CV0-004 Practice Exam 56 — 20 Questions

Question 1

A company is deploying a cloud-native application that uses containers orchestrated by Kubernetes. The security team wants to enforce the principle of least privilege at the Kubernetes level. Which THREE measures should be implemented? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply Pod Security Standards (e.g., restricted policy). Pod Security Standards (PSS) define security contexts for pods, with the 'restricted' policy enforcing the principle of least privilege by disallowing privileged containers, host network access, and other high-risk capabilities. This directly prevents pods from running with unnecessary permissions, aligning with the security team's goal at the pod level.

Answer

Implement network policies to restrict pod-to-pod communication

Answer

Use namespaces to separate environments

Question 2

A company is deploying a new web application in a hybrid cloud environment. The application must be able to scale out automatically during peak usage and scale in during low usage. The deployment must also ensure that the application remains available if a single Availability Zone fails. Which deployment strategy should the architect recommend?

Accepted Answer

Create an auto-scaling group spanning multiple Availability Zones.. An auto-scaling group spanning multiple Availability Zones ensures both automatic scaling based on demand and high availability. If one Availability Zone fails, the load balancer distributes traffic to healthy instances in the remaining zones, meeting the requirement for continuous availability during a zone failure.

Answer

Deploy a cluster of instances in a single Availability Zone with a load balancer.

Answer

Use a single large instance and manually resize during peak periods.

Answer

Deploy a load balancer in front of a single instance.

Question 3

A cloud engineer is troubleshooting a performance issue in a virtualized environment. A critical application is running slowly, and the engineer suspects resource contention. The host server has 32 vCPUs and 256 GB of RAM, running four VMs. Which tool should the engineer use to determine if CPU ready time is causing the performance degradation?

Accepted Answer

Use the hypervisor's monitoring console to view CPU ready time. CPU ready time is a hypervisor-level metric that measures the time a VM is ready to execute but must wait for a physical CPU core to become available. Since the engineer suspects resource contention among VMs on the same host, the hypervisor's monitoring console is the only tool that can expose this metric directly. Guest OS tools like 'top' or Performance Monitor cannot see CPU ready time because it occurs at the virtualization layer, not inside the VM.

Answer

Run the 'top' command inside the affected VM

Answer

Deploy a network analyzer to capture traffic between VMs

Answer

Check the performance monitor in the guest operating system

Question 4

A cloud engineer is migrating a legacy application to AWS. The application requires minimal downtime during the database migration from SQL Server to Aurora MySQL. Which TWO AWS services should the engineer use to achieve this?

Accepted Answer

AWS Schema Conversion Tool (SCT). The AWS Schema Conversion Tool (SCT) is used to convert the source SQL Server database schema and code to be compatible with Aurora MySQL, handling differences in data types, stored procedures, and other database objects. The AWS Database Migration Service (DMS) then performs the actual data migration with minimal downtime by continuously replicating changes from the source to the target database until a cutover is performed. Together, SCT and DMS enable a heterogeneous migration with near-zero downtime.

Answer

AWS Snowball

Answer

AWS Direct Connect

Answer

AWS DataSync

Question 5

A company is implementing a cloud governance strategy. They need to ensure that all resources are tagged with cost center and environment, and any untagged resources are automatically remediated. Which of the following best practices should be applied?

Accepted Answer

Use policy-as-code to enforce tagging and automatically apply tags to untagged resources. Policy-as-code (e.g., Azure Policy, AWS Config Rules, or Open Policy Agent) allows you to define tagging requirements declaratively and automatically remediate non-compliant resources. This approach enforces governance in real-time without manual intervention, ensuring all resources are tagged with cost center and environment as specified.

Answer

Implement role-based access control to restrict resource creation

Answer

Set up budget alerts to notify when costs exceed thresholds

Answer

Create a manual audit process to check tags weekly

Question 6

A cloud architect is designing a CI/CD pipeline for a microservices application deployed on a managed Kubernetes service. The pipeline should include stages for source, build, test, deploy, and verify. Which TWO of the following are typical pipeline stages? (Select TWO.)

Accepted Answer

Build. (Build) is correct because in a CI/CD pipeline for AWS EKS, the Build stage compiles source code, runs unit tests, and creates container images (e.g., using Docker) that are pushed to a registry like Amazon ECR. This stage is essential for transforming code into deployable artifacts for Kubernetes workloads.

Answer

Audit

Answer

Backup

Answer

Monitor

Question 7

A company is migrating a legacy application to a public cloud. The application requires a static IP address for licensing. The security team insists on encrypting all traffic between the application and the database. Which of the following should the cloud architect implement?

