CV0-004 Operations and Support Practice Test 12 — 15 Questions

Question 1

A cloud operations team runs a containerized workload on Amazon ECS with tasks spread across an Auto Scaling group of EC2 instances. During a peak-traffic event, the team observes that a single task repeatedly restarts with an out-of-memory error while the host instance still shows 40% free memory. The team wants the scheduler to stop placing new tasks on that host when its committed memory is exhausted. Which action should the team take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Set a task memory reservation in the task definition so ECS accounts for that memory when placing tasks on the instance.. The restart loop happens because the scheduler lacks information about committed memory, so it keeps packing tasks onto a host that cannot actually hold them. Declaring a memory reservation per task gives the scheduler the data it needs to refuse placement on an exhausted instance. The hard limit only caps a single container and does not influence placement decisions, and scaling or resizing does not correct the underlying bin-packing logic.

Answer

Increase the EC2 instance type size in the Auto Scaling group launch template and recycle the instances.

Answer

Enable ECS managed scaling on the service and lower the target capacity utilization threshold.

Answer

Raise the container memory hard limit in the task definition so the task can use the host's remaining free memory.

Question 2

A cloud engineer is responsible for a fleet of Amazon EC2 instances running a stateless web application. The engineer needs to ensure that if an instance fails a status check, it is automatically replaced without manual intervention. Which AWS feature should be used to meet this requirement?

Accepted Answer

EC2 Auto Scaling group with health checks set to EC2 and a launch template. The requirement is to automatically replace instances that fail status checks. An EC2 Auto Scaling group with EC2 health checks monitors instance status and replaces unhealthy instances. The launch template defines the instance configuration. This is the standard AWS pattern for self-healing fleets of stateless instances.

Answer

AWS OpsWorks for Chef Automate with auto-healing policies

Answer

EC2 Auto Recovery feature enabled on each instance

Answer

AWS Elastic Beanstalk with rolling updates and immutable deployments

Question 3

A cloud administrator needs to ensure that an Amazon S3 bucket containing regulated data logs every object-level access attempt, including reads and writes, for audit purposes. Which action should the administrator take?

Accepted Answer

Enable AWS CloudTrail data events for the S3 bucket and configure the trail to deliver to a log archive account.. AWS CloudTrail data events are the designated mechanism for recording object-level S3 API activity, including reads and writes, in a structured and reliable manner. Sending the trail to a dedicated log archive account strengthens the audit posture by separating log custody from the account being monitored.

Answer

Configure an S3 event notification to publish to Amazon SNS whenever an object is created in the bucket.

Answer

Enable S3 server access logging on the bucket and deliver the logs to a separate logging bucket.

Answer

Enable S3 Object Lock in governance mode on the bucket to prevent deletion of audit records.

Question 4

A cloud operations team manages a fleet of Amazon EC2 instances behind an Application Load Balancer. During a recent incident, several instances stopped passing their ELB health checks but the Auto Scaling group did not replace them. The team wants the Auto Scaling group to automatically terminate and replace instances that fail ELB health checks, not just EC2 status checks. Which action should the team take?

Accepted Answer

Enable ELB health checks as an additional health check type on the Auto Scaling group.. Auto Scaling groups by default rely only on EC2 status checks, which do not detect application-level failures seen by the load balancer. Adding ELB as a health check type lets the group treat targets failing the load balancer check as unhealthy and replace them automatically, restoring capacity without manual intervention.

Answer

Increase the health check grace period on the Auto Scaling group.

Answer

Configure a lifecycle hook to terminate instances that fail health checks.

Answer

Lower the unhealthy threshold on the target group health check.

Question 5

A cloud operations team is designing a backup strategy for a set of Amazon RDS for MySQL databases that support a production application. The team needs to be able to restore the database to any point in time within the last 35 days and must also retain a copy of the database for seven years for regulatory compliance. The team wants to minimize operational overhead. Which TWO actions should the team take? (Choose two.)

Accepted Answer

Export automated backups to Amazon S3 and apply a lifecycle policy for seven-year retention.. Automated backups with a 35-day retention period deliver point-in-time recovery within the required window and are fully managed. Exporting backups to Amazon S3 with a seven-year lifecycle policy provides durable, low-overhead long-term retention for regulatory compliance. Together they meet both the short-term recovery and long-term retention requirements.

