CV0-004 Operations and Support Practice Test 13 — 15 Questions

Question 1

A cloud operations team runs a containerized API on Amazon ECS with the Fargate launch type. During peak hours, CPU utilization on the tasks regularly reaches 95 percent and response latency doubles. The team wants the service to add tasks automatically before users notice degradation, and to remove them when demand drops. Which action should the team take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an Application Auto Scaling target tracking scaling policy on the ECS service using the ECSServiceAverageCPUUtilization metric with a target value and a scale-out cooldown.. Target tracking scaling on the ECS service is the native mechanism for elastic task capacity. It monitors the service-level average CPU metric and adjusts the desired count toward the configured target, scaling out ahead of user-visible degradation and scaling in afterward. Adjusting task size, cluster-level settings, or EC2 capacity providers does not change the number of running Fargate tasks in response to demand.

Answer

Increase the task definition CPU reservation from 1024 to 4096 CPU units and redeploy the service so each task can process more requests.

Answer

Create an EC2 Auto Scaling group with a launch configuration that runs the container image, and attach the group to the ECS cluster as a capacity provider.

Answer

Enable burstable performance mode on the ECS cluster so tasks can consume additional CPU credits during peak hours.

Question 2

A cloud operations team manages a containerized microservices application running on an Amazon EKS cluster. During peak hours, the team observes that pods are frequently being terminated and restarted, and node CPU utilization is consistently above 90 percent. The team wants to automatically scale the number of pods based on CPU utilization while ensuring the cluster has enough nodes to schedule the pods. Which combination of actions should the team take to meet these requirements?

Accepted Answer

Configure a Horizontal Pod Autoscaler (HPA) to scale pods based on CPU utilization, and enable the Kubernetes Cluster Autoscaler to adjust the number of nodes in the node group.. The Horizontal Pod Autoscaler scales the number of pod replicas based on CPU utilization, directly handling increased application load. The Cluster Autoscaler adjusts the node group size when pods cannot be scheduled due to resource constraints, ensuring sufficient compute capacity. Using both together provides a complete scaling solution for the EKS cluster, addressing both pod and node levels. Other options either scale only one dimension or use less integrated mechanisms that do not respond correctly to pod scheduling needs.

Answer

Enable the Kubernetes Horizontal Pod Autoscaler with a target CPU utilization and configure an AWS Auto Scaling group with a target tracking scaling policy based on the average CPU utilization of the nodes.

Answer

Create an Amazon CloudWatch alarm that triggers an AWS Lambda function to call the EKS UpdateNodegroupConfig API to increase the desired size of the node group when CPU exceeds a threshold.

Answer

Deploy a Vertical Pod Autoscaler (VPA) to adjust CPU and memory requests for each pod, and use AWS Application Auto Scaling to add more nodes to the node group.

Question 3

A cloud operations team runs a three-tier application on Google Cloud and wants to reduce the mean time to recovery for incidents. They want automated actions to run when a Cloud Monitoring alert fires, and they want to capture the exact configuration state at the moment of the incident for later analysis. Which TWO approaches should the team implement? (Choose two.)

Accepted Answer

Create an alerting policy in Cloud Monitoring that publishes to a Pub/Sub topic, and trigger a Cloud Run function to run remediation steps.. Automated remediation requires an event path from detection to action, which the alerting policy to Pub/Sub to Cloud Run function pattern provides. Capturing configuration state requires a service that records resource configuration over time, which Cloud Asset Inventory exports deliver. Uptime checks, log-to-BigQuery pipelines, and threshold changes improve visibility or reduce noise but neither act automatically nor preserve the deployed configuration at incident time.

Answer

Configure a Cloud Monitoring uptime check that pings the frontend every minute and emails the on-call engineer.

Answer

Increase the Cloud Monitoring alert threshold so that fewer alerts fire during normal traffic fluctuations.

Answer

Set a Cloud Monitoring log-based alert that writes matching log entries into a BigQuery dataset for dashboards.