Accepted Answer

Create a VPN connection between the application and database subnets.. Creating a VPN connection between the application and database subnets establishes an encrypted tunnel (using IPsec or TLS-based VPN protocols) that ensures all traffic between the two subnets is encrypted, meeting the security team's requirement. Additionally, the application's need for a static IP address can be satisfied by assigning a static private IP to the application instance within its subnet, while the VPN provides secure communication without exposing traffic to the public internet.

Answer

Assign a static public IP address and use NAT.

Answer

Use TLS certificates on the web server.

Answer

Deploy a site-to-site VPN from the cloud to the on-premises data center.

Question 8

A company is using a cloud provider's object storage for archival data. The data is rarely accessed but must be retained for 7 years for compliance. The current storage class is Standard, and the monthly bill is increasing. The cloud administrator wants to minimize costs while meeting compliance requirements. The data must be accessible within 24 hours if needed. Which of the following actions should the administrator take?

Accepted Answer

Use a lifecycle policy to transition objects to a cheaper storage class after a period.. A lifecycle policy automates the transition of objects from a higher-cost storage class (e.g., Standard) to a cheaper class (e.g., S3 Glacier Deep Archive or Azure Archive) after a specified period, reducing costs while retaining data for the required 7 years. The data remains accessible within 24 hours via a restore request, meeting the compliance and retrieval time requirement.

Answer

Compress the objects using server-side encryption.

Answer

Delete the objects after 7 years to save cost.

Answer

Move the data to a cold storage tier like Glacier or Archive.

Question 9

A cloud engineer needs to collect and query log data from multiple cloud services in a centralized location. Which cloud service should be used for centralized log management?

Accepted Answer

Logging service. A centralized logging service allows log collection and querying from multiple sources, providing a single pane of glass for log analysis.

Answer

Audit logging service

Answer

Monitoring service

Answer

Storage service

Question 10

A cloud administrator needs to set up a centralized logging solution to collect logs from multiple projects. Which cloud service should be used?

Accepted Answer

Logging service. A centralized logging service is designed to aggregate and store logs from various sources, such as multiple projects or services, enabling administrators to search, monitor, and analyze log data in one place. The other options serve different purposes: monitoring focuses on metrics and alerts, serverless functions process events but do not natively centralize logs, and audit logs are a subset of logging typically focused on compliance and user activity.

Answer

Monitoring service

Answer

Serverless function service

Answer

Audit logs service

Question 11

A company wants to implement automated patching for their Windows and Linux servers in AWS. They need to schedule patching during a maintenance window and have a rollback plan. Which service should they use?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager automates patching with maintenance windows and allows creation of patching baselines. It also supports rollback by restoring from AMIs or using AWS Backup. Inspector is for vulnerability scanning, not patching. Config is for compliance. OpsWorks is configuration management.

Answer

AWS OpsWorks

Answer

AWS Config

Answer

Amazon Inspector

Question 12

Which cloud deployment model connects an on-premises data center to a public cloud using VPN or dedicated connections like AWS Direct Connect?

Accepted Answer

Hybrid cloud. Hybrid cloud integrates on-premises and public cloud resources via private networking.

Answer

Private cloud

Answer

Multi-cloud

Answer

Public cloud

Question 13

An organization has a site-to-site VPN connection between its on-premises network and a cloud VPC. Users report intermittent connectivity to applications hosted in the cloud. The administrator checks the VPN tunnel status and sees it is up. However, ping tests from on-premises to a cloud instance fail at random times. Which factor should the administrator investigate first?

Accepted Answer

The VPN tunnel is experiencing packet loss due to a mismatch in the IPSec parameters.. Intermittent connectivity with the VPN tunnel appearing up is a classic sign of packet loss or misconfiguration in IPSec parameters (e.g., mismatched phase 1/phase 2 settings, encryption algorithms, or Diffie-Hellman groups). This causes some packets to fail while others pass, leading to intermittent issues. Option A is incorrect because while the on-premises firewall blocking outbound ICMP could cause ping failures, it would not cause intermittent connectivity for all applications; also, the issue is likely VPN-related. Option B is incorrect because a security group blocking ICMP would cause consistent ping failure, not intermittent. Option C is incorrect because missing routes would cause complete failure for all traffic, not intermittent.

Answer

The on-premises firewall is blocking outbound ICMP.

Answer

The security group on the cloud instance is blocking ICMP.

Answer

The routing tables on the cloud VPC are missing routes for the on-premises network.

Question 14

A company runs a critical e-commerce application on a cloud platform. The architecture includes a load balancer in front of an auto scaling group of compute instances across two availability zones. The instances are in a private subnet and use a NAT gateway for outbound internet access. The application stores session data in a managed Redis cache cluster. During a flash sale, users report that the site is extremely slow and some requests time out. Monitoring shows the load balancer's latency metric is high, and the number of healthy hosts fluctuates. The CPU utilization on the compute instances averages 60% and memory averages 70%. The Redis cluster's CPU utilization is 90%, and its memory usage is 95%. The NAT gateway's metrics show high BytesOutToSource but no errors. Which of the following is the most likely cause of the performance issue?

