CV0-004 Deployment — 20 Questions

Question 1

A company is deploying a new web application in a hybrid cloud environment. The application must be able to scale out automatically during peak usage and scale in during low usage. The deployment must also ensure that the application remains available if a single Availability Zone fails. Which deployment strategy should the architect recommend?

Accepted Answer

Create an auto-scaling group spanning multiple Availability Zones.. Option B is correct because an auto-scaling group spanning multiple Availability Zones ensures both automatic scaling based on demand and high availability. If one Availability Zone fails, the load balancer distributes traffic to healthy instances in the remaining zones, meeting the requirement for continuous availability during a zone failure.

Answer

Deploy a cluster of instances in a single Availability Zone with a load balancer.

Answer

Use a single large instance and manually resize during peak periods.

Answer

Deploy a load balancer in front of a single instance.

Question 2

A cloud administrator is deploying a critical application that requires the lowest possible latency between compute instances. The instances will be running in a private subnet and must communicate with each other using their private IP addresses. Which of the following deployment configurations would best meet these requirements?

Accepted Answer

Deploy instances in a placement group within the same Availability Zone.. Deploying instances in a placement group within the same Availability Zone ensures they are physically close together, often in the same rack or cluster, which minimizes network hops and achieves the lowest possible latency. This configuration is ideal for latency-sensitive applications because it leverages non-blocking, high-bandwidth inter-instance communication without traversing additional network infrastructure.

Answer

Deploy instances in different Availability Zones within the same region.

Answer

Deploy instances in the same subnet behind a NAT gateway.

Answer

Deploy instances in different regions and use inter-region peering.

Question 3

An organization is migrating its on-premises virtualization environment to a public cloud. The current environment uses VMware vSphere with VM templates. The cloud provider supports importing VMs in OVF format. Which step should the cloud administrator take to prepare the VMs for migration?

Accepted Answer

Export each VM as an OVF template.. The cloud provider supports importing VMs in OVF format, which is an open standard for packaging and distributing virtual appliances. Exporting each VM as an OVF template from VMware vSphere creates the necessary .ovf descriptor file and accompanying disk files (e.g., .vmdk) that the provider can directly import. This is the correct preparation step because it produces the exact format required by the target cloud platform.

Answer

Take a snapshot of each VM and copy the snapshot files.

Answer

Convert each VM to an ISO image.

Answer

Copy the VM's VMDK files and import them as VHDX.

Question 4

A cloud engineer is deploying a containerized application using Kubernetes. The application consists of a frontend, a backend API, and a database. The engineer needs to ensure that the backend API can be reached by the frontend but not from outside the cluster. Which Kubernetes resource should the engineer use to expose the backend API?

Accepted Answer

ClusterIP service. A ClusterIP service exposes the backend API on a cluster-internal IP address, making it reachable only from within the Kubernetes cluster. This meets the requirement that the frontend can communicate with the backend API, but external traffic is blocked. ClusterIP is the default service type and is ideal for internal service-to-service communication.

Answer

NodePort service

Answer

Ingress resource

Answer

LoadBalancer service

Question 5

A company is deploying a multi-tier application in a cloud environment. The application must comply with PCI DSS, which requires encryption of data at rest and in transit. The database tier must be isolated from direct internet access, while the web tier must be accessible from the internet. Which of the following deployment architectures best meets these requirements?

Accepted Answer

Deploy web tier in a public subnet, database tier in a private subnet, and use SSL/TLS for encryption.. Option D is correct because it separates the web tier into a public subnet for internet accessibility and the database tier into a private subnet for isolation, meeting PCI DSS requirements. SSL/TLS encryption ensures data in transit is protected, and encryption at rest can be applied to the database storage. This architecture aligns with cloud best practices for multi-tier applications requiring compliance.

Answer

Place all tiers in the same subnet and use security groups to restrict traffic.

Answer

Use a single instance for web and database, and place it behind a load balancer.

Answer

Use a VPN connection from the web tier to the database tier and disable encryption.

Question 6

Which TWO of the following are valid considerations when deploying a virtual machine in a cloud environment? (Choose two.)

Accepted Answer

The instance size and family. Option C is correct because the instance size and family directly determine the virtual machine's compute capacity, including vCPUs, memory, and network performance. Selecting the appropriate size and family ensures the workload has sufficient resources without over-provisioning, which is a fundamental deployment consideration in cloud environments like AWS EC2 or Azure VMs.

Answer

The log retention policy

Answer

The password complexity requirements

Answer

The number of virtual CPUs assigned to the hypervisor

Question 7

Which THREE of the following are best practices when deploying a cloud application using Infrastructure as Code (IaC)? (Choose three.)

