CV0-004 Practice Exam 61 — 20 Questions

Question 1

A cloud administrator is troubleshooting a performance issue where a web application experiences intermittent slowdowns. The application is deployed on a public cloud IaaS with auto-scaling. What should the administrator check first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify load balancer configuration. A misconfigured load balancer can cause uneven traffic distribution, leading to intermittent slowdowns. Option B is wrong because CPU utilization spikes might be a symptom, not the root cause, and auto-scaling should handle it. Option C is wrong because database queries are a deeper layer to investigate after network and application tiers. Option D is wrong because network latency is less likely to be intermittent.

Answer

Check CPU utilization of all instances

Answer

Analyze database query performance

Answer

Review network latency between tiers

Question 2

A company has a hybrid cloud environment with an on-premises data center and Microsoft Azure. The on-premises infrastructure includes a VPN gateway connected to an Azure virtual network via site-to-site VPN. The network team reports that traffic from on-premises to Azure is experiencing high latency and packet loss. The VPN tunnel status shows as connected. The team has verified that the on-premises firewall is not dropping packets. The Azure administrator checks the virtual network gateway metrics and sees high inbound packet drops and a high number of VPN tunnel rekeys. What is the MOST likely cause of the issue?

Accepted Answer

The VPN gateway SKU is too small for the traffic volume.. The high inbound packet drops and frequent VPN tunnel rekeys indicate that the VPN gateway is overwhelmed by traffic. A VPN gateway SKU that is too small for the traffic volume cannot handle the throughput, leading to packet drops and forcing the tunnel to rekey more often as it struggles to maintain the connection. This explains the high latency and packet loss despite the tunnel showing as connected. Option A (incorrect encryption algorithms) would prevent tunnel establishment or cause constant renegotiation, not just increased rekeys and drops. Option B (overlapping address space) would cause routing conflicts, not specifically packet drops and rekeys. Option C (misconfigured local network gateway address space) would result in connectivity failure or traffic not being routed correctly, not packet drops and rekeys within a functioning tunnel.

Answer

The on-premises VPN device does not support the same encryption algorithms.

Answer

The Azure virtual network has overlapping address space with on-premises.

Answer

There is a misconfiguration in the local network gateway address space.

Question 3

A cloud administrator for a large e-commerce company receives an alert that the response time of the production web application has increased by 300% in the last hour. The application is deployed on a Kubernetes cluster with three worker nodes, each running multiple pods. The administrator checks the Kubernetes dashboard and notices that one of the worker nodes has a CPU utilization of 95%, while the other two nodes are at 40%. The pods on the overloaded node are experiencing resource throttling. The application uses a deployment with a replica count of 6, and all pods are currently running. The administrator needs to resolve the performance issue quickly and prevent future occurrences. Which of the following actions should the administrator take FIRST?

Accepted Answer

Cordon and drain the overloaded node to redistribute its pods to other nodes.. C is correct because the immediate symptom is an overloaded node (95% CPU) causing resource throttling on its pods. Cordon and drain the node to safely evict its pods, allowing the Kubernetes scheduler to redistribute them to the underutilized nodes (40% CPU), which quickly resolves the performance bottleneck without adding unnecessary resources or changing the deployment configuration.

Answer

Increase the replica count from 6 to 12 to distribute load across more pods.

Answer

Add a new worker node to the cluster to increase overall capacity.

Answer

Modify the deployment to set resource requests and limits for CPU on all pods.

Question 4

A company is migrating its on-premises database to a cloud-based managed database service. The database is currently 500 GB and is expected to grow by 10% monthly. Which TWO factors should the company consider when selecting the storage type?

Accepted Answer

Encryption at rest requirements.. Encryption at rest is a critical consideration when selecting storage for a cloud-based managed database service, as it ensures data is encrypted when stored on disk. Many cloud providers offer transparent data encryption (TDE) or server-side encryption with customer-managed keys (CMKs), and the storage type must support these features to meet compliance requirements.

Answer

Backup frequency and retention.

Answer

Physical location of the data center.

Answer

Operating system compatibility with the storage.

Question 5

A cloud architect is designing a disaster recovery plan for a cloud-based application. The primary site is in a cloud region, and the recovery site is in a different geographic region. The application uses a relational database with synchronous replication. The recovery time objective (RTO) is 1 hour, and the recovery point objective (RPO) is 15 minutes. Which replication strategy BEST meets these objectives?

