CV0-004 Hard Questions — 25 Difficult Questions

Question 1

A cloud engineer is designing a solution for a financial application that requires strict data residency in a specific country. The application must also be highly available across multiple data centers within that country. Which design consideration is most critical?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploying resources in multiple availability zones within the same region.. Deploying across multiple availability zones within the same region keeps data within the country while providing high availability through fault isolation. This satisfies both data residency and availability requirements without introducing cross-border data flows that could violate regulations.

Answer

Using a content delivery network (CDN) to cache data globally.

Answer

Using a global load balancer to distribute traffic across continents.

Answer

Implementing a multi-region active-active architecture.

Question 2

A cloud engineer is configuring auto-scaling for a web application that experiences variable traffic. The application runs on virtual machines and uses a message queue for incoming requests. The scaling policy must ensure that the average CPU utilization stays around 60% and that the queue depth does not exceed 100 messages. Which THREE metrics should the engineer use for the scaling policies? (Choose three.)

Accepted Answer

CPU utilization. Option B (CPU utilization) is correct because the scenario explicitly requires the average CPU utilization to stay around 60%, making it a direct target-tracking metric for the auto-scaling policy. Option C (SQS queue depth/message count) is correct because the requirement states the queue depth must not exceed 100 messages, so this metric drives a scaling policy that adds capacity when the backlog grows. Option E (custom application metrics such as request latency) is correct because variable-traffic web applications often need application-level signals to scale accurately when infrastructure metrics alone are insufficient, and custom metrics can be published to the scaling service to trigger policies. Option A (network throughput) is not required by the stated thresholds and is a weaker proxy for load than CPU or queue depth. Option D (memory utilization) is also not part of the stated requirements and is not a reliable primary scaling signal for this scenario.

Answer

Network throughput (bytes in/out)

Answer

Memory utilization

Question 3

During a security audit, an organization discovers their cloud-based database is accessible from any public IP address due to a firewall rule allowing 0.0.0.0/0 on port 3306 (MySQL). The database must remain accessible to remote developers working from home. What is the most effective remediation?

Accepted Answer

Change the firewall rule to allow only specific known developer IP ranges.. Restricting to specific trusted IP ranges reduces exposure while maintaining remote access.

Answer

Remove the firewall rule entirely and rely on database IAM authentication.

Answer

Enable encryption in transit using TLS and keep the rule as is.

Answer

Move the database to a private subnet without a NAT gateway.

Question 4

An organization must comply with a regulation requiring that all data stored in the cloud be encrypted at rest using a cloud provider's native encryption service. The company also needs to maintain control over the encryption keys. Which solution should the architect recommend?

Accepted Answer

Use the cloud provider's native encryption service with customer-managed keys. The regulation requires cloud-native encryption at rest with customer-controlled keys. Cloud providers offer services like AWS KMS with customer-managed keys (CMKs) or Azure Key Vault with customer-managed keys, which allow the organization to create, rotate, and disable keys independently while the provider handles the underlying encryption of data at rest using envelope encryption. This satisfies both the 'native encryption service' and 'maintain control over the encryption keys' requirements.

Answer

Encrypt the data on-premises before uploading to the cloud

Answer

Use the cloud provider's default encryption with provider-managed keys

Answer

Use a third-party hardware security module (HSM) hosted on-premises

Question 5

Refer to the exhibit. What action should the administrator take to bring the environment into compliance?

Accepted Answer

Resize the non-compliant VMs to t2.medium.. The exhibit shows that the environment has a compliance policy requiring all VMs to be of type t2.medium, but two VMs are running as t2.large and t2.xlarge. Resizing the non-compliant VMs to t2.medium brings them into alignment with the policy, ensuring the environment meets the defined compliance standard. This action directly remediates the violation without unnecessary deletion or ignoring the check.

Answer

Modify the policy file to accept t2.large and t2.xlarge.

Answer

Ignore the compliance check because it is advisory.

