CV0-004 Cloud Architecture and Design Practice Test 2 — 15 Questions

Question 1

Match each cost management concept to its description.

Question 2

A startup is deploying a web application on a public cloud and expects variable traffic throughout the day. The team wants to minimize costs while ensuring that the application can handle sudden spikes in demand. Which scaling strategy best meets these requirements?

Accepted Answer

Auto scaling based on CPU utilization thresholds. Auto scaling based on CPU utilization thresholds is the correct strategy because it dynamically adjusts the number of compute instances in response to real-time demand, ensuring the application can handle sudden spikes while minimizing costs during low-traffic periods. This approach aligns with the startup's requirement for variable traffic and cost efficiency, as it only provisions resources when needed, unlike fixed schedules or manual interventions that cannot react to unpredictable spikes.

Answer

Horizontal scaling using a fixed schedule

Answer

Vertical scaling during off-peak hours

Answer

Manual scaling based on historical data

Question 3

A company is migrating its on-premises application to the cloud and wants to ensure high availability across multiple geographic regions. The application consists of stateless web servers and a stateful database. Which architecture should the company implement?

Accepted Answer

Active-active web servers in two regions with a multi-region database replication. Option C is correct because the application requires high availability across multiple geographic regions for both stateless web servers and a stateful database. Active-active web servers in two regions ensure traffic distribution and failover, while multi-region database replication (e.g., using synchronous or asynchronous replication such as MySQL Group Replication or Aurora Global Database) keeps the stateful database synchronized across regions, enabling read/write capabilities and automatic failover without data loss.

Answer

Active-passive web servers in two regions with a single database in the primary region

Answer

Active-active web servers in two regions with read replicas in each region

Answer

Active-active web servers in one region with a standby database in another region

Question 4

A financial services company must store sensitive customer data in the cloud. The compliance team requires that data at rest be encrypted using customer-managed keys (CMK), and that the keys are rotated every 90 days. Additionally, the cloud provider must not have access to the keys. Which key management solution should the company choose?

Accepted Answer

Use a dedicated HSM (hardware security module) with automated key rotation. Option C is correct because a dedicated HSM provides a tamper-resistant hardware appliance where the customer exclusively controls the encryption keys, ensuring the cloud provider has no access. Automated key rotation policies can be configured on the HSM to meet the 90-day rotation requirement, satisfying both the CMK and provider non-access mandates.

Answer

Store the encryption keys in the cloud provider's parameter store with rotation policy

Answer

Use the cloud provider's default server-side encryption with a managed key

Answer

Implement client-side encryption using a third-party key management service

Question 5

A company is designing a cloud architecture that must meet a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 1 hour for a critical database. The database is 500 GB and runs on a virtual machine. Which backup strategy should be used?

Accepted Answer

Take daily snapshots and transaction log backups every hour. Option A is correct because daily snapshots provide a baseline recovery point, and hourly transaction log backups ensure that the RPO of 1 hour is met by limiting data loss to at most one hour of transactions. Combined with the ability to restore from the latest snapshot and apply transaction logs, this strategy can achieve an RTO of 4 hours for a 500 GB database, assuming adequate infrastructure and restore automation.

Answer

Take full backups weekly and differential backups daily

Answer

Use continuous database replication to a standby instance

Answer

Perform block-level incremental backups every 4 hours

Question 6

A company is deploying a containerized microservices application on a cloud platform. The operations team needs to manage secrets, such as database credentials and API keys, securely without embedding them in container images. Which solution should they use?

Accepted Answer

Use a cloud-native secrets management service to inject secrets at runtime. Option C is correct because a dedicated secrets management service (e.g., AWS Secrets Manager, Azure Key Vault) securely stores and rotates secrets, and containers can retrieve them at runtime via API. Option A is wrong because environment variables in the orchestration platform may expose secrets in logs. Option B is wrong because encrypted configuration files in a storage bucket still require key management. Option D is wrong because storing secrets in the image build process is insecure.

Answer

Include secrets in the container image at build time and encrypt the image

Answer

Encrypt secrets and store them in a cloud storage bucket

Answer

Store secrets as environment variables in the container orchestration platform

Question 7

A company has a hybrid cloud environment where on-premises servers communicate with cloud resources via a VPN connection. The network team notices intermittent connectivity issues and packet loss. The VPN tunnel is established, but performance is degraded. Which step should the team take first to diagnose the issue?

Accepted Answer

Use traceroute and ping to measure latency and packet loss. B is correct because traceroute and ping are the foundational diagnostic tools to measure latency and packet loss across a VPN tunnel. Intermittent connectivity and packet loss often stem from path issues, MTU mismatches, or routing problems that these tools can isolate. Since the tunnel is established, the first step is to quantify the performance degradation before making configuration changes.

Answer

Restart the VPN tunnel and monitor logs

Answer

Increase the MTU size on the VPN tunnel

Answer

Check the CPU utilization of the on-premises VPN appliance

Question 8

A company plans to use a public cloud to host a static website with minimal configuration. The website content is stored in an object storage bucket. Users access the site via a custom domain name. Which cloud service should the company use to serve the content with low latency globally?

