CV0-004 Hard Questions — 25 Difficult Questions

Question 1

A company uses a hybrid cloud model with an on-premises data center and a public cloud. The network team reports that traffic between the cloud and on-premises is experiencing high latency and packet loss. The cloud administrator verifies that the VPN connection is up. What is the most likely cause?

Accepted Answer

The VPN tunnel has a mismatched MTU size.. When a VPN tunnel is up but traffic experiences high latency and packet loss, a mismatched Maximum Transmission Unit (MTU) size is a common cause. This occurs because packets larger than the tunnel's MTU must be fragmented, and if fragmentation is not properly handled (e.g., due to the DF bit being set), packets are dropped, leading to retransmissions and increased latency. The symptoms align with MTU issues rather than simple connectivity or throttling problems.

Answer

A firewall rule is blocking ICMP packets.

Answer

VMs are placed in different cloud regions.

Answer

The cloud provider is throttling bandwidth.

Question 2

A cloud engineer is troubleshooting a web application that is not responding. The engineer examines the serial console output of the web-server instance and finds the error shown in the exhibit. What is the MOST likely cause of this issue?

Accepted Answer

A firewall rule is blocking traffic to the metadata server IP address 169.254.169.254.. The error shown in the serial console output indicates that the instance cannot reach the metadata server at 169.254.169.254. This IP address is a link-local address used by cloud providers (e.g., AWS, GCP, Azure) to serve instance metadata, including user data scripts. If a firewall rule blocks traffic to this IP, the instance cannot retrieve its user data, causing the web application to fail to start or respond.

Answer

The service account associated with the instance is missing the required permissions.

Answer

The instance is in a STOPPED state and cannot execute user data scripts.

Answer

The instance does not have a public IP address assigned.

Question 3

A company has a cloud environment with multiple VPCs that need to communicate with each other using private IP addresses. The company wants a centrally managed solution that simplifies routing and security. Which networking architecture should the architect implement?

Accepted Answer

Transit VPC with a VPN appliance. Option D is correct because a Transit VPC with a VPN appliance provides a centrally managed hub-and-spoke architecture that simplifies routing and security for multiple VPCs. The VPN appliance (e.g., a software VPN or AWS Marketplace appliance) establishes encrypted tunnels between the transit VPC and each spoke VPC, allowing private IP communication without the need for full-mesh peering or complex route tables. This design centralizes traffic inspection, policy enforcement, and routing, meeting the requirement for simplified management.

Answer

VPC peering between all VPCs

Answer

Direct Connect to each VPC

Answer

VPN connections between all VPCs

Question 4

A company is implementing a cloud governance strategy. They need to ensure that all resources are tagged with cost center and environment, and any untagged resources are automatically remediated. Which of the following best practices should be applied?

Accepted Answer

Use policy-as-code to enforce tagging and automatically apply tags to untagged resources. Option D is correct because policy-as-code (e.g., Azure Policy, AWS Config Rules, or Open Policy Agent) allows you to define tagging requirements declaratively and automatically remediate non-compliant resources. This approach enforces governance in real-time without manual intervention, ensuring all resources are tagged with cost center and environment as specified.

Answer

Implement role-based access control to restrict resource creation

Answer

Set up budget alerts to notify when costs exceed thresholds

Answer

Create a manual audit process to check tags weekly

Question 5

A cloud administrator is troubleshooting connectivity issues between two virtual networks in a public cloud. The networks are in the same region but different VPCs. Both VPCs have route tables and security groups configured. Instances in VPC A cannot ping instances in VPC B. Which of the following is the most likely cause?

Accepted Answer

VPC peering is not established between the two VPCs.. VPC peering is a direct network connection between two VPCs that enables routing of traffic using private IPv4 or IPv6 addresses. Without an established VPC peering connection, instances in different VPCs cannot communicate, even if they are in the same region. Since the question states the VPCs are separate and no peering is mentioned, this is the most likely root cause of the connectivity failure.

Answer

The instances are not assigned public IP addresses.

Answer

Security groups are blocking ICMP traffic.

Answer

Network ACLs are not configured to allow the traffic.

Question 6

A cloud engineer is troubleshooting a performance issue where a web server cluster experiences high latency during peak hours. The cluster uses an auto-scaling group behind a load balancer. Which THREE steps should the engineer take to identify the root cause?

