CompTIA Cloud+ CV0-004 (CV0-004) — Questions 1–75

A VPN tunnel encrypts all IP traffic between the cloud VPC and the on-premises network, ensuring data in transit is protected regardless of the application protocol. This satisfies the security requirement for encrypting all data in transit between the two environments, as VPNs typically use IPsec (RFC 4301) to provide confidentiality and integrity at the network layer.

The cloud provider's managed certificate service automatically handles certificate provisioning, renewal, and attachment to the load balancer, ensuring HTTPS traffic is encrypted with a trusted certificate from a public CA. This is the best practice because it offloads TLS termination to the load balancer, reducing the VM's CPU overhead and centralizing certificate management. It also ensures the certificate is automatically renewed before expiry, preventing service disruptions.

Pilot light keeps a minimal environment running and can be scaled up quickly; it offers a balance between cost and recovery time. Warm standby would be more expensive, cold standby would not meet RTO/RPO, and multi-site active-active is overkill.

A tagging strategy with tags like environment, team, and project enables cost allocation.

The rules show ACCEPT for SSH (22), HTTP (80), and HTTPS (443), and DROP for RDP (3389). Since the default policy on the INPUT chain is ACCEPT, all other traffic is allowed, which is not secure. The administrator should set the default policy to DROP and only allow necessary ports.

The three most common reasons a cloud database instance becomes unreachable are firewall rules blocking the database port (A), an incorrect connection string in the application (B), and the database service not being started (D). A full storage volume (C) may cause write failures but does not always result in unreachability, and hypervisor maintenance (E) typically uses live migration to avoid downtime.

Tagging resources and enabling cost allocation tags in the billing console allow cost breakdown by department and project. The cloud provider's cost reporting tools can then filter by these tags.

Network security groups (NSGs) operate at the subnet or NIC level and can filter traffic between peered virtual networks even when routing is correctly configured. Since the engineer has verified peering and routing tables, the most likely remaining cause is an NSG rule explicitly or implicitly denying the traffic, as NSGs are stateful and evaluated after routing decisions.

Network ACLs (NACLs) are stateless; security groups are stateful.

Cloud Audit Logs in GCP record administrative activities and data access. CloudTrail is AWS-specific, Azure Monitor is for Azure, and Security Command Center is a security dashboard.

Tags like 'BusinessUnit' and 'Environment' are commonly used for cost allocation and reporting. Tags must be applied consistently for accurate cost tracking.

The correct sequence ensures that the security group is properly configured with the known allowed IPs before being attached to the resource, and then tested. Identifying IPs first prevents misconfiguration, and setting the source within the rule during creation ensures the rule is complete before association.

StackSets allow deploying stacks across multiple accounts and regions. Change sets show changes before execution; Drift Detection detects configuration drift; Nested stacks are for reusability within a single account.

Horizontal scaling (adding instances) combined with auto-scaling based on metrics is best for handling spikes cost-effectively in a stateless app.

CloudFormation validates the AMI ID during stack creation. If the AMI ID is invalid (e.g., mistyped, belongs to a different region, or has been deregistered), the EC2 instance launch fails, causing CloudFormation to roll back the stack. This is a common misconfiguration when copying templates across regions without updating AMI IDs.

AWS Database Migration Service (DMS) can perform online migrations with minimal downtime using CDC. Schema Conversion Tool helps convert database schema if needed.

Restricting access based on IP address ranges (B) is a best practice because it limits the attack surface by allowing only trusted network sources to reach the management console. This is often implemented via security group rules, network ACLs, or cloud provider-specific features like AWS Security Groups or Azure NSGs, reducing exposure to brute-force and unauthorized access attempts.

AWS Security Hub aggregates security findings from multiple AWS services and provides a compliance dashboard.

Synchronous replication across regions (B) ensures that every write is committed to both the primary and secondary sites before acknowledging the client, resulting in zero data loss (RPO=0) in the event of a failover. Application-level multi-region writes (D) allow the application to write directly to multiple independent databases simultaneously, ensuring that all regions have the latest data and no data is lost if one region fails.

Archive storage (like Glacier or Azure Archive) is designed for long-term cold storage at low cost.

Create bucket, enable versioning, add lifecycle rules for transitions and deletions, then test.

