CV0-004 Operations and Support Practice Test 11 — 15 Questions

Question 1

A cloud administrator notices that a cloud-based web application is experiencing intermittent latency during peak hours. The application runs on an auto-scaling group of virtual machines behind a load balancer. Which of the following should the administrator investigate FIRST to resolve the issue?

Accepted Answer

Review the auto-scaling group's scaling policies and thresholds. The intermittent latency during peak hours is most likely caused by the auto-scaling group's scaling policies not reacting quickly enough or being set with thresholds that are too high, leading to insufficient capacity under load. Investigating the scaling policies and thresholds first directly addresses the root cause—whether the group is adding instances too slowly or at too high a utilization trigger—rather than symptoms like health checks or DNS. This aligns with the operational best practice of verifying capacity management before tuning network or load-balancer settings.

Answer

Enable SSL offloading on the load balancer

Answer

Verify the load balancer's health check interval

Answer

Check DNS resolution times for the application domain

Question 2

A company is migrating its on-premises database to a cloud-managed database service. The database contains sensitive financial data. Which of the following is the MOST important security configuration to implement after migration?

Accepted Answer

Enable encryption at rest using a customer-managed key. Option C is correct because encryption at rest protects data in the database storage. Option A is wrong because patching is important but not the most critical for security after migration. Option B is wrong because public access should be disabled, not enabled. Option D is wrong because replication is for availability, not security.

Answer

Configure automated patching schedule

Answer

Enable public read access for monitoring tools

Answer

Set up cross-region replication for high availability

Question 3

An organization has a hybrid cloud environment with resources in both a private cloud and a public cloud. The operations team reports that the cloud management platform cannot collect monitoring data from the public cloud instances. The security team recently updated firewall rules. Which of the following is the MOST likely cause?

Accepted Answer

The public cloud instances cannot reach the management platform's IP address due to firewall changes. The security team's recent firewall rule update is the most likely cause because the cloud management platform typically uses specific ports and protocols (e.g., HTTPS on TCP 443, SSH on TCP 22, or WinRM on TCP 5985/5986) to collect monitoring data from public cloud instances. If the firewall rules block outbound traffic from the public cloud instances to the management platform's IP address, or block inbound traffic from those instances at the platform's side, the data collection will fail. This directly aligns with the reported symptom of the management platform being unable to collect monitoring data after a firewall change.

Answer

The load balancer in front of the management platform is misconfigured

Answer

The SNMP community string was modified on the instances

Answer

The management platform's NAT IP address was changed

Question 4

A cloud engineer needs to deploy a stateless application across multiple availability zones. The application must scale horizontally based on CPU utilization. Which of the following is the BEST configuration?

Accepted Answer

Create an auto-scaling group spanning multiple zones with a load balancer. Option A is correct because auto-scaling groups across zones with a load balancer provide high availability and scaling. Option B is wrong: vertical scaling is not horizontal. Option C is wrong: manual scaling is not automated. Option D is wrong: spot instances may be terminated, causing instability.

Answer

Deploy a single large instance and increase its size as needed

Answer

Use a managed container service and manually add containers

Answer

Deploy instances in one zone using spot instances to reduce cost

Question 5

A company uses a cloud object storage service to store backup data. The cloud provider charges for storage and retrieval. The operations team wants to minimize costs while ensuring data is available within 24 hours of a restore request. Which storage tier should they use?

Accepted Answer

Cold storage tier with retrieval time of 12 hours. Option C is correct because the cold storage tier offers a retrieval time of 12 hours, which meets the requirement of making data available within 24 hours while minimizing costs compared to hotter tiers. Cold storage is designed for infrequently accessed data with longer retrieval times, providing a cost-effective balance between availability and expense for backup data that does not need immediate access.

