CV0-004 Practice Test 44 — 15 Questions

Question 1

A cloud administrator is configuring network security for a multi-tier application. Which TWO statements about security groups and network ACLs are correct?

Accepted Answer

Network ACLs are stateless and require explicit allow rules for both inbound and outbound traffic.. Network ACLs are stateless, meaning they do not automatically allow return traffic; you must explicitly define allow rules for both inbound and outbound traffic. Option E is correct because security groups are stateful and support only allow rules; you cannot create a deny rule within a security group, and any traffic not explicitly allowed is implicitly denied.

Answer

Network ACLs evaluate rules before security groups.

Answer

Security groups can be used to deny traffic from specific IP addresses.

Answer

Security groups are stateless.

Question 2

A financial services company is migrating a critical application to a hybrid cloud environment. The application must maintain sub-millisecond latency between the front-end and back-end components. The on-premises data center is located in New York, and the cloud region chosen is AWS us-east-1. The network team has established a dedicated AWS Direct Connect connection. After deploying the application, latency tests show 2 ms on average, which is acceptable. However, during peak hours, latency spikes to 10 ms. The cloud administrator suspects that the spike is due to increased traffic going over the VPN backup link instead of Direct Connect. What should the administrator do to resolve the issue?

Accepted Answer

Configure the cloud resources to use only the Direct Connect connection and disable the VPN.. The latency spike during peak hours is caused by traffic failing over to the VPN backup link, which introduces higher latency and potential congestion. By configuring cloud resources to use only the Direct Connect connection and disabling the VPN, the administrator ensures all traffic stays on the low-latency, dedicated path. This eliminates the possibility of traffic being routed over the VPN, which is typically slower and less reliable than Direct Connect.

Answer

Move the application to a different AWS region closer to the on-premises data center.

Answer

Increase the bandwidth of the VPN backup link.

Answer

Implement traffic shaping to prioritize application traffic over the Direct Connect link.

Question 3

A company is migrating its on-premises workloads to a public cloud. The security team requires that all data in transit between the cloud resources and on-premises be encrypted. Which solution should the cloud architect recommend?

Accepted Answer

Implement a VPN tunnel between the cloud VPC and the on-premises network.. A VPN tunnel encrypts all IP traffic between the cloud VPC and the on-premises network, ensuring data in transit is protected regardless of the application protocol. This satisfies the security requirement for encrypting all data in transit between the two environments, as VPNs typically use IPsec (RFC 4301) to provide confidentiality and integrity at the network layer.

Answer

Deploy a hardware security module (HSM) for key management.

Answer

Enable encryption on the cloud storage buckets.

Answer

Use TLS for all application traffic.

Question 4

An application log shows the entries above. The application is a web server running on a virtual machine in a cloud environment. The database is a managed cloud database service. Which of the following is the MOST likely root cause of the failure?

Accepted Answer

The application's database credentials are incorrect or the application's IP is not whitelisted.. The log entries show authentication failures. This indicates that the application's database credentials are incorrect or the application's IP address is not whitelisted in the managed database service. Option A is wrong because a network firewall blocking traffic would likely result in connection timeouts, not authentication errors. Option B is incorrect because connection pool exhaustion would lead to resource contention errors, not authentication failures. Option D is wrong because if the database service was down, the application would likely encounter a connection refusal or timeout, not specific authentication errors.

Answer

A network firewall is blocking traffic to the database.

Answer

The database connection pool is exhausted.

Answer

The database service is down.

Question 5

A security analyst is investigating a potential data exfiltration from a cloud environment. The analyst finds that an instance IAM role was assumed by a compromised user, and the role has permissions to read from a sensitive database. What is the BEST way to prevent this type of attack in the future?

Accepted Answer

Enforce MFA for all users and require MFA when assuming the role.. The best because enforcing MFA for all users and requiring MFA when assuming roles ensures that even if a user's credentials are compromised, the attacker cannot assume the IAM role without also having access to the user's MFA device. This directly addresses the scenario. Option B is not the best because adding a resource-based policy to deny access from the role would break legitimate access and does not prevent the compromised user from assuming the role. Option C is not the best because rotating the role's access keys every 30 days does not prevent an attacker from using the role's temporary credentials if they have already assumed the role; also, IAM roles do not have access keys; they issue temporary credentials. Option D is not the best because removing the IAM role and using a service account would not solve the underlying issue and could introduce other security risks.

Answer

Add a resource-based policy to the database to deny access from the role.

Answer

Rotate the IAM role's access keys every 30 days.

Answer

Remove the IAM role and use a service account instead.

Question 6

A cloud administrator is starting the nginx web server on a new cloud VM but it fails. According to the exhibit, what is the most likely cause of the failure?

Accepted Answer

Another service is already listening on port 80. The error 'bind() to 0.0.0.0:80 failed (98: Address already in use)' indicates that port 80 is already occupied by another process. Option A is correct. Option B is wrong because SELinux would give a permission denied error, not address in use. Option C is wrong because the error says address in use, not file not found. Option D is wrong because the error is about binding, not about configuration syntax.

Answer

The VM does not have network connectivity

Answer

SELinux is blocking nginx from binding to the port

Answer

The nginx configuration file has a syntax error

Question 7

An organization is adopting Infrastructure as Code (IaC) for their cloud deployments. They need to ensure that the configuration files are version-controlled and changes are audited. Which combination of tools should they use?

Accepted Answer

Terraform and Git. Git provides version control and audit trails for Infrastructure as Code (IaC) configuration files, while Terraform is the IaC tool that manages cloud resources declaratively. Together, they satisfy the requirement for version-controlled, auditable configuration files, as Git tracks every change with commit history and Terraform's state files can be stored in Git for change tracking.

