mediumMultiple SelectObjective-mapped
CV0-004 Practice Question: A cloud architect is designing a hybrid cloud…
A cloud architect is designing a hybrid cloud environment that connects an on-premises data center to a public cloud. The architect needs to ensure secure, low-latency connectivity and isolate traffic between different business units. Which TWO solutions should the architect implement? (Choose two.)
⚠ Common exam trap
Watch out — candidates often confuse transit hubs with cloud network peering for isolation, but cloud network peering directly connects two networks with no transitive routing, ensuring traffic isolation between business units, whereas a transit hub can inadvertently route traffic between all connected networks unless carefully configured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Establish a dedicated VPN or direct peering between on-premises and cloud
A dedicated VPN or direct peering establishes a secure, low-latency, and private connection between the on-premises data center and the public cloud, bypassing the public internet to reduce latency and improve security. This is essential for hybrid cloud environments where consistent performance and isolation from internet-based threats are required. Option C is correct because cloud network peering directly connects two cloud networks with no transitive routing, ensuring traffic isolation between business units, whereas a transit hub can inadvertently route traffic between all connected networks unless carefully configured with route tables and network ACLs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure a NAT gateway to allow outbound internet access
Why it's wrong here
NAT gateway is for internet access, not isolation.
- ✓
Establish a dedicated VPN or direct peering between on-premises and cloud
Why this is correct
Provides secure, low-latency connectivity.
- ✓
Implement cloud network peering to connect cloud networks for different business units
Why this is correct
VPC peering allows isolated traffic between VPCs.
- ✗
Deploy a bastion host in a public subnet for administrative access
Why it's wrong here
Bastion host is for management, not network isolation.
- ✗
Use a transit hub to interconnect all cloud networks
Why it's wrong here
Transit gateway centralizes connectivity but does not inherently isolate; additional routing policies are needed.
Go deeper
Related to this question
About these practice questions
One of 977 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.