CV0-004 Operations and Support — Timed 40 Questions

Question 1

A cloud administrator notices that a virtual machine running a critical application is using 95% CPU consistently. The application is single-threaded and performance is degraded. Which action should the administrator take to resolve the issue?

Accepted Answer

Migrate the VM to a host with a higher CPU clock speed.. The application is single-threaded, meaning it can only utilize one CPU core at a time. Increasing the CPU clock speed directly improves the processing speed of that single thread, which resolves the performance degradation. Option C is correct because migrating to a host with a higher CPU clock speed provides a faster core for the single-threaded workload.

Answer

Deploy additional VMs and load balance the application.

Answer

Increase the RAM allocation to the VM.

Answer

Increase the number of vCPUs assigned to the VM.

Question 2

A cloud engineer needs to ensure that a web application can scale out automatically during traffic spikes. Which design best practice should be implemented?

Accepted Answer

Configure an auto scaling group with a load balancer.. Option D is correct because an auto scaling group combined with a load balancer automatically adds or removes VM instances based on predefined metrics (e.g., CPU utilization, request count), ensuring the web application scales out horizontally during traffic spikes without manual intervention. This aligns with cloud elasticity best practices for handling variable workloads.

Answer

Deploy a larger instance size.

Answer

Use a single powerful VM with more vCPUs.

Answer

Manually provision additional VMs during peak times.

Question 3

A company uses a hybrid cloud model with an on-premises data center and a public cloud. The network team reports that traffic between the cloud and on-premises is experiencing high latency and packet loss. The cloud administrator verifies that the VPN connection is up. What is the most likely cause?

Accepted Answer

The VPN tunnel has a mismatched MTU size.. When a VPN tunnel is up but traffic experiences high latency and packet loss, a mismatched Maximum Transmission Unit (MTU) size is a common cause. This occurs because packets larger than the tunnel's MTU must be fragmented, and if fragmentation is not properly handled (e.g., due to the DF bit being set), packets are dropped, leading to retransmissions and increased latency. The symptoms align with MTU issues rather than simple connectivity or throttling problems.

Answer

A firewall rule is blocking ICMP packets.

Answer

VMs are placed in different cloud regions.

Answer

The cloud provider is throttling bandwidth.

Question 4

Which TWO metrics should be monitored to determine if a cloud database is experiencing a memory bottleneck?

Accepted Answer

Swap usage. Swap usage (B) is a direct indicator of memory pressure; when the operating system moves memory pages to disk, it signals that the database cannot fit its working set in RAM, causing severe performance degradation. Page faults per second (E) measures how often the database must retrieve memory pages from disk; a sustained high rate indicates the buffer pool is too small for the workload, confirming a memory bottleneck.

Answer

Network bytes sent

Answer

Average disk queue length

Answer

Disk latency

Question 5

A cloud administrator is troubleshooting an application that fails to connect to a database. The application and database are in the same VPC. Which THREE steps should the administrator take to diagnose the issue?

Accepted Answer

Test connectivity to the database using a telnet or netcat command from the application server.. Option B is correct because telnet or netcat can test basic TCP connectivity to the database port, confirming whether the database is reachable from the application server at the network layer. This step isolates whether the issue is a network connectivity problem versus an authentication or configuration issue within the database itself.

Answer

Check the routing table for a route to the internet.

Answer

Check the DNS resolution of the database endpoint in the application's subnet.

Question 6

A cloud administrator is planning a migration of on-premises workloads to the cloud. Which TWO factors should be considered when selecting the appropriate cloud service model (IaaS, PaaS, SaaS)?

Accepted Answer

The level of control required over the operating system and runtime environment.. Option B is correct because the level of control over the operating system and runtime environment is a defining factor when choosing between IaaS, PaaS, and SaaS. IaaS provides full control over the OS and runtime, PaaS abstracts the OS and runtime but allows control over application deployment, and SaaS offers no control over the underlying infrastructure. This directly impacts migration decisions, especially for legacy applications that require specific OS configurations or custom runtime dependencies.

