CV0-004 Practice Exam 62 — 20 Questions

Question 1

During a security audit, it is discovered that a cloud storage bucket contains sensitive data that should have been encrypted at rest. The bucket was created with default settings. Which step must be taken to encrypt the data that is already stored?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Copy the objects to a new bucket that has default encryption enabled, then delete the original bucket. Enabling default encryption only affects new objects. Existing objects must be re-encrypted by copying them, which applies the new encryption settings.

Answer

Encrypt the objects using client-side encryption before upload

Answer

Use a server-side encryption with customer-provided keys (SSE-C) on each existing object

Answer

Enable default encryption on the bucket; all existing objects will be automatically encrypted

Question 2

A cloud technician is troubleshooting connectivity from a VM with IP 10.0.0.1 to another VM at 10.0.1.10 in a different subnet. The ping output shows 'Destination Host Unreachable'. Which of the following is the most likely cause?

Accepted Answer

The source's default gateway does not have a route to the destination network. The 'Destination Host Unreachable' error indicates that the source VM (10.0.0.1) cannot find a path to the destination subnet (10.0.1.0/24). Since the VMs are in different subnets, the source must send traffic to its default gateway. If that gateway lacks a route to 10.0.1.0/24, it will drop the packet and send an ICMP Destination Unreachable message back, causing the observed error. This is the most likely cause because the issue is at Layer 3 routing, not Layer 2 ARP or local interface problems.

Answer

ARP resolution for the destination IP is failing

Answer

The network interface on the source VM is disabled

Answer

A firewall is blocking ICMP on the destination

Question 3

A cloud engineer is tasked with automating the deployment of a three-tier application. The engineer wants to ensure that the database tier is not directly accessible from the internet but can be reached by the application tier. Which of the following should be implemented?

Accepted Answer

Place the database tier in a private subnet and configure a security group to allow traffic only from the application tier. Placing the database tier in a private subnet ensures it has no direct route to the internet, while a security group configured to allow inbound traffic only from the application tier's security group (or CIDR) enforces least-privilege access. This design aligns with the AWS Well-Architected Framework's security pillar, using network segmentation and stateful firewall rules to isolate the database from public exposure.

Answer

Use the same subnet for all tiers and allow traffic via security groups

Answer

Place the database tier in a public subnet with a restrictive security group

Answer

Connect the database tier to a site-to-site VPN and disable public access

Question 4

A cloud engineer is configuring auto-scaling for a web application. The scaling policy should add 2 instances when CPU utilization exceeds 80% for 5 consecutive minutes and remove 1 instance when CPU drops below 50% for 10 minutes. Which type of scaling policy should they use?

Accepted Answer

Step scaling policy. Step scaling allows adding or removing a specific number of instances based on the size of the alarm breach. Target tracking adjusts to maintain a target metric value. Simple scaling is older and less flexible. Scheduled scaling is time-based.

Answer

Scheduled scaling policy

Answer

Target tracking scaling policy

Answer

Simple scaling policy

Question 5

A company is planning to migrate a legacy application to the cloud. They want to leverage cloud-native features while minimizing code changes. Which TWO migration strategies should they consider?

Accepted Answer

Replatform. Replatform (A) is correct because it involves migrating the application to a cloud-managed platform (e.g., moving from a self-managed database to Amazon RDS or Azure SQL Database) with minimal code changes, allowing the company to leverage cloud-native features like automated backups and scaling. Replace (D) is correct because it means adopting a SaaS alternative (e.g., replacing a custom CRM with Salesforce) that provides cloud-native capabilities without modifying existing code, aligning with the goal of minimizing code changes.

Answer

Rehost

Answer

Rebuild

Answer

Refactor

Question 6

A cloud architect is reviewing costs for a production environment. The environment uses a mix of EC2 instances and RDS databases. Which THREE of the following are effective cost optimization strategies?

Accepted Answer

Use reserved instances for baseline capacity. Reserved instances provide discounts for steady-state usage. Storage lifecycle policies move data to cheaper tiers over time. Rightsizing ensures resources match workload requirements, reducing waste. Using all SSD even for cold data is expensive. Running instances 24/7 when not needed increases costs unnecessarily.

Answer

Use all SSD storage for all data to maximize performance

Answer

Run all instances 24/7 to ensure availability

Question 7

A cloud administrator is troubleshooting an issue where users from the 192.0.2.0/24 network cannot access objects in an S3 bucket. The bucket policy is shown in the exhibit. What is the most likely cause of the issue?

