Answer

Notify law enforcement about the ransomware attack.

Answer

Run a full antivirus scan on the infected VM.

Question 10

A company uses a multi-account AWS organization with separate accounts for development, testing, and production. A developer in the development account needs to access an S3 bucket in the production account to retrieve log files for troubleshooting. The developer has an IAM user in the development account with full S3 permissions, and the production account's S3 bucket policy includes a statement that grants access to the root user of the development account. However, when the developer attempts to access the bucket using AWS CLI with their IAM user credentials, they receive an 'Access Denied' error. The security team has verified that there are no explicit deny policies in either account, and that the bucket policy is correctly configured. The administrator has confirmed that the developer's IAM user has permissions to perform S3 operations. Which of the following is the MOST likely cause of the access failure?

Accepted Answer

The production account must have an IAM role with a trust policy that allows the development account to assume it.. Cross-account S3 access typically requires the developer to assume an IAM role in the production account with a trust policy allowing the development account. The bucket policy granting access to the root user of the development account does not automatically grant access to IAM users in that account; the users must assume the role to get temporary credentials. Adding the user to a group in the target account is not possible across accounts. Using root credentials is insecure. VPC peering addresses network connectivity, not IAM permissions.

Answer

The developer's IAM user needs to be added to an IAM group in the production account.

Answer

A VPC peering connection must be established between the two accounts.

Answer

The developer should use the root user credentials of the development account to access the bucket.

Question 11

A company runs a critical e-commerce application on a private cloud using OpenStack. The application consists of web servers, application servers, and a MySQL database running on separate VMs. Recently, users have reported intermittent 502 Bad Gateway errors during peak hours. The operations team notices that the web server VMs show high CPU ready times and the application server VMs have increased network latency. Storage performance also shows high await times on the SSD-based Ceph cluster. The team suspects resource contention. Which of the following is the BEST course of action to diagnose and resolve the issue?

Accepted Answer

Review the hypervisor's CPU and memory allocation ratios and adjust overcommitment settings.. Option D is correct because high CPU ready times and overall contention indicate overcommitment on the hypervisors. Adjusting overcommitment ratios can reduce contention across CPU, memory, and storage. Option A is incorrect because adding vCPUs may worsen contention. Option B is a temporary fix and does not address the root cause. Option C only addresses storage and not CPU/network contention.

Answer

Migrate the web server VMs to a different compute host using live migration.

Answer

Increase the number of vCPUs for each web server VM to reduce CPU ready time.

Answer

Implement quality of service (QoS) policies on the Ceph cluster to guarantee IOPS for the database.

Question 12

A cloud administrator is troubleshooting a database failover issue. The database is a managed service with a primary and standby replica in different availability zones. The application uses a read-write endpoint. During a recent maintenance event, the primary database failed over automatically, but the application experienced a 10-minute outage. The administrator checks the failover logs and sees that it completed within 2 minutes. What is the most likely cause of the extended outage?

Accepted Answer

The application's database connection pool does not retry DNS resolution. Option A is correct because if the application's connection pool caches the IP address of the primary database, it will not automatically re-resolve the DNS after failover, causing prolonged outages. Option B is wrong because if the standby was out of sync, failover would not complete cleanly. Option C is wrong because the DNS change is usually fast but the application may not re-query DNS. Option D is wrong because multi-AZ configuration is about the database, not the application's endpoint configuration.

Answer

The application was not configured to use multiple availability zones

Answer

The standby replica was not in sync

Answer

The failover triggered a change in the endpoint DNS record

Question 13

A small business hosts a web application on a single cloud server. The server has 2 vCPUs and 4 GB RAM. Recently, the application crashes when the number of concurrent users exceeds 50. The administrator checks the system logs and finds out-of-memory (OOM) errors. What is the best course of action to resolve this issue without redesigning the application?

Accepted Answer

Increase the server's RAM to 8 GB. Option A is correct because increasing RAM directly addresses the OOM errors and is the simplest fix. Option B is wrong because adding a load balancer and another server is more complex and may require application changes. Option C is wrong because enabling swap space is a temporary workaround that can degrade performance. Option D is wrong because code optimization is a redesign effort and not a quick fix.

Answer

Add a load balancer and another server

Answer

Reduce the application's memory footprint by code optimization

Answer

Enable swap space on the server

Question 14

A cloud administrator is responsible for a multi-tier application hosted in a public cloud. The application consists of a web tier, application tier, and database tier. Recently, users have reported that the application is responding slowly during peak hours. The administrator checks the cloud monitoring dashboard and notices that the web tier instances are running at 90% CPU utilization, but the auto-scaling group has not triggered any scaling events. The scaling policy is set to scale out when average CPU exceeds 80% for 5 minutes. What should the administrator do to resolve this issue?

Accepted Answer

Review the cooldown period settings of the auto-scaling group. Option B is correct because a cooldown period that is too long can prevent new instances from being added even if the threshold is exceeded. Option A is wrong because manual scaling is a temporary fix, not addressing the root cause. Option C is wrong because health checks don't affect scaling triggers. Option D is wrong because raising the threshold would worsen the issue.

Answer

Manually increase the number of web tier instances

Answer

Increase the CPU threshold to 95% to avoid unnecessary scaling

Answer

Check the health check configuration of the load balancer

Question 15

An organization is using a hybrid cloud model with an on-premises data center connected to a public cloud via a dedicated Direct Connect circuit. Users on the corporate network report that access to cloud resources is intermittently failing. The cloud administrator pings the cloud gateway and sees packet loss. The on-premises network team confirms no issues on their side. The administrator reviews the cloud provider's status page and finds no outages. What should the administrator do next?

Accepted Answer

Check the bandwidth utilization on the Direct Connect circuit. Option C is correct because intermittent packet loss and no provider outage suggest bandwidth saturation on the Direct Connect circuit. Option A is wrong because failing over to a VPN may not address the root cause and could mask it. Option B is wrong because rebooting the on-premises router is disruptive and doesn't troubleshoot bandwidth. Option D is wrong because a support ticket is unlikely to help if the provider has no issues and the circuit is simply congested.

Answer

Submit a support ticket to the cloud provider

Answer

Reboot the on-premises router

Answer

Failover to a backup VPN connection