CV0-004 Operations and Support Practice Test 4 — 15 Questions

Question 1

A cloud operations team manages a multi-tier application on AWS. They want to receive an alert whenever the number of healthy targets in an Application Load Balancer target group drops below 2 for more than 5 minutes. Which combination of AWS services should they use to create and trigger this alert?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon CloudWatch alarm on the UnHealthyHostCount metric with an SNS topic for notification. The requirement is to alert when healthy targets fall below a threshold. CloudWatch provides the UnHealthyHostCount metric for ALB target groups, and alarms can evaluate that metric over a specified period. SNS then delivers the notification. This is the standard, native AWS monitoring and alerting pattern for such operational health checks.

Answer

AWS Config rule to evaluate target group health and send an SNS notification

Answer

Amazon GuardDuty detector with CloudWatch Events to trigger an SNS topic

Answer

AWS CloudTrail trail with Amazon EventBridge rule to send notifications

Question 2

A cloud architect is designing a backup strategy for a critical application hosted on Azure. The application uses Azure SQL Database and requires a recovery point objective (RPO) of 5 minutes and a recovery time objective (RTO) of 1 hour. The architect must choose a solution that meets these objectives with minimal administrative effort. Which solution should the architect recommend?

Accepted Answer

Implement active geo-replication for the Azure SQL Database to a secondary region.. Active geo-replication for Azure SQL Database provides continuous asynchronous replication with a low RPO and fast failover capabilities, satisfying both the 5-minute RPO and 1-hour RTO. It is a native feature that requires minimal ongoing administration, making it the optimal choice.

Answer

Schedule export of the database to a BACPAC file every 5 minutes and store it in Azure Blob Storage.

Answer

Configure automated backups with a retention policy of 7 days and perform a geo-restore if a failure occurs.

Answer

Use Azure Site Recovery to replicate the Azure SQL Database to another region.

Question 3

A cloud engineer manages a Kubernetes cluster on Amazon EKS. A production deployment is experiencing intermittent failures, and the engineer needs to inspect the live state of pods, including which nodes they run on and their current restart counts, without modifying any resources. Which command should the engineer run?

Accepted Answer

kubectl get pods -o wide. The kubectl get pods -o wide command is a read-only query that extends the default pod listing with node assignment and pod IP information. It lets the engineer see where each pod is running and observe status, which is essential for diagnosing intermittent failures tied to specific nodes without altering any resources.

Answer

kubectl edit pod <name>

Answer

kubectl logs <pod-name> --previous

Answer

kubectl describe deployment <name>

Question 4

A cloud engineer manages a stateless web tier behind an Azure Load Balancer. During a regional incident, the engineer must shift traffic to a standby region with a different virtual network and IP addressing scheme. The application's DNS name must remain unchanged, and the failover must complete within minutes without editing application configuration files. Which approach should the engineer use?

Accepted Answer

Create a Traffic Manager profile with priority routing and health probes, and register the public endpoints in both regions.. The requirement is a health-aware, DNS-level shift that keeps one application name and needs no code changes, which is precisely what a Traffic Manager priority profile provides by probing both regional endpoints and answering queries with the healthy one. A regional load balancer cannot span regions, Front Door's affinity setting works against fast failover, and raw multiple A records lack health awareness.

Answer

Deploy Azure Front Door with the two regional origins and enable session affinity on the frontend.

Answer

Publish both regional public IP addresses as A records under the same DNS name and rely on client retry behavior.

Answer

Add the standby region's virtual machines to the backend pool of the existing regional Azure Load Balancer.

Question 5

A cloud administrator is responsible for a production environment on AWS. They need to implement a strategy to monitor and respond to changes in resource configurations that could impact security. The administrator wants to be alerted when an IAM policy is changed to allow public access to an S3 bucket. Which TWO actions should the administrator take to achieve this? (Choose two.)

Accepted Answer

Enable AWS CloudTrail to log IAM and S3 API calls.. To alert on an IAM policy change that allows public S3 access, you need to capture the API call and then trigger a notification. CloudTrail logs the API call, and EventBridge can match the specific event and invoke a target like SNS. This combination provides real-time detection and alerting. AWS Config and GuardDuty are not designed for immediate event-driven alerting on specific API calls.

Answer

Enable Amazon GuardDuty S3 protection.

Answer

Configure AWS Config with a rule to check for public S3 buckets.

Answer

Use AWS Trusted Advisor to monitor S3 bucket permissions.

Question 6

A cloud operations team runs a Kubernetes cluster on Amazon EKS. They need a single deployment that sends pod-level CPU and memory metrics to Amazon CloudWatch and also exposes them for horizontal pod autoscaling. Which component should they deploy?

