CV0-004 Practice Exam 57 — 20 Questions

Question 1

A cloud engineer is tasked with securing network traffic in a VPC. Which TWO of the following are stateful security mechanisms? (Choose two.)

Accepted Answer

DDoS protection services. Security groups are stateful, automatically allowing return traffic. DDoS protection services are stateful as they track and analyze traffic flows to detect anomalies. Network ACLs are stateless. WAF is typically stateless, processing each request independently. Route tables are stateless, simply directing traffic without tracking connections.

Answer

Web Application Firewall (WAF)

Answer

Network ACLs

Answer

Route tables

Question 2

A cloud administrator notices that a virtual machine running a critical application is using 95% CPU consistently. The application is single-threaded and performance is degraded. Which action should the administrator take to resolve the issue?

Accepted Answer

Migrate the VM to a host with a higher CPU clock speed.. The application is single-threaded, meaning it can only utilize one CPU core at a time. Increasing the CPU clock speed directly improves the processing speed of that single thread, which resolves the performance degradation. Option C is correct because migrating to a host with a higher CPU clock speed provides a faster core for the single-threaded workload.

Answer

Deploy additional VMs and load balance the application.

Answer

Increase the RAM allocation to the VM.

Answer

Increase the number of vCPUs assigned to the VM.

Question 3

A cloud administrator receives an alert that a storage bucket containing sensitive customer data has been accessed from an unknown IP address at 3:00 AM. The bucket policy is configured to allow access only from the corporate VPN CIDR block (10.0.0.0/8). The administrator checks the access logs and sees that the request originated from 203.0.113.50, which is not within the allowed range. The bucket policy also includes a condition that restricts access to Secure Transport (SSL). What is the most likely reason the request succeeded despite the policy?

Accepted Answer

The policy has an Allow statement that permits all accesses using SSL, without restricting the source IP.. The most likely reason is that the bucket policy contains an Allow statement that grants access to all requests using Secure Transport (SSL) but does not include the source IP condition. This permissive statement overrides the IP restriction and allows the request from 203.0.113.50 if it uses SSL.

Answer

The access logs are spoofed; the request actually came from a corporate IP.

Answer

The unknown IP address is part of a misconfigured VPN client that still appears as the corporate CIDR.

Answer

The bucket policy is missing an explicit Deny statement for IP addresses outside the allowed range.

Question 4

A cloud engineer needs to deploy a containerized application on Amazon EKS. The application requires a persistent storage volume that can be dynamically provisioned. Which Kubernetes resource should be used to request storage?

Accepted Answer

PersistentVolumeClaim. A PersistentVolumeClaim (PVC) is the correct Kubernetes resource to request storage because it acts as a request for storage by a pod, specifying size, access modes, and optionally a StorageClass. In Amazon EKS, a PVC can trigger dynamic provisioning of an EBS or EFS volume via a StorageClass, decoupling the storage request from the underlying PersistentVolume. This allows the cloud engineer to deploy the containerized application without manually pre-provisioning storage.

Answer

PersistentVolume

Answer

StorageClass

Answer

ConfigMap

Question 5

Refer to the exhibit. A cloud administrator runs this command on a VM. Which of the following is most likely causing the high 'wa' value?

Accepted Answer

Disk I/O bottleneck. The 'wa' value in the output of the 'top' or 'vmstat' command represents the percentage of time the CPU spends waiting for I/O operations to complete. A high 'wa' value indicates that the CPU is frequently idle because it is waiting for data from storage devices, which is a classic symptom of a disk I/O bottleneck. This occurs when the storage subsystem cannot keep up with the read/write requests from the VM, causing the CPU to stall.

Answer

Network congestion

Answer

High CPU load

Answer

Insufficient memory

Question 6

During a deployment using a script, an administrator receives a 'Permission Denied' error. What is the most likely cause?

Accepted Answer

The service account lacks necessary IAM roles. A service account lacking necessary IAM roles would cause a 'Permission Denied' error. Option B is incorrect because network latency would cause timeouts, not permission errors. Option C is incorrect because targeting the wrong region might cause resource not found errors, but not 'Permission Denied'. Option D is incorrect because insufficient storage would cause disk full errors, not permission errors.

Answer

Network latency is causing timeouts

Answer

The deployment is targeting the wrong region

Answer

The instance has insufficient storage

Question 7

What is the primary benefit of using Infrastructure as Code (IaC)?

