CV0-004 Practice Exam 63 — 20 Questions

Question 1

A cloud administrator notices that a scheduled backup job for a virtual machine has been failing with the error "insufficient storage space". The VM has 100 GB OS disk. The backup solution creates snapshots. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The backup software requires temporary local storage that is full.. The error 'insufficient storage space' during a snapshot-based backup typically occurs because the backup software requires temporary local storage to stage the snapshot data before transferring it to the backup target. When this staging area (often a local cache or temporary directory) runs out of space, the backup fails. Option B correctly identifies that the backup software's temporary local storage is full, which is a common cause of this error.

Answer

The VM's data disk is full.

Answer

The backup service is using local disks for staging.

Answer

The snapshot is being stored on the same disk as the OS.

Question 2

A company is deploying a web application across multiple cloud regions for high availability. The application must maintain session state. Which deployment strategy should be used?

Accepted Answer

Sticky sessions with a load balancer. Sticky sessions (also known as session persistence) ensure that all requests from a client during a session are directed to the same backend server. This is critical for a multi-region deployment where the application must maintain session state, as it prevents session data loss when a load balancer distributes traffic. By using a load balancer with sticky sessions, the application can maintain stateful interactions even across multiple cloud regions, assuming the load balancer is configured for cross-region routing.

Answer

Active-passive failover

Answer

Geo-routing with DNS

Answer

Round-robin load balancing

Question 3

A cloud administrator is optimizing costs for a batch processing workload that runs nightly for 2 hours. The workload can tolerate interruptions. Which THREE purchasing options should the administrator consider? (Choose three.)

Accepted Answer

Preemptible VMs. Correct answer: Preemptible VMs, Spot instances, and On-demand instances. For a batch processing workload that runs nightly for only 2 hours and can tolerate interruptions, cost optimization favors using interruptible instances like Preemptible VMs (Google Cloud) or Spot instances (AWS/Azure) because they offer significant discounts and are suitable for fault-tolerant workloads. On-demand instances are also an option to consider when interruptible instances are not available or if the workload requires guaranteed capacity, though they are more expensive. Reserved instances or dedicated hosts are not cost-effective for such short, periodic workloads because they require long-term commitments (1 or 3 years) and are designed for steady-state usage. Therefore, the three options to consider are Preemptible VMs, Spot instances, and On-demand instances.

Answer

Dedicated hosts

Answer

Reserved instances

Question 4

A systems administrator needs to apply a critical security patch to a set of application servers running in a cloud environment. The administrator wants to minimize downtime and ensure that if the patch causes issues, the servers can be rolled back quickly. Which of the following is the BEST approach?

Accepted Answer

Use a blue-green deployment, patch the green environment, then switch traffic.. Blue-green deployment allows zero-downtime patching by switching traffic from the current (blue) environment to the patched (green) environment, and if issues occur, traffic can be switched back instantly, providing immediate rollback. Option A is incorrect because patching all servers at once causes downtime and no quick rollback. Option B is incorrect because taking snapshots before patching and restoring if needed incurs downtime during restore and is not as quick as switching traffic. Option C is incorrect because using an automated configuration management tool to apply patches gradually may not provide instant rollback and could still cause partial downtime.

Answer

Patch all servers at once during a maintenance window.

Answer

Take a snapshot of each server, apply the patch, and if issues occur, restore from snapshot.

Answer

Use an automated configuration management tool to apply the patch gradually.

Question 5

A company is migrating a legacy on-premises application to a public cloud. The application currently uses a single monolithic architecture and relies on a local file system for storage. The cloud architect needs to redesign the application to take advantage of cloud-native features. Which design principle should the architect prioritize to ensure scalability and resilience?

Accepted Answer

Refactor the application into microservices deployed across multiple instances. Refactoring the monolithic application into microservices enables independent scaling of components, improves fault isolation, and aligns with cloud-native patterns like containerization and orchestration (e.g., Kubernetes). This approach leverages horizontal scaling across multiple instances, which is essential for achieving elasticity and resilience in a public cloud environment, unlike the legacy single-point-of-failure monolithic design.

Answer

Maintain the monolithic architecture and connect via VPN to on-premises storage

Answer

Use vertical scaling by increasing vCPU and RAM on a single large VM

Answer

Deploy the entire application in a single availability zone to reduce latency

Question 6

A company is migrating a legacy application to the cloud. The application requires low-latency access to a shared filesystem that must be accessible from multiple virtual machines simultaneously. Which storage solution should the cloud architect recommend?

Accepted Answer

Block storage. Block storage (C) is correct because it provides a shared filesystem that can be mounted by multiple virtual machines simultaneously with low-latency access. Services like Amazon EBS with multi-attach or Azure Managed Disks support concurrent read/write operations from multiple instances, meeting the legacy application's requirement for a shared, low-latency filesystem.