Answer

Create a manual DB snapshot and retain it for seven years.

Answer

Enable Multi-AZ deployment for the RDS instance.

Answer

Configure a read replica in a second region and promote it for recovery.

Question 6

A cloud operations team manages a multi-account AWS environment with AWS Organizations. They need a centralized, near-real-time view of security findings across all accounts and want the ability to automatically suppress findings that match approved exceptions. Which service should they use to aggregate and manage these findings?

Accepted Answer

AWS Security Hub with the organization-wide aggregation feature enabled. Security Hub is designed to aggregate and normalize findings from multiple AWS security services across an organization, and its automation rules and suppression filters allow approved exceptions to be muted. This combination of centralized aggregation with automated suppression matches the operational requirement precisely.

Answer

AWS Config with a central aggregator in the delegated administrator account

Answer

Amazon Detective with cross-account data ingestion from member accounts

Answer

AWS Trusted Advisor with organizational view enabled in the management account

Question 7

A cloud operations team needs to ensure that all Amazon S3 buckets in their AWS account have server access logging enabled. They want to automatically detect and remediate any bucket that does not have logging enabled. Which combination of AWS services should they use?

Accepted Answer

AWS Config rule with automatic remediation using AWS Systems Manager Automation. The need is to detect and remediate S3 buckets without server access logging. AWS Config provides managed rules that can check for this configuration. When a bucket is non-compliant, Config can automatically run an SSM Automation document to enable logging. This creates a continuous compliance loop with automatic remediation, which is the most direct and native solution.

Answer

Amazon GuardDuty with S3 protection and AWS Lambda remediation

Answer

Amazon Inspector with S3 assessment and AWS Systems Manager Automation

Answer

AWS CloudTrail with Amazon EventBridge and AWS Lambda to enable logging

Question 8

A cloud administrator needs to give the security team read-only visibility into all API activity across an AWS account, including who made each call, when, and from which IP address. The records must be retained for 365 days for compliance. Which service should the administrator use?

Accepted Answer

AWS CloudTrail. CloudTrail is the service purpose-built to record API activity in an AWS account, including caller identity, timestamp, and source address. Delivering those events to durable storage with a retention policy of 365 days meets both the visibility and compliance needs described.

Answer

Amazon CloudWatch Logs

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 9

A cloud administrator is deploying a containerized workload to Google Kubernetes Engine. The workload must automatically scale based on the number of incoming HTTP requests per second rather than CPU utilization. Which GKE feature should the administrator configure to meet this requirement?

Accepted Answer

Horizontal Pod Autoscaler with a custom metric from Cloud Monitoring. The Horizontal Pod Autoscaler is the GKE mechanism that changes replica counts in response to metrics. By supplying a custom metric sourced from Cloud Monitoring that represents HTTP requests per second, the administrator can scale on request rate rather than CPU, which is exactly the workload signal described.

Answer

GKE Autopilot mode with burst scaling enabled

Answer

Vertical Pod Autoscaler in recommendation mode

Answer

Cluster Autoscaler with node pool autoscaling enabled

Question 10

A cloud operations team is deploying a three-tier application across multiple availability zones. To meet a strict recovery time objective, they want the application to keep serving traffic if an entire availability zone becomes unavailable. Which TWO design actions should the team take? (Choose two.)

Accepted Answer

Configure the database with a multi-AZ standby that can be promoted automatically.. High availability across zones requires both a resilient application tier and a resilient data tier. Running instances in multiple zones behind a load balancer keeps the application serving traffic, while a multi-AZ database with automatic failover keeps data available without a lengthy restore, together meeting the aggressive recovery time objective.

Answer

Increase the instance size to handle the full production load on a single instance.

Answer

Take nightly snapshots of the database volumes and store them in a separate region.

Answer

Enable termination protection on all production instances.

Question 11

A cloud operations team deploys a containerized workload to a Kubernetes cluster managed by Amazon EKS. The application pods intermittently fail during peak traffic hours, and the team suspects that the pods are being terminated because they exceed their configured resource limits. Which action should the team take FIRST to confirm this suspicion?

