CV0-004 Practice Exam 54 — 20 Questions

Question 1

A multinational corporation is deploying a new application across multiple cloud regions for disaster recovery. The application requires consistent low latency for users globally. The architect decides to use a content delivery network (CDN) for static assets and a global load balancer for API traffic. After deployment, some users in Asia report occasional timeouts when accessing the API. The API servers are deployed in the US East and Europe regions. The load balancer is configured with latency-based routing. What is the most likely cause of the timeouts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The DNS TTL is set too high, causing cached resolution to a failed server.. A high DNS TTL causes clients to cache the IP address of a failed or unhealthy API server for an extended period. When that server becomes unavailable, clients continue to send requests to the cached IP instead of querying DNS for a healthy endpoint, resulting in timeouts. This is a common issue with latency-based routing, where DNS resolution is critical for directing traffic to the optimal region.

Answer

The latency-based routing is directing traffic to the farthest region due to routing table issues.

Answer

The API servers in Europe have insufficient capacity.

Answer

The CDN is misconfigured for the API endpoints.

Question 2

A company uses Azure VMs and wants to automate patching with minimal downtime. The application is stateless and can tolerate instance restarts. The patch schedule must ensure that at least 2 instances remain available during the update. Which THREE actions should the administrator take? (Select THREE.)

Accepted Answer

Use Azure Update Management to schedule patch deployments. Using an availability set ensures VMs are distributed across update domains, allowing rolling updates. Azure Update Management can schedule patches. Configuring a maintenance window is essential for controlling when patches are applied.

Answer

Enable auto-scaling for the VM scale set

Answer

Create a custom script extension to apply patches

Question 3

A cloud architect is designing a multi-tier application that must remain available during a single Availability Zone failure. Which TWO design principles should the architect apply?

Accepted Answer

Deploy resources across multiple Availability Zones.. Deploying resources across multiple Availability Zones (AZs) ensures that if one AZ fails, the application continues to run using resources in the other AZ(s). This is a fundamental principle of high availability in cloud architecture, as AZs are isolated from each other's failures. Option E complements this by using an auto-scaling group with a minimum of two instances spread across zones, which maintains capacity even if one instance or AZ fails.

Answer

Implement synchronous replication between the primary site and a DR site.

Answer

Use a single load balancer to distribute traffic across instances.

Answer

Place all application servers in the same subnet for low latency.

Question 4

A company uses Azure and wants to set up an alert that triggers when the average CPU of a virtual machine exceeds 90% for the past 15 minutes. The alert should send an email to the operations team. Which Azure resources are needed?

Accepted Answer

Azure Monitor metric alert and action group with email. Azure Monitor alerts evaluate metrics and trigger actions like sending emails via action groups.

Answer

Azure Log Analytics and Logic App

Answer

Azure Advisor recommendation

Answer

Azure Service Health alert

Question 5

A cloud administrator sees the output above when troubleshooting a virtual machine that is unresponsive. The VM is critical and must be restored quickly. What should the administrator do first?

Accepted Answer

Resume the VM using the virsh resume command.. The output from `virsh list --all` shows the VM is in a 'paused' state, which means it is still resident in memory but not executing. The fastest way to restore a paused VM is to resume it with `virsh resume <vm-name>`, which immediately continues CPU execution without requiring a reboot or migration. This directly addresses the unresponsive behavior while preserving the VM's current memory state.

Answer

Restart the libvirtd service on the host.

Answer

Increase the memory allocation for the host to free resources.

Answer

Migrate the VM to another host in the cluster.

Question 6

A cloud engineer is configuring a dashboard to monitor costs across multiple projects. The company uses tags to track costs by project, environment, and team. Which cloud cost management tool allows the engineer to create custom cost and usage reports filtered by tags?

Accepted Answer

Cost Analyzer. Cost Analyzer (or similar feature) allows filtering by tags and creating custom reports for cost analysis.

Answer

Cost Optimization Advisor

Answer

Budget Manager

Answer

Billing Reporter

Question 7

A cloud architect needs to monitor CPU utilization across a fleet of EC2 instances and receive an alert when the average CPU exceeds 80% for 10 minutes. Which AWS service should be used to collect the metric and trigger the alert?

Accepted Answer

Amazon CloudWatch. CloudWatch collects metrics and can trigger alarms based on thresholds.

