CompTIA Cloud+ CV0-004 (CV0-004) — Questions 676–750

Resource pooling allows the provider to serve multiple customers and distribute resources across AZs for fault tolerance.

SAML exchanges signed assertions between the partner's identity provider and the cloud application, letting partners authenticate with existing corporate credentials. It is the established browser-based federation standard for external access, avoiding separate accounts for each partner.

With a minimum healthy percent of 100, ECS ensures that the number of running tasks never drops below the desired count during deployment. The maximum percent of 200 allows ECS to launch additional tasks beyond the desired count, enabling new tasks to start and become healthy before old ones are stopped. This achieves zero-downtime deployment.

A multi-stage pipeline separates build, test, staging and production into discrete stages, and environment approvals gate the production stage so deployment waits for manual sign-off. This satisfies both the automated staging deployment and the approval-before-production constraint.

VPC Flow Logs capture IP traffic metadata for network interfaces, subnets or VPCs, recording accepted and rejected packets. Enabling them on the affected interfaces lets the engineer analyse traffic patterns and pinpoint where packets are dropped between the two VPCs.

IAM roles for service accounts (IRSA) allows Kubernetes pods to assume an IAM role and obtain temporary credentials. The pod can then retrieve the database secret from AWS Secrets Manager using those credentials, avoiding hardcoded secrets. This provides short-lived credentials and fine-grained access control, directly meeting the security team's requirements for the EKS application.

An IaC template declares security group rules as version-controlled code, so required inbound HTTP rules are provisioned consistently and repeatably with every deployment. This eliminates the manual omission that caused the outage, satisfying the best-practice requirement to prevent missing rules in future deployments.

Continuous transaction log shipping replicates every committed transaction to a standby database, achieving an RPO of near zero or within minutes. If the primary fails, the standby can be promoted, and recovery time is typically well under an hour. This meets both the 15-minute RPO and the 1-hour RTO, providing a robust disaster recovery solution.

Health checks probe each backend and remove failing instances from rotation, so an unresponsive VM stops receiving traffic. This directly addresses the stem's constraint that the load balancer kept sending traffic to the failed VM.

Asynchronous replication copies changes after acknowledgement, so a site can lag by up to an hour — matching the one-hour RPO — while costing far less than synchronous replication, which would need low-latency links to meet a near-zero RPO the business does not require.

Amazon EFS is a managed file system that provides shared, elastic storage across multiple Availability Zones. The EFS CSI driver allows Kubernetes to dynamically provision persistent volumes backed by EFS, which is automatically replicated across AZs within a region. This makes it ideal for stateful applications requiring high availability and multi-AZ resilience.

Stateless application design ensures no session or local data persists on individual instances, so any instance can handle any request. This removes the need for sticky sessions or instance-specific state, directly enabling horizontal scaling and safe termination during scale-in events.

Online migration with continuous sync keeps the source MySQL database available whilst replicating ongoing changes to Azure SQL Database, then performs a brief cutover. This directly satisfies the minimal-downtime constraint, unlike offline migration, which requires the source to be taken offline for the entire data copy.

Blue/green deployment maintains two identical production environments and switches traffic at the load balancer or DNS layer once the new version is verified. Because cutover is atomic and rollback is immediate, users experience no downtime during release.

File storage provides a shared, POSIX-compliant file system mountable concurrently by multiple Linux instances within the same VPC, matching the requirement. Block storage attaches to a single instance, and object storage lacks native shared-mount semantics.

Placing resources in a region geographically close to the target user base shortens the physical network path, directly reducing round-trip latency. This satisfies the stem's latency-minimisation goal for a globally distributed application, since propagation delay scales with distance.

The provider's native encryption service satisfies the mandate for cloud-native encryption at rest, while customer-managed keys retain organisational control over key material. This combination meets both the regulatory encryption requirement and the key-ownership constraint without relying on provider-held keys.

A cloud monitoring service ingests metrics such as CPU utilisation from VM agents and hypervisor APIs, then stores and visualises them in dashboards. It satisfies the requirement to collect and visualise CPU metrics across the fleet, unlike compute or storage services that do not provide metric aggregation.

Rehosting lifts the application onto cloud infrastructure unchanged, satisfying the minimal-code-change constraint. Unlike replatforming or refactoring, which demand modification, rehosting preserves the existing codebase and configuration, reducing migration risk and effort. This makes it the most appropriate strategy when code changes must be avoided.