Answer

Cold archive storage

Answer

Local instance store

Answer

Object storage

Question 7

A company is migrating a monolithic application to microservices on a cloud platform. The current application uses a single relational database. The migration plan involves decomposing the application into several services, each with its own database (polyglot persistence). One service handles high-volume time-series data, another handles user profiles, and a third handles transactions. The architect must ensure data consistency across services for user profile updates that affect other services. Which approach should be used to maintain data consistency without tight coupling?

Accepted Answer

Implement a saga pattern using choreography or orchestration. The saga pattern (option D) is the correct approach because it maintains data consistency across microservices without tight coupling by breaking a distributed transaction into a series of local transactions, each with a compensating action for rollback. In this scenario, user profile updates that affect other services can be coordinated via choreography (each service emits and listens to events) or orchestration (a central coordinator manages the steps), ensuring eventual consistency while preserving service autonomy and polyglot persistence.

Answer

Use distributed transactions (e.g., two-phase commit) across all services

Answer

Rely on eventual consistency with asynchronous messaging

Answer

Keep a single shared database for all services

Question 8

A cloud engineer is deploying a serverless application using AWS Lambda. The application processes files uploaded to an S3 bucket. To minimize cold start latency, which deployment configuration should the engineer use?

Accepted Answer

Increase the memory allocation and enable provisioned concurrency.. Provisioned concurrency pre-warms a specified number of Lambda execution environments, eliminating cold starts for those instances. Increasing memory allocation also proportionally increases CPU and network throughput, which can reduce initialization time. Together, these configurations directly address cold start latency for a serverless application processing S3 uploads.

Answer

Set the function timeout to the minimum value.

Answer

Place the Lambda function in a VPC without any NAT gateway.

Answer

Configure the function to run in a specific Availability Zone.

Question 9

A cloud administrator is troubleshooting connectivity to a virtual machine with IP address 10.10.10.10 from another VM on the same subnet. The output of ping and traceroute commands is shown. What is the most likely cause of the connectivity issue?

Accepted Answer

The destination VM's network interface is disabled.. A disabled network interface on the destination VM would cause the VM to be unreachable from the same subnet, even though the VM itself is powered on. Ping and traceroute would fail with no response, as the NIC is not operational at Layer 2, preventing ARP resolution and frame delivery. This matches the symptom of no connectivity despite being on the same subnet, where routing and security groups are not factors.

Answer

The destination VM is powered off.

Answer

The source VM's routing table does not have a default gateway.

Answer

The destination VM's security group is blocking ICMP.

Question 10

Sequence the steps to set up a cloud storage bucket with versioning and lifecycle policies.

Accepted Answer

Create bucket, then enable versioning, then add lifecycle rules (transitions and deletions), then test. Create bucket, enable versioning, add lifecycle rules for transitions and deletions, then test.

Answer

Enable versioning, then create bucket, then add lifecycle rules, then test

Answer

Create bucket, then add lifecycle rules, then enable versioning, then test

Answer

Create bucket, then enable versioning, then test, then add lifecycle rules

Question 11

Which of the following is a benefit of using a Cloud Access Security Broker (CASB) for SaaS applications?

Accepted Answer

It gives visibility and control over Shadow IT and data protection.. CASBs provide visibility into SaaS usage and enforce security policies, such as data loss prevention (DLP) and access control.

Answer

It encrypts data at rest in cloud storage.

Answer

It provides a virtual private network (VPN) for remote access.

Answer

It replaces the need for a web application firewall.

Question 12

Arrange the steps to configure auto-scaling for a group of virtual machines based on CPU utilization.

Accepted Answer

1. Define the VM template, 2. Define the auto-scaling group, 3. Define the CPU-based scaling policy, 4. Attach the policy to the group, 5. Test the configuration. First define the template, then the group, then the scaling policy, attach it, and test.

Answer

1. Define the VM template, 2. Define the CPU-based scaling policy, 3. Define the auto-scaling group, 4. Attach the policy to the group, 5. Test the configuration

Answer

1. Define the auto-scaling group, 2. Define the VM template, 3. Define the CPU-based scaling policy, 4. Attach the policy to the group, 5. Test the configuration

Answer

1. Define the VM template, 2. Define the auto-scaling group, 3. Define the CPU-based scaling policy, 4. Test the configuration, 5. Attach the policy to the group

Question 13

A company is selecting a cloud deployment model. They require the ability to keep sensitive data on-premises due to regulatory compliance, but want to leverage cloud resources for burst computing capacity. Which THREE characteristics describe this model?

Accepted Answer

Provides the ability to burst to the cloud for extra capacity. Hybrid cloud connects on-premises with public cloud, enabling data residency and bursting.

Answer

Uses multiple public cloud providers

Answer

Resources are exclusively owned by one organization

Question 14

A cloud architect is designing identity and access management (IAM) for a multi-cloud environment. The architect wants to enforce least privilege and support federation with an on-premises Active Directory. Which TWO of the following should be implemented? (Select TWO).

Accepted Answer

Using service accounts for application authentication. Federation with SAML allows SSO from on-prem AD, and service accounts provide non-human identities for applications, both supporting least privilege by granting only necessary permissions.

