CV0-004 Practice Test 43 — 15 Questions

Question 1

Refer to the exhibit. A cloud administrator is trying to retrieve a secret from a cloud secrets manager using a script with an access key and secret key. The script returns the error shown. The keys were newly created. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The access key is not activated or has a propagation delay.. Newly created access keys in IAM can take several minutes to propagate across all regions and services due to eventual consistency. The script returns an authentication error because the access key is not yet activated or fully propagated, even though the keys were just created. This is a common issue when using access keys immediately after creation.

Answer

The secret is encrypted with a different KMS key.

Answer

The script is using the wrong region.

Answer

The secret does not exist.

Question 2

Refer to the exhibit. A cloud administrator is trying to retrieve a secret from a cloud secrets manager using a script with an access key and secret key. The script returns the error shown. The keys were newly created. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The network ACL is misconfigured and blocking all inbound traffic.. The exhibit shows that the network ACL (NACL) associated with subnet-12345678 has an inbound rule that denies all traffic (rule number 100 with DENY for 0.0.0.0/0). Since NACLs are stateless and evaluated in order, this explicit deny overrides any allow rules, blocking all inbound internet traffic to the EC2 instance regardless of the security group settings or the instance having a public IP.

Answer

The security group is not applied.

Answer

The route table is missing a default route to the internet gateway.

Answer

The instance is stopped.

Question 3

Refer to the exhibit. A cloud administrator is trying to retrieve a secret from a cloud secrets manager using a script with an access key and secret key. The script returns the error shown. The keys were newly created. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The instance does not have a firewall tag matching the SSH rule.. The most likely cause is that the instance does not have a firewall tag matching the SSH rule. In Google Cloud, firewall rules can be applied to target instances using network tags. Even if the rule allows ingress on port 22 from 0.0.0.0/0, it will only apply to instances that have the corresponding tag (e.g., 'allow-ssh'). Without the tag, the rule is not enforced on the instance, blocking SSH access despite the public IP.

Answer

The instance is not assigned to a service account.

Answer

The subnetwork does not have an external IP range.

Answer

The instance is running an incompatible OS.

Question 4

A company is planning its disaster recovery strategy for a critical application. The application runs on EC2 with data in EBS volumes. The RTO is 2 hours and RPO is 15 minutes. Which approach meets these requirements most cost-effectively?

Accepted Answer

Cross-region continuous replication of EBS volumes. Continuous replication to another region achieves a low RPO (minutes) and can be failed over quickly to meet RTO.

Answer

Hourly AMI backups to the same region

Answer

Pilot light with replication every 30 minutes

Answer

Daily snapshots to the same region

Question 5

A DevOps team is deploying a containerized application to Google Kubernetes Engine (GKE). The team wants to automate the deployment of the application along with its dependencies, such as ConfigMaps and Services, using a single package. Which tool should the team use?

Accepted Answer

Helm charts. Helm charts package Kubernetes resources into a single deployable unit. Docker Compose is for local development, not production. kubectl apply can apply manifests but not as a package manager. Kustomize overlays but not package management.

Answer

kubectl apply with multiple manifest files

Answer

Kustomize overlays

Answer

Docker Compose

Question 6

A company deployed a web application on an EC2 instance in a public subnet. The instance passes status checks and has a public IP address. The security group allows HTTP (80) from 0.0.0.0/0. Users report that the website is not accessible. What should the administrator check next?

Accepted Answer

The network ACL inbound rules.. The security group allows HTTP (80) from 0.0.0.0/0, so inbound traffic is permitted at the instance level. However, the network ACL (NACL) is a stateless firewall that operates at the subnet level. If the NACL inbound rules do not explicitly allow HTTP traffic from the internet (e.g., port 80 from 0.0.0.0/0), the traffic will be dropped before it reaches the EC2 instance, even though the security group allows it. Since the instance passes status checks and has a public IP, the most likely remaining issue is the NACL.

Answer

The route table for the subnet.

Answer

The instance's operating system firewall.

Answer

The instance's user data script.

Question 7

A company has a hybrid cloud environment where on-premises servers communicate with cloud resources via a VPN connection. The network team notices intermittent connectivity issues and packet loss. The VPN tunnel is established, but performance is degraded. Which step should the team take first to diagnose the issue?

Accepted Answer

Use traceroute and ping to measure latency and packet loss. B is correct because traceroute and ping are the foundational diagnostic tools to measure latency and packet loss across a VPN tunnel. Intermittent connectivity and packet loss often stem from path issues, MTU mismatches, or routing problems that these tools can isolate. Since the tunnel is established, the first step is to quantify the performance degradation before making configuration changes.

Answer

Restart the VPN tunnel and monitor logs

Answer

Increase the MTU size on the VPN tunnel

Answer

Check the CPU utilization of the on-premises VPN appliance

Question 8

A cloud administrator is planning a migration of on-premises workloads to the cloud. Which TWO factors should be considered when selecting the appropriate cloud service model (IaaS, PaaS, SaaS)?