To migrate a 10 TB PostgreSQL database to RDS with minimal downtime, AWS DMS provides ongoing replication via change data capture (CDC), allowing continuous data synchronization after the full load. AWS Direct Connect offers a dedicated, stable network connection with consistent bandwidth and low latency, which is critical for replicating such a large volume of data reliably and quickly. Without Direct Connect, internet-based replication could suffer from variable performance, risking the ability to keep the target in sync during the final cutover.

The number of availability zones within a region directly impacts the resilience and fault tolerance of a latency-sensitive application. Deploying across multiple availability zones allows for high availability and failover without adding significant latency, as zones are typically within a few milliseconds of each other. This ensures the application remains responsive even if one zone fails, which is critical for a global user base.

Organization Policies (formerly known as 'Constraints') allow administrators to define and enforce guardrails for Google Cloud resources at the hierarchy level. The specific constraint `compute.requireCsekEncryption` (or the newer CMEK-based equivalent) can be applied to a folder or project to mandate that all Compute Engine disks use a Customer-Managed Encryption Key, rejecting any instance creation or disk attachment that does not comply.

The instance has a security group named "sg-web" which likely does not allow inbound HTTP/HTTPS traffic from the internet. Other options are less plausible given the configuration.

AWS S3 with DynamoDB locks, Azure Blob Storage with leasing, and GCS with object versioning all support locking and encryption. Terraform Cloud also does, but it's not listed. Git and Consul are not recommended for production state.

AWS X-Ray, Azure Application Insights, and GCP Cloud Trace are distributed tracing services.

Amazon CloudWatch is the AWS service for monitoring metrics and creating alarms. CloudWatch Alarms can be configured to trigger SNS notifications when a metric crosses a threshold.

Object storage uses objects with metadata (scalable for unstructured data), block storage uses fixed blocks (low-latency for databases), file storage uses hierarchical files (shared access), and SAN provides block-level access over a high-speed network. Common confusions swap object and block definitions.

The user can access other applications in the same subnet, indicating network connectivity is intact, but a specific application is blocked. A host-based firewall rule on the user's VM (e.g., Windows Firewall or iptables) can filter traffic by port or protocol, and a newly implemented security policy likely added a rule blocking the port used by the critical application. This explains why only that application is inaccessible while others work.

Moving the /var/log/app directory to the /data partition and creating a symlink is the best long-term solution because it permanently relocates the log data to a volume with ample free space without requiring application reconfiguration. The symlink (/var/log/app -> /data/app) makes the application continue to write to the same logical path, while the actual storage is on the /data filesystem. This resolves the root filesystem capacity issue without altering the application's logging behavior or risking data loss.

An Ansible playbook is the best tool for automating patching across multiple VMs because it is agentless, uses SSH for Linux or WinRM for Windows, and supports idempotent execution. This allows the administrator to define the desired patch state declaratively and apply it consistently across the entire fleet without manual intervention.

When a PersistentVolumeClaim (PVC) remains unbound, the most common cause is that no PersistentVolume (PV) matches its requirements. If a PV is already bound to another PVC, it cannot be reused unless released and reclaimed. This leaves the PVC in a pending state, preventing the StatefulSet pods from starting.

Rapid elasticity enables automatic scaling of resources based on demand.

Horizontal scaling adds more instances to handle load, as opposed to vertical scaling which increases the resources of a single instance.

A warm standby with replication keeps a scaled-down copy running, allowing recovery within hours and data loss limited to minutes.

A dedicated connection like AWS Direct Connect provides a private, high-bandwidth, low-latency link between an on-premises data center and a public cloud, bypassing the public internet for consistent performance and security. Option C is correct because a VPN gateway establishes an encrypted tunnel over the public internet (using protocols like IPsec) to securely connect the on-premises network to the cloud VPC, which is a standard requirement for hybrid cloud connectivity.

The auto-scaling group failed to trigger because it was in a cooldown period after a previous scaling action. Cooldown periods are designed to prevent rapid, successive scaling events that could destabilize the environment. During this time, the auto-scaling group ignores new alarms, even if the CPU threshold is exceeded, until the cooldown timer expires.

Using a mix of reserved and spot instances directly reduces compute costs by committing to predictable workloads with reserved instances (which offer significant discounts over on-demand) and using spot instances for fault-tolerant, flexible workloads at steep discounts (often 60-90% off on-demand). This hybrid approach is a core cost optimization strategy in public cloud design, as it balances upfront commitment with opportunistic savings without sacrificing performance for variable workloads.