Answer

The scalability requirements of the application.

Answer

The security compliance requirements for data at rest.

Answer

The total cost of ownership compared to on-premises.

Question 7

A company experienced a security breach where an attacker gained access to an S3 bucket containing sensitive data. The investigation reveals that the bucket policy allowed public access. Which THREE measures should be implemented to prevent future occurrences?

Accepted Answer

Implement bucket policies that require requests to include specific IP address conditions.. Option A is correct because implementing bucket policies that require requests to include specific IP address conditions restricts access to the S3 bucket to only those requests originating from trusted IP ranges. This is a form of network-level access control that, when combined with other measures, helps prevent unauthorized public access by ensuring that even if the bucket policy is misconfigured, only traffic from approved networks can reach the bucket.

Answer

Enable default encryption for all S3 buckets.

Answer

Enable multi-factor authentication (MFA) for all IAM users.

Question 8

An organization uses a cloud-based load balancer to distribute traffic to a web application across multiple availability zones. Users report that the application is intermittently unavailable. The cloud administrator finds that the load balancer health checks are failing on instances in one availability zone. What is the most likely cause?

Accepted Answer

The availability zone is experiencing a partial outage.. When health checks fail for all instances in a single availability zone (AZ) while other AZs remain healthy, the most likely cause is a partial outage or degradation within that AZ. Cloud providers like AWS, Azure, or GCP isolate AZs to prevent single points of failure, but an AZ can experience issues such as network connectivity loss, power disruption, or hardware failures that affect all instances in that zone. The load balancer's health checks are designed to detect such zone-level failures by probing each instance; if an entire AZ is impaired, all its instances will fail the health check simultaneously.

Answer

A single instance in the failing AZ has a misconfigured web server.

Answer

The DNS settings for the application domain are misconfigured.

Answer

The load balancer's listener configuration is incorrect.

Question 9

A cloud administrator needs to automate the patching of operating systems on a fleet of EC2 instances. Which AWS service should be used?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager automates the process of patching managed nodes with both security-related and other types of updates. It uses a patch baseline to define which patches should be installed and can schedule patching across a fleet of EC2 instances, making it the correct service for this task.

Answer

AWS Update Manager

Answer

AWS Config

Answer

Amazon Inspector

Question 10

A company runs a containerized application on a Kubernetes cluster. The application logs indicate occasional 'CrashLoopBackOff' errors. The developer says the application works fine locally. What is the most likely cause in the cloud environment?

Accepted Answer

The memory limit set in the pod spec is too low, causing the container to be OOMKilled.. The 'CrashLoopBackOff' error indicates that the container is repeatedly crashing after startup. Since the application works locally, the issue is likely environmental. A memory limit set too low in the pod spec causes the container to exceed its allowed memory, triggering an OOMKill (Out of Memory Kill) by the kubelet. The container restarts, fails again, and enters CrashLoopBackOff, which is a common cloud-specific resource constraint not present in local development.

Answer

The readiness probe is misconfigured and returning false.

Answer

The container image is not being pulled correctly from the registry.

Answer

The persistent volume claim is not bound to a storage class.

Question 11

A cloud engineer is designing a disaster recovery plan for a critical application. The application requires a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 hour. Which replication strategy should be used?

Accepted Answer

Asynchronous replication with snapshots every 30 minutes.. Asynchronous replication with snapshots every 30 minutes meets the RPO of 1 hour because data loss is limited to at most 30 minutes of changes, which is within the 1-hour window. The RTO of 15 minutes is achievable because the replicated data is readily available in the secondary region, allowing for rapid failover without the delay of restoring from backups.

Answer

Daily backups stored in a different region.

Answer

No replication; rely on infrastructure rebuild.

Answer

Synchronous replication between two regions.