Accepted Answer

Content delivery network (CDN) with the object storage as origin. A CDN caches static content at edge locations worldwide, reducing latency for global users. By configuring the object storage bucket as the origin, the CDN pulls content on cache miss and serves it from the nearest edge node. This meets the requirement of minimal configuration while providing low-latency delivery via a custom domain.

Answer

Reverse proxy server in each region

Answer

DNS-based round-robin to multiple storage buckets

Answer

Load balancer distributing traffic to multiple object storage endpoints

Question 9

An organization is designing a cloud architecture for a data analytics workload that processes large datasets. The workload is CPU-intensive and runs once per day. The company wants to minimize costs. Which compute model should be used?

Accepted Answer

Spot instances with a fallback to on-demand. Option D is correct because spot/preemptible instances offer significant cost savings for fault-tolerant, interruptible workloads like batch processing. Option A is wrong because on-demand instances are more expensive. Option B is wrong because reserved instances are for steady-state usage. Option C is wrong because dedicated hosts are the most expensive option.

Answer

On-demand instances with auto scaling

Answer

Dedicated hosts with a savings plan

Answer

Reserved instances for a 1-year term

Question 10

A company is migrating a legacy monolithic application to a microservices architecture on the cloud. The application has tight coupling and shared database schemas. Which migration strategy should the company adopt to reduce risk and enable iterative migration?

Accepted Answer

Use the strangler fig pattern to gradually replace components. The strangler fig pattern is the correct migration strategy because it allows the company to incrementally replace specific functionalities of the legacy monolithic application with new microservices, reducing risk by keeping the existing system operational during the transition. This approach directly addresses the tight coupling and shared database schema issues by enabling gradual decomposition without requiring a complete rewrite or a risky big-bang migration.

Answer

Re-platform to a managed service and rewrite later

Answer

Containerize the monolithic application and run it on a cluster

Answer

Lift and shift the entire application, then refactor in-place

Question 11

Which TWO factors should be considered when selecting a cloud region for deploying a latency-sensitive application serving a global user base?

Accepted Answer

Number of availability zones. Option B is correct because the number of availability zones within a region directly impacts the resilience and fault tolerance of a latency-sensitive application. Deploying across multiple availability zones allows for high availability and failover without adding significant latency, as zones are typically within a few milliseconds of each other. This ensures the application remains responsive even if one zone fails, which is critical for a global user base.

Answer

Cost of compute and storage

Answer

Data sovereignty and compliance requirements

Answer

Available network bandwidth between zones

Question 12

Which THREE design principles are fundamental to building a highly available cloud architecture?

Accepted Answer

Eliminate single points of failure. Eliminating single points of failure (A) is fundamental because if any single component (e.g., a load balancer, a storage volume, or a compute instance) fails, the entire system can become unavailable. In cloud architectures, this is achieved by deploying redundant components so that no single failure can cause a complete outage. For example, using multiple load balancers in an active-passive or active-active configuration ensures traffic can still be routed if one fails.

Answer

Scale vertically to increase capacity

Answer

Use a single, powerful database instance

Question 13

Which TWO are best practices for designing a multi-tenant SaaS application on a public cloud?

Accepted Answer

Use separate virtual networks or VPCs for each tenant. Options A and C are correct. Tenant isolation at the network layer (VLANs or VPCs) and using row-level security in a shared database are common approaches. Option B is wrong because a dedicated database per tenant is costly for many tenants. Option D is wrong because a single large instance for all tenants creates a noisy neighbor problem. Option E is wrong because a tiered service model is a business decision, not a design best practice for multi-tenancy.

Answer

Assign a dedicated database instance per tenant

Answer

Deploy all tenants on a single large compute instance

Answer

Offer the same service tier to all tenants

Question 14

A company is migrating a web application to the cloud. The application requires low latency and high availability across multiple geographic regions. Which cloud deployment model BEST meets these requirements?

Accepted Answer

Public cloud. The public cloud model is the best fit because it offers globally distributed infrastructure (e.g., AWS Regions, Azure Availability Zones) that enables low-latency access and high availability through multi-region deployment. Public cloud providers natively support global load balancing (e.g., AWS Global Accelerator, Azure Traffic Manager) and auto-scaling across regions, meeting the application's requirements without the capital expense of building private infrastructure.

Answer

Private cloud

Answer

Hybrid cloud

Answer

Community cloud

Question 15

A cloud architect is designing a multi-tier application on a public cloud. To minimize costs while maintaining performance for variable workloads, the architect decides to use a mix of reserved and spot instances. Which design principle is being applied?

Accepted Answer

Cost optimization. Using a mix of reserved and spot instances directly reduces compute costs by committing to predictable workloads with reserved instances (which offer significant discounts over on-demand) and using spot instances for fault-tolerant, flexible workloads at steep discounts (often 60-90% off on-demand). This hybrid approach is a core cost optimization strategy in public cloud design, as it balances upfront commitment with opportunistic savings without sacrificing performance for variable workloads.

Answer

Scalability

Answer

High availability

Answer

Security