CV0-004 Practice Exam 58 — 20 Questions

Question 1

A company is migrating a large Oracle database (2 TB) from on-premises to AWS RDS for Oracle. They require minimal downtime and need to keep the source database running during migration. Which AWS service should they use to achieve continuous replication?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS DMS with CDC. AWS DMS with Change Data Capture (CDC) is the correct choice because it enables continuous replication of ongoing changes from the source Oracle database to the target RDS for Oracle instance, allowing the source to remain fully operational during migration. CDC captures incremental changes (inserts, updates, deletes) from the source's redo logs, minimizing downtime to a brief cutover window. This meets the requirement of a 2 TB database with minimal downtime while keeping the source running.

Answer

AWS DataSync

Answer

AWS S3 Transfer Acceleration

Answer

AWS Snowball Edge

Question 2

A cloud administrator needs to grant a developer read-only access to a specific storage bucket in AWS. Which IAM component should the administrator modify?

Accepted Answer

IAM policy. IAM policies are JSON documents that define permissions for AWS resources like S3 buckets.

Answer

Security group

Answer

AWS WAF

Answer

Network ACL

Question 3

A cloud engineer is responsible for securing a multi-tier application deployed on IaaS. The application consists of web servers, application servers, and database servers. The engineer needs to implement network segmentation to minimize the attack surface. Which of the following is the BEST approach?

Accepted Answer

Create separate subnets for each tier and configure security groups to allow only required traffic between them.. Creating separate subnets for each tier enforces network segmentation at the IP layer, which is a fundamental security best practice for multi-tier applications. By configuring security groups (stateful firewalls) to allow only the specific required traffic (e.g., HTTP/HTTPS from web to app, SQL from app to database), the engineer minimizes the attack surface by preventing lateral movement if one tier is compromised. This approach aligns with the principle of least privilege and is the most effective method in IaaS environments like AWS, Azure, or GCP.

Answer

Use a single security group for all instances and define rules to allow traffic between tiers.

Answer

Place web servers in a public subnet and application and database servers in the same private subnet with a common security group.

Answer

Place all instances in the same subnet and use network ACLs to restrict traffic between tiers.

Question 4

A company uses Azure and wants to enforce multi-factor authentication (MFA) for all administrative users. The solution must be centrally managed and apply to all Azure subscriptions. Which approach should be used?

Accepted Answer

Create a Conditional Access policy in Azure AD requiring MFA for all cloud apps. Conditional Access policies in Azure AD are centrally managed and can enforce MFA for all cloud apps across all Azure subscriptions by targeting the 'Microsoft Azure Management' cloud app. This approach applies to all administrative users regardless of subscription, as Azure AD is the identity provider for Azure resources.

Answer

Configure MFA on each individual Azure subscription

Answer

Assign MFA to each user individually in Azure AD

Answer

Use Azure Policy to require MFA for admin roles

Question 5

A company uses a hybrid cloud model with an on-premises data center and a public cloud. The network team reports that traffic between the cloud and on-premises is experiencing high latency and packet loss. The cloud administrator verifies that the VPN connection is up. What is the most likely cause?

Accepted Answer

The VPN tunnel has a mismatched MTU size.. When a VPN tunnel is up but traffic experiences high latency and packet loss, a mismatched Maximum Transmission Unit (MTU) size is a common cause. This occurs because packets larger than the tunnel's MTU must be fragmented, and if fragmentation is not properly handled (e.g., due to the DF bit being set), packets are dropped, leading to retransmissions and increased latency. The symptoms align with MTU issues rather than simple connectivity or throttling problems.

Answer

A firewall rule is blocking ICMP packets.

Answer

VMs are placed in different cloud regions.

Answer

The cloud provider is throttling bandwidth.

Question 6

A startup wants to develop a new web application with minimal upfront infrastructure management. They want to focus on writing code and not worry about operating system patches or scaling servers. Which cloud service model is MOST appropriate?

Accepted Answer

Platform as a Service (PaaS). Platform as a Service (PaaS) provides a managed platform where the startup can deploy and run their web application code without managing the underlying infrastructure, including operating system patches and server scaling. This aligns with the requirement to focus on writing code while the cloud provider handles the operational overhead.

Answer

Functions as a Service (FaaS)

Answer

Infrastructure as a Service (IaaS)

Answer

Software as a Service (SaaS)

Question 7

A company has a hybrid cloud environment with on-premises servers and AWS. They deploy a new application using AWS Elastic Beanstalk with a load balancer and auto scaling group. The application is a Node.js API that connects to an RDS MySQL database. After deployment, users report that the API returns a '500 Internal Server Error' intermittently. The application logs show 'ETIMEDOUT' errors when connecting to the database. The database is deployed in a private subnet with a security group that allows inbound traffic from the Elastic Beanstalk environment's security group. The database connection string uses the RDS endpoint. The same application works perfectly when deployed on-premises. What is the most likely cause?