Question 12

A cloud administrator runs the `iostat` command on a Linux VM experiencing slow performance. Based on the exhibit, what is the most likely bottleneck?

Accepted Answer

Disk I/O is saturated.. The `iostat` command reports CPU and I/O statistics. The exhibit shows high `%util` (e.g., 99.9%) and elevated `await` or `svctm` values, indicating that the disk device is operating at or near its maximum capacity. This means the disk I/O subsystem is saturated, causing requests to queue and slowing overall VM performance.

Answer

Network bandwidth is limited.

Answer

CPU is overloaded.

Answer

Memory is insufficient.

Question 13

A user reports being unable to upload files to an S3 bucket named 'my-bucket'. The IAM policy attached to the user is shown in the exhibit. What is the most likely reason for the failure?

Accepted Answer

The policy does not include s3:PutObjectAcl, which is needed.. The IAM policy grants s3:PutObject, which allows uploading an object, but it does not include s3:PutObjectAcl. When uploading to an S3 bucket, if the bucket is configured to require bucket-owner-full-control ACLs (e.g., via a bucket policy or default settings), the upload will fail unless the user also has permission to set the ACL. The s3:PutObjectAcl action is necessary to specify the ACL during the PUT request, and its absence is the most likely cause of the failure.

Answer

The policy requires a condition that is not met.

Answer

The policy has a typo in the Action field.

Answer

The bucket policy denies the upload.

Question 14

A cloud administrator launches a new EC2 instance with a userdata script that installs a web server. The instance launches but the web server is not running. The administrator checks the cloud-init logs and sees the warning shown in the exhibit. What is the most likely cause?

Accepted Answer

The userdata script contains a syntax error.. The warning in cloud-init logs indicates that the userdata script failed to execute, which most commonly occurs due to a syntax error in the script. Cloud-init processes userdata as a shell script by default, and any syntax error (e.g., missing quotes, incorrect commands) will cause the script to exit prematurely, preventing the web server from starting. The administrator confirmed the instance launched successfully, so the issue is isolated to the script execution, not infrastructure or permissions.

Answer

The instance type does not have enough memory.

Answer

The instance does not have an IAM role assigned.

Answer

The security group does not allow HTTP traffic.

Question 15

A company operates a multi-tier web application on AWS. The web tier runs on EC2 instances behind an Application Load Balancer. The application tier runs on EC2 instances that connect to an RDS MySQL database. Recently, users have reported slow page load times. The cloud administrator investigates and finds the following: CPU utilization on web and app tier instances is below 50%, memory usage is normal, but the RDS instance's CPU utilization is consistently above 80% and the number of database connections is at the maximum. The administrator also notices that the application code opens a new database connection for each HTTP request and does not close them properly. Which action should the administrator take to resolve the performance issue?

Accepted Answer

Implement a connection pooling mechanism in the application tier.. The performance issue is caused by the application opening a new database connection for each HTTP request and not closing them properly, which exhausts the maximum connections on RDS. Implementing a connection pooling mechanism in the application tier reuses existing connections, reduces connection overhead, and prevents connection exhaustion without requiring a larger instance or increasing the connection limit. This directly addresses the root cause—inefficient connection management—rather than treating symptoms like high CPU or connection limits.

Answer

Scale the RDS instance vertically to a larger instance class.

Answer

Increase the timeout for idle database connections.

Answer

Increase the maximum number of database connections on RDS.

Question 16

A cloud administrator manages a hybrid cloud environment where on-premises servers connect to a VPC in AWS via a VPN connection. The on-premises network uses IP range 10.0.0.0/16. The VPC uses 172.16.0.0/16. The VPN is established and the tunnel status is UP. However, on-premises hosts cannot ping EC2 instances in the VPC. The administrator logs into an EC2 instance and can ping the on-premises VPN gateway IP. The security groups and network ACLs are configured to allow all traffic. The route tables in the VPC have a route to the on-premises network via the virtual private gateway. The on-premises firewall logs show that packets from the VPC are being dropped. What is the most likely cause?