A failing readiness or liveness probe causes Kubernetes to remove pods from Service endpoints or restart them, leaving no healthy backends to serve traffic, so the ingress returns 503. This directly matches the scenario: a new version deployed, private-cloud Kubernetes, and users receiving 503 errors.

IaaS supplies virtualised compute, storage and networking while leaving the guest OS and kernel modules under the customer's control, so the custom Linux distribution runs unmodified. The provider maintains the physical infrastructure, reducing operational overhead without refactoring.

Tagging resources with department and project keys lets cost management tools group and filter spend along those dimensions. This enables accurate cost attribution, which untagged resources cannot support because billing data lacks the metadata needed to map charges to owners.

The container memory limit is 1Gi, but the Java heap is set to 768Mi. The JVM requires additional memory beyond the heap for metaspace, thread stacks, code cache, and native memory. This overhead can easily exceed 256Mi, pushing total memory usage above the 1Gi limit. When the container exceeds its limit, the kernel OOM killer terminates the process, resulting in 'OOMKilled' status. The node has available memory, so the issue is the container limit, not node pressure.

Azure Policy is the governance service that evaluates resources against business rules and can deny noncompliant resource creation or updates. By assigning a built-in or custom policy definition that requires HTTPS-only traffic and a minimum TLS version, the administrator can enforce the requirement across all subscriptions in the tenant, including future ones, at deployment time.

ApproximateNumberOfMessagesVisible reports the count of messages awaiting retrieval, directly reflecting backlog depth. Scaling on this metric adds EC2 capacity precisely when consumer throughput lags behind incoming demand, satisfying the requirement to scale on queue depth rather than CPU or network statistics.

TLS encrypts data in transit, directly satisfying the requirement that management-plane API requests be encrypted. Management-plane endpoints, including Microsoft Entra ID and Azure Resource Manager, require TLS for confidentiality and integrity. Enforcing TLS 1.2 or higher prevents interception or tampering of administrative API traffic.

AES-256 is the symmetric block cipher overwhelmingly adopted for cloud data-at-rest encryption, offering 256-bit keys resistant to brute force. It satisfies the stem's requirement for the encryption standard most commonly used by cloud storage services.

AWS Secrets Manager is designed to securely store and manage secrets such as database credentials, API keys, and environment variables. It provides encryption at rest using KMS, automatic rotation, and fine-grained access control via IAM. Applications can retrieve secrets at runtime using the AWS SDK, keeping them out of source code and templates, which meets the requirement.

Azure Storage supports customer-managed keys by referencing a key in Key Vault or Managed HSM. Setting the account's encryption key source to the Key Vault key makes the customer control rotation and revocation, and Key Vault diagnostic logs record key operations for audit, satisfying the regulated-data requirement.

Azure Application Insights satisfies the distributed tracing requirement by correlating requests across microservices through its telemetry model, using operation IDs to stitch spans into an end-to-end transaction view. This exposes per-hop latency, letting you pinpoint which service introduces delay during intermittent performance issues.

Preemptible VMs are cost-effective and can be interrupted, ideal for batch jobs.

IAM Roles for Service Accounts (IRSA) allows Kubernetes pods to assume an IAM role via a service account. The EKS cluster's OIDC provider is used to federate the service account to IAM, and the pod receives temporary credentials through a projected service account token. This eliminates the need to store credentials in images or environment variables, meeting the security requirement.

Hybrid cloud keeps sensitive customer data on-premises under the firm's control while connecting to public cloud resources for peak risk-analysis bursts. This directly satisfies both constraints: data residency on-premises and elastic compute scaling during peak demand.

Packet Mirroring clones traffic from a specified instance or subnet and sends it to a collector instance for analysis. It operates at the VPC level, requires no agent on the monitored instance, and does not disrupt production traffic. This allows the engineer to capture and analyze packet-level details to diagnose the suspected packet loss.

Root cause analysis is essential because it determines why the incident occurred, enabling remediation of the underlying weakness rather than only the symptom. Without it, the plan cannot prevent recurrence, which is a core objective of any incident response lifecycle.

