CV0-004 Practice Exam 53 — 20 Questions

Question 1

A security team wants to implement host-based intrusion detection on their virtual machines in a public cloud. Which approach provides the most effective detection while minimizing performance impact?

Accepted Answer

Use a cloud-native security service that deploys an agent to monitor system logs and file integrity.. Cloud-native security services that deploy agents on each VM provide host-based intrusion detection by monitoring system logs and file integrity, which is the most effective method for host-level threats. Options A, B, and C are incorrect: A (antivirus) focuses on malware, not intrusion detection; B and C are network-based, not host-based, and may not capture host-level events.

Answer

Install an antivirus agent on each VM.

Answer

Enable network traffic logging at the hypervisor level.

Answer

Enable VPC flow logs and analyze them.

Question 2

A cloud engineer is troubleshooting a performance issue in a multi-tier application on AWS. The web tier shows high latency, but the application logs indicate no errors. The engineer wants to trace a request end-to-end across services. Which AWS service should be used?

Accepted Answer

AWS X-Ray. AWS X-Ray provides distributed tracing, allowing you to trace requests as they travel through your application and identify performance bottlenecks.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS CloudTrail

Question 3

A cloud engineer needs to deploy a serverless function that runs when a new object is uploaded to an S3 bucket. Which AWS service event trigger should be configured?

Accepted Answer

S3. Amazon S3 can directly invoke AWS Lambda when a new object is uploaded by configuring an S3 event notification on the bucket. This native integration allows the S3 service to trigger the function without any intermediary service, making option C the correct choice for a serverless function triggered by an S3 upload event.

Answer

API Gateway

Answer

EventBridge

Answer

SQS

Question 4

Refer to the exhibit. A cloud engineer is troubleshooting network connectivity to a server with IP 10.0.0.5. The server is on the same subnet. Based on the iptables rules shown, what is the most likely cause of the connectivity failure?

Accepted Answer

The INPUT chain drops all traffic destined to the 10.0.0.0/8 network. The INPUT chain has a rule that drops all traffic destined to the 10.0.0.0/8 network, which includes the target server at 10.0.0.5. Since the server is on the same subnet, traffic to it must traverse the INPUT chain on the local system, and this DROP rule will match and discard packets before any other rule can accept them. The rule's position and destination match make it the most direct cause of the connectivity failure.

Answer

The FORWARD chain policy drops all traffic

Answer

The OUTPUT chain rejects all traffic to the server

Answer

The DROP rule in INPUT has zero packet count, so it is not effective

Question 5

A company uses GitHub Actions to build and deploy a microservices application. They want to automate the deployment to a Kubernetes cluster only when changes are pushed to the main branch. Which GitHub Actions event trigger should be used in the workflow?

Accepted Answer

on: push: branches: [ main ]. The 'push' event with branch filters triggers on pushes to main. 'pull_request' triggers on PR events; 'schedule' triggers on a cron; 'workflow_dispatch' triggers manually.

Answer

on: workflow_dispatch:

Answer

on: schedule: - cron: '0 0 * * *'

Answer

on: pull_request: branches: [ main ]

Question 6

A cloud administrator is configuring a new virtual private cloud (VPC) with a public subnet for a web application. The administrator must ensure that the web application can receive HTTPS traffic from the internet but cannot be directly accessed via SSH. Which TWO security controls should the administrator implement? (Choose two.)

Accepted Answer

Configure a network ACL on the subnet to allow inbound TCP ports 80 and 443 from 0.0.0.0/0 and deny inbound TCP port 22.. A network ACL (NACL) is a stateless firewall that operates at the subnet level, allowing you to explicitly deny inbound TCP port 22 (SSH) while allowing TCP ports 80 and 443 (HTTP/HTTPS) from 0.0.0.0/0. Option D is correct because a security group (SG) is a stateful firewall at the instance level; by default, SGs deny all inbound traffic, so you must explicitly allow TCP port 443 from 0.0.0.0/0, and since SSH (port 22) is not allowed, it is implicitly denied. Together, these provide defense-in-depth: the NACL blocks SSH at the subnet boundary, and the SG ensures only HTTPS is permitted to the web server.

Answer

Attach an internet gateway (IGW) to the VPC and enable auto-assign public IP on the subnet.

Answer

Place the web server in a private subnet and use a NAT gateway for outbound traffic.

Answer

Deploy a web application firewall (WAF) in front of the web server.

Question 7

A company wants to migrate a 50 TB on-premises SQL Server database to Amazon RDS for MySQL with minimal downtime. The source database is 3 TB and continues to receive writes. Which service should the cloud architect use to perform the migration with ongoing replication?

