CV0-004 Anomaly Detection Practice Question
A cloud operations team wants to be notified when the average CPU utilization of an auto-scaling group exceeds 80% for 5 consecutive minutes. They also want to avoid notification storms. Which alerting configuration should they use?
⚠ Common exam trap
Candidates often confuse scaling policies with alerting configurations. Remember: scaling policies adjust resources, while alerts notify via actions like SNS. In this question, only anomaly detection provides a notification mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Anomaly detection based on a band model with a sensitivity of 2
The question asks for an alerting configuration to notify when average CPU exceeds 80% for 5 consecutive minutes while avoiding notification storms. Options A, B, and C are scaling configurations (step scaling, simple scaling, scheduled scaling) that adjust capacity, not alert. Option D uses anomaly detection with a band model, which can dynamically define a normal range and generate alerts when metrics fall outside the band. Sensitivity 2 provides a balanced band that detects sustained anomalies, effectively alerting on consistent high CPU without storming. Thus D is the only alerting configuration among the choices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Step scaling policy triggered by a CloudWatch Alarm with a threshold of 80% for 5 evaluation periods
Why it's wrong here
This is a scaling policy that triggers based on a CloudWatch Alarm, but it does not itself send notifications; it initiates a scaling action. The alarm could notify, but the option focuses on the scaling policy, not alerting.
- ✗
Simple scaling policy with a cooldown period
Why it's wrong here
Simple scaling policy with cooldown is used to adjust capacity by a fixed amount and includes a cooldown period to avoid excessive scaling, not for alerting.
- ✗
Scheduled scaling action to increase capacity at peak times
Why it's wrong here
Scheduled scaling action adjusts capacity at predetermined times, not based on real-time CPU load, and does not provide alerting.
- ✓
Anomaly detection based on a band model with a sensitivity of 2
Why this is correct
Anomaly detection with a band model detects when a metric deviates from expected behavior. A sensitivity of 2 creates a band that captures typical variation, triggering alerts only when the metric is consistently outside the band, avoiding storms and matching the requirement for sustained high CPU.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CV0-004 question from scratch — 977 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.