CV0-004 Practice Exam 60 — 20 Questions

Question 1

A company needs to deploy a web application quickly and reliably. Which approach is best?

Accepted Answer

Use a CI/CD pipeline with automated deployment. A CI/CD pipeline with automated deployment is the best approach because it integrates code changes, runs tests, and deploys to production in a repeatable, auditable manner. This ensures speed, consistency, and rollback capability, which are critical for reliable web application deployment in a cloud or on-premises environment.

Answer

FTP the application to each server individually

Answer

Perform a blue-green deployment manually

Answer

Manually copy the application files to the server

Question 2

Sequence the steps to troubleshoot a cloud-based application that is not accessible from the internet.

Accepted Answer

Check security groups, then verify VM state, then test connectivity, then examine application logs. Start with basic checks: security groups, VM state, connectivity, then move to higher-level components and logs.

Answer

Examine application logs, then test connectivity, then check security groups, then verify VM state

Answer

Test connectivity, then check security groups, then verify VM state, then examine application logs

Answer

Verify VM state, then examine application logs, then check security groups, then test connectivity

Question 3

A cloud engineer runs the commands shown in the exhibit. Based on the output, which security issue is present?

Accepted Answer

The firewall rule allows SSH access from any source IP.. The firewall rule 'allow-ssh' allows SSH (tcp:22) from all source IP addresses (0.0.0.0/0), which is a security risk. Option A is incorrect because the bastion host is not shown to be unused for SSH access; the issue is the firewall rule, not the use of the bastion host. Option B is incorrect because the output shows the web servers are running (status RUNNING). Option D is incorrect because the concern is not the number of rules but that the single rule allows SSH from any IP.

Answer

The bastion host is not used for SSH access.

Answer

The web servers are not running.

Answer

There are too many firewall rules allowing SSH.

Question 4

A company experienced a security breach where an attacker gained access to an S3 bucket containing sensitive data. The investigation reveals that the bucket policy allowed public access. Which THREE measures should be implemented to prevent future occurrences?

Accepted Answer

Implement bucket policies that require requests to include specific IP address conditions.. Implementing bucket policies that require requests to include specific IP address conditions restricts access to the S3 bucket to only those requests originating from trusted IP ranges. This is a form of network-level access control that, when combined with other measures, helps prevent unauthorized public access by ensuring that even if the bucket policy is misconfigured, only traffic from approved networks can reach the bucket.

Answer

Enable default encryption for all S3 buckets.

Answer

Enable multi-factor authentication (MFA) for all IAM users.

Question 5

A financial services company is subject to strict compliance requirements. They need to ensure that all cloud storage objects are written to a write-once-read-many (WORM) state for a defined retention period. Which feature should be enabled?

Accepted Answer

Object lock. Object Lock is the correct feature for WORM compliance because it enforces a write-once-read-many (WORM) state on objects, preventing modification or deletion until the specified retention period expires. Lifecycle policies manage data transitions and deletions but do not provide immutability guarantees required for strict compliance.

Answer

Versioning

Answer

Replication

Answer

Lifecycle policies

Question 6

Which TWO of the following are best practices for managing cloud storage in a multi-account environment? (Choose two.)

Accepted Answer

Implement bucket policies to restrict cross-account access.. Options A and C are correct. Implementing bucket policies to restrict cross-account access (A) ensures that storage resources are isolated and secure in a multi-account environment. Enabling logging and monitoring of all storage operations (C) provides audit trails and helps detect unauthorized access. Option B is incorrect because using separate encryption keys per account is a good security practice but not a top requirement specifically for storage management; access control and monitoring are more critical. Option D is wrong because a single storage bucket for all accounts compromises isolation and increases risk. Option E is incorrect because full public access is insecure and violates the principle of least privilege.

Answer

Use separate encryption keys for each account.

Answer

Use a single storage bucket/container for all accounts to simplify management.

Answer

Allow full public access to ensure availability.

Question 7

Which THREE of the following are common causes of application performance degradation in a cloud environment? (Choose three.)

Accepted Answer

Network latency and bandwidth limitations. Options B, C, and D are correct. Network latency and bandwidth limitations (B) slow data transfer, directly degrading performance. Poorly optimized application code (C) causes inefficiencies like excessive resource consumption or blocking operations. Resource exhaustion (D) — including CPU, memory, or disk I/O — throttles application throughput. Option A is incorrect because insufficient security groups affect traffic rules but not performance; they may block or allow traffic but don't degrade speed. Option E is incorrect because overprovisioned storage means excess capacity, which does not degrade performance; underprovisioned storage would cause issues.