Accepted Answer

The Elastic Beanstalk environment is in a different VPC or subnet that cannot reach the RDS instance. The intermittent 'ETIMEDOUT' errors indicate a network connectivity issue between the Elastic Beanstalk environment and the RDS database. Since the application works on-premises, the problem is specific to the AWS networking configuration. The most likely cause is that the Elastic Beanstalk environment is deployed in a different VPC or subnet that lacks routing or a VPC peering connection to reach the RDS instance's private subnet, causing timeouts when the load balancer or auto scaling group instances attempt to connect.

Answer

The database connection string uses the wrong port number

Answer

The security group attached to the RDS instance does not allow traffic from the Elastic Beanstalk environment

Answer

The RDS instance is in a failed state and needs to be rebooted

Question 8

A company is migrating 100 TB of data from on-premises to Google Cloud Storage. The network bandwidth is 1 Gbps, and the migration window is two weeks. Which TWO services should the company consider to complete the transfer within the window? (Choose two.)

Accepted Answer

Transfer Appliance. Storage Transfer Service handles online transfers from various sources, and Transfer Appliance provides offline physical shipping for large datasets when network is insufficient.

Answer

gsutil

Answer

Cloud Dataflow

Answer

Cloud VPN

Question 9

Which TWO design patterns can help a cloud architect achieve a Recovery Time Objective (RTO) of less than 5 minutes for a critical application?

Accepted Answer

Multi-site active-active. Multi-site active-active (B) distributes the application workload across two or more geographically separated sites, with all sites actively serving traffic. If one site fails, traffic is instantly rerouted to the remaining sites via DNS load balancing or global server load balancing (GSLB), enabling sub-5-minute RTO because there is no cold start or failover delay. Hot standby (active/passive) with automatic failover (E) maintains a fully provisioned standby environment that mirrors the primary, with automatic health checks and failover mechanisms (e.g., using AWS Route 53 health checks or Azure Traffic Manager) that can redirect traffic within seconds to minutes, meeting a strict RTO of under 5 minutes.

Answer

Warm standby

Answer

Backup and restore

Answer

Pilot light

Question 10

A cloud architect is designing an auto-scaling policy for a web application. The application's traffic spikes predictably every weekday at 9 AM and decreases after 5 PM. Which scaling policy is most cost-effective?

Accepted Answer

Scheduled scaling policy that increases capacity at 8:45 AM and decreases at 5:15 PM. Scheduled scaling can add capacity before 9 AM and remove it after 5 PM, aligning capacity with predictable patterns without reacting to real-time metrics.

Answer

Step scaling policy that adds instances when CPU > 70%

Answer

Simple scaling policy with a cooldown of 300 seconds

Answer

Target tracking policy with a target CPU of 50%

Question 11

A DevOps engineer is deploying an application on Kubernetes. The exhibit shows the status of pods and a describe output. The frontend pod is stuck in Pending state. Which action should the engineer take to resolve the issue?

Accepted Answer

Reduce the resource requests in the frontend deployment manifest.. The frontend pod is stuck in Pending state because the cluster nodes lack sufficient resources (CPU or memory) to satisfy the pod's resource requests. Reducing the resource requests in the deployment manifest lowers the scheduling threshold, allowing the pod to fit on an available node. This directly addresses the most common cause of Pending pods: insufficient allocatable resources on any node.

Answer

Add a node affinity rule to schedule on nodes with more memory.

Answer

Change the service type from ClusterIP to NodePort.

Answer

Modify the image pull policy to Always.

Question 12

An organization uses multiple cloud providers and wants to centralize secrets management. Which solution would best meet this requirement?

Accepted Answer

HashiCorp Vault. HashiCorp Vault is a multi-cloud secrets management solution that can store and rotate secrets across different providers.

Answer

Azure Key Vault

Answer

AWS Secrets Manager

Answer

Google Cloud Secret Manager

Question 13

A cloud architect is designing a serverless application on AWS Lambda. The function needs to process messages from an SQS queue. Which event trigger should be configured for the Lambda function?

Accepted Answer

SQS trigger. AWS Lambda can be triggered by SQS messages. By configuring an SQS trigger, Lambda automatically polls the queue and invokes the function with each message.

Answer

API Gateway

Answer

S3 bucket event

Answer

EventBridge rule

Question 14

A cloud administrator notices that a cloud-based web application is experiencing intermittent latency during peak hours. The application runs on an auto-scaling group of virtual machines behind a load balancer. Which of the following should the administrator investigate FIRST to resolve the issue?

Accepted Answer

Review the auto-scaling group's scaling policies and thresholds. The intermittent latency during peak hours is most likely caused by the auto-scaling group's scaling policies not reacting quickly enough or being set with thresholds that are too high, leading to insufficient capacity under load. Investigating the scaling policies and thresholds first directly addresses the root cause—whether the group is adding instances too slowly or at too high a utilization trigger—rather than symptoms like health checks or DNS. This aligns with the operational best practice of verifying capacity management before tuning network or load-balancer settings.