Accepted Answer

Monitor CPU and memory utilization on the web servers. Option A is correct because high CPU or memory utilization on web servers directly indicates resource contention, which can cause increased request processing time and latency. Monitoring these metrics helps identify if the auto-scaling group is under-provisioned or if a specific instance is overloaded, guiding scaling policy adjustments.

Answer

Reduce the number of instances in the auto-scaling group

Answer

Review security group rules for the load balancer

Question 7

A cloud administrator is troubleshooting a performance issue in a virtualized environment. Which TWO metrics should be monitored to identify CPU contention on the hypervisor?

Accepted Answer

CPU ready time. CPU ready time (B) measures the time a virtual machine is ready to execute but must wait for the hypervisor to schedule it on a physical core. High ready time directly indicates CPU contention, as the VM is being starved of CPU cycles. CPU co-stopping time (E) occurs when multiple vCPUs in a single VM must wait to be scheduled simultaneously, which also signals CPU overcommitment and contention on the hypervisor.

Answer

Swap rate

Answer

Memory ballooning

Answer

CPU utilization per core

Question 8

A company uses a cloud-based load balancer to distribute traffic to a fleet of web servers. Users report intermittent timeouts. The administrator reviews the load balancer logs and notices that one backend server has a significantly higher error rate than the others. Which of the following is the BEST course of action?

Accepted Answer

Drain connections to the unhealthy server and troubleshoot its configuration.. Option B is correct because draining connections from the unhealthy server allows the load balancer to stop sending new traffic to it while existing sessions complete, preventing further timeouts. Troubleshooting the server's configuration addresses the root cause of the high error rate, such as misconfigured web server software, resource exhaustion, or application bugs. This approach follows the principle of isolating and resolving the faulty component rather than masking the issue with workarounds.

Answer

Immediately add two more backend servers to distribute the load.

Answer

Enable sticky sessions on the load balancer to maintain user sessions.

Answer

Increase the health check interval for all servers to reduce false positives.

Question 9

A cloud administrator is reviewing the security posture of a cloud deployment. The company has a policy of least privilege and must ensure that only authorized services can access storage buckets. Which THREE mechanisms should the administrator configure to enforce this policy? (Choose three.)

Accepted Answer

Bucket policies that restrict access to specific AWS services. Option B is correct because bucket policies, such as AWS S3 bucket policies, can explicitly grant or deny access to specific AWS services (e.g., AWS CloudTrail or AWS Config) using the `Principal` element with a service principal (e.g., `Service: cloudtrail.amazonaws.com`). This aligns with the least privilege policy by ensuring only authorized services can access the storage buckets, without relying on network-level controls.

Answer

Network ACLs that block unauthorized IP ranges

Answer

Security groups that allow traffic from authorized services

Question 10

A company is migrating on-premises workloads to the cloud. They need to ensure high availability for a stateless web application across two availability zones. Which THREE components should be configured to meet this requirement?

Accepted Answer

An auto scaling group spanning both availability zones. An auto scaling group spanning both availability zones (Option A) ensures that the stateless web application can automatically replace failed instances and maintain the desired capacity across multiple AZs, which is essential for high availability. By distributing instances across AZs, the application can tolerate an entire AZ failure without losing all compute capacity.

Answer

A read replica database in a different AZ

Answer

A single large EC2 instance to handle all traffic

Question 11

A company is deploying a critical financial application on a private cloud. The compliance team requires that all data at rest be encrypted with a key managed by the company's hardware security module (HSM). The cloud architect must select a storage solution that supports customer-managed keys and integrates with the existing HSM. Which storage option should the architect choose?

Accepted Answer

Encrypted volumes on a software-defined storage (SDS) cluster. Option C is correct because a software-defined storage (SDS) cluster can be configured to use customer-managed encryption keys that integrate directly with the company's existing hardware security module (HSM) via standard interfaces like PKCS#11 or KMIP. This allows the company to maintain full control over key management and meet the compliance requirement for data-at-rest encryption with HSM-managed keys.

Answer

Object storage with server-side encryption using a cloud provider key

Answer

Instance store volumes on the compute nodes

Answer

Network-attached storage (NAS) appliance with built-in encryption

Question 12

A cloud administrator is troubleshooting a performance issue where an application running on a VM in a private cloud is experiencing high latency. The VM is connected to a virtual switch that uses SR-IOV. The administrator suspects network bottlenecks. Which of the following is the MOST likely cause of the latency?

