CV0-004 Hard Questions — 25 Difficult Questions

Question 1

A cloud operations team needs to implement a monitoring solution for a microservices architecture. The solution must provide centralized logging, metrics, and alerting, and must be able to correlate data from multiple services. Which THREE of the following components should the team include?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A centralized logging system (e.g., ELK stack).. A centralized logging system like the ELK stack (Elasticsearch, Logstash, Kibana) aggregates logs from all microservices into a single searchable repository. This enables the team to correlate events across services by timestamp and metadata, which is essential for debugging distributed transactions and identifying root causes of failures.

Answer

A security information and event management (SIEM) system.

Answer

An application performance monitoring (APM) tool.

Question 2

Refer to the exhibit. A cloud administrator runs the above command on a Linux virtual machine. What is the effect of the current firewall rules?

Accepted Answer

All incoming traffic is allowed except RDP, which is dropped.. The rules show ACCEPT for SSH (22), HTTP (80), and HTTPS (443), and DROP for RDP (3389). Since the default policy on the INPUT chain is ACCEPT, all other traffic is allowed, which is not secure. The administrator should set the default policy to DROP and only allow necessary ports.

Answer

All outgoing traffic is controlled by these rules.

Answer

The firewall is blocking all traffic by default.

Answer

Only SSH, HTTP, and HTTPS are allowed; all other traffic is dropped.

Question 3

An organization's hybrid cloud environment uses a VPN connection between on-premises and the cloud. Intermittent connectivity drops are reported during peak hours. The VPN logs show rekeying failures. Which configuration is most likely the cause?

Accepted Answer

The IPSec dead peer detection interval is set too high. A dead peer detection (DPD) interval set too high delays detection of lost peers, causing rekeying failures under load. Option A is wrong because pre-shared keys don't expire. Option C is wrong because throughput exceeded would show packet loss or high latency, not rekeying failures. Option D is wrong because blocking IKE packets would prevent the VPN from establishing at all.

Answer

The VPN tunnel is using a pre-shared key that has expired

Answer

The VPN gateway throughput is exceeded

Answer

The on-premises firewall is blocking IKE packets

Question 4

A company has deployed a multi-tier application on a public cloud platform. The security team discovers that a Compute Instance is communicating with an external IP address known for malicious activity. The instance is part of an auto scaling group. What is the BEST immediate action to contain the threat while minimizing downtime?

Accepted Answer

Remove the instance from the auto scaling group and attach a security group that blocks all traffic.. Isolating the compromised instance by detaching it from the auto scaling group and applying a security group that denies all traffic can quickly contain the threat. Network ACLs are attached to subnets and changing them could affect other instances. Suspending the auto scaling group alone may not stop the current instance. Updating routing tables is complex and could disrupt legitimate traffic.

Answer

Suspend the auto scaling group to prevent additional instances from being launched.

Answer

Use a routing table blackhole to drop traffic from the instance.

Answer

Modify the network ACL for the subnet to deny traffic to the malicious IP.

Question 5

A company is migrating a legacy database that relies on a specific hardware security module (HSM) that cannot be moved to the cloud. The application must continue to function with minimal redevelopment. Which migration strategy is most appropriate?

Accepted Answer

Replace. (Replace) because the legacy database depends on a specific hardware security module (HSM) that cannot be migrated to the cloud. Replacing the database with a cloud-native equivalent (e.g., Amazon RDS or Azure SQL Database) that supports a cloud-based HSM (like AWS CloudHSM or Azure Key Vault Managed HSM) allows the application to continue functioning with minimal redevelopment, as the replacement typically maintains SQL compatibility and standard interfaces.

Answer

Refactor

Answer

Rehost

Answer

Rebuild

Question 6

An organization wants to minimize costs for a batch processing workload that runs nightly for 2 hours and can tolerate interruptions. Which pricing model is most cost-effective?

Accepted Answer

Spot instances. Spot instances offer significant discounts but can be terminated; suitable for fault-tolerant, interruptible workloads.

Answer

On-demand instances

Answer

Reserved instances

Answer

Dedicated hosts

Question 7

A company is migrating to GCP and needs to ensure data encryption in transit for all external communications. Which THREE measures should be implemented? (Choose three.)

Accepted Answer

Configure load balancer to redirect HTTP to HTTPS. TLS 1.2+ ensures strong encryption in transit. Certificate management ensures valid certificates. Enforcing HTTPS via load balancer policies redirects HTTP traffic.

