CV0-004 Practice Exam 52 — 20 Questions

Question 1

A cloud administrator is configuring auto-scaling for a batch processing application that uses an SQS queue. The number of jobs varies unpredictably. Which metric is most appropriate for scaling the worker instances?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

SQS queue depth (ApproximateNumberOfMessages). SQS queue depth (approximate number of messages) directly indicates the backlog of work and is a common metric for scaling workers.

Answer

Memory utilization of workers

Answer

Network throughput

Answer

CPU utilization of workers

Question 2

A company is designing a disaster recovery plan for a critical database that requires a recovery point objective (RPO) of 1 minute and a recovery time objective (RTO) of 15 minutes. The database runs on a cloud virtual machine. Which backup strategy should the administrator implement to meet these requirements?

Accepted Answer

Implement continuous replication to a standby instance in a different region.. Continuous replication to a standby instance in a different region can achieve RPO of 1 minute (near-zero data loss) and RTO of 15 minutes by failing over quickly, whereas snapshot-based replication would have higher RPO.

Answer

Take daily snapshots and store them in the same region.

Answer

Perform weekly backups to tape and store offsite.

Answer

Use cross-region snapshot replication with hourly snapshots.

Question 3

A company uses AWS Systems Manager Patch Manager to automate patching. They need to ensure that patches are applied during a specific maintenance window with minimal risk of failure. Which additional step should be taken to allow quick recovery if a patch causes issues?

Accepted Answer

Create an AMI snapshot before applying patches. Creating an AMI snapshot or instance backup before patching enables rollback if a patch fails. The other options do not directly support rollback.

Answer

Use AWS CloudFormation to re-create the instance

Answer

Configure a rollback procedure using AWS Systems Manager State Manager

Answer

Enable termination protection on the instances

Question 4

A company uses AWS and wants to implement structured logging for their applications to improve queryability. Which THREE practices should they follow? (Select THREE.)

Accepted Answer

Include timestamp, severity, and request ID in each log entry. Structured logging uses JSON format, includes key fields, and uses consistent schemas.

Answer

Send all logs to a single S3 bucket without partitioning

Answer

Encrypt log files at rest using AWS KMS

Question 5

A cloud application is experiencing intermittent high latency. The operations team has enabled distributed tracing using AWS X-Ray but is unable to pinpoint the source. Which additional step should the team take to identify the root cause of the latency?

Accepted Answer

Analyze traces in X-Ray to identify which service segment has the highest duration.. Distributed tracing (like X-Ray) provides end-to-end visibility of requests. To pinpoint the source of latency, the team should analyze trace data to identify which service or segment is taking the most time. Enabling VPC Flow Logs, application logs, or scaling out would not directly identify the latency source within the application.

Answer

Enable VPC Flow Logs to analyze network traffic patterns.

Answer

Increase the auto-scaling group size to handle the load.

Answer

Examine application logs on each virtual machine.

Question 6

A cloud customer needs to ensure that data stored in an object storage bucket is encrypted at rest. The customer wants to manage the encryption keys themselves. Which encryption option should they choose?

Accepted Answer

Server-side encryption with customer-provided keys. Server-side encryption with customer-provided keys allows the customer to manage their own encryption keys while the cloud provider handles the encryption and decryption process. The customer provides the encryption key as part of the upload request, and the provider uses it to encrypt the object at rest, then discards the key after the operation. This meets the requirement of managing the keys themselves while ensuring data is encrypted at rest on the server side.

Answer

Server-side encryption with provider-managed keys

Answer

Server-side encryption with key management service

Answer

Client-side encryption

Question 7

A company is deploying a containerized application using Kubernetes on a public cloud. The development team has created a Docker image and pushed it to a private container registry. The deployment YAML points to the registry. However, when the deployment is applied, the pods fail to start with an 'ImagePullBackOff' error. The cloud administrator verifies that the registry is reachable from the cluster nodes and that the image exists. What is the most likely reason for the failure?

Accepted Answer

The deployment lacks a secret for registry authentication.. The most likely reason for the ImagePullBackOff error is that the deployment lacks a Kubernetes secret for registry authentication. Since the image is stored in a private container registry, the kubelet must authenticate with the registry to pull the image. Without a properly configured imagePullSecret in the pod spec, the kubelet cannot obtain credentials, resulting in a failed pull and the ImagePullBackOff status.

Answer

The cluster nodes are out of disk space.

Answer

The image tag is incorrect.

Answer

The pod does not have sufficient CPU resources.

Question 8

A company uses a cloud-based object storage service to store backups. The backups must be retained for seven years to meet compliance requirements. Which storage tier should be used to minimize cost while meeting the retention requirement?

