CV0-004 Timed Practice Test 1 — 10 Questions

Question 1

A cloud operations team needs to implement a monitoring solution for a microservices architecture. The solution must provide centralized logging, metrics, and alerting, and must be able to correlate data from multiple services. Which THREE of the following components should the team include?

10 minute time limit — choose an answer to begin.

Accepted Answer

A centralized logging system (e.g., ELK stack).. A centralized logging system like the ELK stack (Elasticsearch, Logstash, Kibana) aggregates logs from all microservices into a single searchable repository. This enables the team to correlate events across services by timestamp and metadata, which is essential for debugging distributed transactions and identifying root causes of failures.

Answer

A security information and event management (SIEM) system.

Answer

An application performance monitoring (APM) tool.

Question 2

A hybrid cloud deployment connects an on-premises data center to a public cloud. Which TWO components are typically required to establish this connectivity? (Select TWO.)

Accepted Answer

Direct peering or dedicated connection (e.g., AWS Direct Connect). A dedicated connection like AWS Direct Connect provides a private, high-bandwidth, low-latency link between an on-premises data center and a public cloud, bypassing the public internet for consistent performance and security. Option C is correct because a VPN gateway establishes an encrypted tunnel over the public internet (using protocols like IPsec) to securely connect the on-premises network to the cloud VPC, which is a standard requirement for hybrid cloud connectivity.

Answer

Load balancer in the cloud

Answer

Public internet with HTTPS

Answer

Cloud-based DNS resolver

Question 3

Refer to the exhibit. A cloud administrator runs the above command on a Linux virtual machine. What is the effect of the current firewall rules?

Accepted Answer

All incoming traffic is allowed except RDP, which is dropped.. The rules show ACCEPT for SSH (22), HTTP (80), and HTTPS (443), and DROP for RDP (3389). Since the default policy on the INPUT chain is ACCEPT, all other traffic is allowed, which is not secure. The administrator should set the default policy to DROP and only allow necessary ports.

Answer

All outgoing traffic is controlled by these rules.

Answer

The firewall is blocking all traffic by default.

Answer

Only SSH, HTTP, and HTTPS are allowed; all other traffic is dropped.

Question 4

A company's cloud environment uses a shared responsibility model. The security team notices that a data breach occurred due to misconfigured storage buckets in the public cloud. Which party is primarily responsible for this misconfiguration according to the shared responsibility model?

Accepted Answer

The customer. Under the shared responsibility model, the customer is responsible for configuring their cloud resources securely, including storage bucket permissions. The cloud provider is responsible for the security of the cloud (infrastructure) but not for customer misconfigurations. The third-party vendor and cloud auditor are not directly responsible for the misconfiguration.

Answer

The cloud service provider

Answer

The cloud auditor

Answer

A third-party security vendor

Question 5

A company wants to ensure high availability for a stateless web application. Which architecture should be recommended?

Accepted Answer

One VM in each of two availability zones with a load balancer. Deploying one VM in each of two availability zones with a load balancer ensures high availability by eliminating a single point of failure. If one availability zone fails, the load balancer automatically routes traffic to the healthy VM in the other zone, keeping the stateless web application accessible. This architecture aligns with the principle of fault tolerance for stateless applications, where no session state is lost during failover.

Answer

Two VMs in the same availability zone with a load balancer

Answer

Single VM with daily backups

Answer

A single large VM with auto-recovery

Question 6

Refer to the exhibit. This log message is from a cloud security scanner. Which principle did the scanner likely detect?

Accepted Answer

Least privilege. The message indicates that user credentials were stored in user data (such as instance metadata) and are accessible to all users with read access to that metadata. This violates the principle of least privilege because credentials should not be widely accessible.

Answer

Separation of duties

Answer

Defense in depth

Answer

Fail securely

Question 7

A company uses a cloud provider's key management service to encrypt data at rest. The security team wants to ensure that encryption keys are automatically rotated every 90 days to meet compliance requirements. Which feature should be enabled?

Accepted Answer

Key automatic rotation. Automatic rotation replaces key material periodically without manual intervention, meeting compliance needs.

Answer

Key import scheduling

Answer

Key revocation

Answer

Key policy enforcement

Question 8

A cloud architect is designing a multi-tier application that must be resilient to the failure of an entire availability zone. Which of the following strategies BEST meets this requirement?

Accepted Answer

Deploy application instances across three availability zones with a load balancer. Deploying across multiple availability zones provides high availability. Option A is wrong because vertical scaling does not address zone failure. Option B is wrong because auto-scaling within a single zone does not help if the zone fails. Option C is wrong because a single load balancer in one zone is a single point of failure.

Answer

Place all instances behind a single load balancer in one zone

Answer

Implement auto-scaling within the same availability zone

Answer

Use larger instance types to handle more load

Question 9

A cloud administrator runs a deployment script that creates multiple resources using Infrastructure as Code (IaC). The script fails with a "400 Bad Request" error when attempting to create a storage account. Which troubleshooting step should the administrator take first?

Accepted Answer

Review the error message details for a specific validation error.. A 400 error indicates a client error, so the first step is to examine the error details to understand what parameter is invalid. Option A is wrong because 400 is not a network error (would be 5xx). Option B is wrong but plausible; however, the error message would specify the exact issue. Option D is wrong because timeouts result in different errors.

Answer

Check the network connectivity to the cloud API endpoint.

Answer

Increase the timeout value for the API call.

Answer

Verify that the script has the correct region parameter.

Question 10

An organization's hybrid cloud environment uses a VPN connection between on-premises and the cloud. Intermittent connectivity drops are reported during peak hours. The VPN logs show rekeying failures. Which configuration is most likely the cause?

Accepted Answer

The IPSec dead peer detection interval is set too high. A dead peer detection (DPD) interval set too high delays detection of lost peers, causing rekeying failures under load. Option A is wrong because pre-shared keys don't expire. Option C is wrong because throughput exceeded would show packet loss or high latency, not rekeying failures. Option D is wrong because blocking IKE packets would prevent the VPN from establishing at all.

Answer

The VPN tunnel is using a pre-shared key that has expired

Answer

The VPN gateway throughput is exceeded

Answer

The on-premises firewall is blocking IKE packets