Accepted Answer

Review the pod events and container status using kubectl describe pod and check for OOMKilled or Evicted reasons.. The fastest way to confirm whether pods are hitting resource limits is to inspect Kubernetes events and container termination reasons. The kubectl describe pod output reports OOMKilled, Evicted, and related statuses that directly indicate whether limits or node pressure caused the failures. This evidence-based step avoids premature scaling or limit changes and keeps the investigation focused on the actual cause.

Answer

Increase the CPU and memory limits for the deployment immediately and observe whether failures stop.

Answer

Enable AWS CloudTrail data events on the EKS cluster and search for DeletePod API calls.

Answer

Configure a Horizontal Pod Autoscaler with a target CPU utilization of 50 percent and wait for the next peak.

Question 12

A cloud engineer is troubleshooting a Microsoft Azure virtual machine that becomes unresponsive under sustained load. The engineer suspects a storage performance bottleneck but needs to confirm whether the issue is IOPS throttling or throughput throttling on the managed disk. Which Azure Monitor metrics should the engineer examine to distinguish between these two causes?

Accepted Answer

Disk IOPS Consumed Percentage and Disk Bandwidth Consumed Percentage. Azure Monitor exposes Disk IOPS Consumed Percentage and Disk Bandwidth Consumed Percentage as platform metrics for managed disks. Comparing which percentage approaches saturation reveals whether the workload is being limited by the provisioned IOPS ceiling or the throughput ceiling, which is the exact distinction the engineer needs.

Answer

Disk Latency and Disk Transactions per second from Azure Monitor

Answer

OS Disk Queue Depth and OS Disk Read Operations/sec from the guest OS

Answer

VM CPU Credits Remaining and VM Network In Total

Question 13

A cloud administrator is asked to give the security team read-only visibility into all objects stored in an Amazon S3 bucket used for application logs, without granting the ability to delete or overwrite any object. The security team authenticates as an IAM role. Which action should the administrator take?

Accepted Answer

Attach an IAM policy granting s3:GetObject and s3:ListBucket on the bucket and its objects to the security team's role.. The request is for ongoing, role-based read access limited to viewing and listing log objects. An IAM policy naming s3:GetObject on the objects and s3:ListBucket on the bucket delivers precisely that, while omitting the write and delete actions that would breach the constraint. Broad wildcards, public sharing, and per-object presigned URLs either over-grant, fail to authenticate the role, or cannot cover future objects.

Answer

Apply an S3 bucket policy that allows s3:* for the security team's role principal on the bucket.

Answer

Enable S3 Block Public Access on the bucket and share the object URLs with the security team.

Answer

Create a presigned URL for each object and distribute the URLs to the security team.

Question 14

A cloud engineer is investigating a sudden increase in egress charges. The engineer suspects that a misconfigured Amazon S3 bucket is being read frequently from the internet. Which tool should the engineer use to identify the source IP addresses and request patterns for that bucket?

Accepted Answer

S3 server access logging. S3 server access logging records each request to a bucket with fields including the requester's IP address, the operation performed, and the response. That request-level detail is what allows the engineer to trace the egress charges back to specific clients and patterns, which the aggregated cost and metrics tools cannot provide.

Answer

AWS Budgets

Answer

AWS Cost Explorer

Answer

Amazon S3 Storage Lens

Question 15

A cloud administrator manages a fleet of Amazon EC2 instances that must receive operating system patches on a defined schedule. The administrator wants to automate patching, control the maintenance window, and receive compliance reports showing which instances are missing patches. Which AWS service should the administrator use?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager is built to automate operating system patching across EC2 and hybrid nodes. It combines patch baselines, maintenance windows, and compliance reporting so the administrator can schedule installs and prove which instances are compliant. Other services either assess configuration or detect vulnerabilities but do not install patches or provide the required scheduling and compliance workflow.

Answer

AWS Config with managed rules for patch compliance

Answer

Amazon Inspector with automated assessment schedules

Answer

AWS Trusted Advisor with security category checks