Answer

Disable TLS for internal VPC traffic

Answer

Enable AES-256 encryption at rest

Question 8

A cloud administrator is troubleshooting a performance issue where an application running on a VM in a private cloud is experiencing high latency. The VM is connected to a virtual switch that uses SR-IOV. The administrator suspects network bottlenecks. Which of the following is the MOST likely cause of the latency?

Accepted Answer

The physical network interface card (NIC) is saturated.. SR-IOV allows a physical NIC to present multiple virtual functions (VFs) directly to VMs, bypassing the virtual switch for data plane traffic. When the physical NIC reaches its bandwidth capacity, all VFs sharing that NIC experience increased latency and packet drops, making NIC saturation the most likely cause of the high latency.

Answer

The virtual switch is dropping packets due to buffer exhaustion.

Answer

The VM's virtual NIC is not using the correct driver.

Answer

The hypervisor's CPU is overloaded due to SR-IOV emulation.

Question 9

A company uses a multi-cloud strategy with both AWS and Azure. The cloud operations team needs to centrally monitor all cloud resources and receive alerts when resource usage exceeds predefined thresholds. Which of the following solutions should the team implement?

Accepted Answer

A third-party monitoring tool that supports both AWS and Azure. A third-party monitoring tool (e.g., Datadog, Splunk, or Dynatrace) can natively ingest metrics and logs from both AWS and Azure APIs, providing a single pane of glass for alerting across a multi-cloud environment. This avoids the vendor lock-in and integration gaps that arise when using native tools from only one cloud provider.

Answer

Azure Monitor with Log Analytics

Answer

AWS CloudWatch with cross-account monitoring

Answer

Custom scripts that log to a central syslog server

Question 10

A cloud administrator is troubleshooting a network connectivity issue between two subnets. They suspect a security group or NACL is blocking traffic. Which tool should they use to analyze the traffic flow?

Accepted Answer

VPC Flow Logs. VPC Flow Logs capture network traffic metadata, helping identify dropped packets.

Answer

AWS X-Ray

Answer

AWS CloudTrail

Answer

AWS Config

Question 11

A company is migrating a legacy application to the cloud. The application has a stateful design and requires low-latency access to a shared file system. The application must scale horizontally to handle increased load. Which THREE of the following architectural changes should be recommended to enable horizontal scaling?

Accepted Answer

Refactor the application to be stateless. Horizontal scaling requires that any instance can handle any request without depending on local state. By refactoring the application to be stateless, session data is externalized, allowing new instances to be added or removed without affecting ongoing transactions. This eliminates the coupling between a client and a specific server, which is essential for elastic scaling in cloud environments.

Answer

Increase the size of the existing virtual machines (vertical scaling)

Answer

Use sticky sessions (session affinity) on the load balancer

Question 12

A cloud engineer needs to ensure that an auto-scaling group does not launch new instances immediately after a scale-in event to allow metrics to stabilize. Which feature should they configure?

Accepted Answer

Cooldown periods. Cooldown periods prevent premature scaling by allowing metrics to stabilize.

Answer

Health checks

Answer

Scheduled scaling

Answer

Lifecycle hooks

Question 13

A company is experiencing high latency in their cloud-based database. The database is provisioned with SSD storage. Which THREE factors should the administrator investigate? (Choose three.)

Accepted Answer

Network bandwidth between application and database. Options A, B, and D are correct because network bandwidth limitations between application and database can cause high latency, unoptimized database queries increase response time, and exceeding IOPS limits leads to throttling and higher latency. Option C is incorrect because the number of database replicas primarily affects read throughput and fault tolerance, not latency directly. Option E is incorrect because region latency is a fixed infrastructure property that typically does not change suddenly, so it is less likely to be the cause of a sudden latency spike.

Answer

Number of database replicas

Answer

Region latency

Question 14

A global company runs a SaaS application in multiple cloud regions. They use DNS-based global load balancing to route users to the nearest region. Recently, users in Asia are experiencing high latency and timeouts. The administrator checks the health of the Asian region's resources and finds everything operational. Latency measurements from a monitoring tool show that traffic from Asian users is being routed to the European region. What should the administrator investigate first?