A NAT Gateway allows instances in a private subnet to initiate outbound traffic to the internet while preventing inbound traffic from reaching them. Placing the NAT Gateway in a public subnet gives it internet access via the Internet Gateway. Updating the private subnet's route table to point to the NAT Gateway enables the application servers to download updates without being directly accessible.

Blue-green deployment keeps the current blue environment serving traffic while the green environment is patched and validated. Switching traffic only after verification, and reverting by redirecting back to blue, satisfies the stem's requirements for minimal downtime and rapid rollback.

Drift detection compares the actual deployed resource configuration against the expected stack template and reports any divergence. It directly identifies where live infrastructure no longer matches the template, satisfying the developer's need to locate differences after the update.

A load balancer distributes incoming requests across healthy instances and removes failed ones from rotation, eliminating the application tier as a single point of failure. This directly delivers the required high availability and fault tolerance.

CloudWatch anomaly detection builds a learned baseline from historical CPU patterns and alarms on deviations, catching unusual spikes rather than fixed thresholds. Static thresholds would either miss subtle spikes or fire constantly on normal variation.

Active-active across availability zones with a load balancer satisfies the automatic failover constraint: the load balancer health-checks each zone's endpoints and reroutes traffic to surviving zones when one fails, with no manual intervention. Running identical instances in every zone also preserves capacity, unlike active-passive, which requires failover orchestration.

Unencrypted data in transit can be intercepted or manipulated on the network, enabling credential theft and session hijacking that grant unauthorised access. This satisfies the vulnerability criterion because cloud traffic traverses shared infrastructure and public networks, where absence of TLS leaves authentication tokens and payloads readable to attackers.

Splitting the monolith into microservices across multiple instances removes the single local file system dependency, letting each service scale independently and survive instance failure. This cloud-native decomposition directly delivers the scalability and resilience the migration demands.

StackSets deploy a single CloudFormation template across multiple AWS accounts and Regions from one administrator account, satisfying the multi-account consistency requirement. They also support update operations and drift detection on each stack instance, so infrastructure changes propagate and configuration drift is identified per account.

SSE-KMS with customer managed keys allows the organization to create and control the KMS keys used for S3 encryption. The customer can define key policies, enable automatic rotation, and disable or revoke keys when needed. This satisfies the requirement for full control over key management, including rotation and revocation, while still using S3 server-side encryption.

In IaaS, the provider secures the physical hosts, hypervisor and network fabric, while the customer owns everything above it, including the guest operating system. Patching that guest OS therefore falls to the customer, satisfying the shared responsibility split for this deployment.

This automates key replacement at specified intervals.

Azure Backup stores VM backups in a Recovery Services vault, which encrypts data at rest by default. The policy controls the backup schedule and retention, and file-level recovery is supported directly from the recovery point. This combination satisfies the nightly schedule, 90-day retention, file restore, and encryption requirements.

A startup probe suppresses liveness and readiness checks until the container initialises, preventing premature restarts, while the readiness probe removes the pod from Service endpoints when unhealthy. Together they satisfy both the startup-delay and traffic-stopping requirements.

Protects data in storage.

Auto-failover groups provide a read-write listener endpoint that remains constant during failover, enabling automatic failover of one or more databases to a secondary region. They support automatic replication and can meet low RPO and RTO requirements by handling the failover process seamlessly.

A CASB sits between users and SaaS providers, discovering unsanctioned applications and enforcing data-loss prevention, encryption and access policies. This directly delivers the visibility and control over Shadow IT and data protection that the question asks for as the SaaS benefit.

AWS Cost Explorer provides pre-built dashboards that visualise cost and usage data, including breakdowns by dimension such as department when costs are tagged accordingly. This directly satisfies the requirement for an existing billing dashboard, unlike raw billing reports or custom-built tooling that would need manual configuration.

Bursting to the cloud directly satisfies the stem's requirement to leverage cloud resources for extra capacity while sensitive data stays on-premises. In a hybrid model, workloads scale out to public cloud during demand spikes, then return on-premises, preserving regulatory compliance without over-provisioning internal hardware.

A unique request ID per transaction lets you correlate every log line belonging to one request across services, which is essential for tracing distributed calls. Without it, entries from concurrent requests interleave and become impossible to reconstruct during analysis.

AWS Compute Optimizer analyses CloudWatch metrics for EC2 instances and delivers rightsizing recommendations, directly satisfying the requirement to identify underutilised instances and cut cloud spend. It evaluates CPU, memory and network utilisation over time, unlike billing tools that only report cost.