Answer

Puppet and Jenkins

Answer

Terraform and Ansible

Answer

CloudFormation and Chef

Question 8

A company runs a critical application on a cloud VM that must achieve a 99.99% monthly uptime SLA. The VM is deployed in a single availability zone. The current architecture has no redundancy. What is the most effective design change to meet the SLA requirement?

Accepted Answer

Deploy the application across two availability zones with a load balancer. Deploying the application across two availability zones with a load balancer provides high availability by eliminating a single point of failure. A 99.99% monthly uptime SLA requires a design that can withstand an entire availability zone failure, which a single-zone deployment cannot achieve. The load balancer distributes traffic to healthy VMs, automatically failing over if one zone becomes unavailable, thus meeting the SLA target.

Answer

Schedule daily backups to a different region

Answer

Upgrade the VM to a larger instance type for better reliability

Answer

Add a second VM in the same availability zone with a load balancer

Question 9

A cloud administrator is planning a migration of on-premises workloads to a public cloud. Which THREE factors should the administrator consider to ensure minimal downtime? (Choose three.)

Accepted Answer

Application compatibility. Application compatibility (A) is critical because incompatible applications may fail to run in the cloud environment, requiring re-architecture or re-platforming that can cause extended downtime. Ensuring applications are compatible with the target cloud's OS, hypervisor, and dependencies allows for a smoother cutover with minimal service interruption.

Answer

Data compression

Answer

Cost of data transfer

Question 10

A cloud engineer is troubleshooting a connectivity issue between two virtual networks in different regions. The engineer has verified that the virtual networks are peered and the routing tables are correct. Which of the following is the MOST likely cause of the issue?

Accepted Answer

A network security group blocking the traffic. Network security groups (NSGs) operate at the subnet or NIC level and can filter traffic between peered virtual networks even when routing is correctly configured. Since the engineer has verified peering and routing tables, the most likely remaining cause is an NSG rule explicitly or implicitly denying the traffic, as NSGs are stateful and evaluated after routing decisions.

Answer

Incorrect route tables on the virtual network gateway

Answer

A physical cable disconnection in the datacenter

Answer

Incorrect DNS resolution

Question 11

A company is using AWS CloudFormation to deploy a multi-tier application. The stack includes an Auto Scaling group and an Application Load Balancer. The operations team reports that deployments are failing because the new instances are not passing health checks. Which CloudFormation template attribute should be modified to ensure that the stack update rolls back automatically if the health check fails?

Accepted Answer

Use a CreationPolicy attribute on the Auto Scaling group with a timeout and signal count.. The CreationPolicy attribute on an Auto Scaling group, when combined with a timeout and a signal count, instructs CloudFormation to wait for a specified number of success signals from the new instances before considering the resource creation complete. If the signals are not received within the timeout (e.g., because the instances fail health checks and never report as healthy), CloudFormation treats the creation as failed and automatically rolls back the stack update. This directly addresses the requirement to roll back on health check failure.

Answer

Add an UpdatePolicy attribute to the Auto Scaling group.

Answer

Modify the DeletionPolicy attribute of the instances.

Answer

Set the DependsOn attribute to ensure the load balancer is created first.

Question 12

A company is adopting Infrastructure as Code (IaC) to manage its cloud resources. Which THREE statements are true about IaC? (Select THREE.)

Accepted Answer

IaC allows for automated provisioning of infrastructure. IaC enables automation, idempotency, and version control. Manual changes are not required; IaC can be used for both mutable and immutable infrastructure.

Answer

IaC eliminates the need for manual configuration changes

Answer

IaC is only applicable for immutable infrastructure

Question 13

A cloud operations team receives an alert that the CPU usage of a VM has exceeded 90% for the past 30 minutes. The VM is part of an auto-scaling group configured to scale out when CPU exceeds 80% for 5 minutes. However, no new instances have been launched. What is the MOST likely reason the auto-scaling failed to trigger?

Accepted Answer

The auto-scaling group is in a cooldown period after a previous scaling action.. The auto-scaling group failed to trigger because it was in a cooldown period after a previous scaling action. Cooldown periods are designed to prevent rapid, successive scaling events that could destabilize the environment. During this time, the auto-scaling group ignores new alarms, even if the CPU threshold is exceeded, until the cooldown timer expires.

Answer

The VM failed a health check and is being replaced.

Answer

The auto-scaling group has reached the minimum instance count.

Answer

The CPU threshold is set too high.

Question 14

A cloud operations team notices that a production database is experiencing intermittent slow queries. The database is running on a virtual machine with 4 vCPUs and 16 GB of memory. The slow queries coincide with high CPU usage. Which of the following is the MOST effective long-term solution?

Accepted Answer

Scale up the database virtual machine to 8 vCPUs and 32 GB of memory.. Scaling up the virtual machine from 4 vCPUs/16 GB to 8 vCPUs/32 GB directly addresses the root cause of high CPU and memory contention, which is causing the intermittent slow queries. This vertical scaling provides immediate additional compute and memory resources to handle peak query loads, making it the most effective long-term solution for a production database experiencing resource exhaustion.

Answer

Migrate the database to a containerized deployment for better resource utilization.

Answer

Use a query performance tuning tool to optimize the slow queries.

Answer

Implement a read replica to offload read traffic.

Question 15

An organization uses GCP and wants to implement a tagging strategy to track costs by project and environment. Which GCP feature should be used to assign metadata to resources for cost attribution?

Accepted Answer

Labels. GCP labels are key-value pairs used to organize and track resources for cost allocation.

Answer

Annotations

Answer