CompTIA Cloud+ CV0-004 (CV0-004) — Questions 1–75

Geographic restrictions are enforced through load balancer ACLs, which filter client source IP ranges independently of backend health. Since health checks pass, the backend is fine; the ACL is the layer silently dropping traffic from the supposedly allowed region.

A managed certificate attached to the load balancer terminates TLS at the provider's edge, encrypting client-to-server traffic without exposing private keys on the VM. This satisfies the HTTPS encryption requirement while automating renewal and reducing operational overhead.

Customer-managed keys in the cloud-managed service let the company retain control over the key lifecycle, satisfying the sensitive financial data requirement. Unlike provider-managed keys, revocation or rotation remains under the organisation's governance, so the cloud provider cannot independently decrypt stored data. This directly addresses the compliance constraint for regulated financial records.

PaaS with a managed relational database provides a platform that handles infrastructure management while supporting relational databases with ACID compliance and strong consistency. This allows the company to focus on the application while ensuring the database meets its transactional requirements, making it the most appropriate model.

Amazon EFS is a fully managed, elastic NFS file system that supports the POSIX interface and can be mounted concurrently by thousands of EC2 instances across multiple Availability Zones within a Region. It automatically scales storage capacity up and down as files are added or removed, making it ideal for read-heavy shared workloads that require cross-AZ access.

Security groups and network ACLs act as stateful or stateless packet filters; if the database listener port (for example 3306 or 5432) is not permitted inbound from the client subnet, connection attempts time out even though the instance itself is healthy and running.

Activating cost allocation tags in the billing console makes tagged resources' spend visible as separate line items in cost reports, satisfying the requirement to allocate costs by department and project. Without activation, tags exist on resources but are excluded from billing data, so departmental and project breakdowns cannot be produced.

Network security groups filter traffic at the subnet or NIC level independently of peering and routing, so a deny rule silently drops packets even when connectivity paths are correct. Inspecting NSG rules on both virtual networks is therefore the most likely explanation for the blocked cross-region traffic.

NACLs are stateless and require rules for both directions.

Reducing the credential lifetime limits how long a stolen secret remains valid, directly shrinking the exposure window. Risk-based sign-in detection flags authentications from atypical locations or impossible travel and can alert or block in near real time, addressing the unexpected-country enumeration. Together these controls target both the duration of exposure and timely detection of the anomaly.

Cloud Audit Logs records Admin Activity, Data Access and System Event entries for every API call in the project, giving the compliance audit trail required. Enabling it satisfies the stem's need to capture all API actions, since these logs are generated automatically per project, folder and organisation.

BusinessUnit and Environment map spend to the two required dimensions: which part of the organisation owns the resource and whether it runs in production or non-production. These tags enable cost allocation reporting by both business unit and environment.

This directly satisfies the requirement to survive a full data center failure. A global load balancer continuously probes regional endpoints and redirects user traffic to a healthy region when one fails. Because the workload is stateless and horizontally scalable, identical clusters can run in parallel without data synchronization concerns, providing both high availability and geographic redundancy.

StackSets deploy a single CloudFormation template across multiple AWS accounts and regions from one administration account, satisfying the requirement to manage common resources in several accounts centrally. Stack policies, change sets, and nested stacks operate within one account, so they cannot span accounts.

CloudFormation parameters allow you to input custom values when creating or updating a stack, such as instance types, key pairs, and subnet IDs. This enables template reuse across environments without modifying the template itself. Parameters can have default values, allowed values, and descriptions, making them ideal for environment-specific configurations. This directly addresses the requirement for different configurations per environment.

Horizontal scaling adds EC2 instances, and CPU-based auto-scaling triggers new capacity only when load rises, then removes it afterwards. This matches spiky, stateless traffic efficiently and keeps cost low, unlike vertical scaling or always-on over-provisioning.

IP restrictions reduce attack surface.

AWS Security Hub aggregates findings across AWS accounts and services, mapping them to standards including PCI DSS, then surfaces compliance status in a single dashboard. This directly satisfies the requirement to demonstrate adherence to PCI DSS security controls through consolidated, continuously updated evidence rather than manual reporting.

Archive storage offers the lowest per-gigabyte cost of Azure's blob tiers, designed for data retained for long periods and rarely accessed. It meets the seven-year retention requirement at minimal expense, unlike hot or cool tiers.

