CV0-004 Practice Test 46 — 15 Questions

Question 1

A company runs a stateless web application on auto-scaling EC2 instances behind an Application Load Balancer. The application experiences sudden traffic spikes. Which scaling approach will handle the spikes most efficiently while minimizing cost?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Horizontal scaling with auto-scaling based on CPU utilization. Horizontal scaling (adding instances) combined with auto-scaling based on metrics is best for handling spikes cost-effectively in a stateless app.

Answer

Vertical scaling of existing instances

Answer

Using reserved instances for all capacity

Answer

Pre-provisioning a large number of instances

Question 2

A company uses a multi-account AWS organization with separate accounts for development, testing, and production. A developer in the development account needs to access an S3 bucket in the production account to retrieve log files for troubleshooting. The developer has an IAM user in the development account with full S3 permissions, and the production account's S3 bucket policy includes a statement that grants access to the root user of the development account. However, when the developer attempts to access the bucket using AWS CLI with their IAM user credentials, they receive an 'Access Denied' error. The security team has verified that there are no explicit deny policies in either account, and that the bucket policy is correctly configured. The administrator has confirmed that the developer's IAM user has permissions to perform S3 operations. Which of the following is the MOST likely cause of the access failure?

Accepted Answer

The production account must have an IAM role with a trust policy that allows the development account to assume it.. Cross-account S3 access typically requires the developer to assume an IAM role in the production account with a trust policy allowing the development account. The bucket policy granting access to the root user of the development account does not automatically grant access to IAM users in that account; the users must assume the role to get temporary credentials. Adding the user to a group in the target account is not possible across accounts. Using root credentials is insecure. VPC peering addresses network connectivity, not IAM permissions.

Answer

The developer's IAM user needs to be added to an IAM group in the production account.

Answer

A VPC peering connection must be established between the two accounts.

Answer

The developer should use the root user credentials of the development account to access the bucket.

Question 3

Which TWO of the following are best practices when configuring a cloud-based virtual private cloud (VPC) for a multi-tier application?

Accepted Answer

Place each application tier in a separate subnet.. Placing each application tier (e.g., web, application, database) in a separate subnet allows you to apply distinct network access control lists (NACLs) and security groups per tier. This segmentation enforces the principle of least privilege, ensuring that only the web tier can communicate with the application tier on specific ports, and only the application tier can reach the database tier. It also isolates failures and simplifies troubleshooting by containing traffic within defined network boundaries.

Answer

Disable VPC flow logs to reduce costs.

Answer

Use the default security group for all instances.

Answer

Place all instances in the same subnet for simplicity.

Question 4

A company uses AWS CloudFormation to manage infrastructure. The operations team needs to be alerted when a stack update fails. Which TWO methods can be used to send notifications? (Choose two.)

Accepted Answer

Configure CloudFormation to send events to an SNS topic. CloudFormation can use SNS topics for stack events. CloudWatch Events (now Amazon EventBridge) can also match stack update failures and trigger notifications.

Answer

Use AWS Trusted Advisor to monitor CloudFormation

Answer

Enable CloudTrail to log stack updates and send logs to CloudWatch Logs

Answer

Use AWS Config to detect stack failures

Question 5

A cloud engineer is troubleshooting a network connectivity issue between two VPCs in AWS. To analyze traffic patterns and identify dropped packets, which feature should be enabled?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC, useful for troubleshooting connectivity and security issues.

Answer

AWS CloudTrail

Answer

Amazon Inspector

Answer

AWS X-Ray

Question 6

A company uses GCP and wants to ensure that log entries from Compute Engine instances are automatically exported to BigQuery for analysis. The logs must include structured JSON data. Which GCP service should be configured to route logs?

Accepted Answer

Cloud Logging using sinks. Cloud Logging can route logs to BigQuery using sinks. It accepts structured logs in JSON format.

Answer

Cloud Audit Logs

Answer

Cloud Functions

Answer

Cloud Monitoring

Question 7

A cloud administrator needs to receive real-time notifications when CPU utilization on a critical web server exceeds 90% for more than 5 minutes. Which cloud monitoring service should be used to create the alert?

Accepted Answer

AWS CloudWatch Alarms. CloudWatch Alarms (AWS) allow you to monitor metrics and trigger actions when thresholds are breached. Other options are not specific to AWS or not designed for alerting on metrics.

Answer

AWS CloudTrail

Answer

AWS Config

Answer

AWS Trusted Advisor

Question 8

A company is evaluating storage options for different use cases. Which TWO storage types are most suitable for hosting a relational database in the cloud? (Select TWO.)

Accepted Answer

File storage. Block storage (e.g., AWS EBS, Azure Disk) is the primary choice for hosting relational databases due to low latency and direct block-level access. File storage (e.g., AWS EFS, Azure Files) can also host relational databases, especially in shared storage scenarios, though with higher latency and lower performance. Therefore, both block storage and file storage are suitable for hosting relational databases. Cache, archive, and object storage are not designed for active database hosting.

