CV0-004 Practice Exam 55 — 20 Questions

Question 1

In the shared responsibility model, which of the following is the cloud customer responsible for?

Accepted Answer

Operating system patching on virtual machines. The shared responsibility model states that customers are responsible for OS patching, application code, IAM, data encryption, and network security groups.

Answer

Network infrastructure under the hypervisor

Answer

Hypervisor security

Answer

Physical hardware maintenance

Question 2

A startup is deploying its web application in the cloud using an auto-scaling group. The application experiences variable traffic, with spikes during business hours. The team has configured the auto-scaling group to scale out when CPU utilization exceeds 70% and scale in when it drops below 30%. However, during a sudden spike, the new instances take over 5 minutes to become healthy, causing slow response times. What should the team do to improve responsiveness?

Accepted Answer

Implement a predictive scaling policy based on historical patterns.. Predictive scaling uses historical traffic patterns to proactively launch instances before CPU utilization spikes, eliminating the 5-minute lag from reactive scaling. This approach anticipates the business-hour surge and ensures capacity is ready when demand increases, directly addressing the slow response time issue.

Answer

Use a larger instance type for the auto-scaling group.

Answer

Reduce the threshold for scale-out to 50% CPU.

Answer

Increase the cooldown period for the scaling policy.

Question 3

A cloud administrator is configuring a web application hosted on a public cloud VM. The application must be accessible over HTTPS, and the administrator needs to ensure that all traffic between the client and the server is encrypted. The cloud provider offers a managed certificate service. Which of the following is the BEST practice for securing the application?

Accepted Answer

Use the cloud provider's managed certificate service to provision and attach the certificate to the load balancer.. The cloud provider's managed certificate service automatically handles certificate provisioning, renewal, and attachment to the load balancer, ensuring HTTPS traffic is encrypted with a trusted certificate from a public CA. This is the best practice because it offloads TLS termination to the load balancer, reducing the VM's CPU overhead and centralizing certificate management. It also ensures the certificate is automatically renewed before expiry, preventing service disruptions.

Answer

Generate a self-signed certificate and configure the web server to use it.

Answer

Disable HTTPS and rely on network-level encryption provided by the cloud provider.

Answer

Create a certificate signing request (CSR) and submit it to a public CA, then install the certificate and private key on the VM.

Question 4

A cloud administrator is troubleshooting an issue where a user in the finance department cannot access a critical application hosted on a private cloud. The user can access other applications in the same subnet. The security team recently implemented a new network security policy. Which of the following is MOST likely causing the issue?

Accepted Answer

A host-based firewall rule is blocking the specific application port on the user's VM.. The user can access other applications in the same subnet, indicating network connectivity is intact, but a specific application is blocked. A host-based firewall rule on the user's VM (e.g., Windows Firewall or iptables) can filter traffic by port or protocol, and a newly implemented security policy likely added a rule blocking the port used by the critical application. This explains why only that application is inaccessible while others work.

Answer

The user's VM is isolated from the subnet due to a misconfigured VLAN.

Answer

The user's account has been disabled due to a failed login attempt.

Answer

The hypervisor is denying access to the application due to a resource quota violation.

Question 5

A cloud engineer is troubleshooting a performance issue with a web application that uses a cloud load balancer and multiple backend instances. Users report intermittent slow responses. The engineer reviews metrics and finds that CPU utilization on backend instances stays below 50% but network throughput is near the instance limit. Which THREE actions should the engineer take to improve performance?

Accepted Answer

Distribute instances across multiple availability zones.. Distributing instances across multiple availability zones (AZs) improves fault tolerance and can reduce network congestion by spreading traffic across physically separate infrastructure. In this scenario, network throughput is near the instance limit, so adding instances in different AZs allows the load balancer to distribute traffic more evenly, preventing any single instance from being overwhelmed. This also leverages the load balancer's cross-zone load balancing capability, which can improve overall throughput and reduce latency for users.

Answer

Change the load balancing algorithm to least connections.

Answer

Increase the number of backend instances.