Accepted Answer

AWS DMS. AWS Database Migration Service (DMS) supports ongoing replication via change data capture (CDC) to migrate with minimal downtime.

Answer

AWS Snowball

Answer

AWS S3 Transfer Acceleration

Answer

AWS DataSync

Question 8

A cloud engineer notices that an application is running slower than expected. Monitoring shows that the CPU utilization is consistently below 30%, but memory usage is at 95%. Which of the following is the most likely cause of the performance issue?

Accepted Answer

Insufficient memory causing swapping to disk. When memory usage is at 95% and CPU utilization is low, the system is likely thrashing—the operating system is forced to page memory to disk (swap) to free RAM. Disk I/O is orders of magnitude slower than RAM, so even with idle CPU, the application stalls waiting for swap operations. This explains the performance degradation despite low CPU load.

Answer

Insufficient disk space for application logs

Answer

Network bandwidth saturation

Answer

CPU contention due to overprovisioning

Question 9

An organization wants to automate patching of their EC2 instances running Windows Server. They need to schedule patching during a maintenance window and ensure minimal downtime. Which AWS service should they use?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager automates patching and can be scheduled via maintenance windows.

Answer

AWS OpsWorks

Answer

Amazon Inspector

Answer

AWS CloudFormation

Question 10

A company is deploying a multi-tier application with web servers and a database. Which architecture ensures high availability?

Accepted Answer

Deploy web servers in an auto-scaling group across two AZs and database in a multi-AZ configuration. Deploying web servers in an auto-scaling group across two Availability Zones (AZs) ensures that if one AZ fails, the other continues serving traffic, while a multi-AZ database configuration (e.g., Amazon RDS Multi-AZ) automatically synchronously replicates data to a standby instance in a different AZ, enabling automatic failover. This combination eliminates single points of failure at both the web and database tiers, meeting high availability requirements.

Answer

Deploy a single large web server and a single database instance

Answer

Deploy web servers in an auto-scaling group in one AZ and database in single instance

Answer

Deploy web servers and database in a single availability zone

Question 11

A company deploys a multi-tier application in a public cloud. The web tier uses an auto scaling group across multiple availability zones. The database tier runs on a single large VM. The application experiences intermittent slowdowns during peak load. Which of the following is the BEST long-term solution?

Accepted Answer

Migrate the database to a managed database service with read replicas. The database tier is a single point of failure and a performance bottleneck during peak load. Migrating to a managed database service with read replicas offloads read-heavy traffic, improves scalability, and provides automatic failover, addressing both performance and availability issues. This is a long-term solution that aligns with cloud best practices for multi-tier applications.

Answer

Add a load balancer in front of the database tier

Answer

Upgrade the database VM to a larger instance type

Answer

Increase the number of web servers in the auto scaling group

Question 12

A company wants to reduce cloud storage costs for data that is accessed frequently for 30 days, then rarely accessed for 90 days, and then must be retained for 7 years for compliance. Which storage lifecycle policy should be implemented?

Accepted Answer

Standard storage for 30 days, then infrequent access for 90 days, then archive. A lifecycle policy that transitions from standard storage to infrequent access after 30 days, and then to archive after 120 days (30+90) meets the access patterns and compliance requirements.

Answer

Standard storage for 30 days, then delete

Answer

Archive immediately for 7 years

Answer

Infrequent access immediately for 120 days, then archive

Question 13

A company uses GCP and wants to implement alerting based on anomaly detection for their Compute Engine instances. Which GCP service should they use?

Accepted Answer

Cloud Monitoring. GCP's Cloud Monitoring (formerly Stackdriver) includes alerting policies that support anomaly detection. Cloud Logging is for logs. Cloud Audit Logs for auditing. Cloud Functions can be triggered but not directly for anomaly detection.

Answer

Cloud Logging

Answer

Cloud Functions

Answer

Cloud Audit Logs

Question 14

A DevOps team is setting up a CI/CD pipeline using GitHub Actions. They want the pipeline to automatically deploy a containerized application to a Kubernetes cluster only when changes are pushed to the main branch. Which GitHub Actions component should they use to trigger the deployment?

Accepted Answer

A workflow with an on.push trigger for the main branch. GitHub Actions workflows are defined in YAML and can include an 'on' trigger specifying events such as push to a branch. This allows automation of the deployment when code is pushed to main.

Answer

A cron job that checks the repository every hour

Answer

A GitHub webhook configured in the repository settings

Answer

A pull request review requirement

Question 15

A cloud administrator is reviewing the security posture of a cloud deployment. The company has a policy of least privilege and must ensure that only authorized services can access storage buckets. Which THREE mechanisms should the administrator configure to enforce this policy? (Choose three.)

