CV0-004 Operations and Support Practice Test 2 — 15 Questions

Question 1

A cloud administrator manages a hybrid cloud environment where on-premises servers connect to a VPC in AWS via a VPN connection. The on-premises network uses IP range 10.0.0.0/16. The VPC uses 172.16.0.0/16. The VPN is established and the tunnel status is UP. However, on-premises hosts cannot ping EC2 instances in the VPC. The administrator logs into an EC2 instance and can ping the on-premises VPN gateway IP. The security groups and network ACLs are configured to allow all traffic. The route tables in the VPC have a route to the on-premises network via the virtual private gateway. The on-premises firewall logs show that packets from the VPC are being dropped. What is the most likely cause?

Accepted Answer

The on-premises firewall is blocking traffic from the VPC CIDR range.. The on-premises firewall logs explicitly show that packets from the VPC are being dropped, indicating the firewall is filtering traffic from the VPC CIDR range (172.16.0.0/16). Since the VPN tunnel is UP, the EC2 instance can ping the on-premises VPN gateway IP, and security groups/network ACLs allow all traffic, the only remaining point of failure is the on-premises firewall blocking the return traffic.

Answer

The VPN tunnel is misconfigured and not passing traffic.

Answer

The security group attached to the EC2 instance is blocking inbound ICMP.

Answer

The VPC route table does not have a route to the on-premises network.

Question 2

A cloud administrator notices that a virtual machine is running out of memory and causing performance issues. The VM is part of a production web application. Which of the following actions should the administrator take FIRST to resolve the issue without impacting availability?

Accepted Answer

Perform a live migration of the VM to a host with more memory.. Option D is correct because live migration (e.g., VMware vMotion or Hyper-V Live Migration) allows the administrator to move the running VM to a host with more physical memory without any downtime, directly resolving the memory pressure while maintaining production availability. This is the only option that addresses the root cause (insufficient host memory) without stopping the VM or risking data loss.

Answer

Stop the VM and increase its memory allocation, then restart it.

Answer

Add a swap file to the VM's virtual disk.

Answer

Take a snapshot of the VM and then increase memory allocation.

Question 3

A cloud administrator is troubleshooting an issue where users from the 192.0.2.0/24 network cannot access objects in an S3 bucket. The bucket policy is shown in the exhibit. What is the most likely cause of the issue?

Accepted Answer

The policy does not grant the s3:ListBucket action.. The bucket policy grants s3:GetObject but not s3:ListBucket. Without s3:ListBucket, users cannot list the objects in the bucket, so they cannot discover the object keys needed to access objects. Even if they know the exact object key, the missing ListBucket action prevents the initial listing operation, which is required for many S3 access patterns.

Answer

The condition uses an incorrect IP address format.

Answer

The policy is missing a required statement ID.

Answer

The resource ARN does not include the bucket itself.

Question 4

A cloud engineer is deploying a new application that requires high availability. The solution must include automated failover and load balancing. Which TWO of the following should the engineer implement?

Accepted Answer

Configure an auto scaling group with a minimum of two instances across two availability zones.. Option A is correct because deploying an auto scaling group with a minimum of two instances across two availability zones ensures that if one instance or zone fails, the other can continue serving traffic, providing high availability. This setup also supports automated failover by replacing unhealthy instances automatically, and it works with a load balancer to distribute traffic. The combination of multi-AZ placement and auto scaling is a foundational pattern for fault-tolerant architectures in cloud environments.

Answer

Take daily snapshots of the instance and store them in a different region.

Answer

Configure a read replica in a different region for failover.

Answer

Deploy the application on a single large instance with more resources.

Question 5

A cloud engineer notices that a virtual machine (VM) in a public cloud environment is consistently running at 90% CPU during business hours. The VM hosts a customer-facing web application. Which of the following is the BEST initial troubleshooting step?

Accepted Answer

Review the VM's performance metrics and application logs.. Option B is correct because the initial step in troubleshooting high CPU usage is to gather diagnostic data. Reviewing the VM's performance metrics (e.g., CPU utilization, memory, disk I/O) and application logs helps identify whether the issue is caused by a legitimate workload spike, a memory leak, or a misconfiguration. This aligns with the 'identify before act' principle in cloud operations, ensuring the engineer understands the root cause before making changes.

