CV0-004 Practice Exam 51 — 20 Questions

Question 1

A company experiences a data breach where an attacker exfiltrated data from a cloud storage bucket. The security team discovers that the bucket had a policy allowing public access. The cloud administrator had previously set the bucket to be private. Which of the following is the MOST likely reason the bucket became public?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An IAM role with administrative privileges applied a bucket policy that overrode the private setting.. A bucket policy that grants public access (e.g., `Principal: "*"` with `Effect: "Allow"`) can override the private block public access setting at the bucket level. Even if the cloud administrator set the bucket to private via the console or ACLs, an IAM role with administrative privileges can apply a bucket policy that explicitly allows public access, effectively making the bucket public. This is because bucket policies are evaluated separately and can grant permissions that supersede other access controls.

Answer

The bucket had versioning enabled, which reverted to a previous public state.

Answer

Access logs were not enabled, so the change was not recorded.

Answer

Server-side encryption was disabled, causing the bucket to become public.

Question 2

A startup wants to run code in response to events without provisioning or managing servers. Which cloud service model should they use?

Accepted Answer

FaaS. FaaS (serverless) runs code in response to events, and the provider manages the infrastructure.

Answer

PaaS

Answer

IaaS

Answer

SaaS

Question 3

A company needs to connect its on-premises data center to a public cloud provider with a dedicated, consistent network connection that bypasses the internet. Which connectivity method should be used?

Accepted Answer

Direct Connect or ExpressRoute. Dedicated connections like AWS Direct Connect or Azure ExpressRoute provide private, consistent connectivity.

Answer

VPC peering

Answer

Internet gateway

Answer

Site-to-Site VPN

Question 4

An organization uses Azure DevOps for CI/CD. They want to implement a deployment strategy where a new version of an application is deployed to a small subset of users (e.g., 5%) and if no errors are detected, the percentage is gradually increased to 100%. Which deployment strategy should they use?

Accepted Answer

Canary. Canary deployment releases to a small subset and gradually increases traffic while monitoring.

Answer

Rolling

Answer

Recreate

Answer

Blue/green

Question 5

A company is implementing a canary deployment for a web application running on AWS. Which TWO components are essential for this strategy? (Choose two.)

Accepted Answer

A load balancer to distribute traffic between versions. A load balancer to route traffic and monitoring to detect issues are essential for canary deployments.

Answer

A blue environment running the old version

Answer

A CI/CD pipeline with automated testing

Answer

An auto scaling group for the new version

Question 6

Which TWO actions should a cloud administrator take to protect against data exfiltration from a cloud storage bucket? (Choose two.)

Accepted Answer

Implement server-side encryption with SSE-S3.. Enabling object versioning allows recovery if data is deleted or overwritten but does not prevent exfiltration. Requiring MFA for delete operations prevents unauthorized deletion but not reading. Restricting public access and encrypting data at rest are effective controls against exfiltration. Audit logging is detective, not preventive.

Answer

Enable object versioning on the bucket.

Answer

Configure bucket access logs for monitoring.

Answer

Enable MFA delete on the bucket.

Question 7

A cloud security analyst finds the above JSON policy attached to an S3 bucket containing confidential customer data. What change must be made to comply with the principle of least privilege?

Accepted Answer

Restrict the Principal to a specific AWS account or user.. The JSON policy attached to the S3 bucket includes a wildcard Principal ("Principal": "*"), which allows anonymous access to anyone. To comply with the principle of least privilege, access must be restricted to only authorized entities. Option A correctly identifies this by requiring the Principal to be set to a specific AWS account or user, ensuring only authenticated and authorized principals can access the bucket.

Answer

Change the Effect to 'Deny'.

Answer

Change the Action to 's3:PutObject'.

Answer

Remove the Resource field.

Question 8

A DevOps engineer is configuring a Kubernetes deployment for a microservices application. The application requires that new pods receive traffic only after a health check endpoint returns HTTP 200. Which Kubernetes feature should be configured on the pods?

Accepted Answer

Readiness probe. Readiness probes determine whether a pod is ready to receive traffic; only when the probe succeeds is the pod added to service endpoints.

Answer

Startup probe

Answer

Liveness probe

Answer

Resource limits

Question 9

A cloud architect is designing a secrets management solution for a microservices application. The solution must avoid hardcoding secrets in code and support automatic rotation. Which THREE of the following are best practices? (Select THREE.)

Accepted Answer

Use a dedicated secrets management service like AWS Secrets Manager.. Best practices include using a dedicated vault, injecting secrets at runtime, and enabling rotation. Storing secrets in environment variables is not recommended. Using IAM roles avoids storing credentials.

Answer

Use long-lived static keys for simplicity.

Answer

Store secrets in environment variables for ease of access.

Question 10

A cloud architect is selecting a deployment model for a workload that has strict data sovereignty requirements; data must remain within the company's on-premises data center. Which cloud deployment model should be chosen?

Accepted Answer

Private cloud. A private cloud deployment model is the correct choice because it provides dedicated infrastructure that is exclusively used by a single organization, ensuring that all data and workloads remain within the company's on-premises data center. This model meets strict data sovereignty requirements by allowing full control over data residency, network boundaries, and physical security, unlike shared or public environments where data may cross jurisdictional lines.

