CV0-004 Deployment Practice Test 4 — 15 Questions

Question 1

A cloud administrator is debugging a failed CloudFormation stack creation. The exhibit shows the stack events. What is the most likely cause of the failure?

Accepted Answer

The referenced security group does not exist in the chosen VPC.. The stack creation fails with a 'CREATE_FAILED' status on the security group resource, and the error message indicates that the security group does not exist in the specified VPC. This is a common issue when a CloudFormation template references a security group by ID or name that is not present in the target VPC, causing the resource creation to fail. The stack events show the security group resource as the point of failure, confirming that the referenced security group is missing.

Answer

The instance type is not supported in the region.

Answer

The stack name already exists.

Answer

The AMI ID is incorrect.

Question 2

A DevOps engineer is deploying an application on Kubernetes. The exhibit shows the status of pods and a describe output. The frontend pod is stuck in Pending state. Which action should the engineer take to resolve the issue?

Accepted Answer

Reduce the resource requests in the frontend deployment manifest.. The frontend pod is stuck in Pending state because the cluster nodes lack sufficient resources (CPU or memory) to satisfy the pod's resource requests. Reducing the resource requests in the deployment manifest lowers the scheduling threshold, allowing the pod to fit on an available node. This directly addresses the most common cause of Pending pods: insufficient allocatable resources on any node.

Answer

Add a node affinity rule to schedule on nodes with more memory.

Answer

Change the service type from ClusterIP to NodePort.

Answer

Modify the image pull policy to Always.

Question 3

A cloud engineer is reviewing a Terraform configuration for deploying a web server. The instance is created successfully, but the web server does not start. What is the most likely cause?

Accepted Answer

The security group does not allow inbound HTTP traffic.. Option D is correct because the user_data script uses yum, which is for Amazon Linux or CentOS, but the AMI ID likely corresponds to an Amazon Linux 2 instance. However, the user_data script is not automatically executed if the AMI does not support cloud-init with the correct user data type. But more directly, the script has no shebang? Actually it does have #!/bin/bash. But the most common issue is that the security group does not allow HTTP traffic. The exhibit does not show security group rules. Therefore, the most likely cause among options is that the security group does not allow inbound HTTP (option D). Option A might be true if the script fails, but it seems plausible. Option B: AMI is for different OS. Option C: subnet may be incorrect but instance launched. Given typical exam scenarios, security group misconfiguration is a frequent issue. I'll go with D. But let's think: The script uses yum, which is typical for Amazon Linux. The AMI id is example. The issue is that user_data may not execute if not properly configured? Actually cloud-init typically executes scripts. But the options: A: script missing execute permission? User data is passed as text, no permissions needed. B: wrong AMI? Could be, but the script uses yum, which is available on Amazon Linux. C: subnet not public? The instance may not have public IP. But the web server not starting could be because the security group blocks HTTP. That is common. I'll choose D.

Answer

The subnet is in a private zone without internet access.

Answer

The AMI ID is for a Windows instance, but the script uses yum.

Answer

The user_data script lacks execute permissions.

Question 4

A company wants to migrate its existing on-premises web application to the cloud to reduce operational overhead. The application runs on a custom Linux distribution with specific kernel modules. Which cloud deployment model would best minimize the need to refactor the application while still reducing maintenance of the underlying infrastructure?

Accepted Answer

Infrastructure as a Service (IaaS). IaaS (Infrastructure as a Service) provides virtualized compute resources where you retain full control over the operating system, including custom Linux distributions and kernel modules. This allows you to migrate the application as-is without refactoring, while the cloud provider handles the underlying physical infrastructure maintenance, such as hardware failures and network cabling.

Answer

Container as a Service (CaaS)

Answer

Platform as a Service (PaaS)

Answer

Software as a Service (SaaS)

Question 5

Users are unable to load a web page on a newly deployed web server. The security group for the server allows inbound HTTP from 0.0.0.0/0. The web service is running and listening on port 80. Which of the following is the MOST likely cause?

Accepted Answer

The web server is listening on the wrong IP address.. Option D is correct because if the web server is listening on an IP address other than the one clients are reaching (e.g., 127.0.0.1 or a different private IP), inbound HTTP requests will not be processed even though the security group allows traffic on port 80. This is a common misconfiguration where the server binds to a loopback or incorrect interface, causing it to ignore external packets.

Answer

The DNS record for the domain is not yet propagated.

Answer

The VM's firewall is blocking inbound requests on port 80.

Answer

The load balancer target group is unhealthy.

Question 6

An organization is migrating a legacy monolithic application to the cloud using a re-platform approach (lift and shift with minimal changes). After migration, performance is worse than on-premises. Which of the following is the BEST next step to improve performance without significant application changes?

Accepted Answer

Increase the size of the virtual machines and allocate more vCPUs.. In a re-platform (lift and shift) migration, the application's architecture remains unchanged, so performance issues often stem from insufficient cloud resources. Increasing the VM size and allocating more vCPUs directly addresses resource contention without requiring code modifications, making it the best immediate step.

Answer

Refactor the application into microservices and use Kubernetes.

Answer

Move the application to a containerized environment using Docker.

Answer

Implement a content delivery network (CDN) to cache static assets.

Question 7

A company is deploying a cloud-based application that requires consistent, low-latency access to shared database files. Which storage option should be used for the database files?

Accepted Answer

Block storage volumes attached to the database server. Block storage volumes (e.g., Amazon EBS or Azure Managed Disks) provide consistent, low-latency I/O performance because they are directly attached to the database server via a high-speed network and support protocols like NVMe or SCSI. This allows the database to perform synchronous writes and reads with minimal jitter, which is critical for transactional workloads that require ACID compliance. Unlike shared file systems or object storage, block storage offers the raw disk-level access that database engines (e.g., MySQL, PostgreSQL, SQL Server) expect for their data and log files.

