CV0-004 Practice Test 50 — 15 Questions

Question 1

Which cloud service model provides the customer with the most control over the operating system and software stack?

Accepted Answer

IaaS. IaaS provides virtualized computing resources where the customer manages the OS, middleware, and applications. PaaS abstracts the OS, SaaS provides complete applications, and FaaS abstracts the runtime entirely.

Answer

FaaS

Answer

SaaS

Answer

PaaS

Question 2

A cloud architect is designing a deployment pipeline using GitHub Actions. They want to automatically run tests on every push to the main branch. Which GitHub Actions component defines the automation workflow?

Accepted Answer

Workflow. A workflow is a configurable automated process defined in YAML in the .github/workflows directory.

Answer

Job

Answer

Step

Answer

Action

Question 3

A developer wants to deploy an application using Azure Bicep. What is a key benefit of using Bicep over ARM templates?

Accepted Answer

Bicep has simpler, more readable syntax than ARM JSON. Bicep is a domain-specific language that simplifies authoring ARM templates by providing a cleaner syntax, modularization, and code reuse. It compiles to ARM JSON templates.

Answer

Bicep can be used to manage any cloud provider

Answer

Bicep eliminates the need for resource providers

Answer

Bicep supports imperative scripting

Question 4

A cloud engineer is writing a Terraform configuration to deploy an AWS EC2 instance. Which file extension is typically used for Terraform configuration files written in HCL?

Accepted Answer

.tf. Terraform uses the .tf extension for HCL configuration files.

Answer

.yaml

Answer

.json

Answer

.hcl

Question 5

Which THREE of the following are valid methods to manage identity and access in a multi-cloud environment?

Accepted Answer

Implement a federation using SAML 2.0 between the corporate identity provider and each cloud.. Options B, C, and E are correct. B: Federation via SAML 2.0 enables single sign-on (SSO) across multiple clouds, centralizing identity management. C: Assigning resource tags and using attribute-based access control (ABAC) allows granular, policy-driven access across clouds based on resource attributes. E: A cloud access security broker (CASB) provides visibility and enforces access policies consistently across multiple cloud environments. Option A is incorrect because a site-to-site VPN secures network connectivity, not identity and access. Option D is incorrect because a single shared API key is not identity-based and poses a security risk by not providing individual accountability.

Answer

Set up a site-to-site VPN between the on-premises network and each cloud.

Answer

Use a single shared API key for all clouds to simplify automation.

Question 6

A company wants to migrate its on-premises workloads to the cloud but must keep sensitive data on-premises due to regulatory requirements. Which cloud deployment model should the company use?

Accepted Answer

Hybrid cloud. A hybrid cloud connects on-premises infrastructure with public cloud resources, allowing sensitive data to remain on-premises while leveraging the cloud for other workloads.

Answer

Multi-cloud

Answer

Public cloud

Answer

Private cloud

Question 7

A company is migrating a legacy monolithic application to the cloud. The application currently runs on a single server with 16 vCPUs and 64 GB RAM. The cloud architect recommends redesigning the application to be stateless and horizontally scalable. What is the primary benefit of this approach?

Accepted Answer

Improved fault tolerance and elasticity. Horizontal scaling allows adding more instances to handle increased load, improving availability and elasticity compared to vertical scaling of a monolithic server.

Answer

Lower storage costs

Answer

Simpler licensing costs

Answer

Reduced network latency

Question 8

A company uses a cloud-based load balancer to distribute traffic to a fleet of web servers. Users report intermittent timeouts. The administrator reviews the load balancer logs and notices that one backend server has a significantly higher error rate than the others. Which of the following is the BEST course of action?

Accepted Answer

Drain connections to the unhealthy server and troubleshoot its configuration.. Draining connections from the unhealthy server allows the load balancer to stop sending new traffic to it while existing sessions complete, preventing further timeouts. Troubleshooting the server's configuration addresses the root cause of the high error rate, such as misconfigured web server software, resource exhaustion, or application bugs. This approach follows the principle of isolating and resolving the faulty component rather than masking the issue with workarounds.

Answer

Immediately add two more backend servers to distribute the load.

Answer

Enable sticky sessions on the load balancer to maintain user sessions.

Answer

Increase the health check interval for all servers to reduce false positives.

