CV0-004 Practice Questions 1 — 50 Questions

Question 1

Match each cost management concept to its description.

Question 2

A load balancer log entry shows the above for a request. What is the MOST likely cause of the 504 error?

Accepted Answer

The backend server took too long to respond to the request.. A 504 Gateway Timeout error from a load balancer indicates that the load balancer sent the request to a backend server but did not receive a timely response. The load balancer has a configured timeout value (often 30-120 seconds), and if the backend server fails to respond within that window, the load balancer terminates the connection and returns a 504. This is the most common cause of 504 errors in load-balanced environments.

Answer

The DNS resolution for the domain name has failed.

Answer

The requested resource does not exist on the backend server.

Answer

The load balancer's health check is misconfigured.

Question 3

Arrange the steps to deploy a new virtual machine in a public cloud environment (e.g., AWS, Azure, GCP) in the correct order.

Question 4

Sequence the steps to troubleshoot a cloud-based application that is not accessible from the internet.

Question 5

Order the steps to migrate an on-premises database to a cloud-managed database service (e.g., RDS, Cloud SQL).

Question 6

A company uses a hybrid cloud model with an on-premises data center and a public cloud. The network team reports that traffic between the cloud and on-premises is experiencing high latency and packet loss. The cloud administrator verifies that the VPN connection is up. What is the most likely cause?

Accepted Answer

The VPN tunnel has a mismatched MTU size.. When a VPN tunnel is up but traffic experiences high latency and packet loss, a mismatched Maximum Transmission Unit (MTU) size is a common cause. This occurs because packets larger than the tunnel's MTU must be fragmented, and if fragmentation is not properly handled (e.g., due to the DF bit being set), packets are dropped, leading to retransmissions and increased latency. The symptoms align with MTU issues rather than simple connectivity or throttling problems.

Answer

A firewall rule is blocking ICMP packets.

Answer

VMs are placed in different cloud regions.

Answer

The cloud provider is throttling bandwidth.

Question 7

A cloud operations team receives an alert that the CPU usage of a VM has exceeded 90% for the past 30 minutes. The VM is part of an auto-scaling group configured to scale out when CPU exceeds 80% for 5 minutes. However, no new instances have been launched. What is the MOST likely reason the auto-scaling failed to trigger?

Accepted Answer

The auto-scaling group is in a cooldown period after a previous scaling action.. The auto-scaling group failed to trigger because it was in a cooldown period after a previous scaling action. Cooldown periods are designed to prevent rapid, successive scaling events that could destabilize the environment. During this time, the auto-scaling group ignores new alarms, even if the CPU threshold is exceeded, until the cooldown timer expires.

Answer

The VM failed a health check and is being replaced.

Answer

The auto-scaling group has reached the minimum instance count.

Answer

The CPU threshold is set too high.

Question 8

A cloud engineer is troubleshooting a web application that is not responding. The engineer examines the serial console output of the web-server instance and finds the error shown in the exhibit. What is the MOST likely cause of this issue?

Accepted Answer

A firewall rule is blocking traffic to the metadata server IP address 169.254.169.254.. The error shown in the serial console output indicates that the instance cannot reach the metadata server at 169.254.169.254. This IP address is a link-local address used by cloud providers (e.g., AWS, GCP, Azure) to serve instance metadata, including user data scripts. If a firewall rule blocks traffic to this IP, the instance cannot retrieve its user data, causing the web application to fail to start or respond.

Answer

The service account associated with the instance is missing the required permissions.

Answer

The instance is in a STOPPED state and cannot execute user data scripts.

Answer

The instance does not have a public IP address assigned.

Question 9

A company has a cloud environment with multiple VPCs that need to communicate with each other using private IP addresses. The company wants a centrally managed solution that simplifies routing and security. Which networking architecture should the architect implement?

Accepted Answer

Transit VPC with a VPN appliance. Option D is correct because a Transit VPC with a VPN appliance provides a centrally managed hub-and-spoke architecture that simplifies routing and security for multiple VPCs. The VPN appliance (e.g., a software VPN or AWS Marketplace appliance) establishes encrypted tunnels between the transit VPC and each spoke VPC, allowing private IP communication without the need for full-mesh peering or complex route tables. This design centralizes traffic inspection, policy enforcement, and routing, meeting the requirement for simplified management.