Answer

AWS Systems Manager

Answer

AWS Config

Answer

AWS CloudTrail

Question 8

A company wants to reduce costs by identifying underutilized EC2 instances. Which tool should they use to get rightsizing recommendations?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer analyzes instance usage and recommends optimal sizes.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Budgets

Question 9

A team is designing a CI/CD pipeline for a microservices application. They want to automatically build, test, and deploy each service independently to a Kubernetes cluster. The pipeline must integrate with Git repositories and support parallel job execution. Which tool is best suited for this requirement?

Accepted Answer

GitLab CI. GitLab CI is integrated with Git repositories, supports parallel jobs, and can deploy to Kubernetes, making it a good fit for microservices CI/CD.

Answer

Azure DevOps

Answer

Jenkins

Answer

AWS CodePipeline

Question 10

A company is migrating a 50 TB on-premises database to AWS RDS MySQL. The migration must have minimal downtime and support ongoing replication during the cutover. The database schema is standard MySQL. Which combination of services should the company use?

Accepted Answer

AWS Database Migration Service (DMS) with Change Data Capture (CDC) replication. AWS DMS with CDC enables minimal downtime migration by replicating ongoing changes. Schema Conversion Tool is unnecessary for MySQL to MySQL. Snowball is for large data sets offline, not for minimal downtime.

Answer

AWS DMS with schema conversion tool to convert to MySQL

Answer

AWS Snowball Edge to transfer database dump, then import to RDS

Answer

AWS DataSync to transfer database files to S3, then restore to RDS

Question 11

A company wants to reduce costs by identifying underutilized EC2 instances and receiving recommendations to downsize them. Which AWS service provides rightsizing recommendations based on historical utilization metrics?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer analyzes utilization and provides recommendations to optimize instance types.

Answer

AWS Cost Explorer

Answer

AWS Trusted Advisor

Answer

AWS Auto Scaling

Question 12

A cloud administrator is troubleshooting a connectivity issue between a web server and a database server in the same VPC but different subnets. The security group for the database server allows inbound traffic from the web server's security group. However, the web server cannot establish a TCP connection to the database. What are two possible causes? (Choose two.)

Accepted Answer

The network ACL of the web server subnet is blocking outbound traffic.. Network ACLs are stateless and apply to subnet boundaries. Even if the web server's security group allows outbound traffic, the subnet's network ACL must explicitly allow outbound traffic to the database server's IP and port. If the outbound rule is missing or denies the traffic, the TCP SYN packet will be dropped before it leaves the subnet. Option C is correct because the database subnet's network ACL must allow inbound traffic from the web server's IP and port; if it blocks the inbound SYN, the connection cannot be established.

Answer

The security group of the web server does not allow outbound traffic to the database.

Answer

The route table of the database subnet does not contain a route to the web server subnet.

Answer

The database server is not listening on the correct port.

Question 13

A security auditor is reviewing the IAM configuration for a cloud account. The auditor finds that a user has permissions to create and delete resources in all services. Which principle of security is being violated?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should only have the minimum permissions necessary to perform their job functions. Granting full access to all services violates this principle.

Answer

Need to know

Answer

Defense in depth

Answer

Separation of duties

Question 14

A cloud architect is designing a disaster recovery plan for a critical application that requires an RPO of 15 minutes and an RTO of 1 hour. The application runs on GCP Compute Engine with persistent disks. Which backup strategy best meets these requirements?

Accepted Answer

Schedule snapshots every 15 minutes and store in a different region. Snapshot schedules can be as frequent as every 10 minutes, and snapshots can be restored quickly, meeting the RPO and RTO.

Answer

Use gcloud compute instances move to move instances to another region

Answer

Use persistent disk synchronous replication to another zone

Answer

Schedule daily snapshots to a different region

Question 15

A cloud administrator is investigating a performance issue with a cloud-based application. The application's response time has increased significantly. Monitoring shows low CPU and memory, but high network latency. Which two actions should the administrator take? (Choose two.)

Accepted Answer

Use a trace tool to identify network hops and bottlenecks.. Using a trace tool (such as traceroute or MTR) allows the administrator to identify each network hop between the application and its users, revealing where latency is introduced. This directly addresses the symptom of high network latency by pinpointing congested or failing routers, misconfigured firewalls, or suboptimal routing paths.

Answer

Review the security group rules for any restrictive outbound rules.

Answer

Check the load balancer's connection draining settings.