Accepted Answer

The policy does not grant the s3:ListBucket action.. The bucket policy grants s3:GetObject but not s3:ListBucket. Without s3:ListBucket, users cannot list the objects in the bucket, so they cannot discover the object keys needed to access objects. Even if they know the exact object key, the missing ListBucket action prevents the initial listing operation, which is required for many S3 access patterns.

Answer

The condition uses an incorrect IP address format.

Answer

The policy is missing a required statement ID.

Answer

The resource ARN does not include the bucket itself.

Question 8

A cloud architect is designing a deployment pipeline for a multi-tier application. The team wants to automate testing and deployment while ensuring that only healthy code reaches production. Which TWO practices should they implement?

Accepted Answer

Blue/green deployment. Blue/green deployment (C) is correct because it allows the team to route traffic to a new 'green' environment while keeping the old 'blue' environment idle, enabling instant rollback if testing fails. Canary releases (D) are correct because they incrementally shift a small percentage of traffic to a new version, allowing automated monitoring to detect issues before full rollout. Both practices ensure only healthy code reaches production by validating changes in a controlled, reversible manner.

Answer

Infrastructure as Code

Answer

Immutable infrastructure

Answer

Manual approval gates

Question 9

A DevOps team sets up a CI/CD pipeline for a containerized application on Kubernetes. They want to test a new version with a small subset of users before full rollout. Which deployment method should they use?

Accepted Answer

Canary. A canary deployment releases the new version to a small subset of users (e.g., 5-10% of traffic) while the rest continue using the stable version. This allows the team to monitor performance, errors, and user feedback before gradually increasing the rollout. Kubernetes supports canary deployments natively through techniques like multiple Deployments with shared labels and service mesh traffic splitting (e.g., Istio or Linkerd).

Answer

Recreate

Answer

Rolling update

Answer

Blue/green

Question 10

Refer to the exhibit. A cloud administrator applies the bucket policy shown. After applying, users report that they can no longer access the prod-backup bucket using their applications. The applications use the AWS SDK with default configuration. What is the most likely reason?

Accepted Answer

The applications are using HTTP instead of HTTPS.. The bucket policy explicitly denies access unless the request uses HTTPS (aws:SecureTransport is false). The applications use the AWS SDK with default configuration, which typically does not enforce HTTPS; many SDKs default to HTTP for performance or legacy reasons. Since the policy denies HTTP requests, the applications are blocked, making C the correct answer.

Answer

The policy does not include an Allow statement.

Answer

The policy has a syntax error in the condition.

Answer

The policy's principal "*" blocks all users.

Question 11

A company runs a web application on three virtual machines behind a load balancer. During a traffic spike, one VM becomes unresponsive. The load balancer continues sending traffic to it, causing errors. Which configuration change would prevent this issue in the future?

Accepted Answer

Configure health checks on the load balancer.. Health checks allow the load balancer to periodically probe the status of each backend VM (e.g., via HTTP GET or TCP SYN). If a VM fails a configurable number of consecutive checks, the load balancer automatically marks it as unhealthy and stops routing traffic to it, preventing errors during a spike. This is the standard mechanism in AWS ELB, Azure Load Balancer, and HAProxy to detect and isolate failed instances.

Answer

Set a longer connection timeout on the load balancer.

Answer

Increase the number of VMs to five.

Answer

Change the load balancing algorithm to round-robin.

Question 12

A company is deploying a critical application on Google Kubernetes Engine (GKE) and needs to ensure high availability and automatic scaling. Which THREE features should be configured?

Accepted Answer

Multiple node pools with multiple nodes. Horizontal Pod Autoscaler (HPA) scales pods based on metrics. Node pools with multiple nodes provide redundancy. Cluster auto-scaling adds nodes as needed. StatefulSets are for stateful apps, not high availability by themselves. Regional clusters provide multi-zone HA.

Answer

Single cluster in one zone

Answer

StatefulSets for all deployments

Question 13

An organization must comply with a regulation requiring that all data stored in the cloud be encrypted at rest using a cloud provider's native encryption service. The company also needs to maintain control over the encryption keys. Which solution should the architect recommend?

Accepted Answer

Use the cloud provider's native encryption service with customer-managed keys. The regulation requires cloud-native encryption at rest with customer-controlled keys. Cloud providers offer services like AWS KMS with customer-managed keys (CMKs) or Azure Key Vault with customer-managed keys, which allow the organization to create, rotate, and disable keys independently while the provider handles the underlying encryption of data at rest using envelope encryption. This satisfies both the 'native encryption service' and 'maintain control over the encryption keys' requirements.

Answer

Encrypt the data on-premises before uploading to the cloud

Answer

Use the cloud provider's default encryption with provider-managed keys

Answer

Use a third-party hardware security module (HSM) hosted on-premises

Question 14

A cloud administrator is deploying a web application that must be highly available across two availability zones. The deployment includes an application load balancer and multiple EC2 instances. Which TWO configurations are required to meet the high availability requirement?