Answer

Migrate the VM to a different availability zone.

Answer

Reboot the VM to reset resource usage.

Answer

Scale up the VM to a larger instance size.

Question 6

A company is designing a disaster recovery (DR) plan for a critical application hosted in a public cloud. The application requires a recovery time objective (RTO) of 1 hour and a recovery point objective (RPO) of 15 minutes. Which of the following DR strategies BEST meets these requirements?

Accepted Answer

Warm standby with continuous data replication.. Warm standby with continuous data replication meets the RTO of 1 hour and RPO of 15 minutes because it maintains a partially scaled-down replica of the production environment that can be quickly scaled up, and continuous replication (e.g., using asynchronous replication or Change Block Tracking) ensures data loss is limited to seconds or minutes, well within the 15-minute RPO.

Answer

Backup and restore with daily backups.

Answer

Cold standby with nightly backups.

Answer

Pilot light with hourly snapshots.

Question 7

A cloud administrator is troubleshooting a performance issue where an application running on a VM in a private cloud is experiencing high latency. The VM is connected to a virtual switch that uses SR-IOV. The administrator suspects network bottlenecks. Which of the following is the MOST likely cause of the latency?

Accepted Answer

The physical network interface card (NIC) is saturated.. SR-IOV allows a physical NIC to present multiple virtual functions (VFs) directly to VMs, bypassing the virtual switch for data plane traffic. When the physical NIC reaches its bandwidth capacity, all VFs sharing that NIC experience increased latency and packet drops, making NIC saturation the most likely cause of the high latency.

Answer

The virtual switch is dropping packets due to buffer exhaustion.

Answer

The VM's virtual NIC is not using the correct driver.

Answer

The hypervisor's CPU is overloaded due to SR-IOV emulation.

Question 8

Which TWO of the following are best practices when configuring a cloud-based virtual private cloud (VPC) for a multi-tier application?

Accepted Answer

Place each application tier in a separate subnet.. Option A is correct because placing each application tier (e.g., web, application, database) in a separate subnet allows you to apply distinct network access control lists (NACLs) and security groups per tier. This segmentation enforces the principle of least privilege, ensuring that only the web tier can communicate with the application tier on specific ports, and only the application tier can reach the database tier. It also isolates failures and simplifies troubleshooting by containing traffic within defined network boundaries.

Answer

Disable VPC flow logs to reduce costs.

Answer

Use the default security group for all instances.

Answer

Place all instances in the same subnet for simplicity.

Question 9

Which THREE of the following are common causes of cloud resource provisioning failures?

Accepted Answer

Insufficient service quotas.. Option A is correct because cloud providers enforce service quotas (e.g., AWS Service Quotas, Azure subscription limits, GCP project quotas) that cap the number of resources you can provision per region or account. When a provisioning request exceeds these quotas, the API call fails with an explicit error (e.g., AWS 'LimitExceeded' or Azure 'QuotaExceeded'). This is a common failure mode, especially in automated scaling or CI/CD pipelines.

Answer

Disk encryption settings.

Answer

Incorrect resource tagging.

Question 10

A cloud engineer is troubleshooting a web application that is not responding. The engineer examines the serial console output of the web-server instance and finds the error shown in the exhibit. What is the MOST likely cause of this issue?

Accepted Answer

A firewall rule is blocking traffic to the metadata server IP address 169.254.169.254.. The error shown in the serial console output indicates that the instance cannot reach the metadata server at 169.254.169.254. This IP address is a link-local address used by cloud providers (e.g., AWS, GCP, Azure) to serve instance metadata, including user data scripts. If a firewall rule blocks traffic to this IP, the instance cannot retrieve its user data, causing the web application to fail to start or respond.

Answer

The service account associated with the instance is missing the required permissions.

Answer

The instance is in a STOPPED state and cannot execute user data scripts.

Answer

The instance does not have a public IP address assigned.