Accepted Answer

The physical network interface card (NIC) is saturated.. SR-IOV allows a physical NIC to present multiple virtual functions (VFs) directly to VMs, bypassing the virtual switch for data plane traffic. When the physical NIC reaches its bandwidth capacity, all VFs sharing that NIC experience increased latency and packet drops, making NIC saturation the most likely cause of the high latency.

Answer

The virtual switch is dropping packets due to buffer exhaustion.

Answer

The VM's virtual NIC is not using the correct driver.

Answer

The hypervisor's CPU is overloaded due to SR-IOV emulation.

Question 13

A company runs a critical e-commerce application on AWS. The architecture includes an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances across two Availability Zones. The instances are in a private subnet and use a NAT Gateway for outbound internet access. The application stores session data in an ElastiCache Redis cluster. During a flash sale, users report that the site is extremely slow and some requests time out. Monitoring shows the ALB's latency metric is high, and the number of healthy hosts fluctuates. The CPU utilization on the EC2 instances averages 60% and memory averages 70%. The Redis cluster's CPU utilization is 90%, and its memory usage is 95%. The NAT Gateway's metrics show high BytesOutToSource but no errors. Which of the following is the most likely cause of the performance issue?

Accepted Answer

The ElastiCache Redis cluster is overloaded and becoming a bottleneck for session lookups. The ElastiCache Redis cluster is the most likely bottleneck because its CPU utilization is at 90% and memory usage at 95%, indicating it is near capacity. Since the application stores session data in Redis, high latency and timeouts during a flash sale are consistent with an overloaded session store that cannot keep up with request volume, causing the ALB to experience increased latency and healthy host fluctuations as sessions fail to be retrieved or written.

Answer

The NAT Gateway is throttling traffic due to bandwidth limits

Answer

The Auto Scaling group is not scaling quickly enough due to cooldown periods

Answer

The ALB's idle timeout setting is too low, causing premature connection drops

Question 14

A cloud administrator is deploying a critical application that requires the lowest possible latency between compute instances. The instances will be running in a private subnet and must communicate with each other using their private IP addresses. Which of the following deployment configurations would best meet these requirements?

Accepted Answer

Deploy instances in a placement group within the same Availability Zone.. Deploying instances in a placement group within the same Availability Zone ensures they are physically close together, often in the same rack or cluster, which minimizes network hops and achieves the lowest possible latency. This configuration is ideal for latency-sensitive applications because it leverages non-blocking, high-bandwidth inter-instance communication without traversing additional network infrastructure.

Answer

Deploy instances in different Availability Zones within the same region.

Answer

Deploy instances in the same subnet behind a NAT gateway.

Answer

Deploy instances in different regions and use inter-region peering.

Question 15

A company has a hybrid cloud environment with on-premises servers and AWS. They deploy a new application using AWS Elastic Beanstalk with a load balancer and auto scaling group. The application is a Node.js API that connects to an RDS MySQL database. After deployment, users report that the API returns a '500 Internal Server Error' intermittently. The application logs show 'ETIMEDOUT' errors when connecting to the database. The database is deployed in a private subnet with a security group that allows inbound traffic from the Elastic Beanstalk environment's security group. The database connection string uses the RDS endpoint. The same application works perfectly when deployed on-premises. What is the most likely cause?

Accepted Answer

The Elastic Beanstalk environment is in a different VPC or subnet that cannot reach the RDS instance. The intermittent 'ETIMEDOUT' errors indicate a network connectivity issue between the Elastic Beanstalk environment and the RDS database. Since the application works on-premises, the problem is specific to the AWS networking configuration. The most likely cause is that the Elastic Beanstalk environment is deployed in a different VPC or subnet that lacks routing or a VPC peering connection to reach the RDS instance's private subnet, causing timeouts when the load balancer or auto scaling group instances attempt to connect.

Answer

The database connection string uses the wrong port number

Answer

The security group attached to the RDS instance does not allow traffic from the Elastic Beanstalk environment

Answer

The RDS instance is in a failed state and needs to be rebooted

Question 16

A cloud architect must design a deployment for a containerized microservices application. The requirements include automated scaling based on CPU utilization, rolling updates with zero downtime, and service discovery. Which orchestration feature should be used?