Answer

Community cloud

Answer

Hybrid cloud

Answer

Public cloud

Question 11

An administrator notices that a cloud-hosted database is experiencing high latency during peak usage. The CPU and memory utilization on the DB server are below 50%, but disk IOPS are consistently at the provisioned limit. What should the administrator check first?

Accepted Answer

Check if the storage volume has an IOPS cap.. The symptoms (high latency, low CPU/memory utilization, but disk IOPS at provisioned limit) indicate the storage volume's IOPS cap is being hit, causing queueing and latency. Option A is incorrect because network bandwidth is not indicated as the bottleneck; CPU and memory are low, and latency is tied to disk. Option B is incorrect because adding storage volumes would not directly address the IOPS cap; it might spread load but does not increase the per-volume IOPS limit. Option D is incorrect because increasing vCPUs would not resolve an IOPS limitation; the CPU is not saturated.

Answer

Check network bandwidth between the DB and application servers.

Answer

Add additional storage volumes and stripe data.

Answer

Increase the number of vCPUs on the DB server.

Question 12

During a CI/CD pipeline for a web application, the team wants to reduce risk by deploying a new version to a small percentage of users initially, monitoring for errors, and automatically rolling back if issues are detected. Which deployment strategy should they implement?

Accepted Answer

Canary deployment. Canary deployment releases to a subset of users and includes monitoring and automatic rollback. Blue/green uses two full environments and switch traffic; rolling updates gradually replace instances; in-place updates replace instances without traffic shifting.

Answer

Blue/green deployment

Answer

Rolling deployment

Answer

In-place deployment

Question 13

A cloud administrator notices that a virtual machine is running out of memory and causing performance issues. The VM is part of a production web application. Which of the following actions should the administrator take FIRST to resolve the issue without impacting availability?

Accepted Answer

Add a swap file to the VM's virtual disk.. Adding a swap file to the VM's virtual disk provides virtual memory, which can be allocated while the VM is running and does not require downtime. This is the first action to relieve memory pressure without impacting availability. Live migration (D) does not increase the VM's memory allocation, so it does not resolve the issue. Stopping the VM (A) causes downtime. Taking a snapshot (C) adds overhead and increasing memory may still require a restart.

Answer

Stop the VM and increase its memory allocation, then restart it.

Answer

Take a snapshot of the VM and then increase memory allocation.

Answer

Perform a live migration of the VM to a host with more memory.

Question 14

A DevOps team is implementing a CI/CD pipeline using Jenkins. They want to ensure that code is automatically built, tested, and deployed to a staging environment before manual approval for production. Which stage should include the deployment to staging?

Accepted Answer

Deploy. In a typical CI/CD pipeline, the deploy stage follows build and test, and before production.

Answer

Build

Answer

Source

Answer

Verify

Question 15

A cloud administrator needs to transfer 50 TB of data from an on-premises NAS to Amazon S3. The office has limited bandwidth (50 Mbps). Which service is most suitable for this offline transfer?

Accepted Answer

AWS Snowball. AWS Snowball is designed for large offline data transfers where network bandwidth is limited. Physical devices are shipped to transfer data.

Answer

AWS VPN

Answer

AWS DataSync

Answer

S3 Transfer Acceleration

Question 16

An organization uses Azure DevOps for CI/CD and needs to deploy serverless functions written in multiple languages. The functions must be triggered by HTTP requests and handle background processing from Azure Blob Storage events. Which THREE Azure services should be used to build this solution?

Accepted Answer

Azure API Management. Azure Functions is the compute service. API Management provides HTTP triggers with management. Azure Blob Storage can trigger functions via event subscriptions (Event Grid). Logic Apps is for workflows, not functions. Application Insights is for monitoring.

Answer

Azure Logic Apps

Answer

Azure Application Insights

Question 17

A company wants to receive alerts when their cloud costs exceed a budget threshold. Which cost management feature should they use?

Accepted Answer

Cost anomaly detection alerts. Cost anomaly detection alerts are designed to identify unusual spending patterns using machine learning, not for alerting against a predefined budget threshold. The correct cloud cost management feature for receiving alerts when costs exceed a budget threshold is budget alerts (e.g., AWS Budgets, Azure Budgets), which is not among the listed options. Therefore, none of the provided options is correct.

Answer

Rightsizing recommendations

Answer

Reserved Instance planning

Answer

Tagging strategy

Question 18

A company uses multiple AWS accounts. The cloud team wants to allocate costs to specific business units. What should they implement?

Accepted Answer

Tagging strategy. A tagging strategy with tags like environment, team, and project enables cost allocation.

Answer

Cost Explorer

Answer

AWS Budgets

Answer

AWS Organizations

Question 19

A cloud architect is designing a disaster recovery plan. The application requires a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 hour. Which strategy best meets these requirements?

Accepted Answer

Continuous replication to a warm standby site. Continuous replication to a standby environment (pilot light or warm standby) can achieve low RTO and RPO. Snapshot-based with daily backups has RPO of 1 day. Cross-region replication of snapshots can have RPO hours. Warm standby with continuous replication meets both RTO and RPO.

Answer

Daily snapshots replicated to another region

Answer

Scheduled cross-region snapshots every 6 hours

Answer

Backup to tape and store offsite

Question 20

A cloud engineer is setting up automated patching for Linux instances in AWS. They need to define a maintenance window during which patches are applied. Which service should they use?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager provides automated patching with maintenance windows.

Answer

AWS Config

Answer

AWS OpsWorks

Answer

Amazon Inspector