CV0-004 Practice Exam 59 — 20 Questions

Question 1

A cloud architect is designing a CI/CD pipeline for a microservices application deployed on AWS. The pipeline should include stages for source code checkout, building, testing, and deploying to production. Which TWO of the following tools are suitable for implementing this pipeline?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

GitHub Actions. GitHub Actions and AWS CodePipeline are both CI/CD services that can manage the entire pipeline lifecycle. Terraform and CloudFormation are IaC tools, and Docker is a containerization tool.

Answer

Docker

Answer

CloudFormation

Answer

Terraform

Question 2

A company operates a hybrid cloud environment with on-premises servers and a public cloud provider. They use AWS for compute and storage. Their application requires low-latency access to on-premises databases. They set up a Direct Connect link between their data center and AWS. Recently, users report slow application performance. Cloud engineers notice increased latency on the Direct Connect link. The on-premises network team confirms no issues with their internal network. The application uses jumbo frames on the on-premises side for optimized performance. The virtual interface on the AWS side is configured with a default MTU of 1500. Which of the following is the MOST likely cause of the increased latency?

Accepted Answer

The MTU on the virtual interface is set to 1500, causing fragmentation and reassembly delays.. The application uses jumbo frames on-premises, but the AWS virtual interface defaults to an MTU of 1500. When packets larger than 1500 bytes traverse the Direct Connect link, they must be fragmented at the on-premises router and reassembled at the AWS side. This fragmentation and reassembly process introduces significant processing overhead and latency, which explains the reported slow performance.

Answer

The on-premises router has not configured BGP graceful restart for the Direct Connect session.

Answer

The cloud provider's routing table has not propagated the latest on-premises prefixes, causing traffic to take a suboptimal path.

Answer

The Direct Connect link bandwidth is oversubscribed, causing packet loss and retransmission delays.

Question 3

A cloud administrator is troubleshooting a performance issue where an application occasionally experiences high latency. The application runs on AWS and uses EC2, ELB, and RDS. Which combination of tools would best help trace the request flow and identify the bottleneck?

Accepted Answer

AWS X-Ray and VPC Flow Logs. AWS X-Ray provides end-to-end tracing, and VPC Flow Logs capture network traffic details, together helping pinpoint latency sources.

Answer

AWS Trusted Advisor and AWS Personal Health Dashboard

Answer

Amazon CloudWatch Logs and AWS Shield

Answer

AWS CloudTrail and AWS Config

Question 4

A company is adopting a canary deployment strategy for a microservice running on Kubernetes. They want to initially route 5% of traffic to the new version and monitor for errors before increasing. Which Kubernetes resource is best suited to implement this traffic splitting?

Accepted Answer

Service with multiple Deployments and replica scaling. Service meshes like Istio provide traffic routing capabilities, but in native Kubernetes, a Service can be used with multiple Deployments, but traffic splitting is not native. However, using a Service with label selectors that match both versions and manually adjusting replica counts is a common approach, but more advanced canary deployments use tools like Flagger or Istio. Among the options, a Service with a canary Deployment and adjusting replicas is most straightforward.

Answer

ConfigMap

Answer

Ingress resource

Answer

HorizontalPodAutoscaler

Question 5

A DevOps team is designing a CI/CD pipeline for a cloud-native application. They require a deployment strategy that supports traffic shifting in small increments and automatic rollback based on health checks. Which TWO strategies meet these requirements?

Accepted Answer

Rolling deployment. Canary deployment meets both requirements because it shifts traffic incrementally and can automatically roll back based on health checks. Rolling deployment also meets the requirements: it updates instances gradually, shifting traffic in small increments, and can be configured with health checks to trigger automatic rollback if the new version fails. Blue/green deployment does not shift traffic incrementally; it switches all at once. Recreate and immutable deployments do not support incremental traffic shifting or automatic rollback based on health checks.

Answer

Recreate deployment

Answer

Immutable deployment

Answer

Blue/green deployment

Question 6

Which THREE of the following are essential components of a cloud incident response plan? Select three.

Accepted Answer

Root cause analysis. Options C, D, and E are correct because root cause analysis, a communication plan, and containment procedures are essential components of a cloud incident response plan. Cost optimization strategies and data backup schedules are operational concerns, not core incident response functions.

Answer

Data backup schedule

Answer

Cost optimization strategies

Question 7

A company has a policy that all cloud resources must be tagged with 'CostCenter' and 'Project' tags. The cloud operations team uses a monitoring tool to alert when untagged resources are created. The team receives an alert for a new EC2 instance that lacks the required tags. The instance was launched two hours ago by a DevOps engineer who is on leave. The instance is critical for production. What should the administrator do to resolve the compliance violation?

Accepted Answer

Apply the required tags to the existing instance using the cloud provider's console or CLI.. The compliance violation is the absence of required tags, not a problem with the instance itself. The administrator can use the AWS Management Console, CLI (e.g., `aws ec2 create-tags`), or SDK to apply the 'CostCenter' and 'Project' tags to the existing EC2 instance without disrupting its operation. This resolves the alert and maintains production continuity.