Accepted Answer

Cold storage with a retrieval time of several hours.. Cold storage (e.g., Amazon S3 Glacier Deep Archive or Azure Blob Storage Cool/Archive tier) offers the lowest cost for long-term retention while still allowing retrieval within several hours, which is acceptable for backup compliance. The seven-year retention requirement exceeds the typical 90-day minimum for archival tiers, but cold storage has no such minimum and is optimized for data accessed less than once a year, making it the most cost-effective choice.

Answer

Archival storage with a minimum retention period of 90 days.

Answer

Infrequent access storage with a retrieval fee.

Answer

Standard storage with life-cycle policies to delete after seven years.

Question 9

A cloud engineer needs to deploy a stateless application across multiple availability zones. The application must scale horizontally based on CPU utilization. Which of the following is the BEST configuration?

Accepted Answer

Create an auto-scaling group spanning multiple zones with a load balancer. An auto-scaling group spanning multiple availability zones ensures high availability and fault tolerance by distributing instances across zones, while the load balancer distributes traffic and the scaling policy adjusts capacity based on CPU utilization. This configuration meets the requirements for a stateless, horizontally scalable application without manual intervention.

Answer

Deploy a single large instance and increase its size as needed

Answer

Use a managed container service and manually add containers

Answer

Deploy instances in one zone using spot instances to reduce cost

Question 10

Refer to the exhibit. A cloud security engineer is reviewing an S3 bucket policy that controls access to the 'example-bucket' bucket. The 'AdminRole' IAM role attempts to upload an object to the bucket using the AWS CLI without specifying the '--server-side-encryption' parameter. The object transfer uses HTTPS. What will be the outcome?

Accepted Answer

The upload fails because the condition in the Allow statement is not satisfied.. The S3 bucket policy includes an Allow statement with a condition that requires `s3:x-amz-server-side-encryption` to be `AES256`. Since the `AdminRole` IAM role did not specify the `--server-side-encryption` parameter, the condition is not satisfied, and the Allow statement does not grant permission. Without a matching Allow, the default implicit deny applies, causing the upload to fail.

Answer

The upload succeeds but the object is stored without server-side encryption.

Answer

The upload succeeds because the request uses HTTPS and the role is allowed.

Answer

The upload fails because the Deny statement blocks all requests that are not using HTTPS.

Question 11

A cloud architect is designing network security for a VPC. The architect needs to implement both stateful and stateless firewalls. Which TWO of the following correctly describe these firewall types?

Accepted Answer

Security groups are stateful; they automatically allow return traffic for allowed inbound connections.. Security groups are stateful firewalls that automatically allow return traffic for allowed inbound connections. Network ACLs are stateless firewalls that support both allow and deny rules evaluated in priority order. Option C, while true, describes a property of security groups (allow rules only) but is not a direct description of the firewall type (stateful vs. stateless) as asked by the question. Therefore, only options B and D are correct.

Answer

Network ACLs are stateful; they track connection state and allow return traffic automatically.

Answer

Security groups support allow rules only; deny rules are not supported.

Answer

Both security groups and network ACLs can be used to allow or deny traffic based on source IP and port.

Question 12

A cloud administrator is managing a fleet of virtual machines that run a batch processing job. The job is memory-intensive and runs once a day. The administrator wants to optimize cost without affecting performance. Which of the following is the BEST approach?

Accepted Answer

Use a mix of reserved instances for the minimum required capacity and spot instances to handle the daily workload. It combines reserved instances for the baseline capacity needed daily, ensuring cost savings through a 1- or 3-year commitment, with spot instances for the memory-intensive batch workload. Spot instances can handle the peak demand at a significantly lower cost (often 60-90% discount) without affecting performance, as the batch job is fault-tolerant and can be interrupted. This hybrid approach optimizes cost while maintaining the required performance for the daily job.

Answer

Purchase dedicated hosts to ensure resource isolation

Answer

Manually shut down instances when the job completes

Answer

Use only on-demand instances to avoid commitment

Question 13

A cloud administrator needs to apply a critical security patch to a virtual machine that is part of a production application. The application must remain available during patching. Which of the following is the BEST approach?

Accepted Answer

Remove the VM from the load balancer, apply the patch, then return it to service during a maintenance window. Removing the VM from the load balancer ensures that no new traffic is sent to it while the patch is applied, maintaining application availability for users. After the patch is applied and the VM is verified as healthy, it can be returned to the load balancer pool. This approach aligns with a rolling update strategy, which is the standard method for applying patches to production VMs without downtime.

Answer

Postpone the patch until the next scheduled update cycle

Answer

Patch all VMs simultaneously to minimize the time to full deployment

Answer

Apply the patch during peak usage hours to ensure immediate deployment

Question 14

Which TWO of the following are best practices for securing an API gateway in a cloud environment?

Accepted Answer

Implement rate limiting to control the number of requests per client.. Rate limiting is a fundamental security control for API gateways. It mitigates abuse and denial-of-service (DoS) attacks by restricting the number of requests a client can make within a specified time window, typically enforced via token bucket or leaky bucket algorithms. This ensures fair resource usage and protects backend services from being overwhelmed.