Answer

Enable SSL offloading on the load balancer

Answer

Verify the load balancer's health check interval

Answer

Check DNS resolution times for the application domain

Question 15

A company experiences a cloud service outage that affects multiple customers. The cloud provider publishes a post-incident report identifying the root cause. As a cloud administrator, which of the following actions should be taken to prevent recurrence?

Accepted Answer

Design the application to be deployed across multiple availability zones or regions. Designing the application for multi-AZ or multi-region deployment ensures high availability and fault tolerance, which directly mitigates the impact of a single cloud provider's infrastructure failure. This architectural pattern leverages redundancy to maintain service continuity even when one availability zone or region experiences an outage, preventing recurrence of customer-facing downtime.

Answer

Request a service credit from the provider for the outage

Answer

Submit a formal complaint to the cloud provider's regulatory body

Answer

Migrate all workloads to a different cloud provider immediately

Question 16

An organization uses a cloud-based monitoring service to track CPU utilization across a fleet of virtual machines. The administrator notices that one VM consistently shows 100% CPU utilization at the same time each day. Which of the following should the administrator do NEXT?

Accepted Answer

Check the VM's local task scheduler for any jobs running during the peak times. The consistent daily spike in CPU utilization at the same time strongly suggests a scheduled task or cron job is triggering the load. Checking the VM's local task scheduler (e.g., Task Scheduler on Windows or cron on Linux) is the logical first step to identify the specific process causing the spike before taking any remediation actions.

Answer

Add the VM to an auto scaling group to distribute the load

Answer

Immediately increase the VM size to accommodate the peak

Answer

Scan the VM for malware that might be causing the activity

Question 17

A company is migrating its on-premises e-commerce application to a public cloud provider. The application consists of a web tier, an application tier, and a database tier. The cloud architect has designed a three-tier architecture using virtual machines (VMs) in a virtual private cloud (VPC). During the deployment, the web servers are placed in a public subnet, the application servers in a private subnet, and the database servers in a separate private subnet. All security groups and network ACLs have been configured to allow the required traffic. After deploying the application, the operations team reports that the web servers cannot communicate with the application servers. The web servers are able to reach the internet, and the application servers can be reached from the operations team's management bastion host. Which of the following is the MOST likely cause of the issue?

Accepted Answer

The route table associated with the web servers' subnet is missing a route to the application servers' subnet.. The web servers are in a public subnet with a route table that typically includes a default route (0.0.0.0/0) pointing to an internet gateway, enabling internet access. However, for the web servers to reach the application servers in a private subnet, the route table associated with the web servers' subnet must also contain a route to the destination CIDR block of the application servers' subnet, pointing to a local route or a virtual private cloud (VPC) peering connection. Without this explicit route, traffic from the web servers to the application servers is dropped because the route table does not know how to forward packets to that subnet, even though security groups and network ACLs are correctly configured.

Answer

The web servers do not have a route to the internet gateway.

Answer

The network ACL on the application servers' subnet is blocking inbound traffic from the web servers.

Answer

The security group on the web servers is blocking outbound traffic to the application servers.

Question 18

A company is migrating on-premises storage to Google Cloud Storage (GCS) using Storage Transfer Service. The source is an on-premises NAS with 100 TB of data. Which THREE considerations are relevant for this migration? (Select THREE.)

Accepted Answer

The possibility to schedule periodic transfers for ongoing sync. Storage Transfer Service supports online transfers from sources like Amazon S3, HTTP/HTTPS, and on-premises via a staging area. Bandwidth, data integrity, and transfer time are key considerations.

Answer

Requirement to install an agent on the NAS

Answer

The need for a physical appliance like Snowball Edge

Question 19

A cloud administrator notices that a storage bucket in a cloud object storage service is publicly accessible. The bucket contains sensitive customer data. What is the most likely cause of this issue?

Accepted Answer

The bucket policy or ACL was set to allow public access.. The most likely cause is that the bucket policy or ACL was misconfigured to allow public access. Option A correctly identifies this. Option B is incorrect because versioning does not affect access permissions. Option C is incorrect because lifecycle policies manage object transitions, not access. Option D is incorrect because server-side encryption does not control public access.

Answer

The bucket has versioning enabled.

Answer

The bucket has a lifecycle policy to transition objects to archival storage.

Answer

The bucket is using server-side encryption with customer-provided keys.

Question 20

A cloud administrator runs the `iostat` command on a Linux VM experiencing slow performance. Based on the exhibit, what is the most likely bottleneck?

Accepted Answer

Disk I/O is saturated.. The `iostat` command reports CPU and I/O statistics. The exhibit shows high `%util` (e.g., 99.9%) and elevated `await` or `svctm` values, indicating that the disk device is operating at or near its maximum capacity. This means the disk I/O subsystem is saturated, causing requests to queue and slowing overall VM performance.

Answer

Network bandwidth is limited.

Answer

CPU is overloaded.

Answer

Memory is insufficient.