Question 11

A cloud engineer deploys the Kubernetes manifest shown in the exhibit. After deployment, the frontend pods are in CrashLoopBackOff state. The engineer checks the logs and finds 'OOMKilled' errors. Which of the following changes would resolve the issue?

Accepted Answer

Increase the memory limit to 1Gi.. The 'OOMKilled' error indicates the container's memory usage exceeded its configured limit, causing the kernel's Out-Of-Memory (OOM) killer to terminate the process. Increasing the memory limit to 1Gi provides the container with more memory headroom, preventing the OOM kill and allowing the pod to run without crashing.

Answer

Increase the number of replicas to 5.

Answer

Reduce the CPU limit to 250m.

Answer

Change the service type to ClusterIP.

Question 12

A cloud administrator is managing a hybrid cloud environment where on-premises servers connect to a public cloud VPC via a site-to-site VPN. Users report intermittent connectivity issues to cloud resources. The administrator examines the VPN tunnel logs and sees 'Phase 2 negotiation failed' errors. Which of the following is the MOST likely cause?

Accepted Answer

Mismatched encryption domain definitions (traffic selectors) between on-premises and cloud VPN gateways.. Phase 2 negotiation failures in IPsec VPNs indicate that the two gateways cannot agree on the security associations (SAs) for encrypting data traffic. This is most commonly caused by mismatched encryption domain definitions (traffic selectors), such as differing local/remote subnets, protocols, or ports. When the on-premises and cloud VPN gateways define the allowed traffic differently, they cannot establish the Phase 2 SA, leading to intermittent connectivity.

Answer

Dead Peer Detection (DPD) is disabled on one side.

Answer

Incorrect pre-shared key used for the VPN tunnel.

Answer

Packet loss due to high latency on the internet link.

Question 13

A cloud operations team receives an alert that the CPU usage of a VM has exceeded 90% for the past 30 minutes. The VM is part of an auto-scaling group configured to scale out when CPU exceeds 80% for 5 minutes. However, no new instances have been launched. What is the MOST likely reason the auto-scaling failed to trigger?

Accepted Answer

The auto-scaling group is in a cooldown period after a previous scaling action.. The auto-scaling group failed to trigger because it was in a cooldown period after a previous scaling action. Cooldown periods are designed to prevent rapid, successive scaling events that could destabilize the environment. During this time, the auto-scaling group ignores new alarms, even if the CPU threshold is exceeded, until the cooldown timer expires.

Answer

The VM failed a health check and is being replaced.

Answer

The auto-scaling group has reached the minimum instance count.

Answer

The CPU threshold is set too high.

Question 14

A cloud engineer notices that a virtual machine running a critical application is experiencing high CPU usage. The engineer needs to resolve the issue without affecting other VMs on the same host. Which of the following actions should the engineer take first?

Accepted Answer

Migrate the VM to another host in the cluster.. Migrating the VM to another host in the cluster (option C) is the correct first action because it immediately offloads the CPU pressure from the current host without impacting the VM's operation or other VMs. This leverages VMware vMotion or Microsoft Hyper-V Live Migration to move the running VM to a less-utilized host, isolating the performance issue while preserving uptime and avoiding resource contention.

Answer

Restart the VM to clear the high CPU usage.

Answer

Increase the CPU allocation for the VM.

Answer

Add another VM to the same host to distribute load.

Question 15

A company runs a web application on three virtual machines behind a load balancer. During a traffic spike, one VM becomes unresponsive. The load balancer continues sending traffic to it, causing errors. Which configuration change would prevent this issue in the future?

Accepted Answer

Configure health checks on the load balancer.. Health checks allow the load balancer to periodically probe the status of each backend VM (e.g., via HTTP GET or TCP SYN). If a VM fails a configurable number of consecutive checks, the load balancer automatically marks it as unhealthy and stops routing traffic to it, preventing errors during a spike. This is the standard mechanism in AWS ELB, Azure Load Balancer, and HAProxy to detect and isolate failed instances.

Answer

Set a longer connection timeout on the load balancer.

Answer

Increase the number of VMs to five.

Answer

Change the load balancing algorithm to round-robin.