Accepted Answer

Bucket policies that restrict access to specific cloud services. Bucket policies can explicitly grant or deny access to specific cloud services (e.g., logging or auditing services) using the principal element with a service principal. This aligns with the least privilege policy by ensuring only authorized services can access the storage buckets, without relying on network-level controls. Option C is correct because organizational policies enforce rules across accounts, restricting permissions at the account level to ensure only authorized services have access. Option D is correct because IAM roles can be used to grant granular permissions to services that require access, following the principle of least privilege.

Answer

Network ACLs that block unauthorized IP ranges

Answer

Security groups that allow traffic from authorized services

Question 16

A virtual machine in a cloud environment is experiencing high disk I/O latency. The administrator checks the performance metrics and sees that the disk queue length is consistently above 100. What is the best immediate action?

Accepted Answer

Attach an additional disk and stripe the data. Attach an additional disk and stripe the data. A high disk queue length indicates that the disk is overwhelmed with I/O requests. Stripping data across multiple disks (e.g., RAID 0) distributes the I/O load, reducing queue length and latency. Option B is wrong because network bandwidth does not affect disk I/O. Option C is wrong because migrating to a host with faster disks may help but is not the immediate action; adding disks is quicker and more direct. Option D is wrong because increasing memory does not directly improve disk I/O performance.

Answer

Upgrade the VM's network bandwidth

Answer

Migrate the VM to a host with faster disks

Answer

Increase the VM's memory

Question 17

An organization is designing a disaster recovery plan with a Recovery Time Objective (RTO) of 4 hours and a Recovery Point Objective (RPO) of 1 hour. Which disaster recovery strategy best meets these requirements while minimizing cost?

Accepted Answer

Warm standby. Warm standby maintains a partially running environment that can be fully activated quickly, meeting an RTO of 4 hours and RPO of 1 hour at a lower cost than hot standby.

Answer

Cold standby

Answer

Backup and restore

Answer

Hot standby

Question 18

A cloud engineer is troubleshooting an issue where a virtual machine (VM) in a VPC cannot communicate with an on-premises database server through a site-to-site VPN. The VPN tunnel status shows 'UP' and the on-premises firewall logs show packets from the VM's public IP (but the VM is in a private subnet with no public IP). What is the MOST likely cause?

Accepted Answer

The route table for the subnet is missing a route to the on-premises network via the VPN.. The VPN tunnel status is 'UP' and the on-premises firewall sees packets from the VM's public IP, but the VM is in a private subnet with no public IP. This indicates that the VM's traffic is being sent to the internet instead of through the VPN tunnel. The most likely cause is that the subnet's route table lacks a specific route directing traffic destined for the on-premises network to the virtual private gateway (VGW) or VPN connection, causing the traffic to be routed to the internet gateway (IGW) and source-NATed to the public IP.

Answer

The on-premises firewall is blocking the VM's private IP address.

Answer

The VM's security group is blocking outbound traffic to the on-premises subnet.

Answer

The VPN tunnel is misconfigured with mismatched pre-shared keys.

Question 19

During a disaster recovery drill, a cloud engineer discovers that the RTO for a critical application is not being met. The application runs on EC2 instances with data in EBS volumes. Which change would most likely improve the RTO?

Accepted Answer

Enable cross-region replication for the EBS snapshots. Cross-region replication of EBS snapshots reduces the time to have data available in the recovery region. Changing replication frequency doesn't affect recovery time if snapshots are not pre-replicated. Using larger instances may not help if data transfer is the bottleneck. Scheduled scaling is unrelated to DR recovery.

Answer

Increase the frequency of EBS snapshots from daily to hourly

Answer

Configure scheduled scaling to pre-warm instances in the recovery region

Answer

Increase the EC2 instance size in the recovery region

Question 20

A company is moving a legacy monolithic application to the cloud. The application has interdependencies that make it difficult to refactor. The architect needs to minimize changes while gaining cloud benefits like elasticity and pay-as-you-go. Which migration strategy is BEST?

Accepted Answer

Rehost (Lift and shift). Rehosting (lift and shift) is the best strategy because it moves the monolithic application to the cloud with minimal changes, preserving existing interdependencies. This allows the company to immediately gain cloud benefits like elasticity and pay-as-you-go pricing without refactoring the tightly coupled codebase. The application runs on cloud infrastructure (e.g., EC2 instances) as-is, leveraging auto-scaling and resource optimization.

Answer

Retire

Answer

Repurchase

Answer

Refactor / Re-architect