The Horizontal Pod Autoscaler automatically adjusts the number of pod replicas based on observed CPU utilization, directly addressing the pod scaling requirement. The Cluster Autoscaler adjusts the desired capacity of the node group when pods cannot be scheduled due to insufficient resources, ensuring nodes are added during peak load. Together they provide both pod-level and node-level elasticity, which is the correct operational approach for this scenario.

Azure Arc projects on-premises servers and Kubernetes clusters into Azure Resource Manager, enabling consistent management, policy, and monitoring across both environments while keeping data on-premises. Burst workloads can run in Azure connected to the same identity plane through Microsoft Entra ID, satisfying portability and centralized identity.

Publishing custom metrics with PutMetricData lets the team record application-specific measurements alongside standard metrics in CloudWatch. These metrics can be visualized and alarmed on, and they can be correlated with logs and traces to build a fuller picture of application behavior, which directly supports the observability requirement.

Organization policies can enforce that only CMEK-protected disks are allowed.

A public subnet and internet gateway only provide a route; the security group acts as a stateful virtual firewall at the instance's elastic network interface. With no inbound rule permitting HTTP/HTTPS from 0.0.0.0/0, the web application stays unreachable despite the instance running.

GCP Cloud Trace captures distributed traces across microservices and reports per-span latency, satisfying the need to pinpoint slow service hops. Its trace-to-log correlation and latency distribution analysis directly expose bottlenecks in request paths, making it valid for diagnosing the performance issue described.

Amazon CloudWatch ingests EC2 hypervisor-level metrics, including CPUUtilization, without agents, and its alarms evaluate thresholds against configurable periods. An alarm set above 80% transitions to ALARM and invokes an SNS topic action, satisfying the notification requirement directly. CloudTrail records API activity, and Trusted Advisor offers recommendations, neither providing metric threshold alarms.

Since the user reaches other applications in the same subnet, routing and network ACLs are functioning. A host-based firewall rule on the user's VM blocking the specific application port is the most likely cause of this single-application failure.

Relocating /var/log/app onto the /data partition and symlinking it back frees the root filesystem permanently, since logs then consume /data's capacity instead. This satisfies the long-term requirement, unlike log rotation or deletion, which only delay reoccurrence as logs regrow.

Ansible playbooks are agentless, connecting over SSH or WinRM to run idempotent patch tasks across many VMs simultaneously. This satisfies the agentless, multi-VM automation constraint, unlike manual patching or single-host scripting, and requires no persistent agent installation on each target.

RequestCountPerTarget is a metric emitted by the Application Load Balancer that measures the average number of requests received per target (e.g., EC2 instance) over a specified period. Scaling based on this metric directly ties capacity to actual demand, allowing the Auto Scaling group to add instances when request load increases, ensuring responsive scaling during traffic spikes.

Keeping both tiers in one virtual network means traffic stays on the provider's private backbone and never crosses the public internet. A network security group or firewall rule scoped to the database subnet that permits only the application subnet's CIDR enforces least-privilege access at the subnet boundary, satisfying both the private-path and restricted-access requirements.

Rapid elasticity provisions and releases resources automatically as demand changes, satisfying the stem's requirement for scaling without human intervention. Measured service and on-demand self-service cover metering and user-initiated provisioning, but only rapid elasticity delivers the automatic, dynamic capacity adjustment described.

Horizontal scaling adds more VM instances to the pool and spreads requests across them, matching the stem's stateless web tier. Vertical scaling would instead resize a single existing VM, which cannot distribute load across multiple hosts.

Continuous replication satisfies the one-hour RPO by shipping every write to the standby, while the warm standby's pre-provisioned, running-but-idle capacity enables promotion within the 15-minute RTO. Unlike pilot light or backup/restore, no rebuild or data reload delay is incurred, meeting both targets simultaneously.

Warm standby with continuous replication keeps a scaled-down environment running and replicates data continuously, giving an RPO near zero and failover well within two hours. This satisfies both the 15-minute RPO and 2-hour RTO at lower cost than active-active.

High inter-zone network latency directly delays log shipping from primary to replica, so each replica applies writes later than the primary commits them. Since the replicas sit in different availability zones, cross-zone round-trip time is the bottleneck driving the observed replication lag, not write volume alone.

