CV0-004 Practice Test 39 — 15 Questions

Question 1

A company is deploying a containerized microservices architecture on Azure Kubernetes Service (AKS). The security team requires that all container images are scanned for vulnerabilities before deployment. Which deployment approach should the DevOps team implement to ensure only approved images are used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable Azure Container Registry tasks for automatic vulnerability scanning and enforce with Azure Policy.. Azure Container Registry (ACR) Tasks can automatically scan images for vulnerabilities using Microsoft Defender for Cloud, and Azure Policy can enforce that only images from approved registries or with passing scan results are deployed to AKS. This ensures that all container images are scanned before deployment and that only compliant images are used, meeting the security team's requirement.

Answer

Store all images in a private registry without any scanning.

Answer

Use Docker Content Trust to sign images and verify signatures during deployment.

Answer

Deploy an admission controller that checks image signatures only.

Question 2

A cloud engineer is writing an Ansible playbook to provision virtual machines in Azure. The playbook includes a task that uses the 'azure_rm_virtualmachine' module. Which of the following best describes Ansible's architecture in this scenario?

Accepted Answer

Ansible is agentless and uses SSH or WinRM to connect to target machines.. Ansible is agentless and connects via SSH or WinRM. It is not agent-based; it does not require Python on the control node only; it is not a managed service.

Answer

Ansible uses agents installed on target VMs to execute modules.

Answer

Ansible is a managed service in Azure that runs playbooks automatically.

Answer

Ansible requires Python to be installed only on the control node.

Question 3

Which THREE elements are required for a complete key lifecycle management strategy in a cloud environment? (Choose three.)

Accepted Answer

Secure key generation. Secure key generation is the foundational first step in a key lifecycle management strategy. In a cloud environment, keys must be generated using a FIPS 140-2 validated hardware security module (HSM) or a cloud provider's equivalent (e.g., AWS CloudHSM, Azure Key Vault Premium) to ensure cryptographic strength and prevent exposure of the private key material during creation.

Answer

Key backup and recovery

Answer

Key access control

Question 4

A company is deploying a microservices architecture that must scale dynamically based on traffic. Which technology should be used?

Accepted Answer

Kubernetes with Horizontal Pod Autoscaler. Kubernetes with Horizontal Pod Autoscaler (HPA) automatically scales the number of pods based on metrics like CPU utilization or custom metrics, enabling dynamic scaling in a microservices architecture. Option A is incorrect because manually adding VMs is not dynamic and requires human intervention. Option B is incorrect because a monolithic application on a single instance cannot scale dynamically and lacks microservices benefits. Option D is incorrect because a single large instance with a load balancer still has a fixed capacity and cannot scale out automatically.

Answer

Manually add more virtual machines during peak hours

Answer

Deploy a monolithic application on a single large instance

Answer

Use a single large instance with a load balancer

Question 5

After deploying a new cloud application, users report that they cannot connect to the application. The cloud administrator checks the security group rules and finds that the inbound rule for HTTP traffic is missing. What is the best practice to prevent this issue in future deployments?

Accepted Answer

Use an Infrastructure as Code (IaC) template to define security group rules.. The best practice to prevent missing security group rules is to use Infrastructure as Code (IaC) templates (Option B). IaC allows you to define security group rules declaratively, ensuring consistency and enabling version control and automated validation before deployment. Manual checklists (Option A) are error-prone and rely on human memory. Cloning a security group (Option C) does not guarantee the cloned group has the correct rules and does not address the root cause of inconsistent configurations. Allowing all traffic by default (Option D) is insecure and violates the principle of least privilege. By using IaC, you enforce security configurations programmatically, reducing the risk of misconfigurations.

Answer

Create a checklist for manual review before each deployment.

Answer

Clone a security group that already has the correct rules.

Answer

Configure the security group to allow all traffic by default.

Question 6

A cloud administrator needs to automate the process of patching multiple virtual machines in a private cloud. Which of the following is the best tool for this purpose?

