CompTIA Cloud+ CV0-004 (CV0-004) — Questions 76–150

Amazon SQS is a fully managed message queuing service that enables asynchronous communication and decoupling of microservices. It supports standard and FIFO queues, dead-letter queues for handling failed messages, and message retention configurable from 1 minute to 14 days. This directly matches the requirements for a managed queuing service with dead-letter queue support.

Session Manager provides shell access through the Systems Manager agent without opening inbound SSH ports or distributing private keys. Sessions can be recorded and streamed to CloudWatch Logs and S3 with object lock for tamper evidence, satisfying both the hardware-key and centralized-logging requirements.

High disk I/O wait with low CPU indicates the storage subsystem is the bottleneck. Cloud VMs have limits on IOPS and throughput. If the disk queue is saturated, increasing provisioned IOPS (if using a cloud disk like AWS EBS or Azure Disk) can improve performance. Checking queue depth helps confirm the bottleneck before making changes.

Active-active runs identical workloads concurrently in both regions, each serving traffic, so a full region outage leaves the surviving region already handling production load. This differs from active-passive, where the standby region only takes over after failover, incurring downtime.

A PersistentVolumeClaim (PVC) with ReadWriteOnce allows a single node to mount the volume for read-write access, which is suitable for a single pod. It provides persistent storage that survives pod restarts. This is the standard way to request durable storage in Kubernetes and meets the requirement.

Cloud Monitoring alerting policies can send notifications to a Pub/Sub topic, and a subscriber such as a Cloud Run function can execute automated remediation. This closes the loop from detection to action without human latency, which directly reduces recovery time. It is the supported event-driven pattern for automated response in Google Cloud and scales with alert volume.

Immutable infrastructure replaces servers rather than mutating them in place, so every deployment ships a freshly built, identically configured image. This eliminates configuration drift, makes rollbacks deterministic, and ensures environments remain reproducible across scaling events and regions.

Under the shared responsibility model, the cloud provider secures the infrastructure, but the customer owns configuration of their own resources. Storage bucket permissions and access policies are customer-controlled, so the misconfiguration and resulting breach rest with the customer.

S3 Block Public Access provides preventive controls that override bucket policies and ACLs that would otherwise grant public access. Enabling it at both the account and bucket levels ensures the setting applies broadly and cannot be bypassed by individual bucket configuration changes. This is the correct preventive control for preventing accidental or intentional public exposure of sensitive data.

X-Ray traces already capture per-segment timing, so comparing segment durations isolates the subcomponent responsible for latency. Ranking segments by duration pinpoints the slow service or downstream call driving the intermittent spikes, which aggregate tracing alone cannot reveal.

The EC2 instance can reach the on-premises VPN gateway, proving the tunnel and VPC routing work. Since on-premises firewall logs show dropped packets from the VPC CIDR, the firewall is filtering that range, blocking return traffic to EC2 instances.

Files created before versioning was enabled have no prior versions recorded, so they never appear in the version history list. Microsoft Entra ID is unrelated here; the constraint is that versioning only captures objects written after it was switched on, leaving pre-existing files unrestorable via version history.

The AWS EBS CSI driver enables dynamic provisioning of EBS volumes. Using WaitForFirstConsumer ensures the volume is provisioned in the same availability zone as the pod, allowing the pod to attach the volume after rescheduling within the same zone. This meets both dynamic provisioning and persistence requirements.

Object storage addresses the stem's scalability constraint by using a flat namespace with HTTP-accessible objects, so capacity grows without provisioning volumes. Block storage requires pre-sized LUNs and a filesystem, capping practical scale. This makes S3 suitable for unstructured data such as media and logs.

Cooldown periods pause further scaling actions after a scale-in, letting metrics stabilise before the auto-scaling group launches replacement instances. This directly satisfies the stem's requirement to prevent immediate launches, as the cooldown timer blocks new scaling activity until it expires.

High CPU ready time means vCPUs wait in the hypervisor's run queue before receiving physical CPU cycles. Over-provisioning vCPUs across guests on the same host oversubscribes physical cores, so each VM waits longer, presenting as an unresponsive guest.

Queue depth directly reflects pending work, so workers scale with actual backlog rather than a proxy. Because job volume varies unpredictably, ApproximateNumberOfMessages lets auto-scaling add instances when messages accumulate and remove them when the queue drains, matching capacity to demand.

A VM group with automatic recovery monitors guest health and restarts the virtual machine when the operating system stops responding, satisfying the requirement to recover automatically from an OS crash. Unlike host-level HA, which only reacts to physical host failure, this detects in-guest unresponsiveness and triggers the restart.

The variable block declares an input variable, letting the AMI ID be supplied at plan or apply time rather than hard-coded, which makes the configuration reusable across environments. Output exposes values, locals compute intermediates, and provider configures the AWS plugin.

Customer-managed keys in a key management service let the organization own the key material and define access through policies. Revoking a user's permission to the key immediately removes their ability to decrypt data, and the company can rotate or disable keys itself. This meets both the encryption-at-rest and exclusive-control requirements.

Measuring restore duration directly validates the recovery time objective, confirming services return within the agreed RTO. Timing restoration from backups exercises the actual recovery mechanism, exposing whether backup retrieval, data transfer and service start-up collectively satisfy the RTO constraint defined in the stem.

ClusterIP assigns a virtual IP reachable only inside the cluster network, so frontend pods can reach the backend API while external clients cannot. This satisfies the stem's requirement that the backend be unreachable from outside the cluster.