Answer

Verify that the instances are in the same placement group.

Question 16

An organization wants to ensure that only authenticated users from their corporate Active Directory can access cloud resources. Which federation protocol is most commonly used for this purpose?

Accepted Answer

SAML. SAML is widely used for federation between corporate identity providers (e.g., Active Directory) and cloud services.

Answer

LDAP

Answer

OAuth 2.0

Answer

RADIUS

Question 17

A cloud architect is choosing a compute pricing model for a batch processing job that runs for 2 hours every night. The job can be interrupted. Which option is most cost-effective?

Accepted Answer

Spot instances. Spot instances are the most cost-effective option because the batch processing job is fault-tolerant (can be interrupted) and runs for a fixed, short duration (2 hours nightly). Spot instances offer significant discounts (often 60-90% off on-demand pricing) by leveraging unused cloud capacity, which can be reclaimed with a 2-minute warning. This aligns perfectly with the workload's tolerance for interruption and its predictable but non-critical schedule.

Answer

Reserved instances for 1 year

Answer

On-demand instances

Answer

Dedicated hosts

Question 18

A company is planning to migrate a 200 TB on-premises file server to AWS S3. The network link is 1 Gbps and cannot be saturated due to other traffic. The migration must be completed within two weeks. Which TWO services or features should the cloud engineer consider to accelerate the transfer? (Choose two.)

Accepted Answer

AWS DataSync. AWS DataSync is correct because it is designed to efficiently migrate large datasets to AWS by using parallel multi-threaded transfers and incremental syncs, which can optimize the use of the available 1 Gbps link without saturating it. It can handle the 200 TB file server migration by automating the transfer and reducing the time required compared to manual copying, though the 1 Gbps link alone may still be insufficient for the two-week window, making it a partial solution.

Answer

AWS Direct Connect

Answer

AWS DMS

Answer

AWS Storage Gateway

Question 19

A cloud administrator is managing a hybrid cloud environment where on-premises servers connect to a public cloud VPC via a site-to-site VPN. Users report intermittent connectivity issues to cloud resources. The administrator examines the VPN tunnel logs and sees 'Phase 2 negotiation failed' errors. Which of the following is the MOST likely cause?

Accepted Answer

Mismatched encryption domain definitions (traffic selectors) between on-premises and cloud VPN gateways.. Phase 2 negotiation failures in IPsec VPNs indicate that the two gateways cannot agree on the security associations (SAs) for encrypting data traffic. This is most commonly caused by mismatched encryption domain definitions (traffic selectors), such as differing local/remote subnets, protocols, or ports. When the on-premises and cloud VPN gateways define the allowed traffic differently, they cannot establish the Phase 2 SA, leading to intermittent connectivity.

Answer

Dead Peer Detection (DPD) is disabled on one side.

Answer

Incorrect pre-shared key used for the VPN tunnel.

Answer

Packet loss due to high latency on the internet link.

Question 20

A cloud administrator is troubleshooting a web application hosted on a cloud virtual machine (VM) that is experiencing intermittent high latency during peak traffic hours. The application is deployed on a single VM instance with 4 vCPUs and 8 GB RAM, running a Linux OS. The VM is connected to a virtual network with a public IP. The administrator has verified that the application code is optimized and there are no memory leaks. CPU utilization remains below 50% during peaks, but network outbound traffic shows periodic spikes up to 500 Mbps. The VM's network interface is configured with a 1 Gbps bandwidth cap. The administrator suspects that the issue is related to network throttling or packet loss. Which of the following actions should the administrator take to resolve the issue?

Accepted Answer

Upgrade the VM to a larger instance size with higher network bandwidth cap (e.g., 2 Gbps).. The VM's network bandwidth cap of 1 Gbps is being saturated during peak traffic (spikes up to 500 Mbps, but with overhead and burst behavior, the cap can cause throttling and packet loss). Upgrading to a larger instance size with a higher network bandwidth cap (e.g., 2 Gbps) directly addresses the bottleneck by providing more headroom for outbound traffic, reducing latency caused by queueing and drops. The administrator has already ruled out CPU and memory issues, so the network cap is the likely culprit.

Answer

Increase the VM's vCPU count to 8 to improve processing capacity.

Answer

Configure the firewall to allow all traffic to reduce processing overhead.

Answer

Enable DDoS protection on the public IP to filter malicious traffic.