CV0-004 Practice Test 37 — 15 Questions

Question 1

A cloud administrator notices that a cloud-based application is running slowly. The administrator checks the cloud monitoring dashboard and sees that CPU utilization is at 95% for the application server. Which of the following should the administrator do first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Scale out by adding another instance.. The correct first step is to scale out by adding another instance (Option B). CPU utilization at 95% indicates a compute bottleneck. Scaling out distributes the workload across multiple instances, increasing total CPU capacity and reducing pressure on the original server. Adding a network interface (A) addresses network throughput, not CPU. Rebooting (C) provides only temporary relief and does not add capacity. Increasing memory (D) may help if the bottleneck is memory, but the monitoring shows CPU is the issue, so memory increase is not the appropriate first action.

Answer

Add an additional network interface.

Answer

Reboot the server.

Answer

Increase the memory allocation.

Question 2

A company's cloud environment has experienced a sudden spike in network traffic, causing a critical application to become unresponsive. Which of the following is the FIRST step the cloud administrator should take to address this issue?

Accepted Answer

Analyze the network traffic logs to identify the source of the spike.. The first step in troubleshooting is to identify the problem, which involves analyzing network traffic logs to determine the source of the spike. Option A is wrong because restarting the server may temporarily restore service but does not address the root cause and could lead to recurring issues. Option C is wrong because contacting the cloud provider should be done after internal diagnosis, not as the first step. Option D is wrong because increasing bandwidth without understanding the cause of the spike can waste resources and may not solve the problem if the issue is due to a DDoS attack or misconfiguration.

Answer

Restart the application server to restore service.

Answer

Contact the cloud provider to report the issue.

Answer

Increase the bandwidth for the affected application.

Question 3

An organization requires that all cloud resources be tagged with the cost center and environment (e.g., production, development). A compliance checker runs weekly to report untagged resources. The cloud administrator notices that newly created resources are often missing tags. What is the most effective long-term solution?

Accepted Answer

Configure a cloud governance policy that prevents resource creation without required tags.. Enforcing tagging as part of resource creation policy prevents untagged resources from being created, ensuring compliance proactively.

Answer

Create a custom dashboard to show untagged resources.

Answer

Run a script daily to tag any untagged resources.

Answer

Send an email reminder to all users about tagging policies.

Question 4

Which TWO steps should be performed to ensure that a new cloud user has only the minimum required permissions to perform their job? (Choose two.)

Accepted Answer

Provide permissions based on the user's specific job functions.. The principle of least privilege involves granting only necessary permissions and periodically reviewing them. Using a broad policy is the opposite. Removing the user is not appropriate. Creating a group is good for management but not directly for least privilege.

Answer

Assign the user to a group with broad administrator access for flexibility.

Answer

Remove the user's account immediately after granting access.

Answer

Create a custom role that includes all possible permissions.

Question 5

Which of the following is the best practice for securely storing secrets such as database passwords in a cloud environment?

Accepted Answer

Use a dedicated secrets management service.. Dedicated secrets management services provide secure storage, rotation, and access control.

Answer

Hard-code the secrets in the application code.

Answer

Store secrets in a configuration file in the repository.

Answer

Encrypt secrets and store them in a shared storage.

Question 6

A company uses a cloud provider's identity federation to allow employees to sign in using their corporate Active Directory credentials. After a merger, employees from the acquired company need access. What must be modified to enable federated access for the new users without disrupting existing access?

Accepted Answer

Update the trust policy to include the new Active Directory domain.. Updating the trust policy to include the new Active Directory domain allows federation from both the original and acquired domains under the same identity provider, enabling access for new users without disrupting existing access. Options A, B, and C are incorrect because they would either require separate management, create unnecessary overhead, or disrupt the existing federation setup.

Answer

Create a separate federation agreement for the new domain.

Answer

Manually create cloud IAM users for each employee.

Answer

Create a new identity provider in the cloud.

Question 7

Which TWO of the following are common security concerns specific to a public cloud infrastructure?