Question 6

A cloud administrator is configuring a Linux VM as a router. The iptables rules are shown. The administrator can SSH into the VM from the network but cannot forward traffic between interfaces. What is the most likely cause?

Accepted Answer

The FORWARD chain's default policy is DROP and no rules allow forwarding. The FORWARD chain in iptables controls traffic that passes through the VM (i.e., traffic not destined for the VM itself). If its default policy is DROP and no explicit ACCEPT rules exist for forwarding, the kernel will drop all forwarded packets, preventing the VM from acting as a router. SSH access works because it uses the INPUT chain, which is separate from FORWARD.

Answer

The INPUT chain has a rule dropping invalid packets

Answer

The INPUT chain is missing a rule to allow forwarded traffic

Answer

The NAT table is misconfigured

Question 7

A cloud operations team wants to be notified when the average CPU utilization of an auto-scaling group exceeds 80% for 5 consecutive minutes. They also want to avoid notification storms. Which alerting configuration should they use?

Accepted Answer

Anomaly detection based on a band model with a sensitivity of 2. The question asks for an alerting configuration to notify when average CPU exceeds 80% for 5 consecutive minutes while avoiding notification storms. Options A, B, and C are scaling configurations (step scaling, simple scaling, scheduled scaling) that adjust capacity, not alert. Option D uses anomaly detection with a band model, which can dynamically define a normal range and generate alerts when metrics fall outside the band. Sensitivity 2 provides a balanced band that detects sustained anomalies, effectively alerting on consistent high CPU without storming. Thus D is the only alerting configuration among the choices.

Answer

Step scaling policy triggered by a CloudWatch Alarm with a threshold of 80% for 5 evaluation periods

Answer

Simple scaling policy with a cooldown period

Answer

Scheduled scaling action to increase capacity at peak times

Question 8

An organization uses a cloud-based backup service to back up its critical database every night. The backup job has been failing for the past three days with an error message indicating 'insufficient storage space in the backup repository.' The administrator checks the backup repository and finds that it is 80% full. The database is 2 TB in size, and the backup policy retains 7 daily backups. The administrator estimates that each full backup is approximately 500 GB after deduplication. The company's RPO requirement is 24 hours. What should the administrator do to resolve the backup failure without violating the RPO?

Accepted Answer

Delete the oldest full backup that is more than 7 days old.. The backup repository is running out of space. Deleting older backups (beyond the current retention window) frees up space immediately, allowing the next backup to succeed and meet the 24-hour RPO. The retention policy is 7 days, so deleting backups older than 7 days or adjusting retention is appropriate.

Answer

Increase the backup retention period to 14 days to keep more backups.

Answer

Enable incremental backups instead of full backups to reduce size.

Answer

Reduce the deduplication ratio to lower storage usage.

Question 9

A cloud administrator is troubleshooting connectivity to a web server running on a Linux VM. The web server is configured to listen on ports 80 (HTTP) and 443 (HTTPS). The administrator runs the iptables command shown in the exhibit. Based on the output, what is the MOST likely reason that external users cannot access the web server on port 443?

Accepted Answer

The iptables rule for port 443 only allows traffic from the 10.0.0.0/8 subnet, which does not include external IP addresses.. The iptables rule for port 443 specifies a source IP range of 10.0.0.0/8, which is a private RFC 1918 address space. External users have public IP addresses that do not fall within this subnet, so their HTTPS traffic is implicitly dropped by the rule's match condition. The default policy being ACCEPT does not override the explicit rule that only permits traffic from the 10.0.0.0/8 subnet.

Answer

The web server is not configured to listen on port 443, so iptables rules are irrelevant.

Answer

The iptables default policy is ACCEPT, but the rule for port 443 explicitly drops traffic from external sources.

Answer

The rule for port 80 is placed before the rule for port 443, causing all HTTPS traffic to be evaluated as HTTP and dropped.

Question 10

Which storage type is most appropriate for a shared file system that multiple virtual machines need to mount simultaneously with read/write access?

Accepted Answer

File storage. File storage (e.g., Amazon EFS, Azure Files) provides a shared file system that can be mounted by multiple VMs. Block storage is attached to a single VM. Object storage does not support file system semantics like locking. Archive storage is for long-term cold data.