Answer

Cache storage

Answer

Archive storage

Answer

Object storage

Question 9

A cloud architect is designing a multi-tier web application that must handle sudden traffic spikes. The application layer is stateless, and the database layer is read-heavy with occasional writes. Which design best meets the requirement for elasticity and cost efficiency?

Accepted Answer

Use auto-scaling for the application tier and read replicas for the database. Auto-scaling the stateless application tier dynamically adds or removes instances based on CPU or request metrics, directly handling traffic spikes without over-provisioning. For the read-heavy database tier, read replicas offload SELECT queries from the primary database, improving read throughput and cost efficiency by scaling horizontally only when needed, while the primary handles occasional writes.

Answer

Implement auto-scaling for the database tier and use a larger application instance

Answer

Use a load balancer to distribute traffic to multiple database instances

Answer

Deploy large application and database instances to handle peak load

Question 10

A cloud engineer is troubleshooting a web application that is not responding. The engineer examines the serial console output of the web-server instance and finds the error shown in the exhibit. What is the MOST likely cause of this issue?

Accepted Answer

A firewall rule is blocking traffic to the metadata server IP address 169.254.169.254.. The error shown in the serial console output indicates that the instance cannot reach the metadata server at 169.254.169.254. This IP address is a link-local address used by cloud providers (e.g., AWS, GCP, Azure) to serve instance metadata, including user data scripts. If a firewall rule blocks traffic to this IP, the instance cannot retrieve its user data, causing the web application to fail to start or respond.

Answer

The service account associated with the instance is missing the required permissions.

Answer

The instance is in a STOPPED state and cannot execute user data scripts.

Answer

The instance does not have a public IP address assigned.

Question 11

A company is using a PaaS offering to host a web application. Which THREE management responsibilities are retained by the customer? (Select THREE.)

Accepted Answer

Application code. In PaaS, the customer manages the application code, data, and access configuration. The provider manages the runtime, OS, and infrastructure.

Answer

Runtime environment

Answer

Operating system patches

Question 12

A company uses a cloud-based backup solution for its virtual machines. The backup policy specifies daily backups with a retention of 30 days. The backup administrator notices that backups are failing with an error indicating insufficient storage space in the backup repository. Which of the following is the most likely reason for this issue?

Accepted Answer

The retention period is too long for the available storage.. The error indicates insufficient storage space in the backup repository. With a daily backup policy and a 30-day retention period, the repository must accommodate at least 30 full backups (or the equivalent incremental/differential chain). If the repository's capacity is less than the total size of 30 backups, the retention period exceeds the available storage, causing failures. This is the most direct cause of the error.

Answer

The backup frequency is too low.

Answer

Compression is not enabled on the backup.

Answer

The backup window is too short.

Question 13

A cloud administrator is troubleshooting a database failover issue. The database is a managed service with a primary and standby replica in different availability zones. The application uses a read-write endpoint. During a recent maintenance event, the primary database failed over automatically, but the application experienced a 10-minute outage. The administrator checks the failover logs and sees that it completed within 2 minutes. What is the most likely cause of the extended outage?

Accepted Answer

The application's database connection pool does not retry DNS resolution. If the application's connection pool caches the IP address of the primary database, it will not automatically re-resolve the DNS after failover, causing prolonged outages. Option B is wrong because multi-AZ configuration is about the database, not the application's endpoint configuration. Option C is wrong because if the standby was out of sync, failover would not complete cleanly. Option D is wrong because the DNS change is usually fast but the application may not re-query DNS.

Answer

The application was not configured to use multiple availability zones

Answer

The standby replica was not in sync

Answer

The failover triggered a change in the endpoint DNS record

Question 14

A security team needs to enforce multi-factor authentication (MFA) for all users accessing the cloud management console. Which IAM feature should be configured?

Accepted Answer

Condition in IAM policy requiring MFA. A condition in an identity policy can require the presence of multi-factor authentication, enforcing MFA for access to the cloud management console. This is a standard mechanism to mandate MFA at the policy level, ensuring users must authenticate with a second factor before accessing the console.

Answer

IAM role

Answer

Resource-based policy

Answer

Password policy

Question 15

A company is migrating its on-premises workload to a public cloud. The security team wants to ensure that all data transmitted between the on-premises network and the cloud VPC is encrypted in transit and that the connection uses dedicated bandwidth. Which of the following should the security team implement?

Accepted Answer

Set up a direct connection between the on-premises router and the cloud VPC.. A dedicated connection (e.g., AWS Direct Connect or Azure ExpressRoute) provides a private physical link with dedicated bandwidth between on-premises and the cloud VPC. While encryption is not inherent, it can be added using IPsec over the direct connection or by using encrypted protocols on top. This combination satisfies both requirements: dedicated bandwidth and encryption in transit. Option C (site-to-site VPN) encrypts traffic but uses shared internet bandwidth, failing the dedicated bandwidth requirement. Therefore, D is the best answer.

Answer

Attach an internet gateway to the VPC and use public IP addresses.

Answer

Use a NAT gateway to translate private IPs to public IPs.

Answer

Configure a site-to-site VPN between the on-premises network and the cloud VPC.