Answer

Insufficient number of security groups

Answer

Overprovisioned storage

Question 8

A cloud administrator notices that a virtual machine (VM) hosting a web application is consistently running at 95% CPU utilization during business hours. End users complain that the application is slow. The application is stateless and can scale horizontally. The VM is part of an auto-scaling group configured with a target tracking scaling policy based on average CPU utilization. The administrator checks CloudWatch metrics and sees that the CPU utilization has been above the target of 70% for the last two hours, but no new instances have been launched. What should the administrator do FIRST to resolve the issue?

Accepted Answer

Verify that the CloudWatch agent is sending CPU metrics and that the metric names match the scaling policy configuration.. The auto-scaling policy is configured to scale based on average CPU utilization, but it has not triggered despite sustained high CPU. Since the application is stateless and can scale horizontally, the issue is likely that the scaling policy is not receiving the correct metrics. The first step should be to verify that the CloudWatch agent is properly sending CPU metrics and that the metric names and dimensions match the scaling policy configuration. Without accurate metrics, auto-scaling cannot make scaling decisions. Option A is correct because it addresses the root cause—missing or mismatched metrics. Options B, C, and D are premature actions that do not diagnose the underlying issue; manually scaling, changing thresholds, or resizing the instance may temporarily help but do not fix the core problem.

Answer

Manually increase the desired capacity of the auto-scaling group.

Answer

Reduce the target tracking value to 50% so scaling happens sooner.

Answer

Replace the instance with a larger instance type that has more vCPUs.

Question 9

Which THREE are common causes of network latency in a cloud environment? (Choose three.)

Accepted Answer

Firewall rule misconfiguration. Firewall rule misconfiguration (A) is a common cause of network latency in a cloud environment because overly restrictive or incorrectly ordered rules can force traffic to be inspected multiple times or dropped and retransmitted. For example, a misconfigured stateful firewall may require packets to traverse multiple security groups or network ACLs, adding processing delay per packet. This is especially impactful in virtualized environments where firewall processing is offloaded to the hypervisor or a virtual appliance, introducing micro-latency.

Answer

DNS resolution delays

Answer

High bandwidth utilization

Question 10

A cloud administrator is troubleshooting a performance issue where a virtual machine running a database is experiencing high latency. The hypervisor shows the VM has been allocated 4 vCPUs and 16 GB of RAM, but the host server has 32 GB of RAM and 16 cores. Which of the following is most likely the cause of the latency?

Accepted Answer

The VM's storage is on a network share.. The VM has 4 vCPUs on a host with 16 physical cores, so CPU over-provisioning is not the issue. However, the database workload is sensitive to storage latency. If the VM's virtual disks reside on a network share (e.g., NFS, SMB), I/O operations must traverse the network, introducing higher latency compared to local storage. This is a common cause of performance degradation in database VMs, as they require low-latency disk access. The RAM allocation (16 GB out of 32 GB host) is adequate, and paravirtualized drivers typically improve performance.

Answer

The VM is over-provisioned on vCPUs relative to physical cores.

Answer

The VM has too little RAM.

Answer

The VM is using paravirtualized drivers.

Question 11

A cloud engineer is configuring an auto-scaling group with a lifecycle hook to run a custom script when instances are launched. The script installs software and registers the instance with a load balancer. The engineer wants to ensure the instance does not receive traffic until the script completes successfully. What should the engineer do?

Accepted Answer

Use a lifecycle hook with a 'pending:wait' state and then send a 'complete-lifecycle-action' signal after the script succeeds.. Lifecycle hooks pause the instance launch process until you complete an action and notify the auto-scaling group to continue. By setting the hook to 'pending:wait', the instance remains in a pending state and does not become healthy until you send a 'complete-lifecycle-action' signal.

Answer

Set the lifecycle hook to 'terminating:wait' to delay termination.

Answer

Configure the load balancer health check to fail until the script runs.

Answer

Configure the launch configuration with a user-data script that runs after the instance is in service.

Question 12

Which of the following is the cloud provider's responsibility under the shared responsibility model?

Accepted Answer

Securing the physical data center. The cloud provider is responsible for physical infrastructure, hypervisor, and global network. Customer manages OS, apps, IAM, data, and network security groups.

Answer

Encrypting data stored in cloud resources

Answer

Configuring identity and access management policies

Answer

Patching guest operating systems

Question 13

Refer to the exhibit. A cloud administrator sees this log after a nightly backup job. Which of the following is the most likely cause of the timeout?

Accepted Answer

The volume has a high I/O load during the snapshot.. The log indicates a timeout during a nightly backup job that involves creating a snapshot. A high I/O load on the volume during the snapshot process can cause the snapshot to take longer than the configured timeout threshold, as the snapshot must capture a consistent point-in-time state while the volume is actively being written to. This is a common issue in cloud environments where the snapshot process competes for disk resources, leading to delays that exceed the timeout limit.

Answer

The volume is attached to an instance that is powered off.

Answer

The snapshot target region is unreachable.

Answer

The backup agent is not installed.

