CV0-004 Practice Test 6 — 10 Questions

Question 1

A company uses a cloud-based backup solution for its virtual machines. The backup policy specifies daily backups with a retention of 30 days. The backup administrator notices that backups are failing with an error indicating insufficient storage space in the backup repository. Which of the following is the most likely reason for this issue?

Accepted Answer

The retention period is too long for the available storage.. The error indicates insufficient storage space in the backup repository. With a daily backup policy and a 30-day retention period, the repository must accommodate at least 30 full backups (or the equivalent incremental/differential chain). If the repository's capacity is less than the total size of 30 backups, the retention period exceeds the available storage, causing failures. This is the most direct cause of the error.

Answer

The backup frequency is too low.

Answer

Compression is not enabled on the backup.

Answer

The backup window is too short.

Question 2

An organization wants to ensure that only authorized personnel can access the cloud management console. Which of the following is the BEST method to achieve this?

Accepted Answer

Enable multi-factor authentication (MFA) for all console users.. Multi-factor authentication (MFA) is the best method because it adds an additional layer of security beyond just a password, requiring a second factor (e.g., a time-based one-time password from an authenticator app or a hardware token). This significantly reduces the risk of unauthorized access even if credentials are compromised, as the attacker would also need the second factor. In cloud environments like AWS, Azure, or GCP, MFA is a fundamental security best practice for protecting the management console.

Answer

Implement strong password policies with complex passwords.

Answer

Disable the web console and require API access only.

Answer

Restrict console access to a specific IP address range.

Question 3

A cloud administrator is tasked with ensuring that only encrypted connections are used to transfer files to a cloud storage bucket. Which of the following should the administrator enforce?

Accepted Answer

Require HTTPS for all uploads.. HTTPS (HTTP over TLS) encrypts data in transit using TLS, ensuring that files uploaded to a cloud storage bucket are protected from eavesdropping and tampering. By requiring HTTPS for all uploads, the administrator enforces encrypted connections as mandated by the security policy, which is a standard practice for cloud storage services like AWS S3 or Azure Blob Storage.

Answer

Use HTTP with a custom header.

Answer

Allow FTP but restrict to specific IPs.

Answer

Enable SFTP access to the bucket.

Question 4

A company is migrating a legacy application to a public cloud. The application requires a static IP address for licensing. The security team insists on encrypting all traffic between the application and the database. Which of the following should the cloud architect implement?

Accepted Answer

Create a VPN connection between the application and database subnets.. Option A is correct because creating a VPN connection between the application and database subnets establishes an encrypted tunnel (using IPsec or TLS-based VPN protocols) that ensures all traffic between the two subnets is encrypted, meeting the security team's requirement. Additionally, the application's need for a static IP address can be satisfied by assigning a static private IP to the application instance within its subnet, while the VPN provides secure communication without exposing traffic to the public internet.

Answer

Assign an elastic IP and use NAT.

Answer

Use TLS certificates on the web server.

Answer

Deploy a site-to-site VPN from the cloud to the on-premises data center.

Question 5

A cloud administrator is troubleshooting an issue where a user in the finance department cannot access a critical application hosted on a private cloud. The user can access other applications in the same subnet. The security team recently implemented a new network security policy. Which of the following is MOST likely causing the issue?

Accepted Answer

A host-based firewall rule is blocking the specific application port on the user's VM.. Option D is correct because the user can access other applications in the same subnet, indicating network connectivity is intact, but a specific application is blocked. A host-based firewall rule on the user's VM (e.g., Windows Firewall or iptables) can filter traffic by port or protocol, and a newly implemented security policy likely added a rule blocking the port used by the critical application. This explains why only that application is inaccessible while others work.

Answer

The user's VM is isolated from the subnet due to a misconfigured VLAN.

Answer

The user's account has been disabled due to a failed login attempt.

Answer

The hypervisor is denying access to the application due to a resource quota violation.

Question 6

A cloud administrator is configuring a web application hosted on a public cloud VM. The application must be accessible over HTTPS, and the administrator needs to ensure that all traffic between the client and the server is encrypted. The cloud provider offers a managed certificate service. Which of the following is the BEST practice for securing the application?