Accepted Answer

Kubernetes with Horizontal Pod Autoscaler. Kubernetes with Horizontal Pod Autoscaler (HPA) is the correct choice because HPA automatically scales the number of pod replicas based on observed CPU utilization (or custom metrics), meeting the automated scaling requirement. Kubernetes also supports rolling updates with zero downtime via its Deployment controller, which gradually replaces old pods with new ones while maintaining service availability. Additionally, Kubernetes provides built-in service discovery through DNS (CoreDNS) and Services, allowing microservices to find each other by name without external dependencies.

Answer

Docker Compose with a reverse proxy

Answer

Ansible playbooks with Docker modules

Answer

AWS ECS with Fargate

Question 17

A cloud administrator is managing a hybrid cloud environment where on-premises servers connect to a public cloud VPC via a site-to-site VPN. Users report intermittent connectivity issues to cloud resources. The administrator examines the VPN tunnel logs and sees 'Phase 2 negotiation failed' errors. Which of the following is the MOST likely cause?

Accepted Answer

Mismatched encryption domain definitions (traffic selectors) between on-premises and cloud VPN gateways.. Phase 2 negotiation failures in IPsec VPNs indicate that the two gateways cannot agree on the security associations (SAs) for encrypting data traffic. This is most commonly caused by mismatched encryption domain definitions (traffic selectors), such as differing local/remote subnets, protocols, or ports. When the on-premises and cloud VPN gateways define the allowed traffic differently, they cannot establish the Phase 2 SA, leading to intermittent connectivity.

Answer

Dead Peer Detection (DPD) is disabled on one side.

Answer

Incorrect pre-shared key used for the VPN tunnel.

Answer

Packet loss due to high latency on the internet link.

Question 18

A company is migrating a legacy application to a public cloud. The application requires a static IP address for licensing. The security team insists on encrypting all traffic between the application and the database. Which of the following should the cloud architect implement?

Accepted Answer

Create a VPN connection between the application and database subnets.. Option A is correct because creating a VPN connection between the application and database subnets establishes an encrypted tunnel (using IPsec or TLS-based VPN protocols) that ensures all traffic between the two subnets is encrypted, meeting the security team's requirement. Additionally, the application's need for a static IP address can be satisfied by assigning a static private IP to the application instance within its subnet, while the VPN provides secure communication without exposing traffic to the public internet.

Answer

Assign an elastic IP and use NAT.

Answer

Use TLS certificates on the web server.

Answer

Deploy a site-to-site VPN from the cloud to the on-premises data center.

Question 19

A cloud administrator is troubleshooting connectivity to a web server running on a Linux VM. The web server is configured to listen on ports 80 (HTTP) and 443 (HTTPS). The administrator runs the iptables command shown in the exhibit. Based on the output, what is the MOST likely reason that external users cannot access the web server on port 443?

Accepted Answer

The iptables rule for port 443 only allows traffic from the 10.0.0.0/8 subnet, which does not include external IP addresses.. Option D is correct because the iptables rule for port 443 specifies a source IP range of 10.0.0.0/8, which is a private RFC 1918 address space. External users have public IP addresses that do not fall within this subnet, so their HTTPS traffic is implicitly dropped by the rule's match condition. The default policy being ACCEPT does not override the explicit rule that only permits traffic from the 10.0.0.0/8 subnet.

Answer

The web server is not configured to listen on port 443, so iptables rules are irrelevant.

Answer

The iptables default policy is ACCEPT, but the rule for port 443 explicitly drops traffic from external sources.

Answer

The rule for port 80 is placed before the rule for port 443, causing all HTTPS traffic to be evaluated as HTTP and dropped.

Question 20

A company uses a hybrid cloud model with an AWS Direct Connect connection to its on-premises network. Users report intermittent connectivity to cloud resources. A network engineer finds packet loss on the Direct Connect virtual interface. Which of the following should be checked FIRST to resolve the issue?

Accepted Answer

The BGP session status between the on-premises router and the AWS Direct Connect endpoint. Intermittent packet loss on a Direct Connect virtual interface is most commonly caused by BGP session flapping or misconfiguration, as BGP is the routing protocol that establishes and maintains connectivity between the on-premises router and the AWS Direct Connect endpoint. Checking the BGP session status first allows the engineer to quickly identify if the issue is due to route advertisement problems, hold timer mismatches, or session resets, which are frequent root causes of intermittent packet loss.

Answer

The physical port status of the Direct Connect router

Answer

The MTU setting on the on-premises firewall

Answer

The VPN tunnel status for the Direct Connect link