Question 4

A cloud operations team must ensure that a critical workload continues to run even if an entire AWS Region becomes unavailable. The workload's data is stored in Amazon S3, and the team wants the data available in a second Region with minimal operational effort and automatic replication. Which action should the team take?

Accepted Answer

Configure S3 Cross-Region Replication on the source bucket.. Cross-Region Replication continuously copies objects to a destination bucket in another Region, so a current copy exists without manual intervention. That automatically maintained replica is what allows the workload to recover if the primary Region becomes unavailable, which the other options cannot deliver.

Answer

Enable S3 Versioning on the bucket and rely on it for regional failover.

Answer

Apply an S3 Lifecycle policy to transition objects to a second Region.

Answer

Use S3 Transfer Acceleration to speed up access from the secondary Region.

Question 5

A cloud engineer is investigating why an application hosted on Amazon EC2 cannot connect to an Amazon RDS for MySQL database in the same VPC. The database security group allows traffic on port 3306 from the application's security group. The engineer confirms the application is using the correct endpoint and credentials. Which action should the engineer take NEXT to identify the cause?

Accepted Answer

Verify the network ACLs on the database subnet allow inbound and outbound traffic on the required ephemeral ports.. Because the security group already permits the database port from the application's security group, the remaining likely culprit is a stateless network ACL that blocks the request or the ephemeral return traffic. Network ACLs require explicit rules in both directions, unlike stateful security groups. Verifying NACL rules on the database subnet is the correct next step before making any disruptive or risky changes.

Answer

Modify the RDS security group to allow 0.0.0.0/0 on port 3306 to rule out a security group issue.

Answer

Reboot the RDS instance to clear any stale connection state and retest connectivity.

Answer

Check whether the EC2 instance has a public IP address and attach an Elastic IP to ensure outbound connectivity.

Question 6

A cloud administrator manages workloads in Microsoft Azure. The security team requires that all virtual machines apply operating system updates automatically during a defined window without the administrator logging in to each machine. Which Azure feature should the administrator use to meet this requirement?

Accepted Answer

Azure Update Manager, with a maintenance configuration that schedules update assessments and installations on the target virtual machines.. Azure Update Manager is the service purpose-built for assessing and installing operating system updates on Azure virtual machines and Arc-connected servers. A maintenance configuration defines the schedule and window, and the service performs assessment and installation automatically, which is exactly what the security team requires without per-machine administrator logon.

Answer

Microsoft Defender for Cloud, with the regulatory compliance dashboard enabled for the subscription.

Answer

Azure Policy, with a built-in initiative that audits whether the Guest Configuration extension is installed.

Answer

Azure Automation State Configuration, with a DSC configuration that declares the Windows Update service as running.

Question 7

A cloud operations team runs a Kubernetes cluster on Google Kubernetes Engine (GKE). They need to ensure that a critical payment microservice is automatically restarted if its container process fails, and that a new Pod is created if the node hosting it becomes unhealthy. Which Kubernetes object should they configure to meet these requirements?

Accepted Answer

A Deployment with a ReplicaSet. A Deployment with a ReplicaSet is the correct Kubernetes controller for stateless, long-running microservices. The ReplicaSet ensures the desired number of Pod replicas are running, and the kubelet restarts failed containers. If a node becomes unhealthy, the ReplicaSet controller creates replacement Pods on healthy nodes. This provides both container-level and node-level self-healing, which the payment microservice requires.

Answer

A standalone Pod

Answer

A DaemonSet

Answer

A CronJob

Question 8

A cloud operations team runs a three-tier application on Amazon EC2 instances behind an Application Load Balancer. During a peak-traffic event, users report intermittent 503 errors, and the operations team wants to automatically add capacity when the average CPU utilization of the Auto Scaling group exceeds 70 percent for five consecutive minutes, then remove capacity when it drops below 30 percent. Which TWO configuration elements must the team define to accomplish this? (Choose two.)