Answer

Archive storage

Answer

Object storage

Answer

Block storage

Question 11

A cloud administrator launches a new EC2 instance with a userdata script that installs a web server. The instance launches but the web server is not running. The administrator checks the cloud-init logs and sees the warning shown in the exhibit. What is the most likely cause?

Accepted Answer

The userdata script contains a syntax error.. The warning in cloud-init logs indicates that the userdata script failed to execute, which most commonly occurs due to a syntax error in the script. Cloud-init processes userdata as a shell script by default, and any syntax error (e.g., missing quotes, incorrect commands) will cause the script to exit prematurely, preventing the web server from starting. The administrator confirmed the instance launched successfully, so the issue is isolated to the script execution, not infrastructure or permissions.

Answer

The instance type does not have enough memory.

Answer

The instance does not have an IAM role assigned.

Answer

The security group does not allow HTTP traffic.

Question 12

Refer to the exhibit. An administrator is unable to SSH into a cloud server with IP 10.0.1.10 from a remote location (outside the 10.0.0.0/16 network). What is the most likely cause?

Accepted Answer

The firewall rule order is incorrect. Firewall rules are evaluated in order; the first rule (rule #1) drops all SSH traffic from any source, and the second rule (rule #2) permits SSH traffic only from the internal network (10.0.0.0/16). Since the remote location is outside this network, the packet matches the first rule and is dropped before reaching the second rule. Option B is incorrect because the firewall is not dropping all packets on port 22; it only drops those from external sources due to the rule order. Option C is incorrect because a host key change would cause a different SSH warning, not a connection timeout. Option D is incorrect because if the SSH service were not running, the error would be 'connection refused' rather than a timeout.

Answer

The firewall is dropping all packets on port 22

Answer

The SSH host key has changed

Answer

The SSH service is not running

Question 13

An administrator deployed a new web application using an auto-scaling group. Users report that the application becomes slow after a few hours. The administrator examines the scaling policy and notices that the CPU utilization threshold is set to 80% for scale-out and 20% for scale-in. What is the most likely issue?

Accepted Answer

The scale-out threshold is too high, causing delayed scaling. A scale-out threshold of 80% means that new instances are only added when CPU utilization reaches 80%, which can cause delays in scaling out, leading to performance degradation as the application becomes slow over time. Option A is incorrect because a low scale-in threshold of 20% would cause premature termination of instances, not slowness. Option B is incorrect because load balancer misconfiguration would typically cause immediate failures or uneven traffic distribution, not gradual slowdown. Option C is incorrect because a memory leak would cause degradation over time, but the specific symptom of slowness after a few hours combined with the scaling policy thresholds points to the scaling configuration as the primary issue.

Answer

The scale-in threshold is too low, causing instances to be terminated prematurely

Answer

The load balancer is misconfigured

Answer

The application has a memory leak

Question 14

A company is deploying a web application that requires high availability across two geographically separate data centers. The application must be active in both sites simultaneously, and traffic must be load-balanced between them. Which architecture best meets these requirements?

Accepted Answer

Active-active architecture. Active-active architecture allows both sites to handle traffic simultaneously, providing load balancing and high availability. Active-passive would leave one site idle. Warm standby implies one site is not fully active. Fault tolerance (N+1) is a component-level concept, not a site-level architecture.

Answer

Active-passive architecture

Answer

Fault-tolerant N+1 architecture

Answer

Warm standby architecture

Question 15

A cloud load balancer is not distributing traffic evenly to backend servers. All servers pass health checks. Which of the following is the most likely cause?

Accepted Answer

Session persistence is enabled and directing traffic to specific servers.. Session persistence (sticky sessions) is the most likely cause because it forces the load balancer to direct traffic from the same client to the same backend server, leading to uneven distribution. All servers passing health checks rules out health check issues (Option A and D). A server reaching its connection limit (Option B) would typically cause that server to stop accepting new connections, but health checks would likely fail, so it is less likely.

Answer

The health check interval is set too long.

Answer

One of the backend servers has reached its connection limit.

Answer

The health check path is incorrect.