Accepted Answer

Use the cloud provider's managed certificate service to provision and attach the certificate to the load balancer.. The cloud provider's managed certificate service automatically handles certificate provisioning, renewal, and attachment to the load balancer, ensuring HTTPS traffic is encrypted with a trusted certificate from a public CA. This is the best practice because it offloads TLS termination to the load balancer, reducing the VM's CPU overhead and centralizing certificate management. It also ensures the certificate is automatically renewed before expiry, preventing service disruptions.

Answer

Generate a self-signed certificate and configure the web server to use it.

Answer

Disable HTTPS and rely on network-level encryption provided by the cloud provider.

Answer

Create a certificate signing request (CSR) and submit it to a public CA, then install the certificate and private key on the VM.

Question 7

A cloud administrator is troubleshooting connectivity to a web server running on a Linux VM. The web server is configured to listen on ports 80 (HTTP) and 443 (HTTPS). The administrator runs the iptables command shown in the exhibit. Based on the output, what is the MOST likely reason that external users cannot access the web server on port 443?

Accepted Answer

The iptables rule for port 443 only allows traffic from the 10.0.0.0/8 subnet, which does not include external IP addresses.. Option D is correct because the iptables rule for port 443 specifies a source IP range of 10.0.0.0/8, which is a private RFC 1918 address space. External users have public IP addresses that do not fall within this subnet, so their HTTPS traffic is implicitly dropped by the rule's match condition. The default policy being ACCEPT does not override the explicit rule that only permits traffic from the 10.0.0.0/8 subnet.

Answer

The web server is not configured to listen on port 443, so iptables rules are irrelevant.

Answer

The iptables default policy is ACCEPT, but the rule for port 443 explicitly drops traffic from external sources.

Answer

The rule for port 80 is placed before the rule for port 443, causing all HTTPS traffic to be evaluated as HTTP and dropped.

Question 8

A cloud administrator is configuring a Linux VM as a router. The iptables rules are shown. The administrator can SSH into the VM from the network but cannot forward traffic between interfaces. What is the most likely cause?

Accepted Answer

The FORWARD chain's default policy is DROP and no rules allow forwarding. The FORWARD chain in iptables controls traffic that passes through the VM (i.e., traffic not destined for the VM itself). If its default policy is DROP and no explicit ACCEPT rules exist for forwarding, the kernel will drop all forwarded packets, preventing the VM from acting as a router. SSH access works because it uses the INPUT chain, which is separate from FORWARD.

Answer

The INPUT chain has a rule dropping invalid packets

Answer

The INPUT chain is missing a rule to allow forwarded traffic

Answer

The NAT table is misconfigured

Question 9

A cloud administrator receives an alert that a VM's disk usage is at 95%. The VM is running a critical database. Which TWO actions should the administrator take to resolve the issue while minimizing downtime?

Accepted Answer

Increase the size of the existing disk. Increasing the size of the existing disk (Option A) is correct because it allows the VM to gain additional storage capacity without requiring a reboot or migration, minimizing downtime. Modern hypervisors and cloud platforms support live resizing of virtual disks, and once the disk is expanded, the OS can extend the partition online using tools like `resize2fs` (Linux) or Disk Management (Windows). This directly addresses the 95% disk usage alert for the critical database with minimal service interruption.

Answer

Shrink an existing partition to free space

Answer

Restore the VM from a recent backup to a larger disk

Answer

Add a new disk and move data to it

Question 10

A company uses a hybrid cloud model with an AWS Direct Connect connection to its on-premises network. Users report intermittent connectivity to cloud resources. A network engineer finds packet loss on the Direct Connect virtual interface. Which of the following should be checked FIRST to resolve the issue?

Accepted Answer

The BGP session status between the on-premises router and the AWS Direct Connect endpoint. Intermittent packet loss on a Direct Connect virtual interface is most commonly caused by BGP session flapping or misconfiguration, as BGP is the routing protocol that establishes and maintains connectivity between the on-premises router and the AWS Direct Connect endpoint. Checking the BGP session status first allows the engineer to quickly identify if the issue is due to route advertisement problems, hold timer mismatches, or session resets, which are frequent root causes of intermittent packet loss.

Answer

The physical port status of the Direct Connect router

Answer

The MTU setting on the on-premises firewall

Answer

The VPN tunnel status for the Direct Connect link