CV0-004 Operations and Support Practice Test 14 — 15 Questions

Question 1

A cloud operations team supports a latency-sensitive application running on Amazon EC2 instances. Users in a remote region report that responses are slow even though the application's own metrics show normal processing times. The team wants to continuously measure the network path between the users' region and the application endpoint, capturing round-trip latency and packet loss without modifying the application. Which AWS service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon CloudWatch Network Monitor.. CloudWatch Network Monitor is purpose-built to probe paths between AWS and external or cross-region endpoints, reporting latency and packet loss continuously. Because it operates at the network layer and requires no agent or code change, it fits the scenario where application metrics look healthy but the user-perceived path is slow, allowing the team to correlate network degradation with the reported slowness.

Answer

AWS Network Manager with a global network configured.

Answer

VPC Flow Logs with a custom metric filter.

Answer

AWS CloudTrail with data events enabled on the load balancer.

Question 2

A cloud administrator is responsible for a production account and needs to ensure that an Amazon S3 bucket containing sensitive data cannot be made public, even by an administrator. The administrator wants a preventive control that blocks public access at the bucket and account level. Which action should the administrator take?

Accepted Answer

Enable S3 Block Public Access at both the bucket and account levels and verify that no bucket policy grants public access.. S3 Block Public Access is the preventive control that overrides policies and ACLs granting public access, and applying it at both the account and bucket levels ensures comprehensive protection. Detective controls such as AWS Config rules or access logging only reveal exposure after the fact, and narrow IAM denials do not cover all paths to public access. The preventive setting is the correct choice for blocking public exposure.

Answer

Create an AWS Config rule that detects public S3 buckets and sends an alert to the operations team when one is found.

Answer

Enable S3 server access logging and review the logs for public read requests to detect unauthorized exposure.

Answer

Attach an IAM policy to all users denying s3:PutBucketPolicy to prevent anyone from adding a public bucket policy.

Question 3

A cloud administrator is responsible for a Microsoft Azure environment. The administrator needs to ensure that virtual machine (VM) disks are backed up daily and that backups are retained for 30 days. The administrator also needs to be able to restore individual files from the backups. Which TWO actions should the administrator take to meet these requirements? (Choose two.)

Accepted Answer

Configure Azure Backup for the VMs using the Azure VM backup extension and associate them with the backup policy.. To back up Azure VM disks daily with 30-day retention and file-level restore, the administrator must create a Recovery Services vault and configure a backup policy with the desired schedule and retention. Then, the VMs must be configured for Azure Backup using the VM backup extension and associated with that policy. Together, these actions provide the required backup and restore capabilities.

Answer

Install the Microsoft Azure Recovery Services (MARS) agent on each VM and configure a backup schedule.

Answer

Create an Azure Storage account with blob versioning enabled and configure lifecycle management.

Answer

Enable Azure Site Recovery for the VMs and configure a replication policy.

Question 4

A cloud engineer manages a Kubernetes cluster on Google Kubernetes Engine. A production Deployment repeatedly enters CrashLoopBackOff after a configuration change, and the engineer needs to inspect why the container is terminating without modifying the running workload. Which action should the engineer take?

Accepted Answer

Run kubectl logs on the failing pod with the --previous flag to retrieve logs from the prior container instance. Retrieving logs from the previous container instance surfaces the actual termination error without altering the Deployment or node configuration. Because CrashLoopBackOff restarts containers, the current instance may not have logged anything yet, so the --previous flag is essential. Disruptive actions like deleting, scaling, or replacing nodes neither reveal the cause nor respect the constraint of not modifying the running workload.

Answer

Enable GKE node auto-repair to replace the node hosting the failing pod

Answer

Delete the Deployment and recreate it with a higher restart backoff limit

Answer

Scale the Deployment to zero replicas and then back to the original count

Question 5

A cloud administrator is responsible for a Microsoft Azure environment where several production virtual machines must be backed up nightly. The recovery requirements state that backups must be retained for 90 days, that individual files must be restorable without recovering the entire VM, and that the backup data must be encrypted at rest. Which Azure Backup configuration should the administrator implement?

Accepted Answer

Create a Recovery Services vault, enable Azure Backup for the VMs, and set a daily backup policy with 90-day retention.. Azure Backup with a Recovery Services vault is the native solution for VM backup in Azure. The vault encrypts backup data at rest, the backup policy defines the nightly schedule and 90-day retention, and file-level recovery lets administrators restore individual files from a recovery point without recovering the entire VM, matching all three requirements in the scenario.