Accepted Answer

Exposure of insecure application programming interfaces (APIs).. Options A and D are correct. Insecure APIs are a top cloud security concern because they allow programmatic access and can be exploited if not properly secured. Misconfiguration of cloud resources is a leading cause of data exposure in public cloud environments. Option B is incorrect because physical theft is the provider's responsibility and is not a common customer concern. Option C is incorrect because packet sniffing on the provider's internal network is mitigated by network segmentation and encryption, and is not a typical threat in public clouds. Option E is incorrect because hypervisor-level malware is rare and providers quickly patch vulnerabilities.

Answer

Physical theft of servers from data centers.

Answer

Packet sniffing on the provider's internal network.

Answer

Hypervisor-level malware.

Question 8

A cloud administrator is troubleshooting a performance issue where users report slow access to a web application hosted in a public cloud. The application uses an auto-scaling group of web servers behind a load balancer. The administrator notices that the CPU utilization on the web servers is low, but the load balancer metrics show a high number of pending requests. What is the most likely cause?

Accepted Answer

The load balancer health checks are misconfigured, causing healthy instances to be removed.. Misconfigured health checks can cause the load balancer to incorrectly mark healthy instances as unhealthy and remove them from the target group. This results in fewer instances handling traffic, leading to a buildup of pending requests even though the remaining instances have low CPU utilization. Option A is incorrect because API rate limiting would affect API calls, not HTTP traffic to the web servers. Option B is incorrect because an incorrect DNS IP would prevent users from reaching the application entirely, not cause pending requests. Option C is incorrect because blocking inbound traffic on port 80 would cause connection timeouts or failures, not a high number of pending requests.

Answer

The web servers are throttled by the cloud provider's API rate limiting.

Answer

The DNS records point to an incorrect IP address.

Answer

The security group is blocking inbound traffic on port 80.

Question 9

A company has a three-tier application in a cloud VPC: web servers in a public subnet, application servers in a private subnet, and database servers in a private subnet. The web servers can connect to the application servers, but the application servers cannot connect to the database servers. The security groups are configured as follows:
- Web SG: inbound HTTP from 0.0.0.0/0, outbound all
- App SG: inbound HTTP from Web SG, outbound all
- DB SG: inbound MySQL from App SG, outbound all
What is the most likely cause of the connectivity issue?

Accepted Answer

The network access control list (NACL) on the database subnet is blocking inbound traffic from the application subnet.. Security groups are stateful and allow return traffic automatically, so outbound rules are not the issue. The inbound rule on DB SG allows MySQL from App SG, so A is not the issue. B is not needed because outbound is all. D is irrelevant because web SG does not affect traffic between app and DB. The issue likely is a network ACL (NACL) on the database subnet, which is stateless and needs explicit inbound and outbound rules; if it blocks inbound MySQL from the app subnet, the connection fails.

Answer

The database security group is missing an inbound rule for MySQL.

Answer

The application security group is missing an outbound rule for MySQL.

Answer

The web security group is blocking traffic to the database.

Question 10

A company is experiencing intermittent network connectivity issues between two cloud subnets. The cloud provider's monitoring shows no packet loss. Which troubleshooting step should be taken first?

Accepted Answer

Review the security group rules for both subnets. Security group rules can cause intermittent connectivity issues by selectively dropping traffic based on stateful inspection, timeouts, or misconfigured rules. Option B is wrong because virtual routers are typically managed by the provider and are unlikely to cause intermittent issues without alerts. Option C is wrong because increasing bandwidth does not address the underlying cause of intermittent drops. Option D is wrong because physical cabling is not relevant in the cloud.

Answer

Replace the virtual routers

Answer

Increase the bandwidth between subnets

Answer

Check the physical cabling

Question 11

A cloud engineer receives alerts that a storage volume is reaching capacity. Which three immediate actions should the engineer consider? (Choose three.)