Accepted Answer

Configure synchronous database replication with automated failover. Synchronous database replication with automated failover ensures that every write transaction is committed to both the primary and recovery site databases before acknowledging success, guaranteeing zero data loss (RPO=0) and near-instantaneous failover within seconds to minutes, which comfortably meets the RTO of 1 hour and RPO of 15 minutes. This strategy directly satisfies the strict RPO requirement by maintaining a fully synchronized, hot standby replica that can be promoted immediately upon failure.

Answer

Perform daily backups of the database and restore at the recovery site

Answer

Use storage-level asynchronous replication between regions

Answer

Use a script to copy database logs every hour to the recovery site

Question 6

A company wants to deploy a containerized application to a Kubernetes cluster using a rolling update strategy. They have defined a Kubernetes Deployment manifest. Which field controls the number of pods that can be unavailable during the update?

Accepted Answer

spec.strategy.rollingUpdate.maxUnavailable. The `spec.strategy.rollingUpdate.maxUnavailable` field in a Kubernetes Deployment manifest explicitly controls the maximum number of Pods that can be unavailable during a rolling update. This field can be set as an absolute number or a percentage of the desired Pod count, ensuring that the update proceeds without dropping below a specified availability threshold.

Answer

spec.strategy.rollingUpdate.maxSurge

Answer

spec.template.spec.containers[].readinessProbe

Answer

spec.replicas

Question 7

A cloud administrator is deploying a virtual machine (VM) in a public cloud and must ensure that the VM can be recovered quickly in case of failure. The administrator configures the VM to use a managed disk. What additional deployment step should be taken to meet the recovery objective with minimal cost?

Accepted Answer

Configure automated snapshots of the managed disk on a schedule.. Configuring automated snapshots of the managed disk provides a cost-effective, incremental backup mechanism that enables rapid recovery of the VM in case of failure. Snapshots capture point-in-time copies of the disk and can be used to create a new managed disk or restore the VM quickly, meeting the recovery objective without the expense of maintaining a separate, always-on replica.

Answer

Set the VM's boot diagnostics to store logs in a storage account.

Answer

Deploy a second VM in a different region as a pilot light.

Answer

Attach the VM to multiple managed disks in an availability set.

Question 8

A company is designing a multi-cloud disaster recovery solution. They need to ensure RPO of 15 minutes and RTO of 1 hour for critical workloads. Which of the following should be implemented?

Accepted Answer

Synchronous replication to a standby environment in another cloud provider. Synchronous replication ensures that data is written to both the primary and standby environments simultaneously, guaranteeing zero data loss and meeting the 15-minute RPO. With a pre-configured standby environment in another cloud provider, failover can occur within minutes, satisfying the 1-hour RTO. This approach provides the lowest possible RPO and RTO for critical workloads.

Answer

Asynchronous replication to a secondary cloud with a 30-minute delay

Answer

Pilot light environment that is started manually during a disaster

Answer

Daily backups to object storage in a different region

Question 9

A cloud architect is designing a multi-tier application in a public cloud that must comply with PCI DSS. The web tier must be accessible from the internet, but the application tier should not have any public IP addresses. Which architecture meets these requirements?

Accepted Answer

Place the web tier in a public subnet behind an internet-facing load balancer, and the app tier in a private subnet with a NAT gateway for outbound traffic.. It places the web tier in a public subnet with an internet-facing load balancer, allowing internet access, and the app tier in a private subnet with no public IP, meeting the requirement. The NAT gateway enables outbound traffic for the app tier (e.g., for updates) without exposing it inbound. Option A is wrong because it assigns public IPs to both tiers, which violates the requirement that the app tier should not have public IPs. Option B is wrong because deploying both in private subnets would prevent internet access to the web tier, and VPC peering to a data center does not address internet access. Option C is wrong because a site-to-site VPN would route all traffic through on-premises, which is unnecessary and doesn't provide direct internet access to the web tier as required.

Answer

Assign public IP addresses to both tiers and use security group rules to restrict traffic.

Answer

Deploy both tiers in private subnets and use a VPC peering connection to the corporate data center.

Answer

Use a site-to-site VPN between the cloud VPC and an on-premises network for all traffic.

Question 10

A company uses an automated patching solution that reboots instances after applying patches. After a recent patching cycle, several web servers failed to rejoin the load balancer pool. The administrator checks the application logs and finds that the web service failed to start because a required dependency was removed during patching. Which of the following should the administrator implement to prevent this issue in the future?