Accepted Answer

The on-premises firewall is blocking traffic from the VPC CIDR range.. The on-premises firewall logs explicitly show that packets from the VPC are being dropped, indicating the firewall is filtering traffic from the VPC CIDR range (172.16.0.0/16). Since the VPN tunnel is UP, the EC2 instance can ping the on-premises VPN gateway IP, and security groups/network ACLs allow all traffic, the only remaining point of failure is the on-premises firewall blocking the return traffic.

Answer

The VPN tunnel is misconfigured and not passing traffic.

Answer

The security group attached to the EC2 instance is blocking inbound ICMP.

Answer

The VPC route table does not have a route to the on-premises network.

Question 17

A cloud administrator notices that a virtual machine is running out of memory and causing performance issues. The VM is part of a production web application. Which of the following actions should the administrator take FIRST to resolve the issue without impacting availability?

Accepted Answer

Perform a live migration of the VM to a host with more memory.. Option D is correct because live migration (e.g., VMware vMotion or Hyper-V Live Migration) allows the administrator to move the running VM to a host with more physical memory without any downtime, directly resolving the memory pressure while maintaining production availability. This is the only option that addresses the root cause (insufficient host memory) without stopping the VM or risking data loss.

Answer

Stop the VM and increase its memory allocation, then restart it.

Answer

Add a swap file to the VM's virtual disk.

Answer

Take a snapshot of the VM and then increase memory allocation.

Question 18

A cloud administrator is troubleshooting an issue where users from the 192.0.2.0/24 network cannot access objects in an S3 bucket. The bucket policy is shown in the exhibit. What is the most likely cause of the issue?

Accepted Answer

The policy does not grant the s3:ListBucket action.. The bucket policy grants s3:GetObject but not s3:ListBucket. Without s3:ListBucket, users cannot list the objects in the bucket, so they cannot discover the object keys needed to access objects. Even if they know the exact object key, the missing ListBucket action prevents the initial listing operation, which is required for many S3 access patterns.

Answer

The condition uses an incorrect IP address format.

Answer

The policy is missing a required statement ID.

Answer

The resource ARN does not include the bucket itself.

Question 19

A cloud engineer is deploying a new application that requires high availability. The solution must include automated failover and load balancing. Which TWO of the following should the engineer implement?

Accepted Answer

Configure an auto scaling group with a minimum of two instances across two availability zones.. Option A is correct because deploying an auto scaling group with a minimum of two instances across two availability zones ensures that if one instance or zone fails, the other can continue serving traffic, providing high availability. This setup also supports automated failover by replacing unhealthy instances automatically, and it works with a load balancer to distribute traffic. The combination of multi-AZ placement and auto scaling is a foundational pattern for fault-tolerant architectures in cloud environments.

Answer

Take daily snapshots of the instance and store them in a different region.

Answer

Configure a read replica in a different region for failover.

Answer

Deploy the application on a single large instance with more resources.

Question 20

A cloud engineer notices that a virtual machine (VM) in a public cloud environment is consistently running at 90% CPU during business hours. The VM hosts a customer-facing web application. Which of the following is the BEST initial troubleshooting step?

Accepted Answer

Review the VM's performance metrics and application logs.. Option B is correct because the initial step in troubleshooting high CPU usage is to gather diagnostic data. Reviewing the VM's performance metrics (e.g., CPU utilization, memory, disk I/O) and application logs helps identify whether the issue is caused by a legitimate workload spike, a memory leak, or a misconfiguration. This aligns with the 'identify before act' principle in cloud operations, ensuring the engineer understands the root cause before making changes.

Answer

Migrate the VM to a different availability zone.

Answer

Reboot the VM to reset resource usage.

Answer

Scale up the VM to a larger instance size.