Accepted Answer

Amazon CloudWatch agent deployed via the Amazon CloudWatch Observability EKS add-on. The CloudWatch Observability EKS add-on installs the CloudWatch agent with Container Insights, which is the supported way to publish pod-level CPU and memory metrics to CloudWatch on EKS. Those metric namespaces are then consumable by dashboards and by the HorizontalPodAutoscaler through the CloudWatch metrics adapter. A tracing daemon, a compliance recorder, or a generic OpenTelemetry collector does not deliver the same curated metric set out of the box.

Answer

AWS X-Ray daemon as a sidecar in every application pod

Answer

AWS Config recorder with managed rules for EKS

Answer

AWS Distro for OpenTelemetry (ADOT) collector as a DaemonSet

Question 7

A cloud operations team wants to enforce guardrails that prevent misconfigured resources from being deployed in a Google Cloud organization. They need policies that evaluate resource configuration before or at deployment time and can deny non-compliant creations. Which TWO Google Cloud capabilities should the team implement? (Choose two.)

Accepted Answer

Organization Policy Service constraints applied at the organization and folder level. Organization Policy Service constraints and Policy Controller both operate as preventive controls that evaluate configuration and deny non-compliant deployments. The first applies across the resource hierarchy for Google Cloud services, while the second extends admission-time enforcement to Kubernetes workloads, together covering the guardrail requirement.

Answer

Cloud Asset Inventory feeds analyzed with BigQuery for compliance reporting

Answer

VPC Service Controls perimeters configured around sensitive projects

Answer

Security Command Center Premium findings exported to Cloud Logging

Question 8

A cloud operations team is using AWS Systems Manager to manage a fleet of EC2 instances. They need to run a script on all instances to install a security agent. The script must run only once per instance and should not run again if the instance is rebooted. Which Systems Manager feature should they use?

Accepted Answer

AWS Systems Manager Run Command. The requirement is to run a script once on each instance. Run Command is designed for one-time execution of commands across a fleet. It does not have a built-in mechanism to re-run on reboot, unlike State Manager associations. Therefore, Run Command is the appropriate choice.

Answer

AWS Systems Manager Patch Manager

Answer

AWS Systems Manager State Manager

Answer

AWS Systems Manager Automation

Question 9

A cloud engineer is responsible for a critical web application deployed on AWS. The application runs on an Auto Scaling group of EC2 instances behind an Application Load Balancer (ALB). The engineer needs to implement a health check mechanism that ensures traffic is only routed to healthy instances and that unhealthy instances are automatically replaced. The health check should verify that the application is responding correctly to HTTP requests on a specific path and should also consider the instance's system status. Which configuration should the engineer implement?

Accepted Answer

Configure the ALB target group health check to use the HTTP protocol on a custom path, and enable ELB health checks on the Auto Scaling group. Additionally, set up a CloudWatch alarm on the StatusCheckFailed metric to trigger an Auto Scaling group replacement policy.. The engineer should configure the ALB target group to perform HTTP health checks on a custom path that validates application functionality. Enabling ELB health checks on the Auto Scaling group ensures that instances failing these checks are replaced. Adding a CloudWatch alarm on the EC2 StatusCheckFailed metric addresses underlying instance-level failures. This layered approach guarantees that only healthy instances serve traffic and that any unhealthy instance is automatically replaced, meeting the requirements for high availability and correct application response.

Answer

Configure the ALB target group health check to use HTTP on the root path, and enable both EC2 and ELB health checks on the Auto Scaling group. Set the health check grace period to 0 seconds to ensure immediate replacement.

Answer

Configure the ALB target group health check to use HTTP on a custom path, and set the Auto Scaling group to use EC2 health checks. Create a Lambda function that periodically polls the application and terminates unhealthy instances.

Answer

Configure the ALB target group health check to use TCP on port 80, and set the Auto Scaling group to use EC2 status checks only. Rely on the ALB to remove unhealthy instances from rotation.

Question 10

A team operates a multi-tier application on Google Cloud. They need a managed service that automatically scales a stateless container image based on HTTP request concurrency and provides a stable HTTPS endpoint with a managed TLS certificate. Which Google Cloud service should they choose?

Accepted Answer

Cloud Run with a serverless network endpoint group and managed certificates. Cloud Run is the Google Cloud managed compute service that runs a stateless container image, scales by request concurrency, and can be fronted by a global external Application Load Balancer using a serverless network endpoint group. That combination yields a stable HTTPS endpoint with a Google-managed certificate. GKE, Compute Engine instance groups, and App Engine standard each require more operational work or do not scale on the specific concurrency signal requested.

