CV0-004 Practice Test 38 — 15 Questions

Question 1

After deploying a new application version, users get 503 errors. The application runs on Kubernetes in a private cloud. What is the most likely cause?

Accepted Answer

Application health check failing. 503 errors typically indicate that the application is not passing health checks, causing the load balancer or Kubernetes service to stop routing traffic to the affected pods. Option B is incorrect because an incorrect ingress configuration usually results in 404 errors or connection timeouts, not 503. Option C is incorrect because insufficient pod resources lead to OOM kills or CPU throttling, which may cause 503s only indirectly if health checks fail, but the more direct cause is failed health checks. Option D is incorrect because node port exhaustion is rare and would cause connection refused, not 503.

Answer

Incorrect ingress configuration

Answer

Insufficient pod resources

Answer

Node port exhaustion

Question 2

Refer to the exhibit. An application running on an EC2 instance is failing to connect to an RDS database. What is the most likely issue?

Accepted Answer

The security group for the RDS instance does not allow inbound traffic from the EC2 instance. A 'connection refused' error typically indicates that the database is reachable but the port is blocked, likely by a security group. Option A is wrong if the database is in a different VPC, the error would be timeout or no route. Option C is wrong because a stopped database would result in a 'no route to host' or timeout. Option D is wrong because port 3306 is standard for MySQL and the error is not about wrong port.

Answer

The database instance is in a different VPC

Answer

The database instance is stopped

Answer

The application is using the wrong database port

Question 3

A cloud administrator is troubleshooting an application that is experiencing intermittent timeouts. The application runs on a cloud VM and connects to a cloud database. The administrator sees no errors in the application logs but notices high network latency during peak hours. Which of the following is the MOST likely cause?

Accepted Answer

Insufficient provisioned IOPS on the database. Insufficient provisioned IOPS can cause queue buildup and increased latency during peak loads, leading to intermittent timeouts. Option B is incorrect because schema issues would typically cause query errors or failures, not just latency. Option C is incorrect because a missing route would cause complete connectivity failure, not intermittent timeouts. Option D is incorrect because SSL misconfiguration would cause handshake failures and errors, not just latency.

Answer

Incorrect database schema

Answer

SSL certificate mismatch between app and database

Answer

Missing route table entry for the database subnet

Question 4

Which THREE are common reasons why a cloud database instance may become unreachable?

Accepted Answer

Firewall rules blocking the database port. The three most common reasons a cloud database instance becomes unreachable are firewall rules blocking the database port (A), an incorrect connection string in the application (B), and the database service not being started (D). A full storage volume (C) may cause write failures but does not always result in unreachability, and hypervisor maintenance (E) typically uses live migration to avoid downtime.

Answer

Storage volume is full on the database server

Answer

Hypervisor maintenance causing VM reboot

Question 5

During a cloud migration, a database server is moved from on-premises to a cloud-managed database service. After migration, the application team reports that some queries are running slower than before. The database CPU utilization is low. What is the most likely cause?

Accepted Answer

The network latency between the application and the database has increased. Increased network latency between the application and the cloud database can slow query response times without raising CPU utilization. Option B is wrong: improper indexing forces full table scans, which typically increase CPU usage. Option C is wrong: misconfigured connection pooling usually leads to connection errors or timeouts, not consistently slow queries with low CPU. Option D is wrong: insufficient memory causes swapping and high disk I/O, which would increase CPU usage.

Answer

The database is not indexed properly

Answer

The database connection pooling is misconfigured

Answer

The cloud database instance type has insufficient memory

Question 6

A hybrid cloud setup uses a site-to-site VPN between on-premises and a public cloud. Users report intermittent connectivity failures. Traceroutes show packets dropping after a specific hop. What is the most likely cause?

Accepted Answer

The MTU setting on the VPN endpoint is too low, causing packet fragmentation.. An MTU mismatch within the VPN tunnel can cause packets to be fragmented or dropped when they exceed the MTU size, leading to intermittent connectivity issues. Traceroute showing drops after a specific hop suggests fragmentation problems. Option A is incorrect: missing routes would cause complete lack of connectivity, not intermittent drops. Option B is incorrect: incorrect pre-shared keys would prevent the VPN tunnel from establishing at all. Option C is incorrect: an overloaded gateway might cause latency or failures but typically not specific hop drops in traceroute.

Answer

The routing tables on the cloud side are missing routes for the on-premises network.

Answer

The VPN tunnel is misconfigured with incorrect pre-shared keys.

Answer

The VPN gateway is overloaded due to too many tunnels.

Question 7

A cloud architect is designing a hybrid cloud environment that connects an on-premises data center to a public cloud. The architect needs to ensure secure, low-latency connectivity and isolate traffic between different business units. Which TWO solutions should the architect implement? (Choose two.)

Accepted Answer

Establish a dedicated VPN or direct peering between on-premises and cloud. A dedicated VPN or direct peering establishes a secure, low-latency, and private connection between the on-premises data center and the public cloud, bypassing the public internet to reduce latency and improve security. This is essential for hybrid cloud environments where consistent performance and isolation from internet-based threats are required. Option C is correct because cloud network peering directly connects two cloud networks with no transitive routing, ensuring traffic isolation between business units, whereas a transit hub can inadvertently route traffic between all connected networks unless carefully configured with route tables and network ACLs.

