CV0-004 Cloud Architecture and Design — Timed 30 Questions

Question 1

A company is migrating a legacy on-premises application to a public cloud. The application currently uses a single monolithic architecture and relies on a local file system for storage. The cloud architect needs to redesign the application to take advantage of cloud-native features. Which design principle should the architect prioritize to ensure scalability and resilience?

Accepted Answer

Refactor the application into microservices deployed across multiple instances. Option C is correct because refactoring the monolithic application into microservices enables independent scaling of components, improves fault isolation, and aligns with cloud-native patterns like containerization and orchestration (e.g., Kubernetes). This approach leverages horizontal scaling across multiple instances, which is essential for achieving elasticity and resilience in a public cloud environment, unlike the legacy single-point-of-failure monolithic design.

Answer

Maintain the monolithic architecture and connect via VPN to on-premises storage

Answer

Use vertical scaling by increasing vCPU and RAM on a single large VM

Answer

Deploy the entire application in a single availability zone to reduce latency

Question 2

A cloud architect is designing a multi-tier web application in a cloud environment. The application must handle unpredictable traffic spikes while minimizing costs. The architect decides to use auto-scaling groups for the web tier and a managed database service for the data tier. Which additional design consideration is MOST important to ensure the application remains available during a regional outage?

Accepted Answer

Distribute the auto-scaling group across multiple availability zones. Distributing the auto-scaling group across multiple Availability Zones (AZs) ensures that if one AZ fails, the web tier continues to serve traffic from the remaining AZs. This is the most critical design consideration for maintaining availability during a regional outage because it provides fault isolation at the AZ level, which is a fundamental principle of high availability in cloud architecture.

Answer

Configure the auto-scaling group to burst into on-premises resources during spikes

Answer

Increase the size of the web tier instances to handle more traffic

Answer

Use a read replica of the database to distribute read traffic

Question 3

A company is deploying a critical financial application on a private cloud. The compliance team requires that all data at rest be encrypted with a key managed by the company's hardware security module (HSM). The cloud architect must select a storage solution that supports customer-managed keys and integrates with the existing HSM. Which storage option should the architect choose?

Accepted Answer

Encrypted volumes on a software-defined storage (SDS) cluster. Option C is correct because a software-defined storage (SDS) cluster can be configured to use customer-managed encryption keys that integrate directly with the company's existing hardware security module (HSM) via standard interfaces like PKCS#11 or KMIP. This allows the company to maintain full control over key management and meet the compliance requirement for data-at-rest encryption with HSM-managed keys.

Answer

Object storage with server-side encryption using a cloud provider key

Answer

Instance store volumes on the compute nodes

Answer

Network-attached storage (NAS) appliance with built-in encryption

Question 4

A cloud engineer is troubleshooting a performance issue in a virtualized environment. A critical application is running slowly, and the engineer suspects resource contention. The host server has 32 vCPUs and 256 GB of RAM, running four VMs. Which tool should the engineer use to determine if CPU ready time is causing the performance degradation?

Accepted Answer

Use the hypervisor's monitoring console to view CPU ready time. CPU ready time is a hypervisor-level metric that measures the time a VM is ready to execute but must wait for a physical CPU core to become available. Since the engineer suspects resource contention among VMs on the same host, the hypervisor's monitoring console (e.g., vSphere, Hyper-V Manager) is the only tool that can expose this metric directly. Guest OS tools like 'top' or Performance Monitor cannot see CPU ready time because it occurs at the virtualization layer, not inside the VM.

Answer

Run the 'top' command inside the affected VM

Answer

Deploy a network analyzer to capture traffic between VMs

Answer

Check the performance monitor in the guest operating system

Question 5

A cloud architect is designing a disaster recovery plan for a cloud-based application. The primary site is in a cloud region, and the recovery site is in a different geographic region. The application uses a relational database with synchronous replication. The recovery time objective (RTO) is 1 hour, and the recovery point objective (RPO) is 15 minutes. Which replication strategy BEST meets these objectives?

Accepted Answer

Configure synchronous database replication with automated failover. Synchronous database replication with automated failover ensures that every write transaction is committed to both the primary and recovery site databases before acknowledging success, guaranteeing zero data loss (RPO=0) and near-instantaneous failover within seconds to minutes, which comfortably meets the RTO of 1 hour and RPO of 15 minutes. This strategy directly satisfies the strict RPO requirement by maintaining a fully synchronized, hot standby replica that can be promoted immediately upon failure.

Answer

Perform daily backups of the database and restore at the recovery site

Answer

Use storage-level asynchronous replication between regions

Answer

Use a script to copy database logs every hour to the recovery site

Question 6

A cloud architect is designing a hybrid cloud environment that connects an on-premises data center to a public cloud. The architect needs to ensure secure, low-latency connectivity and isolate traffic between different business units. Which TWO solutions should the architect implement? (Choose two.)