Question 16

A cloud administrator is troubleshooting an issue where a virtual machine (VM) cannot connect to the internet. Which TWO of the following are valid first steps to diagnose the problem?

Accepted Answer

Verify the VM's network interface is attached to the correct subnet.. Verifying the VM's network interface is attached to the correct subnet is a fundamental first step in diagnosing internet connectivity issues. If the VM is on an isolated or mismatched subnet, it cannot route traffic to the internet gateway, regardless of other configurations. This check ensures the VM's virtual NIC is connected to the appropriate virtual network and subnet that has a route to the internet.

Option D is also correct because checking the VM's security group rules is another essential first step. Security groups act as a virtual firewall controlling inbound and outbound traffic at the network interface level. If the security group rules do not allow outbound traffic to the internet (e.g., missing default outbound rule or overly restrictive rules), the VM will be unable to connect to the internet. Checking these rules early can quickly identify misconfigurations that block internet access.

Together, verifying subnet attachment and security group rules are two of the most appropriate initial diagnostic steps, as they address the network-level controls that directly impact connectivity.

Answer

Check the VM's OS firewall settings.

Answer

Create a new VM.

Answer

Reboot the VM.

Question 17

A small business plans to migrate its on-premises infrastructure to the cloud to reduce capital expenditure. They have a limited IT team and want to minimize management overhead. Which cloud deployment model should they choose?

Accepted Answer

Public cloud. The public cloud deployment model is the correct choice because it allows the small business to offload all infrastructure management to the cloud provider, eliminating the need for on-premises hardware and reducing capital expenditure. With a limited IT team, the public cloud's shared responsibility model minimizes management overhead by handling physical security, hardware maintenance, and hypervisor updates, while the business only manages its applications and data.

Answer

Private cloud

Answer

Community cloud

Answer

Hybrid cloud

Question 18

A cloud architect is designing a cost-optimized architecture for a batch processing workload that runs every hour for 10 minutes. The workload is fault-tolerant and can be interrupted. Which TWO pricing models should the architect consider to minimize costs? (Select TWO.)

Accepted Answer

On-demand instances. On-demand instances (C) are correct because they allow the architect to pay only for the compute capacity used per hour, with no upfront commitment, which is ideal for a short-duration (10-minute) batch workload that runs every hour. Spot instances (D) are correct because the workload is fault-tolerant and can be interrupted, enabling the use of spare cloud capacity at significantly discounted rates (often 60-90% off on-demand), further minimizing costs for this interruptible batch processing task.

Answer

Dedicated hosts

Answer

Savings plans

Answer

Reserved instances

Question 19

A cloud operations team is analyzing a security incident in which an unauthorized user accessed a storage bucket. The bucket was configured with public access. Which three best practices should the team implement to prevent such incidents in the future? (Select THREE).

Accepted Answer

Enable access logging and monitor logs.. Enabling access logging (e.g., AWS S3 server access logs or Azure Storage analytics logs) allows the team to record all requests made to the bucket, including the requester, IP address, and action. Monitoring these logs with a SIEM or log analysis tool helps detect unauthorized access attempts early, providing forensic evidence and enabling proactive threat response. This is a critical detective control for security incidents.

Answer

Enable encryption on the storage bucket.

Answer

Enable versioning on the bucket.

Question 20

A data scientist is migrating a 10 TB on-premises PostgreSQL database to Amazon RDS for PostgreSQL. The migration must have minimal downtime. Which TWO AWS services should the data scientist use together to achieve this? (Select TWO.)

Accepted Answer

AWS Direct Connect. To migrate a 10 TB PostgreSQL database to RDS with minimal downtime, AWS DMS provides ongoing replication via change data capture (CDC), allowing continuous data synchronization after the full load. AWS Direct Connect offers a dedicated, stable network connection with consistent bandwidth and low latency, which is critical for replicating such a large volume of data reliably and quickly. Without Direct Connect, internet-based replication could suffer from variable performance, risking the ability to keep the target in sync during the final cutover.

Answer

AWS Snowball

Answer

AWS Schema Conversion Tool (SCT)

Answer

AWS DataSync