Accepted Answer

Consistent and repeatable deployments. IaC ensures consistent and repeatable deployments by defining infrastructure in code. Option A is wrong because improved network performance is not a direct benefit. Option B is wrong because manual control is the opposite of automation. Option D is wrong because IaC may reduce costs through automation but consistency is key.

Answer

Improved network performance

Answer

Full manual control over resources

Answer

Lower cloud service costs

Question 8

Which TWO of the following are best practices for managing cloud costs? (Select TWO.)

Accepted Answer

Implementing resource tagging for cost allocation. A is correct because resource tagging enables granular cost allocation and chargeback by attaching metadata (e.g., environment, project, cost center) to cloud resources. This allows you to filter and group costs in billing reports, making it easier to identify spending patterns and optimize budgets. Without tagging, costs are aggregated, obscuring which teams or workloads drive expenses.

Answer

Consolidating all environments into a single subscription

Answer

Overprovisioning resources to ensure high performance

Answer

Manually stopping idle virtual machines

Question 9

A company runs a production application on multiple cloud regions for high availability. They want to minimize latency for global users. Which DNS routing policy should they use?

Accepted Answer

Latency routing. Latency routing policy directs traffic to the AWS region that provides the lowest latency for the user based on real-time network measurements. This minimizes latency for global users by routing to the region that responds fastest, which is the requirement in this scenario. Geolocation routing routes based solely on the user's geographic location, which may not always correspond to lowest latency if the nearest region is congested or the user is far from a region in their assigned location.

Answer

Failover routing

Answer

Geolocation routing

Answer

Simple routing

Question 10

A cloud administrator is designing network security for a three-tier application. The web tier must be accessible from the internet, but the application and database tiers should only be reachable from the web tier. Which security group configuration should be used?

Accepted Answer

Use separate security groups: web allows HTTP/HTTPS from 0.0.0.0/0; app allows traffic from web security group; db allows traffic from app security group. It uses separate security groups for each tier, implementing the principle of least privilege. The web tier security group allows HTTP/HTTPS from 0.0.0.0/0 for internet access, while the app tier security group references the web tier security group as its source, ensuring only traffic from the web tier can reach the application tier. Similarly, the database tier security group references the app tier security group, restricting access exclusively to the application tier. This configuration enforces strict east-west traffic control and prevents direct internet access to the internal tiers.

Answer

Assign the same security group to all tiers and use a single inbound rule

Answer

Place all tiers in the same subnet and use a network ACL to permit all traffic

Answer

Configure a network ACL for each subnet with allow rules for the required traffic

Question 11

A cloud administrator wants to set up cost monitoring and receive alerts when spending exceeds the budget. Which TWO AWS services should they use? (Select TWO.)

Accepted Answer

AWS Budgets. AWS Budgets allows you to set custom budgets and receive alerts when costs exceed thresholds. Cost Explorer provides visualization and analysis of costs and usage.

Answer

Amazon CloudWatch Billing Metrics

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 12

Match each cloud deployment model to its description.

Accepted Answer

Public cloud: Owned by third-party provider, accessible over internet, multi-tenant. Deployment models define ownership and access scope. Public is third-party multi-tenant; private is single-tenant; hybrid combines models; community is shared by like-minded organizations. Common errors include swapping definitions between hybrid and community.

Answer

Private cloud: Owned by third-party provider, accessible over internet, multi-tenant

Answer

Hybrid cloud: Shared by several organizations with common concerns

Question 13

Which of the following is a key benefit of using object storage like Amazon S3 over block storage?

Accepted Answer

Unlimited scalability for unstructured data. Amazon S3 is designed for unlimited scalability, allowing you to store and retrieve any amount of unstructured data (e.g., images, videos, backups) without provisioning storage in advance. Unlike block storage, which has fixed size limits per volume, S3 automatically scales to accommodate petabytes of data, making it ideal for modern cloud-native applications.

Answer

Direct attachment to a single VM

Answer

Supports file-level locking

Answer

Lower latency for database workloads

Question 14

A cloud administrator needs to deploy a new application that requires a static IP address. The administrator is using a cloud provider that allows the reservation of elastic IP addresses. Which deployment step should be taken to ensure the IP address is not lost when the resource is stopped?

Accepted Answer

Allocate an elastic IP address and associate it with the resource.. Elastic IP addresses are static public IPv4 addresses that you can allocate to your account and associate with a resource. When you associate an elastic IP with an instance, it persists even if the instance is stopped, because the IP is reserved in your account until you explicitly release it. This ensures the IP address is not lost when the resource is stopped, unlike ephemeral public IPs that change on stop/start.

Answer

Configure the instance to obtain an IP via DHCP.