Answer

Configure a NAT gateway to allow outbound internet access

Answer

Deploy a bastion host in a public subnet for administrative access

Answer

Use a transit hub to interconnect all cloud networks

Question 8

A company is migrating its on-premises application to the cloud and needs to ensure high availability. The application requires a stateless web tier and a stateful database tier. Which design approach BEST meets these requirements?

Accepted Answer

Deploy web servers behind a load balancer and use a managed database with multi-AZ replication.. Deploying web servers behind a load balancer provides horizontal scaling and fault tolerance for the stateless web tier, while using a managed database with multi-AZ replication ensures automatic failover and data durability for the stateful database tier. This combination meets high availability requirements by eliminating single points of failure and providing redundancy across Availability Zones.

Answer

Deploy one large web server and one large database server.

Answer

Use round-robin DNS for web servers and a read replica for the database.

Answer

Use auto-scaling for web servers and a single database instance.

Question 9

Which cloud deployment model involves connecting an on-premises data center to a public cloud provider using a VPN or dedicated connection?

Accepted Answer

Hybrid cloud. A hybrid cloud combines on-premises infrastructure with public cloud resources, typically connected via VPN or dedicated circuits like AWS Direct Connect or Azure ExpressRoute.

Answer

Private cloud

Answer

Multi-cloud

Answer

Public cloud

Question 10

Which TWO factors should be considered when selecting a cloud region for deploying a latency-sensitive application serving a global user base?

Accepted Answer

Number of availability zones. The number of availability zones within a region directly impacts the resilience and fault tolerance of a latency-sensitive application. Deploying across multiple availability zones allows for high availability and failover without adding significant latency, as zones are typically within a few milliseconds of each other. This ensures the application remains responsive even if one zone fails, which is critical for a global user base.

Answer

Cost of compute and storage

Answer

Data sovereignty and compliance requirements

Answer

Available network bandwidth between zones

Question 11

A company is experiencing intermittent connectivity issues between its on-premises data center and a public cloud environment over a VPN connection. Which TWO of the following should the administrator check to troubleshoot the problem?

Accepted Answer

Validate the route tables on both sides of the VPN.. Route tables control the path that traffic takes between networks. If the route tables on either the on-premises VPN device or the cloud virtual network gateway do not have the correct entries (e.g., missing routes for the remote subnet or incorrect next-hop IPs), traffic can be dropped or misdirected, causing intermittent connectivity. Validating these routes ensures that packets destined for the cloud or on-premises are properly forwarded over the VPN tunnel.

Answer

Verify that the internet bandwidth is sufficient.

Answer

Ensure the cloud storage performance is adequate.

Answer

Check the DNS resolution of cloud endpoints.

Question 12

A cloud administrator notices that a virtual machine is unresponsive. The VM is running on a hypervisor host that shows high CPU utilization. What should the administrator do first?

Accepted Answer

Check the VM console for OS-level issues. The first step in troubleshooting an unresponsive VM is to check the VM console for OS-level issues. This allows the administrator to see if the OS is hung, has a kernel panic, or is waiting for input. Option A is wrong because rebooting the hypervisor host would affect all VMs and is a drastic measure that should only be taken after other diagnostics. Option B is wrong because increasing the VM's vCPU count does not address the root cause of unresponsiveness and could worsen resource contention on an already overloaded host. Option C is wrong because migrating the VM to another host is premature without first determining if the issue is OS-related; also, migration might not be possible if the VM is completely unresponsive.

Answer

Reboot the hypervisor host

Answer

Increase the VM's vCPU count

Answer

Migrate the VM to another host

Question 13

Which THREE of the following are recommended practices for securing cloud API access? (Choose three.)

Accepted Answer

Use role-based access control to limit permissions for each API user. Role-based access control (RBAC) is a fundamental security practice for cloud API access because it enforces the principle of least privilege. By assigning permissions based on job functions rather than individual identities, RBAC limits the potential damage from compromised credentials or insider threats. This approach is recommended by cloud providers like AWS (IAM roles), Azure (RBAC roles), and Google Cloud (IAM roles) to ensure API users only have the permissions necessary for their tasks.

Answer

Embed API keys directly in application source code for convenience

Answer

Expose API endpoints publicly for easy access by all clients

Question 14

Refer to the exhibit. A cloud administrator runs the command to inspect an instance and notices that it is running, but the web application hosted on it is unreachable from the internet. The instance is in a public subnet with an internet gateway attached to the VPC. Which of the following is the most likely cause?

Accepted Answer

The instance's security group does not allow inbound HTTP/HTTPS traffic from 0.0.0.0/0.. The instance has a security group named "sg-web" which likely does not allow inbound HTTP/HTTPS traffic from the internet. Other options are less plausible given the configuration.

Answer

The instance type t2.medium does not support public IP addresses.

Answer

The subnet subnet-abc is not associated with a route table that has a route to the internet gateway.

Answer

The volume vol-111 is not encrypted.

Question 15

A company uses Google Cloud Platform and wants to enforce that all Compute Engine instances use a specific Customer-Managed Encryption Key (CMEK) for disk encryption. Which GCP service should be used to enforce this policy?

Accepted Answer

Organization Policies. Organization Policies (formerly known as 'Constraints') allow administrators to define and enforce guardrails for Google Cloud resources at the hierarchy level. The specific constraint `compute.requireCsekEncryption` (or the newer CMEK-based equivalent) can be applied to a folder or project to mandate that all Compute Engine disks use a Customer-Managed Encryption Key, rejecting any instance creation or disk attachment that does not comply.

Answer

IAM Conditions

Answer

Cloud Security Command Center

Answer

Cloud Key Management Service