Accepted Answer

Store IaC templates in a version control system.. Storing IaC templates in a version control system (e.g., Git) is a best practice because it enables change tracking, rollback, collaboration, and auditability. This aligns with GitOps principles, where the version control repository serves as the single source of truth for infrastructure state, ensuring all changes are reviewed and recorded.

Answer

Embed credentials directly in the IaC templates.

Answer

Manually modify resources after deployment to tune performance.

Question 8

A company is deploying a web application across multiple cloud regions for high availability. The application must maintain session state. Which deployment strategy should be used?

Accepted Answer

Sticky sessions with a load balancer. Sticky sessions (also known as session persistence) ensure that all requests from a client during a session are directed to the same backend server. This is critical for a multi-region deployment where the application must maintain session state, as it prevents session data loss when a load balancer distributes traffic. By using a load balancer with sticky sessions, the application can maintain stateful interactions even across multiple cloud regions, assuming the load balancer is configured for cross-region routing.

Answer

Active-passive failover

Answer

Geo-routing with DNS

Answer

Round-robin load balancing

Question 9

A cloud architect must design a deployment for a containerized microservices application. The requirements include automated scaling based on CPU utilization, rolling updates with zero downtime, and service discovery. Which orchestration feature should be used?

Accepted Answer

Kubernetes with Horizontal Pod Autoscaler. Kubernetes with Horizontal Pod Autoscaler (HPA) is the correct choice because HPA automatically scales the number of pod replicas based on observed CPU utilization (or custom metrics), meeting the automated scaling requirement. Kubernetes also supports rolling updates with zero downtime via its Deployment controller, which gradually replaces old pods with new ones while maintaining service availability. Additionally, Kubernetes provides built-in service discovery through DNS (CoreDNS) and Services, allowing microservices to find each other by name without external dependencies.

Answer

Docker Compose with a reverse proxy

Answer

Ansible playbooks with Docker modules

Answer

AWS ECS with Fargate

Question 10

A deployment of a new application version fails with a '503 Service Unavailable' error after a rolling update. The previous version was working. What is the most likely cause?

Accepted Answer

New version missing a required dependency. A 503 Service Unavailable error during a rolling update typically indicates that the new application version cannot start or serve traffic. The most likely cause is a missing required dependency (e.g., a library, module, or runtime component) that the previous version did not need, causing the new pods or containers to fail readiness probes and be removed from the load balancer pool.

Answer

Database connection pool exhausted

Answer

DNS propagation delay

Answer

SSL certificate expired

Question 11

A cloud engineer needs to deploy a virtual machine with a specific configuration that includes a custom script to install software after boot. The deployment must be repeatable and version-controlled. Which approach should be used?

Accepted Answer

Use an Infrastructure as Code template with a user data script. Option D is correct because Infrastructure as Code (IaC) templates, such as AWS CloudFormation or Azure Resource Manager, allow you to define the entire VM configuration declaratively, including a user data script that runs custom software installation commands at first boot. This approach ensures repeatability, version control through template files stored in Git, and automated deployment without manual intervention.

Answer

Run a shell script after the VM is deployed

Answer

Create a golden image with the software pre-installed

Answer

Manually install software after creating the VM

Question 12

A cloud administrator is deploying a web application that must be highly available across two availability zones. The deployment includes an application load balancer and multiple EC2 instances. Which TWO configurations are required to meet the high availability requirement?

Accepted Answer

Launch EC2 instances in at least two availability zones. Option A is correct because launching EC2 instances in at least two availability zones ensures that if one AZ fails, the application continues to serve traffic from the other AZ. This is a fundamental requirement for achieving high availability across AZs, as it distributes the compute capacity across physically separate data centers.

Answer

Use a single EC2 instance with an auto-recovery policy

Answer

Set up health checks to automatically replace unhealthy instances

Answer

Enable cross-zone load balancing on the ALB

Question 13

A DevOps engineer runs a rollout status command for a Kubernetes deployment and receives the error shown. The deployment specification includes a rolling update strategy with maxSurge=25% and maxUnavailable=25%. What is the most likely cause of the failure?

Accepted Answer

The new pod template contains an invalid container image tag. The error message from the rollout status command indicates that the new ReplicaSet is unable to create pods, which typically occurs when the pod template in the deployment specification references an invalid container image tag. Kubernetes attempts to pull the image, fails, and marks the pods as ImagePullBackOff or ErrImagePull, preventing the rollout from progressing. The rolling update strategy with maxSurge=25% and maxUnavailable=25% is not the cause, as these settings control the rate of pod replacement, not the validity of the image reference.