Answer

Storing shared credentials in application code

Answer

Assigning full administrator roles to all users

Answer

Disabling multi-factor authentication (MFA)

Question 15

Match each security control to its purpose.

Accepted Answer

IAM: Manages user identities and access permissions to cloud resources.. Common security controls in cloud environments include IAM, Encryption, Security Groups, and MFA. Distractors swap definitions between controls, testing knowledge of their specific purposes.

Answer

IAM: Acts as a virtual firewall for instances to control traffic.

Answer

Encryption: Requires users to provide two or more verification factors to gain access.

Question 16

A cloud engineer is troubleshooting a performance issue where a web server cluster experiences high latency during peak hours. The cluster uses an auto-scaling group behind a load balancer. Which THREE steps should the engineer take to identify the root cause?

Accepted Answer

Monitor CPU and memory utilization on the web servers. High CPU or memory utilization on web servers directly indicates resource contention, which can cause increased request processing time and latency. Monitoring these metrics helps identify if the auto-scaling group is under-provisioned or if a specific instance is overloaded, guiding scaling policy adjustments.

Answer

Reduce the number of instances in the auto-scaling group

Answer

Review security group rules for the load balancer

Question 17

Which TWO steps should an administrator take to troubleshoot a cloud VM that fails to boot?

Accepted Answer

Check the VM's console logs for error messages.. Console logs provide detailed error messages during the boot process, helping identify the root cause of boot failure. Option C is correct because incorrect boot order (e.g., trying to boot from a non-bootable device) can prevent the VM from starting; verifying and adjusting boot order is a standard troubleshooting step. Option B is incorrect because while verifying the root disk is attached is a basic check, it alone does not address other common boot issues (e.g., corrupted OS, incorrect boot configuration). Option D is incorrect because rebooting the hypervisor host affects multiple VMs and is not a targeted troubleshooting step for a single VM failing to boot. Option E is incorrect because deleting and recreating the VM is a drastic measure that results in data loss and should only be considered after all other troubleshooting steps have failed.

Answer

Verify the root disk is attached.

Answer

Reboot the hypervisor host.

Answer

Delete and recreate the VM instantly.

Question 18

A company wants to reduce cloud costs by identifying underutilized EC2 instances. Which AWS service provides rightsizing recommendations?

Accepted Answer

AWS Compute Optimizer. AWS Compute Optimizer analyzes utilization and recommends instance type changes to save costs.

Answer

AWS Budgets

Answer

AWS Trusted Advisor

Answer

AWS Cost Explorer

Question 19

Order the steps to configure a load balancer to distribute traffic across multiple web servers.

Accepted Answer

Create target group, Define health checks, Create load balancer, Create listeners, Associate target group with listener. First create the target group, define health checks, then the load balancer, listeners, and finally associate the target group.

Answer

Create load balancer, Create listeners, Create target group, Define health checks, Associate target group with listener

Answer

Create target group, Create load balancer, Create listeners, Define health checks, Associate target group with listener

Answer

Define health checks, Create target group, Create load balancer, Create listeners, Associate target group with listener

Question 20

A company is designing a cloud network architecture for a three-tier application. The web tier must be accessible from the internet, the application tier should only be accessible from the web tier, and the database tier should only be accessible from the application tier. The company uses a single VPC with multiple subnets. The security team requires that all traffic between tiers be encrypted in transit. The architect proposes using security groups and network ACLs. Which combination of security group rules meets these requirements while following the principle of least privilege?

Accepted Answer

Web: inbound 443 from 0.0.0.0/0, outbound to app SG:8443. App: inbound from web SG:8443, outbound to db SG:3306. DB: inbound from app SG:3306.. It uses security group (SG) references to enforce strict, stateful traffic flow between tiers: the web SG allows inbound HTTPS (443) from the internet and outbound to the app SG on port 8443; the app SG allows inbound only from the web SG on port 8443 and outbound to the DB SG on port 3306; the DB SG allows inbound only from the app SG on port 3306. This follows least privilege by restricting each tier’s communication to only the necessary ports and source/destination SGs, and the use of TLS/SSL on port 443 and 8443 ensures encryption in transit as required.

Answer

Web: inbound 443 from 0.0.0.0/0, outbound to 0.0.0.0/0:0-65535. App: inbound from web SG:443, outbound to 0.0.0.0/0:0-65535. DB: inbound from app SG:3306, outbound to 0.0.0.0/0:0-65535.

Answer

Web: inbound 443 from 0.0.0.0/0 and 22 from 0.0.0.0/0, outbound to app SG:443. App: inbound from web SG:443, outbound to db SG:3306. DB: inbound from app SG:3306.

Answer

Web: inbound 443 from 0.0.0.0/0, outbound to app subnet CIDR:1433. App: inbound from web subnet CIDR:443, outbound to db subnet CIDR:3306. DB: inbound from app subnet CIDR:3306.