Accepted Answer

The level of control required over the operating system and runtime environment.. The level of control over the operating system and runtime environment is a defining factor when choosing between IaaS, PaaS, and SaaS. IaaS provides full control over the OS and runtime, PaaS abstracts the OS and runtime but allows control over application deployment, and SaaS offers no control over the underlying infrastructure. This directly impacts migration decisions, especially for legacy applications that require specific OS configurations or custom runtime dependencies.

Answer

The scalability requirements of the application.

Answer

The security compliance requirements for data at rest.

Answer

The total cost of ownership compared to on-premises.

Question 9

Which THREE of the following are best practices when deploying a cloud application using Infrastructure as Code (IaC)? (Choose three.)

Accepted Answer

Store IaC templates in a version control system.. Storing IaC templates in a version control system (e.g., Git) is a best practice because it enables change tracking, rollback, collaboration, and auditability. This aligns with GitOps principles, where the version control repository serves as the single source of truth for infrastructure state, ensuring all changes are reviewed and recorded.

Answer

Embed credentials directly in the IaC templates.

Answer

Manually modify resources after deployment to tune performance.

Question 10

A cloud engineer deploys the Kubernetes manifest shown in the exhibit. After deployment, the frontend pods are in CrashLoopBackOff state. The engineer checks the logs and finds 'OOMKilled' errors. Which of the following changes would resolve the issue?

Accepted Answer

Increase the memory limit to 1Gi.. The 'OOMKilled' error indicates the container's memory usage exceeded its configured limit, causing the kernel's Out-Of-Memory (OOM) killer to terminate the process. Increasing the memory limit to 1Gi provides the container with more memory headroom, preventing the OOM kill and allowing the pod to run without crashing.

Answer

Increase the number of replicas to 5.

Answer

Reduce the CPU limit to 250m.

Answer

Change the service type to ClusterIP.

Question 11

A cloud engineer is using Ansible to automate the configuration of cloud resources. The engineer needs to ensure that the automation does not require any agent software to be installed on the target nodes. Which characteristic of Ansible makes this possible?

Accepted Answer

It is agentless. Ansible is agentless; it connects over SSH (Linux) or WinRM (Windows) to execute tasks without installing any software on the target.

Answer

It uses PowerShell Desired State Configuration

Answer

It uses a master-agent architecture

Answer

It requires a pull-based model

Question 12

Which THREE are common tasks in a CI/CD pipeline? (Select THREE.)

Accepted Answer

Source code checkout from version control. Source code checkout from version control is a fundamental first step in any CI/CD pipeline. The pipeline agent must retrieve the latest code from a repository (e.g., Git) to build, test, and deploy the application. Without this checkout, subsequent automated steps have no codebase to work with.

Answer

Manual code review by a senior developer

Answer

Handwritten notes for deployment steps

Question 13

During a disaster recovery test, a cloud administrator discovers that the standby database in a different region is not synchronized with the primary. The primary database uses asynchronous replication. What is the MOST likely reason for the sync failure?

Accepted Answer

Network latency causing replication lag. Asynchronous replication does not guarantee immediate synchronization; network latency between regions can cause replication lag, meaning the standby may not have the latest data if the primary fails before sync completes. Option A is incorrect because license expiration would typically prevent the standby from starting or functioning, not cause lag. Option C is incorrect because a firewall blocking port 3306 would completely halt replication, not cause lag. Option D is incorrect because while incorrect configuration could cause sync issues, the question specifies a standby database, and a read replica would not be used as a standby; the most likely reason in a DR test with async replication is network latency.

Answer

License expiration on the standby database

Answer

Firewall rules blocking port 3306 between regions

Answer

Incorrect replication configuration using a read replica instead of a standby

Question 14

A cloud administrator notices that a security group rule allowing SSH (port 22) from any IP address (0.0.0.0/0) was created for a Linux server. The server is used for administrative purposes only. Which security best practice should be applied to reduce the attack surface?

Accepted Answer

Restrict the source IP address to the company's public IP range. Restricting the source IP address to the company's public IP range (option D) directly reduces the attack surface by limiting SSH access to only trusted administrative networks. This is the most effective security best practice because it prevents unauthorized external hosts from even attempting to connect to port 22, regardless of authentication method or port obscurity. In cloud environments like AWS, security group rules are stateful and evaluated before any packet reaches the instance, making source IP restriction a fundamental layer of defense.

Answer

Disable password authentication and use SSH keys only

Answer

Change the SSH port to a non-standard port

Answer

Add a deny rule for SSH in the network ACL

Question 15

A company's application is unable to connect to a managed cloud database. The database is deployed in a VPC with public accessibility disabled. The application runs on an EC2 instance in the same VPC. Which three troubleshooting steps should the administrator take? (Choose three.)

Accepted Answer

Check the network ACL associated with the database subnet for appropriate rules.. Options B, C, and E are correct. Option A is incorrect because an internet gateway is not needed for communication within the same VPC. Option D is incorrect because a public IP is not required for instances in the same VPC. Option B checks network ACL rules for the database subnet, which can affect inbound/outbound traffic. Option C verifies the database endpoint configuration in the application, which could be misconfigured. Option E checks the security group for the database, ensuring it allows inbound traffic from the EC2 instance's security group.

Answer

Ensure the VPC has an internet gateway attached.

Answer

Verify that the EC2 instance has a public IP address.