Question 14

A DevOps team is implementing an automated deployment pipeline for a cloud application. Which THREE steps are essential components of a continuous delivery pipeline? (Select THREE.)

Accepted Answer

Deploying to a staging environment for integration tests. Deploying to a staging environment for integration tests is a core step in a continuous delivery pipeline. It validates that the application works correctly in an environment that mirrors production before any release decision is made, ensuring that integration and end-to-end tests can run safely without impacting live users.

Answer

Deploying to production automatically without approval

Answer

Monitoring and rollback capability

Question 15

A cloud engineer is troubleshooting an issue where users cannot connect to a web application hosted on a cloud VM. The VM's security group allows HTTP (port 80) from 0.0.0.0/0, and the VM's OS firewall is disabled. The engineer can ping the VM's public IP from the internet. What is the most likely cause of the issue?

Accepted Answer

Web server service is not running on the VM. Since the OS firewall is disabled and the security group allows HTTP from 0.0.0.0/0, the only remaining layer that could block connectivity is the application itself. If the web server service (e.g., Apache, Nginx, IIS) is not running on the VM, it will not listen on TCP port 80, so HTTP requests will be refused even though network-level access is permitted. The ability to ping the VM confirms IP-level reachability, isolating the issue to the application layer.

Answer

OS firewall is blocking port 80

Answer

Incorrect routing table on the VM

Answer

Security group rule is applied to the wrong subnet

Question 16

A cloud administrator is deploying a critical application that requires the lowest possible latency between compute instances. The instances will be running in a private subnet and must communicate with each other using their private IP addresses. Which of the following deployment configurations would best meet these requirements?

Accepted Answer

Deploy instances in a placement group within the same Availability Zone.. Deploying instances in a placement group within the same Availability Zone ensures they are physically close together, often in the same rack or cluster, which minimizes network hops and achieves the lowest possible latency. This configuration is ideal for latency-sensitive applications because it leverages non-blocking, high-bandwidth inter-instance communication without traversing additional network infrastructure.

Answer

Deploy instances in different Availability Zones within the same region.

Answer

Deploy instances in the same subnet behind a NAT gateway.

Answer

Deploy instances in different regions and use inter-region peering.

Question 17

A security administrator needs to enforce least privilege for a Kubernetes cluster in a cloud environment. Which approach should be used to restrict permissions for pods that need to access the cloud provider's API?

Accepted Answer

Use a service account with a role that has only the required permissions. Using a service account with a role that has minimal permissions and attaching it to the pod ensures least privilege for pod-to-cloud API access.

Answer

Assign the pod a static cloud IAM user credential

Answer

Disable cloud API access for all pods

Answer

Grant the pod cluster-admin privileges in Kubernetes

Question 18

A company is deploying a multi-tier application in a cloud environment. The application must comply with PCI DSS, which requires encryption of data at rest and in transit. The database tier must be isolated from direct internet access, while the web tier must be accessible from the internet. Which of the following deployment architectures best meets these requirements?

Accepted Answer

Deploy web tier in a public subnet, database tier in a private subnet, and use SSL/TLS for encryption.. It separates the web tier into a public subnet for internet accessibility and the database tier into a private subnet for isolation, meeting PCI DSS requirements. SSL/TLS encryption ensures data in transit is protected, and encryption at rest can be applied to the database storage. This architecture aligns with cloud best practices for multi-tier applications requiring compliance.

Answer

Place all tiers in the same subnet and use security groups to restrict traffic.

Answer

Use a single instance for web and database, and place it behind a load balancer.

Answer

Use a VPN connection from the web tier to the database tier and disable encryption.

Question 19

An organization maintains a private cloud using OpenStack and also uses AWS for additional capacity. They have a critical application that must remain available even if one cloud provider goes offline. The application is deployed in both environments with active load balancing. Which cloud deployment model best describes this architecture?

Accepted Answer

Hybrid cloud. The architecture uses both a private cloud (OpenStack) and a public cloud (AWS) with active load balancing to ensure availability even if one provider fails. This is the defining characteristic of a hybrid cloud, which integrates private and public cloud resources while maintaining orchestration between them.

Answer

Multi-cloud

Answer

Public cloud

Answer

Private cloud

Question 20

A cloud engineer is deploying a Lambda function that processes events from an SQS queue. The function must be able to handle a burst of up to 1000 concurrent invocations. Which configuration should the engineer set to ensure the function can scale to meet this demand?

Accepted Answer

Set the function's reserved concurrency to 1000. Lambda scales by increasing concurrency. The reserved concurrency sets a limit; burst concurrency is a regional limit. To handle 1000 concurrent, set reserved concurrency to at least 1000. Unreserved account concurrency is shared.

Answer

Enable provisioned concurrency for the function

Answer

Configure SQS to batch messages in groups of 100

Answer

Set the function's unreserved account concurrency to 1000