Answer

Network file system (NFS) mount

Answer

Object storage (e.g., Amazon S3)

Answer

Ephemeral instance storage

Question 8

During a cloud deployment, a virtual machine is created from a custom image. After boot, the VM is not accessible via SSH. Which of the following should the administrator check FIRST?

Accepted Answer

The security group rules for inbound SSH. The most common reason a newly deployed VM is inaccessible via SSH is that the security group or network ACL does not permit inbound TCP port 22 traffic. Security groups act as a virtual firewall at the instance level, and if the rule allowing SSH from the administrator's IP is missing or misconfigured, the connection will be refused. This should be the first check because it is a frequent misconfiguration during deployment.

Answer

The boot volume is encrypted

Answer

The hypervisor version compatibility

Answer

The image's OS license activation status

Question 9

A Kubernetes StatefulSet is deployed to run a database. The pods are stuck in pending state. The administrator checks and finds that the PersistentVolumeClaim is not bound to any PersistentVolume. Which of the following is the MOST likely cause?

Accepted Answer

The PV is already bound to another PVC.. When a PersistentVolumeClaim (PVC) remains unbound, the most common cause is that no PersistentVolume (PV) matches its requirements. If a PV is already bound to another PVC, it cannot be reused unless released and reclaimed. This leaves the PVC in a pending state, preventing the StatefulSet pods from starting.

Answer

The PVC and PV have different access modes.

Answer

The PVC requests storage size that exceeds available PV capacity.

Answer

The storage class provisioner is not installed.

Question 10

A cloud architect is designing an auto-scaling policy for a web application that experiences predictable traffic spikes every weekday morning from 8 to 10 AM. The application runs on a group of virtual machines behind a load balancer. Which scaling approach is MOST cost-effective while ensuring performance during the spike?

Accepted Answer

Scheduled scaling to increase capacity before 8 AM and decrease after 10 AM. Scheduled scaling is the most cost-effective approach because the traffic pattern is predictable (every weekday 8–10 AM). By configuring the auto-scaling group to add instances before the spike and remove them after, you avoid paying for idle resources during off-peak hours while ensuring capacity is ready when needed. This approach directly matches the known schedule without relying on reactive metrics or manual intervention.

Answer

Dynamic scaling based on CPU utilization threshold

Answer

Proactive scaling using machine learning to predict spikes

Answer

Manual scaling by the operations team each morning

Question 11

A startup wants to develop a new web application with minimal upfront infrastructure management. They want to focus on writing code and not worry about operating system patches or scaling servers. Which cloud service model is MOST appropriate?

Accepted Answer

Platform as a Service (PaaS). Platform as a Service (PaaS) provides a managed platform where the startup can deploy and run their web application code without managing the underlying infrastructure, including operating system patches and server scaling. This aligns with the requirement to focus on writing code while the cloud provider handles the operational overhead.

Answer

Functions as a Service (FaaS)

Answer

Infrastructure as a Service (IaaS)

Answer

Software as a Service (SaaS)

Question 12

An e-commerce company is deploying a disaster recovery solution across two cloud regions. The primary region runs the production workload. The recovery region should have a fully provisioned environment that can take over immediately in case of a failure. Which deployment strategy BEST meets this requirement while minimizing costs?

Accepted Answer

Warm standby in the recovery region. Warm standby is the correct strategy because it maintains a fully provisioned, scaled-down copy of the production environment in the recovery region that can be activated immediately upon failover. This meets the requirement for immediate takeover while minimizing costs by running only the essential resources (e.g., a minimal number of compute instances, a standby database) instead of a full active-active deployment.

Answer

Backup and restore to the recovery region upon failure

Answer

Multi-site active-active with load balancers

Answer

Pilot light with minimal resources running in recovery

Question 13

A company is considering a multi-cloud deployment to avoid vendor lock-in. Which TWO factors should they consider? (Select TWO.)

Accepted Answer

Consistent security policies across clouds. Option B is correct because consistent security policies across clouds ensure a unified security posture, which is critical for compliance and risk management in a multi-cloud environment. Without consistent policies, vulnerabilities can arise from misconfigurations or gaps in coverage between providers. Option C is correct because data egress costs between clouds can be significant, as each cloud provider charges for data leaving their network, and these costs must be factored into the total cost of ownership to avoid budget overruns.

Answer

Unified management tools support

Answer

Performance differences between providers

Answer

Software licensing compatibility

Question 14

A DevOps team is implementing an automated deployment pipeline for a cloud application. Which THREE steps are essential components of a continuous delivery pipeline? (Select THREE.)

Accepted Answer

Deploying to a staging environment for integration tests. Option A is correct because deploying to a staging environment for integration tests is a core step in a continuous delivery pipeline. It validates that the application works correctly in an environment that mirrors production before any release decision is made, ensuring that integration and end-to-end tests can run safely without impacting live users.

Answer

Deploying to production automatically without approval

Answer

Monitoring and rollback capability

Question 15

A hybrid cloud deployment connects an on-premises data center to a public cloud. Which TWO components are typically required to establish this connectivity? (Select TWO.)

Accepted Answer

Direct peering or dedicated connection (e.g., AWS Direct Connect). Option B is correct because a dedicated connection like AWS Direct Connect provides a private, high-bandwidth, low-latency link between an on-premises data center and a public cloud, bypassing the public internet for consistent performance and security. Option C is correct because a VPN gateway establishes an encrypted tunnel over the public internet (using protocols like IPsec) to securely connect the on-premises network to the cloud VPC, which is a standard requirement for hybrid cloud connectivity.

Answer

Load balancer in the cloud

Answer

Public internet with HTTPS

Answer

Cloud-based DNS resolver