Answer

VPC peering between all VPCs

Answer

Direct Connect to each VPC

Answer

VPN connections between all VPCs

Question 10

A cloud administrator is troubleshooting connectivity to a virtual machine with IP address 10.10.10.10 from another VM on the same subnet. The output of ping and traceroute commands is shown. What is the most likely cause of the connectivity issue?

Accepted Answer

The destination VM's network interface is disabled.. The correct answer is A because a disabled network interface on the destination VM would cause the VM to be unreachable from the same subnet, even though the VM itself is powered on. Ping and traceroute would fail with no response, as the NIC is not operational at Layer 2, preventing ARP resolution and frame delivery. This matches the symptom of no connectivity despite being on the same subnet, where routing and security groups are not factors.

Answer

The destination VM is powered off.

Answer

The source VM's routing table does not have a default gateway.

Answer

The destination VM's security group is blocking ICMP.

Question 11

A cloud engineer is troubleshooting a performance issue in a virtualized environment. A critical application is running slowly, and the engineer suspects resource contention. The host server has 32 vCPUs and 256 GB of RAM, running four VMs. Which tool should the engineer use to determine if CPU ready time is causing the performance degradation?

Accepted Answer

Use the hypervisor's monitoring console to view CPU ready time. CPU ready time is a hypervisor-level metric that measures the time a VM is ready to execute but must wait for a physical CPU core to become available. Since the engineer suspects resource contention among VMs on the same host, the hypervisor's monitoring console (e.g., vSphere, Hyper-V Manager) is the only tool that can expose this metric directly. Guest OS tools like 'top' or Performance Monitor cannot see CPU ready time because it occurs at the virtualization layer, not inside the VM.

Answer

Run the 'top' command inside the affected VM

Answer

Deploy a network analyzer to capture traffic between VMs

Answer

Check the performance monitor in the guest operating system

Question 12

A cloud engineer is troubleshooting a VM that is experiencing high latency. The VM is hosted on a hypervisor with other VMs. Which TWO metrics should the engineer review to identify if resource contention is occurring?

Accepted Answer

Memory ballooning. Memory ballooning (A) is a VMware mechanism where the hypervisor reclaims idle memory from a VM by inflating a balloon driver, forcing the VM to swap. High ballooning indicates memory overcommitment and contention, directly causing latency. CPU ready time (B) measures the time a VM is ready to run but waiting for a physical CPU core; elevated ready time signals CPU contention among VMs on the same hypervisor.

Answer

Network packet drops

Answer

Swap usage

Answer

Disk queue length

Question 13

A company is implementing a cloud governance strategy. They need to ensure that all resources are tagged with cost center and environment, and any untagged resources are automatically remediated. Which of the following best practices should be applied?

Accepted Answer

Use policy-as-code to enforce tagging and automatically apply tags to untagged resources. Option D is correct because policy-as-code (e.g., Azure Policy, AWS Config Rules, or Open Policy Agent) allows you to define tagging requirements declaratively and automatically remediate non-compliant resources. This approach enforces governance in real-time without manual intervention, ensuring all resources are tagged with cost center and environment as specified.

Answer

Implement role-based access control to restrict resource creation

Answer

Set up budget alerts to notify when costs exceed thresholds

Answer

Create a manual audit process to check tags weekly

Question 14

A cloud architect is designing a hybrid cloud environment that connects an on-premises data center to a public cloud. The architect needs to ensure secure, low-latency connectivity and isolate traffic between different business units. Which TWO solutions should the architect implement? (Choose two.)

Accepted Answer

Establish a dedicated VPN or direct connect between on-premises and cloud. Option B is correct because a dedicated VPN or Direct Connect establishes a secure, low-latency, and private connection between the on-premises data center and the public cloud, bypassing the public internet to reduce latency and improve security. This is essential for hybrid cloud environments where consistent performance and isolation from internet-based threats are required.