Answer

Terminate the instance immediately and launch a new one with proper tags.

Answer

Ignore the alert because the instance is critical and the engineer will fix it when back.

Answer

Modify the tag policy to exempt instances launched by senior engineers.

Question 8

A cloud engineer is tasked with setting up a disaster recovery (DR) plan for a critical application that runs on virtual machines in a private cloud. The DR site is a public cloud. The application requires low recovery time objective (RTO) of less than 15 minutes and recovery point objective (RPO) of less than 5 minutes. Which of the following replication strategies BEST meets these requirements?

Accepted Answer

Use continuous asynchronous replication to the DR site.. Continuous asynchronous replication can achieve low RPO (under 5 minutes) and low RTO (under 15 minutes) if VMs can be quickly started from the replicated data. Option A is wrong because daily replication cannot achieve RPO < 5 minutes. Option B is wrong because synchronous replication may introduce latency and affect primary performance, and while it can achieve low RPO, recovery may involve additional steps increasing RTO. Option C is wrong because agent-based backup every 5 minutes may meet RPO but RTO would be higher due to restoration time from backup, often exceeding 15 minutes.

Answer

Replicate virtual machine images to the DR site daily.

Answer

Use synchronous replication to keep data identical.

Answer

Configure agent-based backup to the DR site every 5 minutes.

Question 9

A company uses a cloud object storage service to store backup data. The cloud provider charges for storage and retrieval. The operations team wants to minimize costs while ensuring data is available within 24 hours of a restore request. Which storage tier should they use?

Accepted Answer

Cold storage tier with retrieval time of 12 hours. The cold storage tier offers a retrieval time of 12 hours, which meets the requirement of making data available within 24 hours while minimizing costs compared to hotter tiers. Cold storage is designed for infrequently accessed data with longer retrieval times, providing a cost-effective balance between availability and expense for backup data that does not need immediate access.

Answer

Archive storage tier with retrieval time of 48 hours

Answer

Hot storage tier

Answer

Infrequent access tier with retrieval time of 1 hour

Question 10

A cloud security team needs to ensure that all API calls made to the cloud provider are logged and monitored for suspicious activity. Which service should be enabled?

Accepted Answer

Enable cloud audit logging for the management console and API calls.. Cloud audit logging services (e.g., AWS CloudTrail, Azure Monitor) are specifically designed to record all API calls to the management console and APIs, providing a centralized log for monitoring and security analysis. Option A (WAF) is incorrect because it filters and monitors HTTP traffic to web applications, not API calls to the cloud provider. Option B (IDS) is incorrect because it monitors network traffic for suspicious activity but does not log API-level actions. Option D (SIEM) is incorrect because it aggregates and analyzes logs from various sources, but it is not itself a logging service for API calls; the underlying audit logging service must still be enabled first.

Answer

Deploy a web application firewall (WAF).

Answer

Configure an intrusion detection system (IDS) on the network.

Answer

Implement a security information and event management (SIEM) system.

Question 11

Which TWO are advantages of using containers over virtual machines? (Select TWO.)

Accepted Answer

Less overhead because they share the host OS kernel. Containers share the host operating system kernel, eliminating the need for a separate guest OS per instance. This reduces overhead significantly compared to virtual machines, which each require their own full OS, leading to more efficient use of system resources.

Answer

Better hardware isolation

Answer

Requires a hypervisor to run

Answer

Larger resource consumption

Question 12

Refer to the exhibit. A cloud engineer is using AzCopy to transfer files to Azure Blob Storage. The copy fails with the above error. Which of the following is the most likely cause?

Accepted Answer

The SAS token used has expired. The error explicitly indicates an authentication failure, which is typically due to an expired or invalid SAS token. Option A is wrong because a firewall block would result in a different error (e.g., 403 Forbidden). Option C is wrong because a non-existent container would return a 404 error. Option D is wrong because insufficient throughput would cause a timeout, not an authentication error.

Answer

The network throughput is insufficient

Answer

The storage account firewall is blocking the IP

Answer

The destination container does not exist

Question 13

A company's compliance policy requires that all virtual machine (VM) instances must have security patches applied within 30 days of release. The cloud environment automatically deploys VMs from a golden image. Which strategy would BEST ensure compliance without manual intervention?

Accepted Answer

Update the golden image with the latest patches and redeploy all VMs from it.. Regularly updating the golden image and using it to create new VMs ensures that all new instances are patched within the required timeframe. Automated patch scanning per instance is reactive and may not enforce the golden image. Using a configuration management tool to apply patches after VM creation can work but may cause a delay; updating the golden image is proactive and ensures consistency. A patch management server is good but not as comprehensive as updating the baseline.

Answer

Use a configuration management tool like Ansible to apply patches on boot.

Answer

Schedule a nightly job to scan each VM for missing patches and apply them.

Answer

Install a patch management server and configure VMs to update from it on startup.

Question 14

A company is deploying a stateful application that requires persistent storage. They are using Kubernetes. Which resource should they create to ensure data persists across pod restarts?