Accepted Answer

Establish a dedicated VPN or direct connect between on-premises and cloud. Option B is correct because a dedicated VPN or Direct Connect establishes a secure, low-latency, and private connection between the on-premises data center and the public cloud, bypassing the public internet to reduce latency and improve security. This is essential for hybrid cloud environments where consistent performance and isolation from internet-based threats are required.

Answer

Configure a NAT gateway to allow outbound internet access

Answer

Deploy a bastion host in a public subnet for administrative access

Answer

Use a transit gateway to interconnect all VPCs

Question 7

A cloud administrator is reviewing the security posture of a cloud deployment. The company has a policy of least privilege and must ensure that only authorized services can access storage buckets. Which THREE mechanisms should the administrator configure to enforce this policy? (Choose three.)

Accepted Answer

Bucket policies that restrict access to specific AWS services. Option B is correct because bucket policies, such as AWS S3 bucket policies, can explicitly grant or deny access to specific AWS services (e.g., AWS CloudTrail or AWS Config) using the `Principal` element with a service principal (e.g., `Service: cloudtrail.amazonaws.com`). This aligns with the least privilege policy by ensuring only authorized services can access the storage buckets, without relying on network-level controls.

Answer

Network ACLs that block unauthorized IP ranges

Answer

Security groups that allow traffic from authorized services

Question 8

A company is migrating its on-premises e-commerce application to a public cloud. The application consists of a stateless web tier, a stateful application tier that stores session data in memory, and a relational database. The migration must ensure high availability, scalability, and minimal downtime during cutover. The cloud provider offers load balancers, auto-scaling groups, managed database services, and caching services. The current on-premises architecture uses a single web server, a single application server, and a single database server. The application tier stores session data in local memory, which is lost if the server fails. The team needs to redesign the architecture to be cloud-native. Which of the following is the BEST course of action?

Accepted Answer

Deploy the web tier behind a load balancer with auto-scaling. Move session state from the application tier to a distributed caching service. Deploy the application tier behind a separate load balancer with auto-scaling. Migrate the database to a managed Multi-AZ deployment.. Option B is correct because it addresses the key requirements: high availability, scalability, and minimal downtime. By moving session state from local memory to a distributed caching service (e.g., Amazon ElastiCache or Azure Cache for Redis), the application tier becomes stateless and can be auto-scaled behind its own load balancer. The managed Multi-AZ database provides automatic failover and high availability, while the web tier behind a load balancer with auto-scaling ensures scalability and fault tolerance. This design eliminates single points of failure and allows zero-downtime cutover by scaling out before decommissioning on-premises resources.

Answer

Deploy the web tier behind a load balancer with auto-scaling. Keep the application tier as a single instance with session replication to a secondary instance. Use a managed database with a read replica.

Answer

Use a load balancer for the web tier with auto-scaling. Deploy the application tier as a single large instance with sticky sessions. Migrate the database to a larger single-instance managed database.

Answer

Deploy both web and application tiers behind a load balancer with auto-scaling. Use sticky sessions to maintain session state. Migrate the database to a managed Multi-AZ deployment.

Question 9

A company is migrating its on-premises application to the cloud and needs to ensure high availability. The application requires a stateless web tier and a stateful database tier. Which design approach BEST meets these requirements?

Accepted Answer

Deploy web servers behind a load balancer and use a managed database with multi-AZ replication.. Option B is correct because deploying web servers behind a load balancer provides horizontal scaling and fault tolerance for the stateless web tier, while using a managed database with multi-AZ replication ensures automatic failover and data durability for the stateful database tier. This combination meets high availability requirements by eliminating single points of failure and providing redundancy across Availability Zones.

Answer

Deploy one large web server and one large database server.

Answer

Use round-robin DNS for web servers and a read replica for the database.

Answer

Use auto-scaling for web servers and a single database instance.

Question 10

A cloud architect is designing a multi-tier application that must meet a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 hour. Which disaster recovery strategy is MOST cost-effective while meeting these requirements?

Accepted Answer

Warm standby with database replication. Warm standby with database replication is the most cost-effective strategy that meets an RTO of 15 minutes and an RPO of 1 hour. It maintains a scaled-down but fully functional copy of the production environment in another region, with synchronous or asynchronous database replication ensuring data loss is within the 1-hour RPO. Failover can be automated to achieve the 15-minute RTO without the expense of running full production capacity in the standby region.

Answer

Backup and restore from object storage

Answer

Pilot light with database replication

Answer

Active-active across two regions

Question 11

A company has a cloud environment with multiple VPCs that need to communicate with each other using private IP addresses. The company wants a centrally managed solution that simplifies routing and security. Which networking architecture should the architect implement?