Answer

Assign a private IP address from a reserved range.

Answer

Set up an external DNS service to point to the public IP.

Question 15

A web application is deployed across multiple availability zones behind a load balancer. The administrator notices that all traffic is being routed to instances in only one availability zone, causing performance issues. The load balancer is configured to distribute traffic across all zones evenly. What is the most likely cause?

Accepted Answer

The instances in the other zones are marked as unhealthy due to failing health checks.. When the load balancer is configured to distribute traffic across all zones, it should balance traffic across all availability zones. However, if instances in other zones fail health checks, they are marked as unhealthy and removed from the rotation, causing all traffic to go to healthy instances in only one zone. Option A is incorrect because firewall rules are not zone-specific; they apply to resources regardless of zone. Option C is incorrect because route tables affect outbound traffic from instances, not load balancer traffic distribution. Option D is incorrect because a single backend pool can contain instances from multiple zones; this does not limit traffic to one zone.

Answer

The firewall rules for the load balancer only allow traffic from one zone.

Answer

The route table for the subnets in the other zones is missing a default route.

Answer

The listener rules are configured to forward traffic to a single backend pool.

Question 16

A storage administrator needs to ensure data durability for a critical database. Which approach provides the highest durability?

Accepted Answer

Replicate data to a different geographic region.. Replicating data to a different geographic region provides the highest durability by ensuring that even if an entire data center or region experiences a catastrophic failure (e.g., natural disaster, power outage), a complete copy of the database remains available in another region. This approach leverages asynchronous or synchronous replication to maintain data consistency across geographically separated sites, achieving a Recovery Point Objective (RPO) and Recovery Time Objective (RTO) that single-site solutions cannot match. In cloud environments, this is often implemented using services like AWS Cross-Region Replication or Azure Geo-Redundant Storage, which guarantee 99.9999999999% (12 nines) durability.

Answer

Store data on a single SSD volume.

Answer

Enable encryption at rest.

Answer

Use RAID 0 across multiple volumes.

Question 17

The exhibit shows the output of the df command and an application error. What is the most likely cause of the error?

Accepted Answer

The /var partition is full.. The df output shows the /var partition is at 100% utilization, and the application error indicates it cannot write to disk, likely due to the /var partition being full. Option A is incorrect because /dev/shm is a tmpfs and not relevant to application writing to /var/log. Option C is incorrect because there is no evidence of filesystem corruption. Option D is incorrect because the root filesystem still has space; the error indicates a space issue, not inode exhaustion.

Answer

The /dev/shm partition is full.

Answer

The filesystem is corrupt.

Answer

The inode usage on the root filesystem is exhausted.

Question 18

A cloud engineer is using Terraform to manage infrastructure. They need to store the state file remotely for team collaboration and to enable state locking. Which THREE of the following backends support state locking? (Select THREE.)

Accepted Answer

Consul backend. The correct answers are Consul backend, Azure Blob Storage with blob lease, and Amazon S3 with DynamoDB, as all three support state locking.

Answer

Local file system

Answer

HTTP backend

Question 19

A user reports being unable to upload files to an S3 bucket named 'my-bucket'. The IAM policy attached to the user is shown in the exhibit. What is the most likely reason for the failure?

Accepted Answer

The policy does not include s3:PutObjectAcl, which is needed.. The IAM policy grants s3:PutObject, which allows uploading an object, but it does not include s3:PutObjectAcl. When uploading to an S3 bucket, if the bucket is configured to require bucket-owner-full-control ACLs (e.g., via a bucket policy or default settings), the upload will fail unless the user also has permission to set the ACL. The s3:PutObjectAcl action is necessary to specify the ACL during the PUT request, and its absence is the most likely cause of the failure.

Answer

The policy requires a condition that is not met.

Answer

The policy has a typo in the Action field.

Answer

The bucket policy denies the upload.

Question 20

A cloud administrator is troubleshooting a virtual machine that is experiencing high memory usage. The VM is running a web server. Which two metrics should the administrator monitor to determine if the VM needs additional memory? (Choose two.)

Accepted Answer

Swap usage. Options A and D are correct. Available memory directly shows the amount of free RAM, and swap usage indicates that the OS is using disk as memory, which is a sign of insufficient physical memory. Disk I/O wait (B) is a disk performance metric, page fault rate (C) is a memory metric but is less direct than swap usage for determining if more memory is needed, and CPU ready time (E) is a CPU metric.

Answer

Disk I/O wait

Answer

Page fault rate

Answer

CPU ready time