Question 9

Which THREE of the following are key considerations when designing a cloud-native application for high availability? (Select exactly three.)

Accepted Answer

Implement loose coupling between services. Loose coupling between services, typically achieved via asynchronous messaging or API gateways, ensures that the failure of one service does not cascade to others, which is fundamental for high availability in cloud-native architectures. This design pattern allows individual services to be updated, scaled, or fail independently, maintaining overall system resilience.

Answer

Use multithreading for all components

Answer

Use synchronous replication for databases

Question 10

A company is deploying a cloud-based application that requires consistent, low-latency access to shared database files. Which storage option should be used for the database files?

Accepted Answer

Block storage volumes attached to the database server. Block storage volumes (e.g., Amazon EBS or Azure Managed Disks) provide consistent, low-latency I/O performance because they are directly attached to the database server via a high-speed network and support protocols like NVMe or SCSI. This allows the database to perform synchronous writes and reads with minimal jitter, which is critical for transactional workloads that require ACID compliance. Unlike shared file systems or object storage, block storage offers the raw disk-level access that database engines (e.g., MySQL, PostgreSQL, SQL Server) expect for their data and log files.

Answer

Network file system (NFS) mount

Answer

Object storage (e.g., Amazon S3)

Answer

Ephemeral instance storage

Question 11

A cloud architect is designing a web application that must remain available during a full region outage. They plan to deploy identical resources in two separate geographical regions. Which high availability architecture is described?

Accepted Answer

Active-active. Active-active means both regions handle traffic simultaneously, providing load sharing and failover. This matches deploying identical resources in two regions.

Answer

Cold standby

Answer

Active-passive

Answer

Warm standby

Question 12

A company uses a public cloud PaaS service to run a custom application. They need to ensure the application can handle increased load without downtime. Which action should they take?

Accepted Answer

Configure auto-scaling for the PaaS service. Configuring auto-scaling for the PaaS service allows it to automatically add instances based on load, ensuring high availability without manual intervention.

Answer

Deploy a load balancer in front of the application

Answer

Move to IaaS to gain more control over scaling

Answer

Upgrade the underlying virtual machines manually

Question 13

A cloud administrator is troubleshooting a connectivity issue between two virtual machines in the same VPC but different subnets. Both VMs have security groups that allow all traffic from the VPC CIDR. What should the administrator check first?

Accepted Answer

The network ACLs for both subnets.. Network ACLs are stateless and evaluate traffic entering and leaving a subnet. Even if security groups allow all traffic from the VPC CIDR, a default or custom NACL rule might implicitly deny traffic between subnets. Since the VMs are in different subnets, the NACL for each subnet must be checked first to ensure inbound and outbound rules permit the traffic.

Answer

The VPC flow logs.

Answer

The route tables for both subnets.

Answer

The DHCP option set.

Question 14

Which THREE of the following are valid considerations when selecting a cloud deployment model (public, private, hybrid)? (Choose three.)

Accepted Answer

Regulatory compliance requirements.. Regulatory compliance requirements (A) are a primary consideration because certain industries (e.g., healthcare, finance) mandate data residency and privacy controls that may only be satisfied by a private or dedicated public cloud infrastructure. Budget and total cost of ownership (B) directly influence the choice between capital-intensive private cloud deployments and operational-expense-based public cloud services. Latency sensitivity (D) dictates whether an application requires on-premises private cloud resources to avoid network jitter and meet strict SLAs, or can tolerate the higher latency of a public cloud.

Answer

Developers' preferred programming languages.

Answer

Cloud provider's marketing claims.

Question 15

A cloud engineer is designing a VPC in AWS for a three-tier web application. The web servers must be accessible from the internet, the application servers should only be accessible from the web servers, and the database servers should only be accessible from the application servers. What is the most secure VPC design?

Accepted Answer

Public subnet for web servers, private subnet for application servers, and a separate private subnet for database servers, with proper security group rules. A three-tier VPC design uses public subnets for web servers (with an internet gateway) and private subnets for application and database servers, with security group rules restricting traffic between tiers.

Answer

Public subnet for web and application servers, private subnet for database servers

Answer

Single public subnet with all servers placed in it, using security groups to restrict traffic

Answer

Use a single private subnet and a NAT gateway for internet access