In-memory session state binds each user to one server, preventing horizontal scaling. Moving sessions to a shared cache or database makes application instances stateless, so any instance can serve any request and additional replicas absorb traffic spikes.

A distinct customer-managed key per tenant provides cryptographic isolation, so a compromised key affects only one tenant. Managed KMS services such as AWS KMS, Azure Key Vault, or Cloud KMS log key usage to CloudTrail, Azure Monitor, or Cloud Audit Logs, giving the auditor the required evidence. This directly satisfies both the isolation and auditability requirements.

HCL configuration files that Terraform loads from a working directory use the .tf extension, holding resource, variable and provider blocks. Terraform also reads .tf.json for JSON syntax and .tfvars for variable values, but .tf is the standard for HCL-authored configuration, satisfying the scenario's requirement.

VPC flow logs capture metadata about IP traffic to and from network interfaces in a VPC, including source/destination IPs and bytes transferred. Filtering for outbound traffic to the third-party API's public IPs will reveal which instances are generating the most egress and confirm whether the increase is due to API calls or other traffic. This is the most direct first step to localize the source before deeper packet analysis.

An ECS service with a desired count of two or more and tasks spread across multiple subnets in different AZs ensures high availability. A target tracking scaling policy based on CPU utilization automatically adjusts the number of tasks. This combination meets both the high availability and auto-scaling requirements.

Public and private subnets enforce the isolation constraint, keeping the database unreachable from the internet while the web tier remains exposed. SSL/TLS satisfies PCI DSS encryption in transit, and storage-level encryption covers data at rest.

The VPN tunnel carries all hybrid traffic, so its status and configuration directly determine whether cloud applications remain reachable. Intermittent drops, rekey failures or mismatched parameters on the tunnel would produce exactly the reported sporadic connectivity loss.

A multi-AZ database keeps a synchronized standby in a separate zone and promotes it automatically during a zone failure. This removes the need to restore from backup, keeping database downtime within the recovery time objective and allowing the application tier to reconnect with minimal delay.

Amazon RDS Multi-AZ deployments create a standby replica in a different Availability Zone and automatically fail over to it in case of an AZ failure. This ensures database availability and durability. It is a key component for a highly available multi-tier application, as it eliminates the database as a single point of failure.

The recovery point objective defines the maximum tolerable data loss measured in time, directly determining backup frequency and replication strategy. It is a core disaster recovery plan component because it translates business tolerance for lost transactions into concrete cloud backup and retention configurations.

CloudWatch Network Monitor continuously probes network paths between source and destination resources in different regions and reports round-trip latency and packet loss. It works without application changes, which fits the requirement to measure the user-to-endpoint path while leaving the workload untouched, making it the correct monitoring service here.

Separating web, application and database tiers into public and private subnets, then restricting traffic with security group rules referencing each tier, enforces the required access path. Only web servers are internet-facing, satisfying the constraint that application and database servers remain unreachable directly.

Keeps data in region and provides HA.

AWS Lambda supports SQS as an event source. When configured, Lambda automatically polls the queue and invokes the function with batches of messages. It scales based on the number of messages, and failed invocations can be retried or sent to a dead-letter queue. This meets the requirements for automatic scaling and graceful failure handling.

Queue depth measures outstanding I/O requests awaiting service, and latency measures response time. Both rising together shows requests are queuing faster than the SSD/HDD mix can serve them, isolating the storage subsystem rather than CPU, network or application as the bottleneck.

An Auto Scaling group spanning multiple Availability Zones ensures that if one AZ fails, instances in the remaining AZ continue to serve traffic. The Auto Scaling group can also replace failed instances automatically. This provides compute-layer high availability and is a fundamental design practice for surviving AZ failures.

Quota is per resource type, not aggregate, so overall headroom can exist while one service limit is exhausted. The deployment fails because that specific resource type has hit its ceiling, satisfying the 'Resource limit exceeded' error.

Security groups are stateful and evaluated per source. Because the bastion host on the same subnet succeeds while web tier instances in a different subnet time out, the database's inbound rule likely scopes the permitted source to the bastion's subnet or IP rather than the web tier CIDR. Adding the web tier subnet on the correct database port resolves the timeout.