Answer

Configure Azure Site Recovery replication with a 90-day retention policy.

Answer

Configure Azure Files share snapshots with a 90-day retention policy for the VM data.

Answer

Enable Azure Disk Encryption on each VM and schedule snapshots with a 90-day retention rule.

Question 6

A cloud administrator needs to grant a third-party auditing firm read-only access to compliance reports in an Amazon S3 bucket for a limited period. The firm's identity provider supports SAML 2.0. Which approach best meets the requirement with least administrative overhead?

Accepted Answer

Configure an IAM identity provider for SAML 2.0 and use role-based federation with a time-limited session. Federating the firm's SAML 2.0 identity provider with IAM lets auditors authenticate with existing credentials and assume a scoped role that returns temporary credentials with automatic expiry. This avoids creating and later removing IAM users and keys, minimizes administrative effort, and enforces least privilege for the engagement period. Presigned URLs and public policies lack identity integration and durable auditability.

Answer

Generate a presigned URL for each compliance report and email it to the auditors

Answer

Create IAM users for each auditor and attach an S3 read-only managed policy

Answer

Enable S3 Block Public Access and share the bucket through a public bucket policy restricted by source IP

Question 7

A cloud operations team is using AWS and needs to monitor the CPU utilization of a fleet of Amazon EC2 instances. The team wants to receive an alert when the average CPU utilization exceeds 80% for 5 consecutive minutes. Which AWS service should they use to create the alarm?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch is the AWS service designed for monitoring metrics and creating alarms. It collects CPU utilization data from EC2 instances and allows alarms to be configured with thresholds and evaluation periods. Setting an alarm for average CPU utilization greater than 80% for 5 consecutive minutes meets the team's requirement to be alerted when the condition is met.

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 8

A cloud administrator is standardizing infrastructure provisioning across teams and wants to enforce that all deployed resources carry a mandatory cost-center tag. The administrator needs non-compliant deployments to be rejected automatically across multiple accounts in an AWS Organization. Which control should be implemented?

Accepted Answer

A service control policy applied at the organization root that denies resource creation without the cost-center tag. Service control policies define the permission ceiling for accounts in an AWS Organization and support condition keys such as aws:RequestTag, so a deny statement can block create operations that omit the cost-center tag. Applying it at the root enforces the rule across every account preventively. Config rules, permissions boundaries, and EventBridge remediation act after the fact or per principal and do not block the deployment.

Answer

An Amazon EventBridge rule that triggers a Lambda function to delete untagged resources

Answer

An AWS Config rule using the required-tags managed rule

Answer

An IAM permissions boundary attached to each developer role

Question 9

A cloud administrator is responsible for a Microsoft Azure environment with a hub-and-spoke network topology. The administrator needs to ensure that all traffic from the spoke virtual networks to the internet is routed through a network virtual appliance (NVA) in the hub virtual network for inspection. Which Azure feature should the administrator configure?

Accepted Answer

User-defined routes (UDRs) on the spoke subnets pointing to the NVA's private IP address. To force traffic from spoke virtual networks through a network virtual appliance in the hub, the administrator must configure user-defined routes on the spoke subnets. The UDR sets the next hop type to 'Virtual appliance' and specifies the NVA's private IP address. This overrides Azure's default system routes and ensures traffic is sent to the NVA for inspection before reaching the internet.

Answer

Azure Private Link to connect the spokes to the hub

Answer

Virtual network peering with gateway transit enabled

Answer

Azure Firewall in the hub virtual network with forced tunneling

Question 10

A cloud engineer is troubleshooting a performance issue in a Microsoft Azure environment. The application runs on an Azure Virtual Machine Scale Set (VMSS) behind an Azure Load Balancer. Users report intermittent slow response times. The engineer suspects that the VMSS instances are experiencing high CPU utilization due to uneven traffic distribution. The engineer needs to collect and analyze performance data to identify the root cause. Which Azure feature should the engineer use to gain deep visibility into the performance of the VMSS instances and the load balancer?

Accepted Answer

Azure Monitor with VM insights and Load Balancer insights. The engineer should use Azure Monitor with VM insights and Load Balancer insights. VM insights provides performance monitoring for VMSS instances, including CPU utilization, and Load Balancer insights offers detailed traffic distribution metrics. This combination allows the engineer to correlate high CPU usage with uneven traffic patterns, pinpointing the root cause. Other options focus on network diagnostics, service health, or require manual log analysis, which are less direct and comprehensive for this performance troubleshooting scenario.