Accepted Answer

Configure a pre-patch health check and verify critical dependencies.. Implementing a pre-patch health check that verifies critical dependencies ensures that the patching process does not remove or break required components. This proactive validation can detect missing dependencies before the reboot, allowing the administrator to remediate or halt the patching cycle, preventing the web service from failing to start.

Answer

Require manual approval before each patching operation.

Answer

Increase the patching frequency to reduce the number of patches per cycle.

Answer

Implement a rolling update strategy for the web servers.

Question 11

A cloud security team is implementing encryption for data at rest using customer-managed keys in a cloud KMS. Which THREE practices should be followed?

Accepted Answer

Use IAM policies to restrict who can use and manage the keys.. IAM policies are essential for enforcing the principle of least privilege in cloud KMS. By restricting who can use (encrypt/decrypt) and manage (rotate/disable/destroy) customer-managed keys, the security team ensures that only authorized principals can access the key material. This prevents unauthorized users or services from compromising data at rest, which is a core requirement for compliance frameworks like PCI DSS or HIPAA.

Answer

Store the key material in plaintext in the application code.

Answer

Use a default cloud provider key to simplify management.

Question 12

A company uses a cloud provider's IAM service to manage access. An administrator creates a new IAM role for an application running on an EC2 instance to access an S3 bucket. The application is unable to read objects from the bucket, even though the role has an attached policy that allows s3:GetObject on the bucket. The administrator verifies that the instance is correctly associated with the role. What is the most likely cause?

Accepted Answer

The role's permissions policy has a condition key that restricts access to a specific IP range.. The role's permissions policy is an IAM policy attached to the role that defines what actions the role can perform. If this policy includes a condition key such as `ipAddress` or `SourceIp`, it can restrict access to requests coming from specific IP addresses. If the EC2 instance's public IP address is not within the allowed range, the `s3:GetObject` call will be denied, even though the permission is granted. Option A is incorrect because the stem does not mention any bucket policy, and the question asks for the most likely cause; a bucket policy denying access would be less common than a condition on the role's policy. Option B is incorrect because if the trust policy did not allow EC2 to assume the role, the instance would not receive temporary credentials at all, and the administrator would likely see errors during association. Option D is incorrect because security groups by default allow all outbound traffic, and S3 access uses HTTPS over the internet or VPC endpoints, so outbound blocking is unlikely unless explicitly configured.

Answer

The S3 bucket policy denies access to the role.

Answer

The role's trust policy does not allow the EC2 service to assume the role.

Answer

The instance's security group is blocking outbound traffic to S3.

Question 13

A company wants to reduce its cloud storage costs for infrequently accessed data that must be retained for 7 years. Which two storage lifecycle policies should they implement? (Select TWO.)

Accepted Answer

Transition data to a lower-cost infrequent access tier after 30 days. Transitioning data to a lower-cost infrequent access tier after 30 days aligns with the requirement to reduce costs for infrequently accessed data. This lifecycle policy moves objects from a standard tier to a cheaper tier (e.g., Amazon S3 Standard-IA or Azure Cool Blob Storage) after a specified period, reducing storage costs while maintaining low-latency retrieval. Option D is correct because archiving data to cold storage after 1 year (e.g., Amazon S3 Glacier or Azure Archive Blob Storage) further reduces costs for data that is rarely accessed but must be retained for 7 years, as cold storage offers the lowest storage cost at the expense of longer retrieval times.

Answer

Move data from object storage to block storage after 30 days

Answer

Use reserved capacity for object storage

Answer

Delete all data older than 1 year

Question 14

A cloud engineer receives an alert that the root filesystem (/) is at 93% usage. The /data volume has plenty of free space. The application stores logs in /var/log/app/ on the root filesystem. Which of the following is the BEST long-term solution?

Accepted Answer

Move the /var/log/app directory to the /data partition and create a symlink. Moving the /var/log/app directory to the /data partition and creating a symlink is the best long-term solution because it permanently relocates the log data to a volume with ample free space without requiring application reconfiguration. The symlink (/var/log/app -> /data/app) makes the application continue to write to the same logical path, while the actual storage is on the /data filesystem. This resolves the root filesystem capacity issue without altering the application's logging behavior or risking data loss.

Answer

Increase the size of the root filesystem

Answer

Delete the /data partition and merge it with root

Answer

Configure log rotation to delete logs more frequently

Question 15

A cloud operations team uses a configuration management tool (e.g., Chef, Puppet) to manage a fleet of Linux servers in a public cloud. After a recent update, the team notices that some servers are failing to apply the new configuration. The logs on the failing servers show connection timeouts to the configuration management server. Other servers in the same subnet and security group apply configurations successfully. The configuration management server is reachable from the admin's workstation. Which of the following is the MOST likely cause of the issue?

