CV0-004 Cloud Architecture and Design Practice Test 3 — 15 Questions

Question 1

An organization must comply with a regulation requiring that all data stored in the cloud be encrypted at rest using a cloud provider's native encryption service. The company also needs to maintain control over the encryption keys. Which solution should the architect recommend?

Accepted Answer

Use the cloud provider's native encryption service with customer-managed keys. Option A is correct because the regulation requires cloud-native encryption at rest with customer-controlled keys. Cloud providers offer services like AWS KMS with customer-managed keys (CMKs) or Azure Key Vault with customer-managed keys, which allow the organization to create, rotate, and disable keys independently while the provider handles the underlying encryption of data at rest using envelope encryption. This satisfies both the 'native encryption service' and 'maintain control over the encryption keys' requirements.

Answer

Encrypt the data on-premises before uploading to the cloud

Answer

Use the cloud provider's default encryption with provider-managed keys

Answer

Use a third-party hardware security module (HSM) hosted on-premises

Question 2

A company wants to deploy a cloud application that requires predictable performance and dedicated resources for a critical database. Which cloud service model is MOST appropriate?

Accepted Answer

Infrastructure as a Service (IaaS). Infrastructure as a Service (IaaS) provides virtualized computing resources, such as dedicated virtual machines, storage, and networking, that can be configured to meet the predictable performance and dedicated resource requirements of a critical database. With IaaS, the company can provision a dedicated server instance with guaranteed CPU, memory, and I/O, avoiding the resource contention common in shared platforms. This model offers full control over the operating system, database software, and security settings, which is essential for a critical database workload.

Answer

Function as a Service (FaaS)

Answer

Software as a Service (SaaS)

Answer

Platform as a Service (PaaS)

Question 3

A cloud architect is planning a disaster recovery (DR) strategy for a mission-critical application. The RTO must be under 1 hour and RPO under 15 minutes. The primary site is in a different region. Which DR pattern meets these requirements?

Accepted Answer

Pilot light. The pilot light pattern meets the RTO under 1 hour and RPO under 15 minutes because it keeps a minimal core set of services (e.g., database replicating via asynchronous replication) running in the DR region, allowing rapid scale-up of the full application stack during failover. This pattern balances cost and recovery speed, as the replicated data ensures an RPO of seconds to minutes, and the pre-provisioned core infrastructure enables failover within minutes, satisfying the strict RTO.

Answer

Backup and restore

Answer

Cold standby

Answer

Multi-site active-active

Question 4

A company is moving a legacy monolithic application to the cloud. The application has interdependencies that make it difficult to refactor. The architect needs to minimize changes while gaining cloud benefits like elasticity and pay-as-you-go. Which migration strategy is BEST?

Accepted Answer

Rehost (Lift and shift). Rehosting (lift and shift) is the best strategy because it moves the monolithic application to the cloud with minimal changes, preserving existing interdependencies. This allows the company to immediately gain cloud benefits like elasticity and pay-as-you-go pricing without refactoring the tightly coupled codebase. The application runs on cloud infrastructure (e.g., EC2 instances) as-is, leveraging auto-scaling and resource optimization.

Answer

Retire

Answer

Repurchase

Answer

Refactor / Re-architect

Question 5

A cloud administrator needs to design a storage solution that provides block-level access for a database server and must be highly durable. Which storage type should be used?

Accepted Answer

Block storage. Block storage is the correct choice because it provides raw, low-latency block-level access that database servers require for high-performance read/write operations. It also supports features like RAID, snapshots, and replication to achieve high durability, making it ideal for transactional databases.

Answer

File storage

Answer

Archive storage

Answer

Object storage

Question 6

An organization is designing a cloud architecture that must be fault-tolerant within a single region. The architect decides to deploy application instances in multiple Availability Zones (AZs). Which cloud characteristic is being leveraged?

Accepted Answer

Resource pooling. Deploying application instances across multiple Availability Zones (AZs) within a single region leverages resource pooling, a key cloud characteristic. Resource pooling allows the cloud provider to aggregate compute, storage, and network resources from multiple physical locations (AZs) into a shared pool that can be dynamically allocated to tenants. By distributing instances across AZs, the architect ensures that if one AZ fails, the application remains available using resources from other AZs, directly utilizing the provider's pooled infrastructure.

Answer

Measured service

Answer

Elasticity

Answer

On-demand self-service

Question 7

A company uses a public cloud provider and has a requirement that all data must be encrypted in transit and at rest. The architect notices that the cloud provider's load balancer terminates TLS and forwards traffic to backend instances over HTTP. Which design change should the architect make?

Accepted Answer

Configure end-to-end encryption using HTTPS between load balancer and backend. Option D is correct because the requirement mandates encryption in transit for all data paths. By configuring end-to-end HTTPS between the load balancer and backend instances, the architect ensures that traffic is encrypted from the client to the backend, even after the load balancer terminates the initial TLS connection. This prevents plaintext HTTP traffic from flowing over the internal network, satisfying the encryption-at-rest and in-transit compliance needs.

Answer

Implement a web application firewall (WAF) on the backend

Answer

Enable TLS termination at the backend instances only

Answer

Use a VPN tunnel between the load balancer and backend

Question 8

Which TWO characteristics are essential for a cloud service to be considered as a true Infrastructure as a Service (IaaS) offering?