Answer

Configure a NAT gateway to allow outbound internet access

Answer

Deploy a bastion host in a public subnet for administrative access

Answer

Use a transit gateway to interconnect all VPCs

Question 15

A company is deploying a new web application in a hybrid cloud environment. The application must be able to scale out automatically during peak usage and scale in during low usage. The deployment must also ensure that the application remains available if a single Availability Zone fails. Which deployment strategy should the architect recommend?

Accepted Answer

Create an auto-scaling group spanning multiple Availability Zones.. Option B is correct because an auto-scaling group spanning multiple Availability Zones ensures both automatic scaling based on demand and high availability. If one Availability Zone fails, the load balancer distributes traffic to healthy instances in the remaining zones, meeting the requirement for continuous availability during a zone failure.

Answer

Deploy a cluster of instances in a single Availability Zone with a load balancer.

Answer

Use a single large instance and manually resize during peak periods.

Answer

Deploy a load balancer in front of a single instance.

Question 16

A cloud engineer is deploying a containerized application using Kubernetes. The application consists of a frontend, a backend API, and a database. The engineer needs to ensure that the backend API can be reached by the frontend but not from outside the cluster. Which Kubernetes resource should the engineer use to expose the backend API?

Accepted Answer

ClusterIP service. A ClusterIP service exposes the backend API on a cluster-internal IP address, making it reachable only from within the Kubernetes cluster. This meets the requirement that the frontend can communicate with the backend API, but external traffic is blocked. ClusterIP is the default service type and is ideal for internal service-to-service communication.

Answer

NodePort service

Answer

Ingress resource

Answer

LoadBalancer service

Question 17

A company is deploying a web application across multiple cloud regions for high availability. The application must maintain session state. Which deployment strategy should be used?

Accepted Answer

Sticky sessions with a load balancer. Sticky sessions (also known as session persistence) ensure that all requests from a client during a session are directed to the same backend server. This is critical for a multi-region deployment where the application must maintain session state, as it prevents session data loss when a load balancer distributes traffic. By using a load balancer with sticky sessions, the application can maintain stateful interactions even across multiple cloud regions, assuming the load balancer is configured for cross-region routing.

Answer

Active-passive failover

Answer

Geo-routing with DNS

Answer

Round-robin load balancing

Question 18

A deployment of a new application version fails with a '503 Service Unavailable' error after a rolling update. The previous version was working. What is the most likely cause?

Accepted Answer

New version missing a required dependency. A 503 Service Unavailable error during a rolling update typically indicates that the new application version cannot start or serve traffic. The most likely cause is a missing required dependency (e.g., a library, module, or runtime component) that the previous version did not need, causing the new pods or containers to fail readiness probes and be removed from the load balancer pool.

Answer

Database connection pool exhausted

Answer

DNS propagation delay

Answer

SSL certificate expired

Question 19

A cloud engineer notices that a virtual machine running a critical application is experiencing high CPU usage. The engineer needs to resolve the issue without affecting other VMs on the same host. Which of the following actions should the engineer take first?

Accepted Answer

Migrate the VM to another host in the cluster.. Migrating the VM to another host in the cluster (option C) is the correct first action because it immediately offloads the CPU pressure from the current host without impacting the VM's operation or other VMs. This leverages VMware vMotion or Microsoft Hyper-V Live Migration to move the running VM to a less-utilized host, isolating the performance issue while preserving uptime and avoiding resource contention.

Answer

Restart the VM to clear the high CPU usage.

Answer

Increase the CPU allocation for the VM.

Answer

Add another VM to the same host to distribute load.

Question 20

A cloud administrator is troubleshooting connectivity issues between two virtual networks in a public cloud. The networks are in the same region but different VPCs. Both VPCs have route tables and security groups configured. Instances in VPC A cannot ping instances in VPC B. Which of the following is the most likely cause?

Accepted Answer

VPC peering is not established between the two VPCs.. VPC peering is a direct network connection between two VPCs that enables routing of traffic using private IPv4 or IPv6 addresses. Without an established VPC peering connection, instances in different VPCs cannot communicate, even if they are in the same region. Since the question states the VPCs are separate and no peering is mentioned, this is the most likely root cause of the connectivity failure.

Answer

The instances are not assigned public IP addresses.

Answer

Security groups are blocking ICMP traffic.

Answer

Network ACLs are not configured to allow the traffic.