Answer

Azure Network Watcher with connection monitor and packet capture

Answer

Azure Log Analytics with custom Kusto queries on VMSS diagnostic logs

Answer

Azure Service Health and Azure Advisor

Question 11

A cloud operations team is configuring cost anomaly detection for a multi-account AWS organization. They want to be notified proactively when spending deviates from expected patterns and to attribute the deviation to the right team. Which TWO actions should they take? (Choose two.)

Accepted Answer

Create a cost allocation report and apply a consistent tag taxonomy across all accounts. Cost Anomaly Detection with per-account monitors and alert subscriptions provides proactive, machine-learning-based notification of abnormal spend, while a consistent cost allocation tag taxonomy enables attribution of those anomalies to the correct team. Trusted Advisor, Budgets thresholds, and in-instance agents do not provide the combination of learned baselines and team-level attribution required here.

Answer

Deploy a third-party agent on every EC2 instance to report hourly spend to a central dashboard

Answer

Set a hard AWS Budgets limit that automatically terminates EC2 instances when exceeded

Answer

Enable AWS Trusted Advisor cost optimization checks and rely on their weekly emails

Question 12

A cloud engineer must ensure that a critical Azure virtual machine automatically restarts if the guest operating system becomes unresponsive, even when the Azure host is healthy. Which Azure feature should be configured?

Accepted Answer

Azure virtual machine application health monitoring with automatic repair. Azure virtual machine application health monitoring probes the guest and, with automatic repair enabled, restarts the VM when the probe reports an unhealthy guest. This targets the specific case of an unresponsive operating system on a healthy host. Availability Zones, autoscale, and Site Recovery address infrastructure redundancy, capacity, and cross-region failover respectively, none of which restart a hung guest.

Answer

Azure Monitor autoscale on the virtual machine scale set

Answer

Azure Availability Zones for the virtual machine

Answer

Azure Site Recovery replication to a secondary region

Question 13

A cloud administrator is responsible for a set of Amazon EC2 instances that must be patched on a recurring schedule. The administrator wants to define a maintenance window, register the target instances, and have the system apply operating system patches automatically with a defined baseline. Which AWS service should the administrator use to accomplish this with the least operational overhead?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager is purpose-built for automated patch management. It combines patch baselines, which define approved patches, with maintenance windows that schedule when patching runs, and it registers target instances as managed nodes. This delivers recurring, baseline-driven patching with low operational overhead.

Answer

Amazon Inspector

Answer

AWS Config conformance packs

Answer

AWS Trusted Advisor

Question 14

A cloud operations team supports a microservices application running on Amazon ECS with AWS Fargate tasks. Users report that some requests fail intermittently, and the team suspects that containers are being terminated because they exceed resource limits or fail health checks. The team wants to collect the relevant diagnostic data to confirm the cause. (Choose two.)

Accepted Answer

Review the Amazon ECS service event log and task stopped reasons in the Amazon ECS console.. Confirming why ECS tasks terminate requires two complementary evidence sources: the ECS service event log and task stopped reasons, which record platform-level termination causes, and container logs delivered to Amazon CloudWatch Logs, which capture application-level errors. Together they distinguish resource-limit kills from health check failures or application crashes.

Answer

Increase the Fargate task CPU and memory allocation and redeploy to observe whether failures stop.

Answer

Enable and inspect AWS CloudTrail data events for the ECS tasks.

Answer

Delete and recreate the ECS cluster to force a clean state.

Question 15

A cloud administrator is responsible for an application hosted on Amazon EC2 that stores session data in memory. The business requires that, in the event of an instance failure, a replacement instance can resume serving users with the existing session data intact and with minimal interruption. Which action should the administrator take to meet this requirement?

Accepted Answer

Move session state to an external store such as Amazon ElastiCache for Redis and configure the application to use it.. Session data held only in instance memory is lost when that instance fails. Storing sessions in a shared external service such as Amazon ElastiCache for Redis lets any replacement instance retrieve the same session data. This decouples session state from compute, so failover restores both capacity and user continuity with minimal disruption.

Answer

Create an Amazon Machine Image of the instance after each user session is established.

Answer

Enable detailed monitoring on the EC2 instances to capture session data in Amazon CloudWatch.

Answer

Configure an Auto Scaling group with a minimum and maximum size of one to replace failed instances automatically.