Accepted Answer

Attach additional volumes. Correct options are A, D, and E. Option A is correct because attaching additional volumes increases total capacity immediately. Option D is correct because deleting unnecessary files frees up space quickly. Option E is correct because increasing the size of the storage volume provides more space without data migration. Option B is incorrect because creating a snapshot is a precautionary backup step, not an immediate remedy for capacity issues. Option C is incorrect because enabling compression may not affect existing data and is not an immediate solution.

Answer

Create a snapshot before making changes

Answer

Enable compression on the volume

Question 12

A cloud administrator notices that a virtual machine is running but cannot be reached over the network. The administrator verifies that the VM is configured with the correct IP address and subnet mask. Which of the following is the MOST likely cause of this issue?

Accepted Answer

Misconfigured default gateway. A misconfigured default gateway is the most likely cause when the IP address and subnet mask are correct but the VM cannot be reached over the network. The default gateway is responsible for routing traffic from the VM to other networks. If it is incorrect, the VM can communicate within its own subnet but not beyond, leading to unreachability. Option A (firewall blocking traffic) is less likely because the administrator verified correct IP configuration, and a firewall issue would typically affect specific ports or protocols, not all connectivity. Option B (incorrect DNS) affects name resolution but not basic IP connectivity. Option C (missing port forwarding) is used for inbound NAT mappings and is not relevant to general network reachability.

Answer

Cloud provider firewall blocking all traffic

Answer

Incorrect DNS server settings

Answer

Missing port forwarding rule

Question 13

A cloud administrator is troubleshooting performance issues with a cloud object storage bucket that is used for storing large amounts of small files. The application reads and writes objects frequently. Which three actions could improve the performance? (Choose three.)

Accepted Answer

Increase the number of concurrent requests from the application.. Options B, C, and E are correct. Option B increases throughput by allowing more parallel requests, which helps with small-file performance. Option C uses a CDN to accelerate data transfer, reducing latency. Option E distributes objects across partitions using prefix naming, improving request rate. Option A is incorrect because multi-region buckets add replication latency. Option D is incorrect because versioning adds overhead for frequent writes.

Answer

Use a multi-region bucket to reduce latency.

Answer

Enable versioning to avoid overwrites.

Question 14

A cloud administrator is troubleshooting a network connectivity issue between two VPCs connected via a VPC peering connection. The administrator has verified that the route tables are correct and that the security groups allow traffic. However, instances in VPC A cannot ping instances in VPC B. Which TWO of the following could be causing the issue? (Choose TWO.)

Accepted Answer

Network ACLs in VPC B are blocking inbound ICMP. Network ACLs are stateless and must allow both inbound and outbound traffic; if they block inbound ICMP, ping fails, making A correct. Host-based firewall rules within the OS of the target instance can also block ICMP, making C correct. B is wrong because security groups in VPC A control inbound traffic to instances in VPC A, not to instances in VPC B. D is wrong because VPC peering supports ICMP. E is wrong because the administrator verified route tables are correct.

Answer

Security groups in VPC A are blocking inbound ICMP

Answer

VPC peering connection does not support ICMP

Answer

Route tables are misconfigured

Question 15

A user reports that they cannot connect to a RDS database instance from their application. The security group for the RDS instance allows inbound traffic on port 3306 from the application server's security group. What should the administrator check NEXT?

Accepted Answer

Network ACL rules for the RDS subnet. The RDS security group already allows inbound traffic from the application server's security group, so the issue likely lies elsewhere. Network ACLs (NACLs) are stateless and apply to the subnet level; they must allow both inbound and outbound traffic in both directions for the connection. Checking NACL rules is the next step. Option A is incorrect because IAM policies control access permissions, not network connectivity. Option C is incorrect because route tables primarily govern traffic between subnets and to the internet; within the same VPC, routes are typically not the cause of this issue. Option D is incorrect because outbound rules on the RDS instance affect traffic leaving the RDS, not incoming connections.

Answer

IAM policy attached to the RDS instance

Answer

Route table entries for the RDS subnet

Answer

Outbound security group rules on the RDS instance