Accepted Answer

PersistentVolumeClaim. A PersistentVolumeClaim (PVC) is the correct resource because it abstracts the underlying storage details and allows a pod to request persistent storage that survives pod restarts. When a pod is recreated, the PVC ensures the same volume is reattached, preserving application state. This is essential for stateful applications in Kubernetes, as pods are ephemeral by default.

Answer

Deployment

Answer

Secret

Answer

ConfigMap

Question 15

Which TWO of the following are valid considerations when deploying a virtual machine in a cloud environment? (Choose two.)

Accepted Answer

The instance size and family. The instance size and family directly determine the virtual machine's compute capacity, including vCPUs, memory, and network performance. Selecting the appropriate size and family ensures the workload has sufficient resources without over-provisioning, which is a fundamental deployment consideration in cloud environments like AWS EC2 or Azure VMs.

Answer

The log retention policy

Answer

The password complexity requirements

Answer

The number of virtual CPUs assigned to the hypervisor

Question 16

A company wants to migrate its on-premises workloads to the cloud but must keep sensitive customer data on-premises due to regulatory compliance. Which cloud deployment model should they use?

Accepted Answer

Hybrid cloud. A hybrid cloud connects on-premises infrastructure to public cloud services, allowing sensitive data to remain on-premises while leveraging the public cloud for other workloads.

Answer

Public cloud

Answer

Multi-cloud

Answer

Private cloud

Question 17

An organization uses a cloud management platform (CMP) to orchestrate resources across multiple cloud providers. The CMP has a policy that automatically terminates any VM that exceeds 85% CPU utilization for more than 15 minutes. The operations team receives complaints that some VMs are being terminated while performing legitimate batch processing jobs. What should the operations team do to resolve this issue?

Accepted Answer

Add an exclusion list for known batch processing VMs.. It allows the operations team to exclude known batch processing VMs from the automatic termination policy without disabling the policy entirely or altering its thresholds. This approach maintains the policy's protective intent for other VMs while accommodating legitimate workloads that require sustained high CPU utilization. Cloud management platforms typically support exclusion lists or tags to selectively apply or bypass policies based on VM metadata or resource groups.

Answer

Create a separate VM group with a different policy that allows higher CPU for longer.

Answer

Disable the automatic termination policy.

Answer

Increase the CPU threshold to 95% and extend the duration to 30 minutes.

Question 18

A load balancer log entry shows the above for a request. What is the MOST likely cause of the 504 error?

Accepted Answer

The backend server took too long to respond to the request.. A 504 Gateway Timeout error from a load balancer indicates that the load balancer sent the request to a backend server but did not receive a timely response. The load balancer has a configured timeout value (often 30-120 seconds), and if the backend server fails to respond within that window, the load balancer terminates the connection and returns a 504. This is the most common cause of 504 errors in load-balanced environments.

Answer

The DNS resolution for the domain name has failed.

Answer

The requested resource does not exist on the backend server.

Answer

The load balancer's health check is misconfigured.

Question 19

A company is deploying a containerized microservices application on a cloud platform. The operations team needs to manage secrets, such as database credentials and API keys, securely without embedding them in container images. Which solution should they use?

Accepted Answer

Use a cloud-native secrets management service to inject secrets at runtime. The correct solution is option B because cloud-native secrets management services like AWS Secrets Manager or Azure Key Vault provide secure storage, automatic rotation, and runtime injection of secrets without embedding them in images. Option A is insecure because including secrets in the container image at build time, even if encrypted, still embeds them in the image and complicates rotation. Option C, encrypting secrets and storing them in a cloud storage bucket, introduces key management challenges and does not provide built-in rotation or fine-grained access control. Option D, storing secrets as environment variables in the orchestration platform, may expose them in logs or configuration dumps and lacks the security features of a dedicated secrets manager.

Answer

Include secrets in the container image at build time and encrypt the image

Answer

Encrypt secrets and store them in a cloud storage bucket

Answer

Store secrets as environment variables in the container orchestration platform

Question 20

A containerized application deployment fails with an 'ImagePullBackOff' error. What should the administrator verify?

Accepted Answer

The container registry credentials and image tag. The 'ImagePullBackOff' error indicates that the container runtime is unable to pull the specified image from the registry. This is commonly caused by an incorrect image tag (e.g., typo or non-existent tag) or invalid registry credentials. Therefore, the administrator should verify the container registry credentials and image tag (Option D). Option A is incorrect because CPU utilization does not cause image pull failures. Option B is incorrect: while DNS misconfiguration can cause name resolution errors, it typically results in a 'ErrImagePull' or 'ImagePullBackOff' with a different underlying cause, but the most common and direct issue is with the image specification itself or authentication. Option C is incorrect because firewall rules would cause timeouts or connection refused errors, not the specific 'ImagePullBackOff' which indicates the image pull was attempted but failed due to credentials or image name.

Answer

The CPU utilization on the node

Answer

The cluster's DNS configuration

Answer

The firewall rules between nodes and registry