A dedicated connection or direct peering provides private, consistent bandwidth between the on-premises data centre and the public cloud, bypassing the public internet. This satisfies the hybrid connectivity requirement for predictable latency and throughput that a standard VPN over the internet cannot guarantee.

Mixing reserved instances for steady baseline capacity with spot instances for interruptible, variable demand directly satisfies the stem's constraint of minimising cost while sustaining performance. This is cost optimisation: matching each workload's tolerance for interruption to the cheapest suitable purchasing model, rather than over-provisioning on-demand capacity.

Multi-tenancy is the defining trait: the provider pools compute, storage and networking across customers, isolating tenants logically rather than physically. This shared-resource model satisfies the stem's public cloud characteristic, contrasting with single-tenant private deployments where hardware is dedicated to one organisation.

RPO defines the maximum tolerable data loss measured in time, determining how frequently backups or replication must occur. It directly satisfies the stem's requirement to establish recovery objectives by quantifying the acceptable gap between the last recoverable data point and the failure moment.

Granting permissions mapped to the user's actual job functions enforces least privilege, since each role receives only the actions their duties require. This satisfies the stem's minimum-permissions constraint rather than assigning broad default or inherited access.

A misconfigured package repository prevents the cloud-init script from installing required packages, so initialisation halts before completion. This directly satisfies the stem's constraint: the VM launched but never finished bootstrapping, indicating a dependency fetch failure rather than a provisioning or networking fault.

When cross-zone load balancing is enabled, the load balancer should distribute traffic across all availability zones. However, if instances in other zones fail health checks, they are marked as unhealthy and removed from the target group's rotation, causing all traffic to go to healthy instances in only one zone.

The pipeline halts at the test stage, so the failure detail resides in that stage's output. Reviewing the test logs reveals the specific assertion, dependency or environment error before any remediation, avoiding speculative changes to code or pipeline configuration that could mask the actual fault.

CloudFormation publishes stack lifecycle events, including update failures, to an SNS topic specified in the stack's notification configuration. Subscribers then receive alerts, directly satisfying the requirement to notify the operations team when a stack update fails.

With CPU and memory below 50%, the bottleneck lies elsewhere. Network bandwidth saturation or storage IOPS throttling limits imposed by the cloud provider commonly degrade VM performance despite adequate compute, so these should be examined next.

The Deploy stage performs the actual release of built artefacts to the staging environment, so it is where staging deployment belongs. Build compiles, test validates, and manual approval gates production, matching the pipeline's required sequence.

Removing single points of failure ensures no individual component outage halts the service, since redundancy lets traffic fail over. This underpins availability by eliminating the components whose failure would cause total loss of the application.

Asynchronous messaging decouples services by allowing them to communicate via messages without waiting for immediate responses. If a service fails, messages can be queued and processed later, providing graceful failure handling. This pattern promotes loose coupling and resilience, making it the most appropriate for the scenario.

Patching the guest operating system falls to the customer because infrastructure-as-a-service places OS-level maintenance squarely on the tenant, not the provider. PCI DSS requires timely security updates on systems handling cardholder data, and the hypervisor, physical hosts and network fabric remain the provider's responsibility under this model.

Open Service Mesh (OSM) is a lightweight service mesh that provides mTLS for service-to-service communication, encrypting traffic and authenticating service identities. It enforces access policies based on service accounts, aligning with zero-trust principles. OSM integrates natively with AKS and can leverage Azure AD workload identities for certificate management, making it essential for encrypted and authenticated communication.

Load balancer health checks report whether each instance behind the balancer is serving traffic. Monitoring these results across availability zones detects instance or zone failures immediately, directly measuring the uptime component of the SLA rather than inferring it from CPU or request counts.

Continuous replication ships every transaction to a standby in another region, giving an RPO of seconds and enabling failover well inside the 15-minute RTO. Snapshot or scheduled replication cannot meet a 5-minute RPO, since data written between intervals would be lost.

VPC Service Controls create a service perimeter around Google Cloud projects and resources, restricting access to only approved VPC networks and preventing data exfiltration even with valid credentials. This directly addresses the requirement to block exfiltration despite compromised IAM credentials, because the perimeter enforces context-aware access independent of IAM permissions.