Answer

The cluster does not have enough CPU resources to schedule new pods

Answer

The maxSurge and maxUnavailable settings are too restrictive

Answer

The old ReplicaSet is still running and preventing the new one from scaling up

Question 14

A company has a hybrid cloud environment with on-premises servers and AWS. They deploy a new application using AWS Elastic Beanstalk with a load balancer and auto scaling group. The application is a Node.js API that connects to an RDS MySQL database. After deployment, users report that the API returns a '500 Internal Server Error' intermittently. The application logs show 'ETIMEDOUT' errors when connecting to the database. The database is deployed in a private subnet with a security group that allows inbound traffic from the Elastic Beanstalk environment's security group. The database connection string uses the RDS endpoint. The same application works perfectly when deployed on-premises. What is the most likely cause?

Accepted Answer

The Elastic Beanstalk environment is in a different VPC or subnet that cannot reach the RDS instance. The intermittent 'ETIMEDOUT' errors indicate a network connectivity issue between the Elastic Beanstalk environment and the RDS database. Since the application works on-premises, the problem is specific to the AWS networking configuration. The most likely cause is that the Elastic Beanstalk environment is deployed in a different VPC or subnet that lacks routing or a VPC peering connection to reach the RDS instance's private subnet, causing timeouts when the load balancer or auto scaling group instances attempt to connect.

Answer

The database connection string uses the wrong port number

Answer

The security group attached to the RDS instance does not allow traffic from the Elastic Beanstalk environment

Answer

The RDS instance is in a failed state and needs to be rebooted

Question 15

A financial services company is deploying a PCI-DSS compliant workload in a public cloud. The deployment must include a web application (port 443) and a database (port 3306). The security requirements mandate that the web application is internet-facing, but the database must be in a private subnet with no direct internet access. The cloud administrator creates two VPCs: one for the web tier and one for the database tier. The web tier is deployed in VPC-A with a public subnet and an internet gateway. The database tier is deployed in VPC-B with a private subnet and a NAT gateway for outbound updates. The administrator configures VPC peering between VPC-A and VPC-B, and updates route tables accordingly. The web application can connect to the database, but the database cannot initiate outbound connections to the internet for updates. What is the most likely issue?

Accepted Answer

The NAT gateway in VPC-B cannot be used for internet access through a VPC peering connection. The NAT gateway in VPC-B cannot be used for internet access through a VPC peering connection because VPC peering does not support transitive routing. When the database in VPC-B tries to reach the internet via the NAT gateway, traffic must go through the VPC peering connection to VPC-A and then to the internet gateway, but VPC peering does not allow a route that forwards traffic from one VPC to another VPC's internet gateway. The database's outbound traffic to the internet is effectively blocked because the NAT gateway's default route (0.0.0.0/0) points to the internet gateway in VPC-B, but the database's traffic must first traverse the peering connection, which is not a valid path for internet-bound traffic in this architecture.

Answer

The database security group does not allow outbound traffic to the internet

Answer

The route table in VPC-B does not have a default route to the NAT gateway

Answer

The VPC peering connection does not support DNS resolution between VPCs

Question 16

A company is deploying a new web application in a hybrid cloud environment. The application must be highly available and able to handle traffic spikes. The cloud team decides to use an auto-scaling group across multiple availability zones with a load balancer. Which additional step should the team take to ensure session persistence during scaling events?

Accepted Answer

Enable sticky sessions on the load balancer. Sticky sessions (also known as session affinity) ensure that all requests from a user during a session are directed to the same backend instance. In an auto-scaling group, instances are added or removed dynamically; without sticky sessions, a load balancer using a default algorithm could route a user to a different instance after a scale-out event, losing the in-memory session state. Enabling sticky sessions on the load balancer preserves session persistence across scaling events by binding the user's session to a specific instance for its duration.

Answer

Implement a stateless application design

Answer

Increase the instance size to handle more sessions

Answer

Configure the load balancer to use a round-robin algorithm

Question 17

A cloud architect is designing a deployment for a multi-tier application that must meet compliance requirements for data residency. The application consists of a web tier, application tier, and database tier. Which TWO deployment strategies should the architect consider to ensure data remains in a specific geographic region while maintaining high availability?

Accepted Answer

Deploy across multiple availability zones in the same region. Deploying across multiple Availability Zones (AZs) within the same region ensures that application components remain within the geographic boundary required for data residency, while providing high availability through fault isolation. If one AZ fails, traffic is automatically routed to healthy instances in other AZs, maintaining uptime without leaving the region.

Answer

Set up a VPN to a neighboring region

Answer

Deploy in a single availability zone

Answer

Deploy across multiple regions

Question 18

Arrange the steps to configure a VPN connection between an on-premises network and a cloud VPC.

Question 19

Arrange the steps to implement a cloud security group that allows only specific IPs to access an application.

Question 20

Match each networking concept to its definition.