CV0-004 Practice Test 9 — 10 Questions

Question 1

A company uses Azure and wants to centrally audit all management operations across subscriptions. Which service should be used to collect and analyze these logs?

Accepted Answer

Azure Monitor. Azure Monitor is the correct service because it provides a centralized platform for collecting, analyzing, and acting on telemetry data from Azure resources, including management operations across subscriptions. Specifically, the Azure Activity Log within Azure Monitor captures all control-plane events (e.g., resource creation, deletion, policy changes) at the subscription level, enabling auditing and alerting. This directly meets the requirement for centrally auditing management operations across multiple subscriptions.

Answer

GCP Cloud Audit Logs

Answer

AWS CloudTrail

Answer

Azure Security Center

Question 2

Which TWO of the following are best practices for securing access to a cloud management console?

Accepted Answer

Restrict access based on IP address ranges. Restricting access based on IP address ranges (B) is a best practice because it limits the attack surface by allowing only trusted network sources to reach the management console. This is often implemented via security group rules, network ACLs, or cloud provider-specific features like AWS Security Groups or Azure NSGs, reducing exposure to brute-force and unauthorized access attempts.

Answer

Use complex passwords and rotate them every 30 days

Answer

Use the root account for daily administration

Answer

Enable guest access for external auditors

Question 3

A company needs to transfer 200 TB of data from an on-premises NAS to Amazon S3 over the internet within 5 days. The available bandwidth is 1 Gbps. Which AWS service should be used to accelerate the transfer?

Accepted Answer

AWS DataSync. AWS DataSync can accelerate transfers over the internet using parallel multi-threading and compression. Snowball would be faster for 200 TB, but the question specifies over the internet. DataSync is optimized for network transfers.

Answer

AWS Snowball

Answer

S3 Transfer Acceleration

Answer

AWS Direct Connect

Question 4

Refer to the exhibit. A developer is trying to upload an object to S3 bucket 'example-bucket' using the IAM policy shown. The upload fails with an AccessDenied error. Which of the following is the MOST likely reason?

Accepted Answer

The bucket policy has a deny that overrides this IAM policy.. The IAM policy grants the s3:PutObject action, but an explicit deny in the bucket policy overrides any allow from an IAM policy. Since AWS evaluates all policies (identity-based and resource-based) and an explicit deny always takes precedence, the upload fails with AccessDenied even though the IAM policy appears sufficient.

Answer

The IAM policy requires server-side encryption with AES256, but the upload request did not specify that header.

Answer

The developer's user is not in the same account as the bucket.

Answer

The IAM policy does not grant the s3:ListBucket permission.

Question 5

A cloud engineer is tasked with automating the deployment of a new web application. Which of the following tools is BEST suited for managing infrastructure as code in a hybrid cloud environment?

Accepted Answer

Terraform. Terraform is the best choice because it is a cloud-agnostic Infrastructure as Code (IaC) tool that uses a declarative configuration language (HCL) to manage resources across multiple providers, including AWS, Azure, and on-premises systems. This makes it ideal for hybrid cloud environments where consistent provisioning and state management are required across disparate platforms.

Answer

AWS CloudFormation

Answer

Ansible

Answer

Docker

Question 6

An organization is migrating workloads to the cloud and after migration, users complain about slow application response times. The administrator reviews the cloud provider's dashboard and sees no resource bottlenecks. Which three factors could still cause poor performance? (Choose three.)

Accepted Answer

DNS resolution delays due to on-premises DNS server. Correct options are B, C, and E. Option B is correct because DNS resolution delays caused by an on-premises DNS server can increase response times without appearing as a resource bottleneck on the cloud provider's dashboard. Option C is correct because geographic latency between the cloud region and the users' location is a network issue, not a resource bottleneck, so it won't show on the dashboard. Option E is correct because a TCP window scaling mismatch can degrade network throughput transparently, without affecting resource metrics. Option A is incorrect because an application not optimized for the cloud would typically cause high resource usage, which would appear as a bottleneck on the dashboard. Option D is incorrect because insufficient CPU cores would result in high CPU utilization, visible as a resource bottleneck on the dashboard.

Answer

The application is not optimized for the cloud infrastructure

Answer

Insufficient number of CPU cores in the VM

Question 7

During a penetration test, a cloud security engineer discovers that a storage bucket is publicly accessible because of a misconfigured block public access setting. The bucket contains encrypted data. Which of the following is the primary risk?

Accepted Answer

Unauthorized users can list and download objects, but encryption at rest protects content if the key is also not accessible.. Unauthorized users can list and download encrypted objects, even if the data is encrypted at rest. The primary risk is data exfiltration if the encryption key is compromised or the data is not properly encrypted.

Answer

The bucket name is exposed to enumeration.

Answer

Data is unreadable because it is encrypted.

Answer

The encryption key is exposed.

Question 8

A cloud administrator is designing a secure multi-tenant environment. Which THREE of the following are best practices for isolating tenant workloads?

Accepted Answer

Deploy tenant workloads on dedicated hypervisors.. Deploying tenant workloads on dedicated hypervisors provides strong physical isolation, preventing a compromised hypervisor from affecting other tenants. This approach eliminates the risk of side-channel attacks or resource contention that could cross tenant boundaries, ensuring each tenant's virtual machines run on separate hardware with no shared compute resources.

Answer

Use a single virtual switch for all tenants.

Answer

Place all tenants on the same storage array for efficiency.

Question 9

An Azure administrator runs the command and gets the output shown. The virtual machine 'web-01' is not accessible over the network. Which of the following is the MOST likely reason?

Accepted Answer

The VM is stopped and deallocated.. The command output shows the VM 'web-01' with a 'PowerState' of 'Stopped (deallocated)'. When a VM is deallocated, it releases its assigned public IP and underlying compute resources, making it unreachable over the network. The VM must be in a 'Running' state to accept network traffic.

Answer

The VM name is incorrect.

Answer

The VM failed to provision.

Answer

The VM is in the wrong region.

Question 10

A company needs to back up a critical database with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 2 hours. Which disaster recovery strategy should be implemented?

Accepted Answer

Cross-region replication with a read replica. Continuous replication (such as using database replication) can achieve a very low RPO like 15 minutes.

Answer

Weekly backups to an external tape library

Answer

Daily snapshots stored in the same region

Answer

Cold standby with hourly snapshots