Accepted Answer

A second CloudWatch alarm that enters the ALARM state when CPU utilization is less than 30 percent for the same evaluation window.. Dynamic scaling in an Auto Scaling group is driven by CloudWatch alarms that translate metric thresholds into scaling actions. Because the scenario specifies different thresholds for scaling out and scaling in, two separate alarms are needed: one for CPU above 70 percent and one for CPU below 30 percent, each evaluated over the stated five-minute window. Target tracking and budget alarms cannot express this asymmetric behavior.

Answer

An AWS Budgets alarm set to notify when EC2 spending exceeds 70 percent of the monthly forecast.

Answer

An Application Load Balancer health check configured with a 70 percent healthy threshold.

Answer

A target tracking scaling policy attached to the Auto Scaling group with a target value of 70 percent.

Question 9

A cloud administrator manages a fleet of Linux virtual machines on Google Cloud. A compliance rule requires that an interactive SSH session to any of these instances be brokered through an identity-aware proxy so that sessions are authenticated and auditable, and that no external IP addresses be assigned to the instances. Which solution should the administrator implement?

Accepted Answer

Use Identity-Aware Proxy TCP forwarding to reach each instance over its internal IP, with firewall rules allowing the IAP range.. The rule has two parts: identity-aware brokering of interactive sessions and no external addresses on the instances. Identity-Aware Proxy TCP forwarding satisfies both because it authenticates the user's identity and IAM permissions before tunneling SSH over the internal address, and the firewall only needs to allow the IAP source range. External IPs, bastion hosts, and VPN-only access all authenticate network location rather than user identity.

Answer

Configure a Cloud VPN tunnel from the corporate network and allow SSH from the corporate address range only.

Answer

Assign external IP addresses to each instance and restrict ingress to the administrator's source IP range with firewall rules.

Answer

Deploy a bastion host with an external IP and have administrators SSH to the bastion before connecting to each instance.

Question 10

A cloud operations team manages a three-tier application on Google Cloud. After a deployment, users report intermittent 503 errors from the HTTP(S) load balancer, and backend health checks are flapping between healthy and unhealthy. The team suspects the backend instances are being overwhelmed during health check bursts. Which TWO actions should the team take to stabilize the health checks and reduce false failures? (Choose two.)

Accepted Answer

Increase the health check's check interval and timeout settings so probes are less frequent and tolerate brief slowdowns.. Health check flapping during bursts is addressed by tuning the probe itself: a longer interval and timeout reduce probe intensity and tolerate brief slowdowns, while higher healthy and unhealthy thresholds require more consistent evidence before an instance's state changes. Together these settings distinguish transient latency from genuine failure. Caching, changing load balancer type, or removing instances do not reduce false health check failures.

Answer

Reduce the number of backend instances in the instance group so each instance receives fewer health check probes.

Answer

Enable Cloud CDN on the backend service so cached responses absorb the health check traffic.

Answer

Switch the backend service to use a network load balancer instead of the HTTP(S) load balancer.

Question 11

A cloud operations team needs to reduce the mean time to recovery for a microservices application running on Amazon EKS. They want to detect service degradation earlier and automatically replace unhealthy pods without manual intervention. Which TWO actions should the team take? (Choose two.)

Accepted Answer

Deploy the application as a Kubernetes Deployment with a ReplicaSet so that failed pods are automatically recreated to maintain the desired replica count.. Reducing recovery time requires both detecting unhealthy containers and replacing them automatically. Liveness and readiness probes give Kubernetes the signals to restart unresponsive containers and to stop sending traffic to pods that are not ready. A Deployment with a ReplicaSet continuously reconciles toward the desired replica count, recreating failed pods. Together these mechanisms deliver automatic detection and remediation without manual intervention.

Answer

Increase the node group size and enable cluster autoscaler so that more nodes are available when pods fail.

Answer

Enable AWS CloudTrail logging for the EKS control plane and create alarms on API error rates to trigger automatic pod replacement.