Accepted Answer

Launch EC2 instances in at least two availability zones. Launching EC2 instances in at least two availability zones ensures that if one AZ fails, the application continues to serve traffic from the other AZ. This is a fundamental requirement for achieving high availability across AZs, as it distributes the compute capacity across physically separate data centers.

Answer

Use a single EC2 instance with an auto-recovery policy

Answer

Set up health checks to automatically replace unhealthy instances

Answer

Enable cross-zone load balancing on the ALB

Question 15

A cloud operations team uses a configuration management tool to apply patches to hundreds of Linux servers. Recently, the automation script that applies security patches has been failing with an error: 'Package not found.' The administrator verifies that the patch repository URL is correct and that the servers have internet access. The script runs every Sunday at 2:00 AM and the failures started two weeks ago. The failed patches are all for the latest kernel update. What should the administrator check FIRST?

Accepted Answer

Verify that the package cache is being updated before the installation step.. The error 'Package not found' typically indicates that the repository metadata is outdated. On many Linux systems, the local package cache (e.g., apt or yum) needs to be updated before installing new packages. The script likely needs to run an update command before attempting to install the patch.

Answer

Ensure the patch repository is reachable via DNS.

Answer

Check if the servers have sufficient disk space for the patch download.

Answer

Roll back to an earlier version of the patch script.

Question 16

A company wants to move its on-premises web application to the cloud with minimal code changes to reduce risk. Which deployment strategy is most appropriate?

Accepted Answer

Rehost. The Rehost (lift-and-shift) strategy is most appropriate because it moves the on-premises web application to the cloud with minimal code changes, directly reducing risk. By migrating the existing virtual machines or physical servers to cloud instances (e.g., AWS EC2 or Azure VMs) without modifying the application architecture, the company preserves the current codebase and operational behavior. This approach avoids the complexity and potential errors associated with rewriting or refactoring code, making it the safest choice for a risk-averse migration.

Answer

Refactor

Answer

Replatform

Answer

Rebuild

Question 17

A cloud administrator is designing a hybrid cloud environment that connects on-premises resources to a public cloud. To ensure data protection, the administrator needs to implement controls for data in transit and data at rest. Which TWO security controls should the administrator implement? (Choose two.)

Accepted Answer

TLS 1.2. TLS 1.2 (option A) protects data in transit (e.g., HTTPS connections), and AES-256 (option B) protects data at rest (e.g., encrypted storage volumes). Together, they provide comprehensive encryption for data traveling between on-premises and cloud, and for data stored in the cloud.

Answer

MFA

Answer

IPsec

Answer

RBAC

Question 18

A company wants to migrate its existing on-premises web application to the cloud to reduce operational overhead. The application runs on a custom Linux distribution with specific kernel modules. Which cloud deployment model would best minimize the need to refactor the application while still reducing maintenance of the underlying infrastructure?

Accepted Answer

Infrastructure as a Service (IaaS). IaaS (Infrastructure as a Service) provides virtualized compute resources where you retain full control over the operating system, including custom Linux distributions and kernel modules. This allows you to migrate the application as-is without refactoring, while the cloud provider handles the underlying physical infrastructure maintenance, such as hardware failures and network cabling.

Answer

Container as a Service (CaaS)

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Question 19

An organization's compliance policy requires that all access to cloud resources be logged and that logs be immutable. Which service should be used to meet these requirements?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS resources, providing a detailed audit log of who made the request, from which IP address, and when. CloudTrail logs can be stored in an S3 bucket with S3 Object Lock enabled, which enforces a write-once-read-many (WORM) model to make logs immutable, meeting the compliance requirement for both logging and immutability.

Answer

AWS CloudWatch Logs

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 20

Which THREE of the following are common causes of VM migration failures in a cloud environment? (Choose three.)

Accepted Answer

Incompatible CPU instruction sets or features between source and target hosts. Options B, D, and E are correct. Incompatible CPU instruction sets or features between source and target hosts (B) can cause migration failure because the VM may rely on specific CPU features. Insufficient storage space on the target host (D) prevents the VM's disk from being copied, leading to failure. Network connectivity issues between the source and target hypervisors (E) disrupt the data transfer required for migration. Option A is wrong: expired software licenses may affect compliance but are not a common cause of migration failures as licenses are typically per-VM or per-host. Option C is wrong: stale DNS records affect name resolution but do not directly impact the migration process, which uses IP addresses or hypervisor identifiers.

Answer

Expired software licenses on the target host

Answer

Stale DNS records for the VM's hostname