Answer

Compute Engine managed instance group with an autoscaling policy on CPU

Answer

App Engine standard environment with automatic scaling

Answer

Google Kubernetes Engine with a HorizontalPodAutoscaler

Question 11

A cloud operations team is using AWS CloudFormation to manage infrastructure. The team needs to ensure that when a stack update fails, the stack automatically rolls back to the previous stable state. Additionally, they want to receive an alert via Amazon SNS when a rollback occurs. Which combination of CloudFormation features should the team use to meet these requirements?

Accepted Answer

Enable rollback on failure in the stack's update options, and configure an Amazon SNS notification for the stack's ROLLBACK_COMPLETE event.. The team should enable the rollback on failure option in the stack's update settings, which automatically reverts the stack to its previous state if an update fails. To receive an alert, they should configure an Amazon SNS notification for the ROLLBACK_COMPLETE event, which is triggered when a rollback finishes successfully. This combination ensures both automatic recovery and timely notification, directly addressing the requirements.

Answer

Enable termination protection on the stack, and configure an Amazon SNS notification for the UPDATE_FAILED event.

Answer

Enable rollback on failure in the stack's update options, and configure an Amazon SNS notification for the UPDATE_ROLLBACK_COMPLETE event.

Answer

Use a change set to preview changes, and configure an Amazon SNS notification for the CREATE_COMPLETE event.

Question 12

A cloud operations team is responsible for a production web application on Microsoft Azure. They want to receive an automated notification whenever the average response time of the application exceeds a threshold for five minutes. The notification must reach the on-call engineer through a mobile push and a shared team channel. Which combination of Azure resources should the team configure?

Accepted Answer

An alert rule on the Application Insights availability metric, with an action group that contains an email and an SMS receiver.. Azure Monitor alert rules evaluate a metric against a threshold for a specified duration, and action groups define the notification channels. Pairing an alert rule based on Application Insights response time with an action group containing email and SMS receivers triggers on the five-minute condition and delivers the message to both the on-call engineer and the team channel.

Answer

A Log Analytics query alert that runs on a schedule, with an automation runbook that restarts the App Service when triggered.

Answer

A metric alert rule scoped to the App Service plan, with a diagnostic setting that streams platform logs to a Log Analytics workspace.

Answer

An Azure Monitor workbook that visualizes response time, shared with the operations team through a dashboard.

Question 13

A cloud administrator needs to grant a service account in Google Cloud permission to read objects from a specific Cloud Storage bucket without granting access to any other bucket. Which mechanism should be used?

Accepted Answer

Add an IAM binding on the bucket that grants roles/storage.objectViewer to the service account. Cloud Storage IAM allows role bindings at the bucket level, so granting roles/storage.objectViewer on a single bucket gives the service account read access to that bucket's objects only. Project-level grants are too broad, signed URLs are unsuitable for a persistent service identity, and legacyBucketReader does not confer object read access.

Answer

Enable uniform bucket-level access and assign roles/storage.legacyBucketReader

Answer

Create a signed URL for each object and distribute the URLs to the service account

Answer

Grant the roles/storage.objectViewer role to the service account at the project level

Question 14

A cloud operations team runs a workload on Amazon EC2 and wants to reduce cost by automatically stopping instances outside business hours. The instances are in an Auto Scaling group with a minimum capacity of two and a maximum of ten. The team needs the instances to stop every evening and start every morning without changing the group's desired capacity. Which approach should the team use?

Accepted Answer

Use AWS Instance Scheduler to stop and start the instances on a defined schedule. AWS Instance Scheduler uses tags and schedules to stop and start EC2 instances automatically, which fits the requirement to power down outside business hours and power up in the morning. It does not modify the Auto Scaling group's desired capacity, so the same instances are stopped and restarted. Scheduled scaling would change capacity, lifecycle hooks coordinate scaling transitions, and hibernation is not a scheduled power-management tool.

Answer

Configure an Auto Scaling lifecycle hook to stop instances at night

Answer

Enable EC2 hibernation on the instances and schedule hibernation with a CloudWatch alarm

Answer

Create a scheduled scaling action that sets the desired capacity to zero at night and back to the original value in the morning

Question 15

A cloud engineer is setting up automated patching for Linux instances in AWS. They need to define a maintenance window during which patches are applied. Which service should they use?

Accepted Answer

AWS Systems Manager Patch Manager. AWS Systems Manager Patch Manager is specifically designed to automate the process of patching managed nodes, including defining maintenance windows during which patches are applied. It allows you to create patch baselines, specify approved patches, and schedule patching within a maintenance window. This meets the requirement of automated patching with a defined maintenance window.

Answer

AWS Config

Answer

AWS OpsWorks

Answer

Amazon Inspector