Answer

Archive storage tier with retrieval time of 48 hours

Answer

Hot storage tier

Answer

Infrequent access tier with retrieval time of 1 hour

Question 6

A cloud administrator is troubleshooting a connectivity issue between two virtual networks in different cloud regions. The networks are connected via a VPN gateway. The administrator can ping resources in one network but not the other. Which of the following should the administrator check FIRST?

Accepted Answer

Review the route tables on both sides for the remote network prefix. Option D is correct: route tables must have entries for the remote network. Option A is wrong because ping is already working in one direction, so VPN tunnel is up. Option B is wrong: NSGs affect traffic but routes are more fundamental. Option C is wrong: if both sides have local NICs configured, routing is the next step.

Answer

Confirm the local network gateways have the correct NIC IP addresses

Answer

Verify the VPN tunnel status on both gateways

Answer

Check network security groups for blocking ICMP

Question 7

A cloud engineer is tasked with automating the deployment of a three-tier application. The engineer wants to ensure that the database tier is not directly accessible from the internet but can be reached by the application tier. Which of the following should be implemented?

Accepted Answer

Place the database tier in a private subnet and configure a security group to allow traffic only from the application tier. Option C is correct: placing the database tier in a private subnet with a network security group allowing only the app tier. Option A is wrong: public subnet would expose the database. Option B is wrong: a single subnet could still have NSGs but doesn't enforce isolation. Option D is wrong: a VPN for database access is overkill and introduces latency.

Answer

Use the same subnet for all tiers and allow traffic via security groups

Answer

Place the database tier in a public subnet with a restrictive security group

Answer

Connect the database tier to a site-to-site VPN and disable public access

Question 8

A company experiences a cloud service outage that affects multiple customers. The cloud provider publishes a post-incident report identifying the root cause. As a cloud administrator, which of the following actions should be taken to prevent recurrence?

Accepted Answer

Design the application to be deployed across multiple availability zones or regions. Option C is correct because designing the application for multi-AZ or multi-region deployment ensures high availability and fault tolerance, which directly mitigates the impact of a single cloud provider's infrastructure failure. This architectural pattern leverages redundancy to maintain service continuity even when one availability zone or region experiences an outage, preventing recurrence of customer-facing downtime.

Answer

Request a service credit from the provider for the outage

Answer

Submit a formal complaint to the cloud provider's regulatory body

Answer

Migrate all workloads to a different cloud provider immediately

Question 9

A cloud administrator is managing a fleet of virtual machines that run a batch processing job. The job is memory-intensive and runs once a day. The administrator wants to optimize cost without affecting performance. Which of the following is the BEST approach?

Accepted Answer

Use a mix of reserved instances for the minimum required capacity and spot instances to handle the daily workload. Option A is correct: using a combination of reserved instances for baseline and spot instances for spikes reduces cost. Option B is wrong: on-demand is most expensive. Option C is wrong: dedicated hosts are costly and unnecessary. Option D is wrong: shutting down manually is inefficient and may miss jobs.

Answer

Purchase dedicated hosts to ensure resource isolation

Answer

Manually shut down instances when the job completes

Answer

Use only on-demand instances to avoid commitment

Question 10

Refer to the exhibit. A cloud engineer is reviewing logs from an EC2 instance. Which of the following is the MOST likely root cause of the application failure?

Accepted Answer

The disk space reached 100% capacity, preventing the application from writing logs. When disk space reaches 100% capacity, the operating system cannot write new data to the filesystem. Since the application relies on writing logs (and potentially other data) to disk, it will fail when it cannot perform these write operations. This is a common root cause in cloud environments where log rotation is not configured or monitoring thresholds are not set.

Answer

The application experienced a segmentation fault due to a code bug

Answer

The instance ran out of memory because the application had a memory leak

Answer

The instance was stopped by the cloud provider due to a license violation

Question 11

Which TWO of the following are benefits of using a content delivery network (CDN) with cloud-hosted applications? (Choose two.)