Accepted Answer

Transit VPC with a VPN appliance. Option D is correct because a Transit VPC with a VPN appliance provides a centrally managed hub-and-spoke architecture that simplifies routing and security for multiple VPCs. The VPN appliance (e.g., a software VPN or AWS Marketplace appliance) establishes encrypted tunnels between the transit VPC and each spoke VPC, allowing private IP communication without the need for full-mesh peering or complex route tables. This design centralizes traffic inspection, policy enforcement, and routing, meeting the requirement for simplified management.

Answer

VPC peering between all VPCs

Answer

Direct Connect to each VPC

Answer

VPN connections between all VPCs

Question 12

An architect is designing a cloud application that must handle unpredictable spikes in traffic. The application should automatically add resources during peak demand and remove them when demand decreases to minimize costs. Which scaling strategy should be used?

Accepted Answer

Horizontal auto-scaling based on CPU utilization. Horizontal auto-scaling based on CPU utilization is the correct strategy because it dynamically adds or removes instances in response to real-time demand, ensuring the application can handle unpredictable traffic spikes while minimizing costs. This approach aligns with cloud elasticity principles, where resources scale out (add instances) during high CPU load and scale in (remove instances) when load decreases, without manual intervention.

Answer

Scheduled scaling based on historical patterns

Answer

Vertical scaling of existing instances

Answer

Manual scaling by operations team

Question 13

Order the steps to configure a load balancer to distribute traffic across multiple web servers.

Question 14

Order the steps to migrate an on-premises database to a cloud-managed database service (e.g., RDS, Cloud SQL).

Question 15

Match each cloud deployment model to its description.

Question 16

Match each cost management concept to its description.

Question 17

A startup is deploying a web application on a public cloud and expects variable traffic throughout the day. The team wants to minimize costs while ensuring that the application can handle sudden spikes in demand. Which scaling strategy best meets these requirements?

Accepted Answer

Auto scaling based on CPU utilization thresholds. Auto scaling based on CPU utilization thresholds is the correct strategy because it dynamically adjusts the number of compute instances in response to real-time demand, ensuring the application can handle sudden spikes while minimizing costs during low-traffic periods. This approach aligns with the startup's requirement for variable traffic and cost efficiency, as it only provisions resources when needed, unlike fixed schedules or manual interventions that cannot react to unpredictable spikes.

Answer

Horizontal scaling using a fixed schedule

Answer

Vertical scaling during off-peak hours

Answer

Manual scaling based on historical data

Question 18

A company is migrating its on-premises application to the cloud and wants to ensure high availability across multiple geographic regions. The application consists of stateless web servers and a stateful database. Which architecture should the company implement?

Accepted Answer

Active-active web servers in two regions with a multi-region database replication. Option C is correct because the application requires high availability across multiple geographic regions for both stateless web servers and a stateful database. Active-active web servers in two regions ensure traffic distribution and failover, while multi-region database replication (e.g., using synchronous or asynchronous replication such as MySQL Group Replication or Aurora Global Database) keeps the stateful database synchronized across regions, enabling read/write capabilities and automatic failover without data loss.

Answer

Active-passive web servers in two regions with a single database in the primary region

Answer

Active-active web servers in two regions with read replicas in each region

Answer

Active-active web servers in one region with a standby database in another region

Question 19

A financial services company must store sensitive customer data in the cloud. The compliance team requires that data at rest be encrypted using customer-managed keys (CMK), and that the keys are rotated every 90 days. Additionally, the cloud provider must not have access to the keys. Which key management solution should the company choose?

Accepted Answer

Use a dedicated HSM (hardware security module) with automated key rotation. Option C is correct because a dedicated HSM provides a tamper-resistant hardware appliance where the customer exclusively controls the encryption keys, ensuring the cloud provider has no access. Automated key rotation policies can be configured on the HSM to meet the 90-day rotation requirement, satisfying both the CMK and provider non-access mandates.

Answer

Store the encryption keys in the cloud provider's parameter store with rotation policy

Answer

Use the cloud provider's default server-side encryption with a managed key

Answer

Implement client-side encryption using a third-party key management service

Question 20

A company is designing a cloud architecture that must meet a recovery time objective (RTO) of 4 hours and a recovery point objective (RPO) of 1 hour for a critical database. The database is 500 GB and runs on a virtual machine. Which backup strategy should be used?

Accepted Answer

Take daily snapshots and transaction log backups every hour. Option A is correct because daily snapshots provide a baseline recovery point, and hourly transaction log backups ensure that the RPO of 1 hour is met by limiting data loss to at most one hour of transactions. Combined with the ability to restore from the latest snapshot and apply transaction logs, this strategy can achieve an RTO of 4 hours for a 500 GB database, assuming adequate infrastructure and restore automation.

Answer

Take full backups weekly and differential backups daily

Answer

Use continuous database replication to a standby instance

Answer

Perform block-level incremental backups every 4 hours