Accepted Answer

The latency-based routing policy. The latency-based routing policy. Since the Asian region's resources are operational but traffic is being routed to Europe, the issue is likely that the latency-based routing policy is misconfigured or not accurately measuring latency from Asian users. This policy uses latency measurements to route users to the closest region; if it's flawed, traffic may be sent to a distant region. Investigate the latency routing policy first. Option B (DNS TTL) affects caching duration, not routing decisions. Option C (geo-location records) is used for geographic routing, not latency-based routing. Option D (load balancer in Asia) is operational, so the problem is at the DNS level, not the load balancer.

Answer

The DNS TTL settings

Answer

The geo-location records in the DNS provider

Answer

The load balancer configuration in the Asian region

Question 15

A company is migrating on-premises workloads to a public cloud. The disaster recovery plan requires an RTO of 15 minutes and an RPO of 5 minutes. Which replication strategy should be used for a critical database?

Accepted Answer

Continuous replication to a standby instance in another region. Continuous replication with synchronous or near-synchronous updates can achieve very low RPO (minutes) and low RTO. Cross-region replication may have higher latency, and snapshot-based backup typically has higher RPO and RTO.

Answer

Weekly full backups with daily incrementals stored in the same region

Answer

Scheduled snapshots every hour with cross-region copy

Answer

Daily snapshots replicated cross-region

Question 16

A company is deploying a critical application in the cloud and needs to ensure that it can automatically recover from an intent—a failure of an entire cloud provider region. Which of the following architectures should be implemented?

Accepted Answer

Active-passive deployment across two regions with DNS-based failover. An active-passive deployment across two regions with DNS-based failover ensures that if one entire region fails, traffic is routed to the passive region, providing disaster recovery at the region level. Option B is wrong because multiple availability zones within a single region cannot survive the failure of the entire region. Option C is wrong because auto-scaling groups in a single region do not protect against region failure. Option D is wrong because active-active across AZs within one region also cannot survive a region-level failure.

Answer

Active-passive deployment across multiple availability zones in the same region

Answer

Single-region deployment with auto-scaling groups

Answer

Active-active deployment across multiple availability zones in the same region

Question 17

During a scheduled DR drill, the cloud team fails over a critical application to the secondary region. After the drill, the application is failed back. The application's RTO was 2 hours, but the actual failover took 2.5 hours. Which action should be taken to improve future failover times?

Accepted Answer

Automate the failover process using infrastructure as code and runbooks. Failing the RTO indicates the process is not meeting the target. Automating the failover process with scripts or runbooks reduces manual steps and time. Rehearsing the process more often also helps but automation directly reduces time.

Answer

Increase the frequency of DR drills

Answer

Increase the bandwidth between regions for data replication

Answer

Reduce the RTO to 1 hour to force faster execution

Question 18

A company uses AWS and wants to analyze cost trends and identify the top services contributing to monthly spending. Which AWS tool provides a pre-built dashboard for this purpose?

Accepted Answer

AWS Cost Explorer. AWS Cost Explorer provides pre-built reports and dashboards for cost trend analysis.

Answer

AWS Trusted Advisor

Answer

AWS Compute Optimizer

Answer

AWS Budgets

Question 19

A company uses AWS and wants to implement a disaster recovery plan with an RTO of 4 hours and RPO of 1 hour. They have a primary site in us-east-1 and a DR site in us-west-2. The application data is stored in Amazon RDS for MySQL. Which strategy meets both RTO and RPO with minimal data loss?

Accepted Answer

Create a cross-region read replica in us-west-2 and promote it during failover.. Cross-region read replicas for Amazon RDS provide asynchronous replication with a typical RPO of less than 5 minutes, easily meeting the 1-hour requirement. In a disaster, you can promote the replica to a primary instance within minutes, meeting the 4-hour RTO.

Answer

Use AWS Database Migration Service (DMS) for continuous replication to a separate RDS instance in us-west-2.

Answer

Export data to S3 using AWS Backup and restore in us-west-2.

Answer

Take daily automated snapshots of the RDS instance and copy them to us-west-2.

Question 20

A cloud engineer is configuring an auto-scaling policy for a batch processing application that takes about 10 minutes to initialize before it can start processing jobs. To avoid premature termination of instances that have just started, what should the engineer configure?

Accepted Answer

Use a lifecycle hook to put the instance in a 'wait' state until initialization is complete. A lifecycle hook can put instances in a pending state until they complete initialization. Cooldown periods prevent scaling actions but do not prevent termination of new instances.

Answer

Disable scale-in for the first 10 minutes using a scheduled action

Answer

Set the health check grace period to 600 seconds

Answer

Increase the cooldown period to 600 seconds