Answer

Set the pod restartPolicy to Always for all containers and rely on the kubelet to recreate the entire pod when a container exits.

Question 12

A cloud engineer is responsible for a set of Amazon EC2 instances that run a stateless web application. The engineer must ensure that the application can automatically recover from instance-level failures and that new instances are launched in multiple Availability Zones to maintain high availability. Which combination of AWS services should the engineer use?

Accepted Answer

An Auto Scaling group with a launch template and an Application Load Balancer. The engineer needs both automatic instance recovery and multi-AZ high availability. An Auto Scaling group with a launch template automatically replaces unhealthy instances and can launch instances across multiple Availability Zones. An Application Load Balancer performs HTTP/HTTPS health checks and distributes traffic only to healthy instances. Together they provide the required resilience and availability for the stateless web application.

Answer

An Auto Scaling group with a launch template and a Network Load Balancer

Answer

An EC2 Auto Recovery alarm and a Network Load Balancer

Answer

A placement group with a spread strategy and an Application Load Balancer

Question 13

A cloud engineer is deploying a containerized workload to Google Kubernetes Engine. The security team requires that the container run as a non-root user, that the root filesystem be mounted read-only, and that privilege escalation be disallowed. The engineer wants to enforce these controls at the pod level so that any violating pod is rejected during admission. Which action should the engineer take?

Accepted Answer

Apply a Pod Security Admission label of restricted to the namespace.. Pod Security Admission is the current Kubernetes mechanism for enforcing pod security standards and is enabled by default in modern GKE releases. Labeling the namespace with the restricted profile causes the admission controller to reject any pod that fails the non-root, read-only root filesystem, and no-privilege-escalation requirements, satisfying the security team's enforcement goal without deprecated APIs.

Answer

Enable Binary Authorization on the GKE cluster and require attestations for the workload images.

Answer

Create a PodSecurityPolicy with runAsNonRoot, readOnlyRootFilesystem, and allowPrivilegeEscalation set to false, then bind it to the service account.

Answer

Create a NetworkPolicy that denies ingress to the namespace and set the pod's runAsUser field to 1000.

Question 14

A cloud operations team runs a three-tier web application on Amazon EC2 instances behind an Application Load Balancer. Users report intermittent 502 errors, and the operations team wants to identify whether the issue originates from unhealthy targets before the load balancer removes them. Which AWS feature should the team enable to actively probe target health at a configurable interval?

Accepted Answer

Application Load Balancer health checks with a shortened healthy and unhealthy threshold. Application Load Balancer health checks are the built-in mechanism that actively probes each registered target and removes unhealthy ones from rotation. Tuning the healthy and unhealthy thresholds lets the team detect failing targets faster and correlate the 502 errors with backend health. Logging and DNS-based services operate at different layers and cannot actively determine target health behind an ALB.

Answer

AWS CloudTrail data events on the target instances

Answer

VPC Flow Logs on the subnet hosting the targets

Answer

Amazon Route 53 latency-based routing with failover records

Question 15

A cloud engineer is investigating why a nightly batch job on Amazon EC2 takes far longer than expected. CloudWatch shows the instance's CPU and memory usage are low throughout the run, but the job performs many small reads against an Amazon EBS gp3 volume. The engineer wants to reduce the time the job spends waiting on storage. Which action should the engineer take?

Accepted Answer

Increase the provisioned IOPS and throughput settings of the gp3 volume to match the job's small-read workload.. The job is storage-bound, not compute-bound, and the read pattern is dominated by many small operations. On gp3, IOPS and throughput are provisioned separately from capacity, so raising the provisioned IOPS increases the rate of read operations the volume can sustain, cutting the wait time. Instance resizing, snapshot restore, and instance store do not correct the volume's operation rate.

Answer

Resize the instance to a larger instance type with more vCPUs so the job can issue more concurrent read requests.

Answer

Move the volume to an instance store device so reads are served from local NVMe storage.

Answer

Create a snapshot of the volume and restore it as a new volume, then reattach it to the instance.