Accepted Answer

Customer has control over the guest operating system. Option A is correct because in IaaS, the customer retains control over the guest operating system, including its configuration, security, and installed applications. The provider manages the underlying physical infrastructure and hypervisor, but the customer is responsible for the OS layer, which is a defining characteristic of IaaS versus PaaS or SaaS.

Answer

Provider automatically applies OS security patches

Answer

Customer manages the underlying hypervisor

Answer

Provider performs automated backups of all customer data

Question 9

Which THREE factors should be considered when selecting a cloud region for deploying a globally distributed application to minimize latency?

Accepted Answer

Geographic proximity to target user base. Geographic proximity to the target user base is a primary factor for minimizing latency because network latency is fundamentally limited by the speed of light and the physical distance data must travel. Deploying application instances in a cloud region close to users reduces round-trip time (RTT) and packet loss, directly improving user experience for latency-sensitive applications like real-time gaming or video conferencing.

Answer

Number of available virtual machine sizes

Answer

Local tax rate for cloud services

Question 10

Which TWO design patterns can help a cloud architect achieve a Recovery Time Objective (RTO) of less than 5 minutes for a critical application?

Accepted Answer

Multi-site active-active. Multi-site active-active (B) distributes the application workload across two or more geographically separated sites, with all sites actively serving traffic. If one site fails, traffic is instantly rerouted to the remaining sites via DNS load balancing or global server load balancing (GSLB), enabling sub-5-minute RTO because there is no cold start or failover delay. Hot standby (active/passive) with automatic failover (E) maintains a fully provisioned standby environment that mirrors the primary, with automatic health checks and failover mechanisms (e.g., using AWS Route 53 health checks or Azure Traffic Manager) that can redirect traffic within seconds to minutes, meeting a strict RTO of under 5 minutes.

Answer

Warm standby

Answer

Backup and restore

Answer

Pilot light

Question 11

A company is migrating a legacy application to the cloud. The application requires low-latency access to a shared filesystem that must be accessible from multiple virtual machines simultaneously. Which storage solution should the cloud architect recommend?

Accepted Answer

Block storage. Block storage (C) is correct because it provides a shared filesystem that can be mounted by multiple virtual machines simultaneously with low-latency access. Services like Amazon EBS with multi-attach or Azure Managed Disks support concurrent read/write operations from multiple instances, meeting the legacy application's requirement for a shared, low-latency filesystem.

Answer

Cold archive storage

Answer

Local instance store

Answer

Object storage

Question 12

A cloud architect is designing a multi-tier web application that must handle sudden traffic spikes. The application layer is stateless, and the database layer is read-heavy with occasional writes. Which design best meets the requirement for elasticity and cost efficiency?

Accepted Answer

Use auto-scaling for the application tier and read replicas for the database. Option A is correct because auto-scaling the stateless application tier dynamically adds or removes instances based on CPU or request metrics, directly handling traffic spikes without over-provisioning. For the read-heavy database tier, read replicas offload SELECT queries from the primary database, improving read throughput and cost efficiency by scaling horizontally only when needed, while the primary handles occasional writes.

Answer

Implement auto-scaling for the database tier and use a larger application instance

Answer

Use a load balancer to distribute traffic to multiple database instances

Answer

Deploy large application and database instances to handle peak load

Question 13

A company runs a critical application on a cloud VM that must achieve a 99.99% monthly uptime SLA. The VM is deployed in a single availability zone. The current architecture has no redundancy. What is the most effective design change to meet the SLA requirement?

Accepted Answer

Deploy the application across two availability zones with a load balancer. Option B is correct because deploying the application across two availability zones with a load balancer provides high availability by eliminating a single point of failure. A 99.99% monthly uptime SLA requires a design that can withstand an entire availability zone failure, which a single-zone deployment cannot achieve. The load balancer distributes traffic to healthy VMs, automatically failing over if one zone becomes unavailable, thus meeting the SLA target.

Answer

Schedule daily backups to a different region

Answer

Upgrade the VM to a larger instance type for better reliability

Answer

Add a second VM in the same availability zone with a load balancer

Question 14

A cloud architect is selecting a deployment model for a workload that has strict data sovereignty requirements; data must remain within the company's on-premises data center. Which cloud deployment model should be chosen?

Accepted Answer

Private cloud. A private cloud deployment model is the correct choice because it provides dedicated infrastructure that is exclusively used by a single organization, ensuring that all data and workloads remain within the company's on-premises data center. This model meets strict data sovereignty requirements by allowing full control over data residency, network boundaries, and physical security, unlike shared or public environments where data may cross jurisdictional lines.

Answer

Community cloud

Answer

Hybrid cloud

Answer

Public cloud

Question 15

A company is designing a disaster recovery plan for its cloud infrastructure. The primary site is in US-East, and the DR site is in US-West. The RPO is 15 minutes, and the RTO is 2 hours. Which replication strategy best meets these requirements at the lowest cost?

Accepted Answer

Asynchronous replication from primary to DR. Asynchronous replication sends data changes from the primary site to the DR site with minimal delay, typically within seconds to minutes, which meets the 15-minute RPO. It does not require the low-latency link that synchronous replication demands, making it more cost-effective for geographically separated sites. The 2-hour RTO is achievable because the DR site can be activated quickly from the replicated data, without the overhead of restoring from backups.

Answer

Scheduled nightly backups to DR

Answer

Synchronous replication between sites

Answer

No replication; manual failover