Accepted Answer

Ansible playbook. An Ansible playbook is the best tool for automating patching across multiple VMs because it is agentless, uses SSH for Linux or WinRM for Windows, and supports idempotent execution. This allows the administrator to define the desired patch state declaratively and apply it consistently across the entire fleet without manual intervention.

Answer

Virtual machine templates

Answer

SSH with manual commands

Answer

Scheduled tasks in the hypervisor management console

Question 7

A company is migrating its on-premises database to a cloud-managed database service. The database contains sensitive financial data. Which of the following is the MOST important security configuration to implement after migration?

Accepted Answer

Enable encryption at rest using a customer-managed key. Encryption at rest using a customer-managed key is the most important security configuration because it directly protects sensitive financial data stored in the database. Even if the underlying storage is compromised, the data remains unreadable without the key. Customer-managed keys provide additional control and help meet compliance requirements. While automated patching (B) is important for overall security, it does not protect data at rest. Public read access (C) should be disabled, not enabled, as it would expose sensitive data. Cross-region replication (D) ensures disaster recovery and availability, but does not address data confidentiality.

Answer

Configure automated patching schedule

Answer

Enable public read access for monitoring tools

Answer

Set up cross-region replication for high availability

Question 8

An organization is moving 100 TB of archival data from on-premises to Google Cloud Storage. The network bandwidth is limited to 10 Mbps, and the migration must complete within two weeks. Which THREE methods should the team consider?

Accepted Answer

Direct peering with Google Cloud. (Google Cloud Data Transfer Appliance) is correct for offline transfer of large datasets when bandwidth is insufficient. Option D (Partner edge appliance) similarly allows offline transfer using a compatible partner device. Option B (Direct peering with Google Cloud) is correct because it establishes a dedicated network connection that can provide higher bandwidth than the existing limited link, enabling faster data transfer. With only 10 Mbps, transferring 100 TB would take over two years; a dedicated connection can be provisioned at higher speeds (e.g., 1 Gbps) to meet the two-week deadline. Options A and E are not viable because they rely on the existing limited network bandwidth and would not complete within the timeframe.

Answer

Google Cloud Storage Transfer Service for on-premises data

Answer

Google Cloud Storage Transfer Service for inter-cloud transfer

Question 9

A company recently migrated its database to a cloud-managed database service. After the migration, the application team reports that some queries are returning stale data. The database is configured with read replicas. What is the most likely reason for the stale data?

Accepted Answer

The application is reading from a read replica that has replication lag.. The most likely reason for stale data is that the application is reading from a read replica that has not yet applied all changes from the primary database. In cloud-managed database services like Amazon RDS or Azure SQL, read replicas use asynchronous replication, which introduces replication lag. If the application directs read queries to a replica that is behind, it will return data that is not current.

Answer

The database parameter group is misconfigured.

Answer

The network latency between the application and database is high.

Answer

The database’s backup and restore process has corrupted the data.

Question 10

A cloud administrator is troubleshooting connectivity issues between two virtual networks in different regions. The virtual networks are peered, but instances cannot communicate. The administrator verifies that the peering status is 'Connected' and route tables appear correct. Which of the following should be checked next?

Accepted Answer

Network security group rules on the instances and subnets [CORRECT]. Even when virtual network peering status shows 'Connected' and route tables are correct, network security group rules can still block traffic. Network security groups act as a stateful firewall at the subnet or network interface level, and typically they deny all inbound traffic unless explicitly allowed. Since the administrator has already verified routing, the next logical step is to check network security group rules for any implicit deny or missing allow rules that could be dropping the inter-region traffic.

Answer

DNS resolution settings

Answer

Gateway subnet configuration

Answer

Service endpoint status

Question 11

Which TWO of the following are benefits of using a content delivery network (CDN) with cloud-hosted applications? (Choose two.)