Accepted Answer

Reduces load on the origin server. Options B and E are correct. CDN reduces latency by caching content at edge locations (B) and reduces origin server load (E). Option A is wrong because CDN typically increases complexity, not simplifies. Option C is wrong: CDN may add cost. Option D is wrong: security is not inherently increased; CDN can provide DDoS protection but is not a built-in benefit.

Answer

Simplifies application architecture

Answer

Eliminates the need for HTTPS encryption

Answer

Lowers overall infrastructure cost

Question 12

Which THREE of the following are recommended practices for securing cloud API access? (Choose three.)

Accepted Answer

Use role-based access control to limit permissions for each API user. Options A, C, and D are correct. API keys should be rotated regularly (A), access should be logged and monitored (C), and principle of least privilege should be applied (D). Option B is wrong: hardcoding keys is insecure. Option E is wrong: public exposure increases risk.

Answer

Embed API keys directly in application source code for convenience

Answer

Expose API endpoints publicly for easy access by all clients

Question 13

Which THREE of the following are common causes of VM migration failures in a cloud environment? (Choose three.)

Accepted Answer

Incompatible CPU instruction sets or features between source and target hosts. Options A, C, and D are correct. Incompatible CPU features (A) can cause migration failures, insufficient storage capacity (C) on target, and network connectivity issues (D) between hosts. Option B is wrong: stale DNS records may cause name resolution problems but not migration failure. Option E is wrong: license checks may block migration but are less common than resource issues.

Answer

Expired software licenses on the target host

Answer

Stale DNS records for the VM's hostname

Question 14

Your organization operates a three-tier web application hosted on a public cloud platform. The application tier consists of an auto-scaling group of virtual machines running a custom web service. The database tier is a managed MySQL service. Recently, users have reported slow response times during business hours, especially when the application performs write operations. Reviewing the monitoring dashboards shows that the CPU utilization on the application instances averages 80% and the database connection pool is consistently maxed out at 200 connections. The auto-scaling group is configured to add instances when CPU exceeds 70% for 5 minutes, but scaling events are not triggering as expected. The application team has confirmed that there are no code changes in the last week. You check the CloudWatch alarms and see no metric alarms for CPU. What is the MOST likely reason the auto-scaling group is not scaling out?

Accepted Answer

The CPU metric alarm that triggers the scaling policy has been deleted or never configured. Option A is correct: without a CPU alarm configured, the scaling policy has no trigger. Option B is wrong: scaling cool-down only delays after a scaling event, but no event occurs. Option C is wrong: health checks are for instance health, not scaling. Option D is wrong: instance count limit would prevent scaling after attempts, but policy would still trigger.

Answer

The auto-scaling group has reached the maximum instance count

Answer

The auto-scaling group has a default cooldown period that is too long

Answer

The application instances are not responding to health checks

Question 15

A company recently migrated its on-premises backup server to a cloud virtual machine running Windows Server with a dedicated data disk for backups. The backup software is configured to write to a folder on the data disk. After two weeks, the backup jobs start failing with 'disk full' errors. The cloud engineer logs into the VM and verifies that the data disk has 500 GB of total space and the backup folder shows only 300 GB used. However, the operating system reports the disk as 100% full. The engineer also notices that the recycle bin on the data disk appears to be empty. Which of the following is the MOST likely cause of the discrepancy?

Accepted Answer

Shadow copies (Volume Shadow Copies) are consuming space on the data disk. Option A is correct: previous backups moved to the system volume shadow copy (VSS) snapshots can consume hidden space. Option B is wrong: VSS and system protection are separate from the recycle bin. Option C is wrong: cloud storage limits affect object storage, not VM disks. Option D is wrong: compression would reduce used space, not increase it.

Answer

The cloud provider has imposed a quota on the disk's storage capacity that is lower than the provisioned size

Answer

The recycle bin on the data disk contains deleted backup files that are not counted

Answer

The backup software is compressing data, causing the disk to appear full due to index fragmentation