The immediate symptom is high CPU utilization on all instances during peak hours, indicating that the current instances are being overwhelmed. Adjusting the auto-scaling policy to scale out at a lower CPU threshold (e.g., from 70% to 50%) will proactively add more instances before CPU becomes saturated, distributing the load and improving response times. This directly addresses the root cause—insufficient compute capacity—without requiring architectural changes or additional services.

RTO and RPO are the key metrics for disaster recovery: time to recover and acceptable data loss.

Go to monitoring, create alarm, set threshold, configure notification, then test.

If the AMI ID is for a Windows instance but the user_data script uses yum (a Linux package manager), the script will fail to execute, causing the web server not to start. This is a common mismatch when using Terraform with incorrect AMI types. Option B (security group) would not prevent the web server process from starting; it would only block inbound access, which does not match the symptom 'web server does not start.' Options A and D are less likely causes for the server not starting.

A transit network with a VPN appliance provides a centrally managed hub-and-spoke architecture that simplifies routing and security for multiple virtual networks. The VPN appliance (e.g., a software VPN or cloud marketplace appliance) establishes encrypted tunnels between the transit network and each spoke network, allowing private IP communication without the need for full-mesh peering or complex route tables. This design centralizes traffic inspection, policy enforcement, and routing, meeting the requirement for simplified management.

Deployment resource manages rolling updates. Readiness probes ensure traffic is sent only to ready pods. Liveness probes restart unhealthy pods.

The aws:SourceIp condition key limits the source IP addresses to the specified range.

In a blue/green deployment, the load balancer is the traffic router. Updating the load balancer target group to point to the green environment is essential because it instantly shifts production traffic from the blue (current) to the green (new) environment without downtime. This action ensures the load balancer forwards requests to the healthy green targets, completing the cutover.

CloudFormation can use SNS topics for stack events. CloudWatch Events (now Amazon EventBridge) can also match stack update failures and trigger notifications.

When CPU and memory are well below capacity, performance degradation in a public cloud VM is often caused by resource throttling at the network or storage layer. Cloud providers enforce bandwidth caps and I/O limits per VM size, and hitting those limits can cause packet loss, queuing, and high latency even when compute resources are idle. Checking network bandwidth and I/O throttling limits is the correct next step to identify if the VM is being rate-limited.

In a typical CI/CD pipeline, the deploy stage follows build and test, and before production.

Eliminating single points of failure (A) is fundamental because if any single component (e.g., a load balancer, a storage volume, or a compute instance) fails, the entire system can become unavailable. In cloud architectures, this is achieved by deploying redundant components so that no single failure can cause a complete outage. For example, using multiple load balancers in an active-passive or active-active configuration ensures traffic can still be routed if one fails.

In the shared responsibility model, the customer is responsible for patching the guest OS, while the cloud provider manages the physical infrastructure and hypervisor.

The load balancer health check result directly indicates whether each instance is reachable and responding correctly to application traffic. Monitoring these results allows the administrator to detect instance failures and verify that the application remains available across multiple availability zones, which is the core requirement for meeting an uptime SLA. Other metrics like throughput, disk space, or CPU utilization are performance indicators but do not directly confirm application availability.

Continuous replication with synchronous or near-synchronous updates can achieve very low RPO (minutes) and low RTO. Cross-region replication may have higher latency, and snapshot-based backup typically has higher RPO and RTO.

Secrets should be stored in a dedicated secrets manager and rotated regularly, never hard-coded.

Auto scaling groups can use scaling policies to add instances based on monitoring alarms. The scenario describes a scaling policy triggered by an alarm on CPU utilization.

Continuous replication to another region achieves a low RPO (minutes) and can be failed over quickly to meet RTO.

Security groups are stateful, meaning if you allow inbound traffic, the response is automatically allowed regardless of outbound rules. Network ACLs are stateless and require explicit rules for both directions.

Object Lock is the correct feature for WORM compliance because it enforces a write-once-read-many (WORM) state on objects, preventing modification or deletion until the specified retention period expires. Lifecycle policies manage data transitions and deletions but do not provide immutability guarantees required for strict compliance.