easyMultiple Select
CV0-004 Practice Question: A hybrid cloud deployment connects an on-premises…
A hybrid cloud deployment connects an on-premises data center to a public cloud. Which TWO components are typically required to establish this connectivity? (Select TWO.)
⚠ Common exam trap
It's easy for candidates to confuse application-layer components (like load balancers or DNS) with network-layer connectivity components, or mistakenly think that public internet with HTTPS alone is sufficient for site-to-site hybrid cloud connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Direct peering or dedicated connection (e.g., AWS Direct Connect)
Option B is correct because a hybrid cloud requires a private, high-bandwidth, low-latency link between the on-premises data center and the public cloud, which is exactly what a dedicated connection such as AWS Direct Connect (or Azure ExpressRoute, or direct peering) provides, bypassing the public internet. Option C is correct because a VPN gateway (e.g., an IPsec site-to-site VPN terminating on an AWS virtual private gateway or Azure VPN gateway) is the other standard mechanism for securely extending the on-premises network into the cloud over an encrypted tunnel. Together, dedicated connections and VPN gateways are the two canonical connectivity components for hybrid cloud architectures. Option A is not required for connectivity itself; a load balancer distributes traffic to workloads but does not establish the hybrid link. Option D is incorrect because plain public internet with HTTPS is not the typical secure hybrid connectivity method and lacks the private/encrypted tunnel characteristics of a VPN or dedicated circuit. Option E is incorrect because a DNS resolver only resolves names and plays no role in establishing network connectivity between the data center and the cloud.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Load balancer in the cloud
Why it's wrong here
A load balancer distributes inbound traffic across cloud instances; it does not link the on-premises network to the cloud. It is tempting because load balancers appear in most cloud architectures, but they sit behind the connection rather than establishing it.
- ✓
Direct peering or dedicated connection (e.g., AWS Direct Connect)
Why this is correct
A dedicated connection or direct peering provides private, consistent bandwidth between the on-premises data centre and the public cloud, bypassing the public internet. This satisfies the hybrid connectivity requirement for predictable latency and throughput that a standard VPN over the internet cannot guarantee.
- ✓
Virtual private network (VPN) gateway
Why this is correct
A VPN gateway encrypts traffic over the public internet between the on-premises data centre and the cloud, satisfying the hybrid connectivity requirement without dedicated leased lines. It terminates the IPsec tunnel on the cloud side, letting private address ranges route securely between both environments.
- ✗
Public internet with HTTPS
Why it's wrong here
Public internet with HTTPS secures application traffic but provides no dedicated private interconnect between the data centre and cloud. It tempts because internet connectivity is often assumed sufficient, yet hybrid designs typically require a VPN or dedicated circuit for private routing.
- ✗
Cloud-based DNS resolver
Why it's wrong here
A cloud-based DNS resolver handles name resolution for cloud workloads; it does not carry traffic between the on-premises data centre and the public cloud. It is tempting because DNS is essential to hybrid environments, but it resolves names rather than providing the interconnect itself.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CV0-004 question from scratch — 834 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.