Answer

Delete the non-compliant VMs.

Question 6

An organization is implementing a canary deployment strategy for a microservice running on Kubernetes. The deployment should automatically roll back if the error rate exceeds 2% within the first 5 minutes. Which THREE components are essential for implementing this strategy? (Choose three.)

Accepted Answer

Service mesh (e.g., Istio, Linkerd). To implement canary with automatic rollback, you need a traffic split mechanism (service mesh), monitoring (Prometheus), and progressive delivery tool (Flagger).

Answer

Horizontal Pod Autoscaler

Answer

Kubernetes Service with label selectors

Question 7

A cloud operations team needs to implement a monitoring solution for a microservices architecture. The solution must provide centralized logging, metrics, and alerting, and must be able to correlate data from multiple services. Which THREE of the following components should the team include?

Accepted Answer

A centralized logging system (e.g., ELK stack).. Option B is correct because a centralized logging system such as the ELK stack (Elasticsearch, Logstash, Kibana) aggregates logs from all microservices into one searchable store, which is essential for centralized logging and for correlating events across services. Option C is correct because a correlation engine and alerting system is what ties together logs and metrics from multiple services, detects patterns or thresholds, and generates alerts, directly satisfying the alerting and correlation requirements. Option D is correct because a metrics collection agent and dashboard such as Prometheus with Grafana provides time-series metrics collection, storage, and visualization, fulfilling the metrics and dashboarding needs of the monitoring solution. Option A is not required here because a SIEM focuses on security event management and compliance rather than general operational monitoring, metrics, and service correlation. Option E is not required because APM is a specialized tool for tracing application performance and, while useful, is not one of the three core components needed for centralized logging, metrics, and alerting in this scenario.

Answer

A security information and event management (SIEM) system.

Answer

An application performance monitoring (APM) tool.

Question 8

A company is migrating a legacy database that relies on a specific hardware security module (HSM) that cannot be moved to the cloud. The application must continue to function with minimal redevelopment. Which migration strategy is most appropriate?

Accepted Answer

Replace. (Replace) because the legacy database depends on a specific hardware security module (HSM) that cannot be migrated to the cloud. Replacing the database with a cloud-native equivalent (e.g., Amazon RDS or Azure SQL Database) that supports a cloud-based HSM (like AWS CloudHSM or Azure Key Vault Managed HSM) allows the application to continue functioning with minimal redevelopment, as the replacement typically maintains SQL compatibility and standard interfaces.

Answer

Refactor

Answer

Rehost

Answer

Rebuild

Question 9

A company needs to transfer 200 TB of data from an on-premises NAS to Amazon S3 over the internet within 5 days. The available bandwidth is 1 Gbps. Which AWS service should be used to accelerate the transfer?

Accepted Answer

AWS DataSync. AWS DataSync can accelerate transfers over the internet using parallel multi-threading and compression. Snowball would be faster for 200 TB, but the question specifies over the internet. DataSync is optimized for network transfers.

Answer

AWS Snowball

Answer

S3 Transfer Acceleration

Answer

AWS Direct Connect

Question 10

A team uses Terraform to manage infrastructure. After running terraform apply, the state file is stored in an S3 backend with DynamoDB locking. During a subsequent terraform plan, the team notices that the state file shows resources that no longer exist in the cloud. Which command should the team run to reconcile the state with the actual cloud resources?

Accepted Answer

terraform refresh. The terraform refresh command updates the Terraform state file to match the actual state of cloud resources. When resources are deleted or modified outside of Terraform, the state becomes outdated. Running terraform refresh queries the provider for the real-world status and reconciles the state accordingly. In contrast, terraform plan only shows proposed changes, terraform import is used to bring existing resources under management, and terraform state rm removes entries from the state without syncing with reality. Therefore, terraform refresh is the correct command to reconcile the state with actual cloud resources.