Accepted Answer

The managed Redis cache cluster is overloaded and becoming a bottleneck for session lookups. The managed Redis cache cluster is the most likely bottleneck because its CPU utilization is at 90% and memory usage at 95%, indicating it is near capacity. Since the application stores session data in Redis, high latency and timeouts during a flash sale are consistent with an overloaded session store that cannot keep up with request volume, causing the load balancer to experience increased latency and healthy host fluctuations as sessions fail to be retrieved or written.

Answer

The NAT gateway is throttling traffic due to bandwidth limits

Answer

The auto scaling group is not scaling quickly enough due to cooldown periods

Answer

The load balancer's idle timeout setting is too low, causing premature connection drops

Question 15

A company is migrating on-premises workloads to the cloud. They need to ensure high availability for a stateless web application across two availability zones. Which THREE components should be configured to meet this requirement?

Accepted Answer

An auto scaling group spanning both availability zones. An auto scaling group spanning both availability zones (Option A) ensures that the stateless web application can automatically replace failed instances and maintain the desired capacity across multiple AZs, which is essential for high availability. By distributing instances across AZs, the application can tolerate an entire AZ failure without losing all compute capacity.

Answer

A read replica database in a different AZ

Answer

A single large compute instance to handle all traffic

Question 16

A cloud administrator receives an alert that a VM's disk usage is at 95%. The VM is running a critical database. Which TWO actions should the administrator take to resolve the issue while minimizing downtime?

Accepted Answer

Increase the size of the existing disk. Increasing the size of the existing disk (Option A) is correct because it allows the VM to gain additional storage capacity without requiring a reboot or migration, minimizing downtime. Modern hypervisors and cloud platforms support live resizing of virtual disks, and once the disk is expanded, the OS can extend the partition online using tools like `resize2fs` (Linux) or Disk Management (Windows). This directly addresses the 95% disk usage alert for the critical database with minimal service interruption.

Answer

Shrink an existing partition to free space

Answer

Restore the VM from a recent backup to a larger disk

Answer

Add a new disk and move data to it

Question 17

A cloud security team is reviewing audit logs and notices that a service account has been used to launch several high-risk API calls that are not part of its normal behavior. Which security control should be implemented to detect such anomalies in real time?

Accepted Answer

Implement an anomaly detection service. Anomaly detection tools use machine learning and behavioral analytics to identify unusual API activity in real time, providing early warning of potential security threats.

Answer

Enable API audit logging

Answer

Use a static IAM policy

Answer

Configure a network ACL

Question 18

A cloud security analyst is reviewing a compliance report and sees that the organization needs to ensure encryption keys are rotated periodically. Which of the following would best satisfy this requirement?

Accepted Answer

Using customer-managed keys with a defined rotation policy. Customer-managed keys allow the customer to set rotation policies. Provider-managed keys are automatically rotated but the customer cannot control the schedule. Storing keys in the application configuration file violates security best practices. Disabling rotation does not meet the requirement.

Answer

Disabling key rotation to prevent key loss

Answer

Storing keys in the application configuration file

Answer

Using provider-managed keys with automatic rotation

Question 19

A cloud user is unable to connect to a web server VM from the internet after a security group rule was modified. The VM is running and can be pinged from other VMs in the same subnet. What is the most likely cause?

Accepted Answer

The inbound rule for HTTP/HTTPS was removed or misconfigured.. Modifying a security group rule likely removed or misconfigured the inbound HTTP/HTTPS rule, blocking internet traffic to the web server. The VM is accessible from other VMs in the same subnet (via private IP), indicating the OS and local services are running, but internet connectivity is controlled by the security group. Option A (local firewall) is unlikely because internal ping works. Option B (missing default gateway) would affect all outbound and inbound traffic. Option D (DNS) affects name resolution, not direct IP connectivity.

Answer

The VM's local firewall is blocking the traffic.

Answer

The VM's routing table is missing a default gateway.

Answer

The VM's DNS settings are incorrect.

Question 20

A company wants to reduce cloud costs for a stateless batch processing workload that runs nightly for about 3 hours. The workload can tolerate interruptions. Which pricing model is most cost-effective?

Accepted Answer

Spot instances. Spot instances are the most cost-effective because they offer deep discounts (up to 90%) for interruptible workloads. The workload is stateless, runs for only 3 hours nightly, and can tolerate interruptions, making it an ideal fit for spot instances. Reserved instances require a long-term commitment and provide capacity for steady-state usage, resulting in paying for 24/7 capacity for a workload that only needs 3 hours daily.

Answer

Reserved instances

Answer

Dedicated hosts

Answer

On-demand instances