Answer

Expose the API endpoints without authentication for ease of integration.

Answer

Return detailed error messages including stack traces to help developers.

Answer

Disable HTTPS to reduce latency.

Question 15

Match each cost management concept to its description.

Accepted Answer

Total Cost of Ownership (TCO): Total cost including purchase, operation, and disposal. TCO is lifecycle cost, Pay-as-you-go is usage-based billing, Reserved Instances offer discounts for prepayment, and Cost Allocation tracks departmental spending. Common confusions include mixing TCO with Pay-as-you-go and Pay-as-you-go with Reserved Instances.

Answer

Total Cost of Ownership (TCO): Pay only for what you use

Answer

Pay-as-you-go: Pre-pay for discounted rate

Question 16

A cloud architect must design a deployment for a containerized microservices application. The requirements include automated scaling based on CPU utilization, rolling updates with zero downtime, and service discovery. Which orchestration feature should be used?

Accepted Answer

Kubernetes with Horizontal Pod Autoscaler. Kubernetes with Horizontal Pod Autoscaler (HPA) is the correct choice because HPA automatically scales the number of pod replicas based on observed CPU utilization (or custom metrics), meeting the automated scaling requirement. Kubernetes also supports rolling updates with zero downtime via its Deployment controller, which gradually replaces old pods with new ones while maintaining service availability. Additionally, Kubernetes provides built-in service discovery through DNS (CoreDNS) and Services, allowing microservices to find each other by name without external dependencies.

Answer

Docker Compose with a reverse proxy

Answer

Ansible playbooks with Docker modules

Answer

AWS ECS with Fargate

Question 17

A company is deploying a web application using Azure Kubernetes Service (AKS). The deployment manifest includes a probe to check if the application is ready to serve traffic. Which TWO types of probes can be used to determine pod health in Kubernetes? (Select TWO.)

Accepted Answer

Liveness probe. Readiness and liveness probes are used for health checking. Startup probes are also available but less common. ConfigMap and Secret are not probes.

Answer

Secret probe

Answer

Startup probe

Answer

ConfigMap probe

Question 18

A cloud engineer is writing a Bicep file to deploy Azure resources. Bicep is a domain-specific language (DSL) that transpiles to ARM templates. Which of the following is a benefit of using Bicep over ARM JSON templates?

Accepted Answer

Bicep reduces code verbosity and supports modules. Bicep provides a simpler syntax with less boilerplate, modularity, and reusable modules. It reduces complexity compared to raw ARM JSON.

Answer

Bicep automatically manages state

Answer

Bicep is natively executed by Azure Resource Manager

Answer

Bicep supports imperative scripting

Question 19

After reviewing the Terraform plan, a cloud administrator notices that the instance will be created with a public IP address. However, the company policy requires that all instances in this subnet remain private. What should the administrator do to meet the policy before applying the plan?

Accepted Answer

Change the 'associate_public_ip_address' argument to 'false' in the resource block.. Setting 'associate_public_ip_address' to false in the Terraform resource block explicitly prevents the instance from receiving a public IP address, directly adhering to the policy. Option A is wrong: using user_data to remove the public IP after boot is unreliable, creates a temporary exposure, and violates the principle of declarative infrastructure. Option B is wrong: the AMI choice does not control public IP assignment; that is determined by subnet settings and resource arguments. Option D is wrong: changing to a private subnet might work if it disables auto-assign public IP, but it is unnecessary and could have other implications; the direct fix is to set the argument to false.

Answer

Add a shell command in user_data to remove the public IP after boot.

Answer

Use a different AMI that does not require public access.

Answer

Modify the subnet_id to point to a private subnet with no internet gateway.

Question 20

Refer to the exhibit. After deploying a new version of the application, users report that some requests fail intermittently. The administrator checks the load balancer configuration and health checks, and both servers are marked as healthy. Which of the following is the MOST likely cause of the intermittent failures?

Accepted Answer

The load balancer is configured for round-robin, which is causing session persistence issues.. Round-robin load balancing distributes requests across all healthy servers without session affinity. After an application update, if the application relies on session state stored locally on a server (e.g., in-memory session data), subsequent requests from the same user may be routed to a different backend that does not have the session data, causing intermittent failures. This explains why both servers appear healthy in health checks but users experience occasional request failures.

Option A is incorrect because a short health check interval would cause servers to be marked down momentarily, but they are consistently marked healthy in this scenario.

Option B is incorrect because if backend servers were not configured to accept traffic on port 80, all requests would fail persistently, not intermittently.

Option C is incorrect because an invalid health check path would cause persistent health check failures, not intermittent ones, and servers would be marked unhealthy, which contradicts the given information that both servers are healthy.

Answer

The health check interval is too short, marking servers down incorrectly.

Answer

The backend servers are not configured to accept traffic on port 80.

Answer

The health check path '/health' is no longer valid after the application update.