Answer

terraform plan

Answer

terraform import

Answer

terraform state rm

Question 11

A company is migrating to GCP and needs to ensure data encryption in transit for all external communications. Which THREE measures should be implemented? (Choose three.)

Accepted Answer

Configure load balancer to redirect HTTP to HTTPS. TLS 1.2+ ensures strong encryption in transit. Certificate management ensures valid certificates. Enforcing HTTPS via load balancer policies redirects HTTP traffic.

Answer

Disable TLS for internal VPC traffic

Answer

Enable AES-256 encryption at rest

Question 12

A company uses a multi-cloud strategy with both AWS and Azure. The cloud operations team needs to centrally monitor all cloud resources and receive alerts when resource usage exceeds predefined thresholds. Which of the following solutions should the team implement?

Accepted Answer

A third-party monitoring tool that supports both AWS and Azure. A third-party monitoring tool (e.g., Datadog, Splunk, or Dynatrace) can natively ingest metrics and logs from both AWS and Azure APIs, providing a single pane of glass for alerting across a multi-cloud environment. This avoids the vendor lock-in and integration gaps that arise when using native tools from only one cloud provider.

Answer

Azure Monitor with Log Analytics

Answer

AWS CloudWatch with cross-account monitoring

Answer

Custom scripts that log to a central syslog server

Question 13

A security administrator is configuring a Web Application Firewall (WAF) to protect a public-facing web application. The application experiences a high volume of traffic from certain geographic regions that are not serving customers. Which WAF feature should be used to block this traffic?

Accepted Answer

Geo-blocking. Geo-blocking allows the WAF to block or allow traffic based on geographic location, reducing unwanted traffic and potential attacks.

Answer

Rate limiting

Answer

OWASP rule set

Answer

IP reputation lists

Question 14

A company is migrating a legacy application to the cloud. The application has a stateful design and requires low-latency access to a shared file system. The application must scale horizontally to handle increased load. Which THREE of the following architectural changes should be recommended to enable horizontal scaling?

Accepted Answer

Refactor the application to be stateless. Horizontal scaling requires that any instance can handle any request without depending on local state. By refactoring the application to be stateless, session data is externalized, allowing new instances to be added or removed without affecting ongoing transactions. This eliminates the coupling between a client and a specific server, which is essential for elastic scaling in cloud environments.

Answer

Increase the size of the existing virtual machines (vertical scaling)

Answer

Use sticky sessions (session affinity) on the load balancer

Question 15

A cloud engineer is configuring an auto-scaling policy for a batch processing application that takes about 10 minutes to initialize before it can start processing jobs. To avoid premature termination of instances that have just started, what should the engineer configure?

Accepted Answer

Use a lifecycle hook to put the instance in a 'wait' state until initialization is complete. A lifecycle hook pauses the instance in a wait state during launch (or termination), giving the batch application time to initialize before it is registered with the load balancer or marked healthy. This prevents premature termination of instances that are still initializing.

Answer

Disable scale-in for the first 10 minutes using a scheduled action

Answer

Set the health check grace period to 600 seconds

Answer

Increase the cooldown period to 600 seconds

Question 16

A company is deploying a containerized application on AWS. The security team requires that the containers run in an environment where the underlying host is not shared with other AWS customers, and the company must have the ability to manage the host's kernel and patching. Which AWS service should be used?

Accepted Answer

Amazon ECS with EC2 launch type on Dedicated Hosts. Running ECS with the EC2 launch type on Dedicated Hosts provides the necessary isolation and control. Dedicated Hosts give you a physical server dedicated to your use, and you can manage the host OS, including kernel and patching. Fargate, EKS managed node groups, and App Runner do not offer this level of control and isolation.

Answer

AWS App Runner

Answer

Amazon ECS with Fargate launch type

Answer

Amazon EKS with managed node groups

Question 17

A DevOps team is implementing a canary deployment for a microservice running on Amazon ECS. They want to gradually shift 10% of traffic to the new version and automatically roll back if error rates exceed 1% in 5 minutes. Which combination of services should they use?