Accepted Answer

The failing servers have a misconfigured DNS resolver.. A misconfigured DNS resolver on the failing servers can cause hostname resolution failures, leading to connection timeouts when trying to reach the configuration management server by hostname. This explains why only some servers are affected, as DNS configuration can vary per server. Option A is wrong because if the agent were missing, logs would show errors like 'agent not found' or 'service not installed', not connection timeouts. Option B is wrong because an expired certificate would typically cause SSL/TLS errors, not generic connection timeouts, and would likely affect all servers. Option C is wrong because all servers share the same security group, so outbound firewall rules are identical; the issue is not a firewall block.

Answer

The failing servers are missing the configuration management agent.

Answer

The configuration management server certificate has expired.

Answer

The failing servers have a firewall rule blocking outbound connections.

Question 16

A company is designing a disaster recovery (DR) plan for a critical application hosted in a public cloud. The application requires a recovery time objective (RTO) of 1 hour and a recovery point objective (RPO) of 15 minutes. Which of the following DR strategies BEST meets these requirements?

Accepted Answer

Warm standby with continuous data replication.. Warm standby with continuous data replication meets the RTO of 1 hour and RPO of 15 minutes because it maintains a partially scaled-down replica of the production environment that can be quickly scaled up, and continuous replication (e.g., using asynchronous replication or Change Block Tracking) ensures data loss is limited to seconds or minutes, well within the 15-minute RPO.

Answer

Backup and restore with daily backups.

Answer

Cold standby with nightly backups.

Answer

Pilot light with hourly snapshots.

Question 17

A cloud engineer is configuring encryption for data stored in an S3 bucket. The company requires that encryption keys be managed by the organization, not the cloud provider. Which encryption option should be used?

Accepted Answer

SSE-C. SSE-C (Server-Side Encryption with Customer-Provided Keys) allows the organization to manage their own encryption keys while AWS handles the encryption and decryption process. The customer provides the encryption key in each request, and AWS discards the key after the operation, ensuring the cloud provider never stores the key. This meets the requirement that keys be managed by the organization, not the cloud provider.

Answer

SSE-KMS

Answer

SSE-S3

Answer

Client-side encryption

Question 18

An organization uses Azure and wants to ensure that only authenticated users from its on-premises Active Directory can access cloud resources. The company has Azure AD Connect set up and wants to enable single sign-on (SSO) for cloud applications. Which federation standard should be used?

Accepted Answer

SAML. SAML (Security Assertion Markup Language) is the correct federation standard because it enables browser-based single sign-on (SSO) by exchanging authentication and authorization assertions between an identity provider (on-premises Active Directory via Azure AD Connect) and a service provider (cloud applications). SAML 2.0 is specifically designed for federated identity scenarios where users authenticate on-premises and gain access to cloud resources without re-entering credentials.

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect

Question 19

A cloud architect is designing a disaster recovery plan for a critical application. The application runs on virtual machines in a public cloud. The recovery time objective (RTO) is 1 hour, and the recovery point objective (RPO) is 15 minutes. Which three strategies should the architect implement? (Select THREE).

Accepted Answer

Implement active-passive failover with automated DNS.. Active-passive failover with automated DNS allows traffic to be redirected to a standby environment within minutes, meeting the 1-hour RTO. The passive site remains ready with pre-provisioned resources, and DNS propagation can be controlled via low TTL values to achieve rapid failover.

Answer

Take daily snapshots of the VMs.

Answer

Use asynchronous replication with a 10-minute lag.

Question 20

A company is designing a cloud architecture that must meet a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 1 hour for a critical database. The database is 500 GB and runs on a virtual machine. Which backup strategy should be used?

Accepted Answer

Take daily snapshots and transaction log backups every hour. Daily snapshots provide a baseline recovery point, and hourly transaction log backups ensure that the RPO of 1 hour is met by limiting data loss to at most one hour of transactions. Combined with the ability to restore from the latest snapshot and apply transaction logs, this strategy can achieve an RTO of 4 hours for a 500 GB database, assuming adequate infrastructure and restore automation.

Answer

Take full backups weekly and differential backups daily

Answer

Use continuous database replication to a standby instance

Answer

Perform block-level incremental backups every 4 hours