Accepted Answer

Reduces load on the origin server. A CDN caches static and dynamic content at edge servers, so requests for cached content are served from the edge rather than the origin server. This offloads traffic from the origin, reducing CPU, memory, and bandwidth consumption on the cloud-hosted application's backend. Option D is correct because edge servers are geographically distributed closer to end users, which minimizes network round-trip time and reduces latency for content delivery.

Answer

Simplifies application architecture

Answer

Eliminates the need for HTTPS encryption

Answer

Lowers overall infrastructure cost

Question 12

The exhibit shows VPC flow log entries for an EC2 instance (eni-12345678). The administrator is troubleshooting a connectivity problem where an application on 10.0.1.5 occasionally cannot connect to a web server at 10.0.2.10 on port 80. What action should the administrator take?

Accepted Answer

Add a network ACL rule allowing inbound TCP/80 from 10.0.1.5 to the subnet of 10.0.2.10.. The REJECT entry in the VPC flow log indicates that traffic is being blocked by a network ACL (NACL), which is stateless. Security groups are stateful and do not produce REJECT entries; they either allow or silently drop traffic. To resolve the issue, the administrator must add an inbound rule to the network ACL associated with the subnet of the web server (10.0.2.10) to allow TCP port 80 from the source IP 10.0.1.5. Option C is correct. Option A is incorrect because increasing the MTU does not affect firewall blocking. Option B is incorrect because a security group rule would not generate a REJECT; the REJECT indicates a NACL blockage. Option D is incorrect because adding a route does not address firewall filtering.

Answer

Increase the MTU on the instance to 9001.

Answer

Add a security group rule allowing inbound TCP/80 from 10.0.1.5.

Answer

Add a route to the VPC route table for 10.0.1.5.

Question 13

A cloud administrator is trying to attach an EBS volume to an EC2 instance for a database migration. The attachment fails with the error shown in the exhibit. The volume contains critical data. Which of the following is the MOST appropriate action to take?

Accepted Answer

Detach the volume from instance 'i-0123ijkl' first, then attach to the new instance.. The error indicates the EBS volume is already attached to another EC2 instance (i-0123ijkl). An EBS volume can only be attached to one instance at a time in a standard attachment. The correct procedure is to first detach the volume from instance i-0123ijkl, then attach it to the target instance. This preserves the critical data without risk of corruption or data loss.

Answer

Create a new volume and copy the data from the existing volume.

Answer

Terminate instance 'i-0123ijkl' to release the volume.

Answer

Force-detach the volume from the other instance.

Question 14

An automated snapshot of a cloud VM is failing with the error 'Quota exceeded for resource snapshots'. What is the most likely cause?

Accepted Answer

The maximum number of snapshots allowed has been reached.. The error 'Quota exceeded for resource snapshots' indicates that the number of snapshots has reached the maximum allowed by the cloud provider. Therefore, Option B is correct. Option A is incorrect because backup windows do not affect snapshot quotas. Option C is incorrect because a high retention policy may cause more snapshots to be retained, but the immediate error is about exceeding the quota, not the policy setting itself. Option D is incorrect because disk space is unrelated to the snapshot count limit.

Answer

The snapshot is being created during a backup window.

Answer

The snapshot retention policy is set too high.

Answer

The VM's disk is too full to create a snapshot.

Question 15

A cloud administrator is troubleshooting a virtual machine that is experiencing high CPU utilization during peak hours. The VM runs a web application and is hosted on a public cloud platform. Which TWO steps should the administrator take first to diagnose the issue?

Accepted Answer

Review the load balancer health check and traffic distribution settings for the backend pool.. Reviewing the load balancer health check and traffic distribution settings helps determine if the high CPU utilization is caused by uneven traffic distribution or unhealthy backend instances. If the load balancer is sending excessive traffic to a single VM due to misconfigured health checks or sticky sessions, the VM's CPU will spike. This is a first-step diagnostic action to rule out load balancing issues before investigating the VM itself.

Answer

Adjust the autoscaling policy to add more instances immediately.

Answer

Check for memory leaks in the application that could indirectly affect CPU.

Answer

Immediately increase the number of vCPUs assigned to the VM.