Accepted Answer

AWS CodeDeploy with CloudWatch alarms. AWS CodeDeploy natively supports canary deployments for Amazon ECS, allowing you to specify a traffic shift percentage (e.g., 10%) and integrate with CloudWatch alarms to automatically trigger a rollback when error rates exceed a defined threshold (e.g., 1% over 5 minutes). This combination directly fulfills the gradual traffic shifting and automated rollback requirements without custom scripting.

Answer

AWS CloudFormation and SSM

Answer

AWS Lambda and Step Functions

Answer

AWS Elastic Beanstalk and Route 53

Question 18

A cloud administrator is troubleshooting a web application hosted on a cloud virtual machine (VM) that is experiencing intermittent high latency during peak traffic hours. The application is deployed on a single VM instance with 4 vCPUs and 8 GB RAM, running a Linux OS. The VM is connected to a virtual network with a public IP. The administrator has verified that the application code is optimized and there are no memory leaks. CPU utilization remains below 50% during peaks, but network outbound traffic shows periodic spikes up to 500 Mbps. The VM's network interface is configured with a 1 Gbps bandwidth cap. The administrator suspects that the issue is related to network throttling or packet loss. Which of the following actions should the administrator take to resolve the issue?

Accepted Answer

Upgrade the VM to a larger instance size with higher network bandwidth cap (e.g., 2 Gbps).. The VM's network bandwidth cap of 1 Gbps is being saturated during peak traffic (spikes up to 500 Mbps, but with overhead and burst behavior, the cap can cause throttling and packet loss). Upgrading to a larger instance size with a higher network bandwidth cap (e.g., 2 Gbps) directly addresses the bottleneck by providing more headroom for outbound traffic, reducing latency caused by queueing and drops. The administrator has already ruled out CPU and memory issues, so the network cap is the likely culprit.

Answer

Increase the VM's vCPU count to 8 to improve processing capacity.

Answer

Configure the firewall to allow all traffic to reduce processing overhead.

Answer

Enable DDoS protection on the public IP to filter malicious traffic.

Question 19

A company uses Azure and wants to centrally audit all management operations across subscriptions. Which service should be used to collect and analyze these logs?

Accepted Answer

Azure Monitor. Azure Monitor is the correct service because it provides a centralized platform for collecting, analyzing, and acting on telemetry data from Azure resources, including management operations across subscriptions. Specifically, the Azure Activity Log within Azure Monitor captures all control-plane events (e.g., resource creation, deletion, policy changes) at the subscription level, enabling auditing and alerting. This directly meets the requirement for centrally auditing management operations across multiple subscriptions.

Answer

GCP Cloud Audit Logs

Answer

AWS CloudTrail

Answer

Azure Security Center

Question 20

A cloud administrator deploys a new application that writes logs to a block storage volume attached to a virtual machine. The application's performance degrades after a few hours. Monitoring shows that the volume's read latency is low, but write latency spikes periodically. The administrator discovers that the volume type is standard HDD. What should the administrator do to improve write performance without changing the application?

Accepted Answer

Migrate to a volume type with provisioned IOPS (SSD).. Standard HDD volumes have low maximum IOPS and burst performance that is quickly exhausted under sustained writes, leading to write latency spikes. Migrating to a volume type with provisioned IOPS, such as SSD, provides consistent and higher write performance without requiring application changes. Option B is incorrect because increasing the volume size does increase baseline IOPS for HDD volumes, but the improvement is marginal and still relies on burst credits, which will be depleted again. Option C is incorrect because moving logs to object storage changes the storage paradigm and would require application modifications to use different APIs. Option D is incorrect because write caching on a data volume is not recommended as it can lead to data loss in the event of a power failure, and caching is typically for read performance.

Answer

Increase the volume size to gain higher baseline IOPS.

Answer

Move the logs to an object storage service.

Answer

Enable write caching on the volume.