A cloud secrets manager with automatic rotation satisfies the core requirement by storing credentials outside application code and rotating them on a defined schedule, limiting exposure if leaked. This removes hardcoded secrets from repositories and configuration files, which is the primary risk the question targets.

Auto scaling service continuously evaluates metrics such as CPU utilisation against thresholds you define, then adds instances when the 80%-for-5-minutes condition is met. It satisfies the stem's requirement for automatic horizontal scaling driven by monitored performance data, unlike monitoring-only or load-balancing services.

Security groups are stateful: they automatically permit return traffic for any inbound connection you allow, so no separate outbound rule is needed. This satisfies the requirement that response traffic be allowed automatically. Network ACLs are stateless and would require explicit inbound and outbound rules.

The Horizontal Pod Autoscaler supports autoscaling based on custom and external metrics, not just CPU or memory. By exporting requests-per-second to Cloud Monitoring and referencing it as a custom metric in the HPA specification, the administrator can scale pods directly on HTTP request rate, which matches the stated requirement.

Object lock enforces WORM protection by preventing object modification or deletion for a defined retention period, meeting the compliance requirement. It satisfies the write-once-read-many constraint directly at the storage-object level, unlike versioning or lifecycle rules.

Identity and access management for the customer's own users remains a customer responsibility in every cloud service model, including SaaS. The provider secures the application infrastructure, but the customer decides who can log in, what roles they hold, and how authentication is enforced. Weak access controls on the customer side are a leading cause of SaaS data breaches.

The --previous flag retrieves logs from the previous instance of a container in a pod that has restarted. In a CrashLoopBackOff scenario, the current container may not have produced logs yet, but the previous instance likely contains the error that caused the crash. This command is essential for diagnosing why the container is failing to start.

A CI/CD pipeline automates build, test and release stages, so each change is validated and deployed consistently with minimal manual intervention. This delivers the speed and reliability the scenario demands, unlike manual or ad hoc deployment methods.

SSE-KMS with a customer-managed key gives the firm control over the key, and disabling that key immediately blocks decryption of all objects, satisfying revocation. AWS KMS logs every cryptographic operation to CloudTrail, and enabling CloudTrail data events captures object-level API activity on the bucket, providing the required usage evidence for auditors.

An elastic IP address is a static public IPv4 address designed for dynamic cloud computing. It can be associated with any virtual machine in the account and moved between instances if a failure occurs. This allows clients that use the hard-coded IP to continue reaching the application even after the underlying virtual machine is replaced, satisfying the requirement for a stable public endpoint.

Warm standby satisfies the 4-hour RTO through pre-provisioned, scaled-down infrastructure that can be promoted quickly, while continuous data replication keeps the 1-hour RPO. It costs less than hot standby's fully mirrored active environment, avoiding the expense of duplicate capacity the RTO does not demand.

AWS Compute Optimizer analyses historical utilisation metrics—such as CPU, memory, and network throughput—from Amazon CloudWatch to generate rightsizing recommendations for EC2 instances. This directly satisfies the company’s requirement to identify underutilised instances and receive downsizing suggestions, as the service uses machine learning to compare observed usage against instance family specifications and outputs specific instance type changes.

Route 53 record changes are control-plane operations recorded by CloudTrail, including the caller identity, source IP, and request parameters. An EventBridge rule that matches the ChangeResourceRecordSets event pattern can trigger an SNS topic or ticketing system immediately, giving the team detection and alerting for out-of-process modifications.

Distributes traffic and integrates with Cloud Armor.

Transaction log backups capture every committed change, so replaying them after a full restore achieves recovery to within five minutes. Continuous database updates demand this log-based approach; full backups alone leave up to a day of data loss, failing the point-in-time requirement.

An Application Load Balancer operates at layer 7, terminating TLS and routing requests by URL path, host header or content. Network load balancers work at layer 4, forwarding packets by IP and port only, so they cannot inspect content or terminate SSL.

A governance policy enforcing tag requirements at creation time prevents untagged resources from ever existing, satisfying the compliance checker's requirement rather than detecting violations after the fact. Weekly reporting only identifies drift retrospectively; blocking creation addresses the root cause, ensuring cost center and environment tags are present on all resources long term.