Bicep's declarative DSL compiles directly to ARM JSON, so it provides identical resource coverage while replacing verbose JSON brackets, quotes and nested expressions with concise, readable syntax. This directly satisfies the stem's requirement for a key benefit over ARM templates: reduced authoring complexity without losing any deployment capability.

The Secrets Store CSI Driver with the AWS provider mounts Secrets Manager values directly into the pod as files, so nothing is baked into the image. Secrets Manager supports native rotation schedules, including every 30 days, and the auto-rotate feature refreshes the mounted files without a pod restart. This satisfies both the runtime retrieval and automatic rotation requirements.

Cloud SQL offers a high availability configuration that creates a standby instance in a different zone within the same region. It provides automatic failover and synchronous replication to the standby. This meets the requirement for a relational database with automatic failover and multi-zone replication within a region.

This design satisfies every stated constraint: the public subnet exposes web servers to the internet, the private app subnet is reachable only from the web tier via security groups, and the isolated database subnet lacks a route to an internet gateway, so no public IPs are needed.

Insufficient service quotas directly block provisioning because the cloud platform enforces per-subscription or per-region limits on resources such as vCPUs, public IP addresses, and storage accounts. When a deployment requests capacity beyond the allotted quota, the API rejects the request, making quota exhaustion a frequent and well-documented cause of provisioning failure.

Pod Security Standards define restricted, baseline and privileged profiles enforced via Pod Security Admission. The restricted profile blocks root execution and host filesystem mounts, directly satisfying both the non-root and host-access constraints without custom policy authoring.

This is exactly what IRSA-style workload identity federation provides: the cloud IAM role trusts the cluster's OIDC issuer, and the annotated service account lets pods exchange a projected service account token for temporary cloud credentials. No static keys exist anywhere, tokens expire automatically, and access is scoped per service account, satisfying the no-long-lived-credentials requirement cleanly.

SAML 2.0 is an open OASIS standard for exchanging authentication and authorisation data, letting Microsoft Entra ID act as identity provider and issue signed assertions to cloud applications. This satisfies the stem's federation requirement with on-premises Active Directory, delivering browser-based SSO without exposing credentials to each application.

Binary Authorization is a GKE-native admission controller that enforces attestation-based policies on container images at deploy time. It verifies cryptographic signatures produced by trusted attestors before allowing a pod to be created. This satisfies the auditor's requirement for integrity and provenance verification without touching individual pipelines, since enforcement happens centrally on the cluster's admission webhook.

IaaS leaves guest OS patching, configuration and administration to the customer, distinguishing it from PaaS, where the provider manages the runtime. This control over the guest operating system is the defining characteristic separating IaaS from higher-level managed offerings.

Correct. Configuring security groups with inbound rules on the database tier to allow only the necessary database port from the web tier's security group, and outbound rules on the web tier, effectively restricts traffic to required ports.

Spreading the stateless application across two Availability Zones behind a load balancer removes a single point of failure. If one zone fails, the load balancer routes traffic to the surviving zone, so the design primarily improves high availability rather than scalability, elasticity or durability.

Archive tiers are engineered for long-term retention of data that is rarely accessed, offering the lowest storage price per gigabyte in exchange for retrieval times measured in hours. The scenario permits several hours of retrieval latency and prioritizes cost, so an archive tier aligns exactly with both the access pattern and the compliance retention period.

Applying Environment, Project and Team tags to all resources creates the three attribution dimensions the stem requires, enabling cost reports grouped by deployment stage, initiative and owning group. Consistent tagging across resources is what makes allocation accurate.

AWS Shield Standard is enabled automatically on all AWS accounts and protects against common network and transport layer DDoS attacks at no extra charge. It defends the ALB without configuration, satisfying the always-on, zero-cost constraint.

Hybrid cloud keeps sensitive customer data on-premises while extending workloads to the public cloud, directly satisfying the regulatory constraint. Unlike public or private cloud alone, it connects on-premises infrastructure with cloud services, letting the company migrate non-sensitive workloads without breaching data-residency rules.

AWS Snowball provides a physical appliance for offline bulk data transfer, bypassing the 50 Mbps bandwidth constraint that would make 50 TB take months to upload. Data is shipped to AWS and imported into S3.

Swap usage rises when physical memory is exhausted and the database pages memory to disk. Sustained swap activity signals a memory bottleneck, since the instance is compensating for insufficient RAM by moving pages to slower storage.

Timestamp, severity and request ID are discrete, machine-parseable fields that let queries filter by time window, log level or trace a single request across services. This satisfies the queryability goal by replacing free-text scanning with indexed field lookups.

The only keyword restricts a job to specified conditions, such as only: tags, so the deploy job runs solely when a tag is pushed. This satisfies the stem's requirement to control execution based on tags rather than branches or merge requests.

Continuous replication to a standby instance in another region satisfies the one-minute RPO by shipping every transaction asynchronously, and meets the fifteen-minute RTO because the standby is already running and can be promoted immediately, avoiding restore-from-backup delays.

Security groups are stateful and already permit port 3306, so the next layer to verify is the stateless network ACL on the RDS subnet, which must allow inbound 3306 and outbound ephemeral return traffic. This satisfies the requirement to check the next likely blocker.

IaaS delivers virtualised compute, storage and networking while leaving the guest OS, patching and middleware entirely under the customer's control. That directly satisfies the stem's requirement to retain control over the operating system and middleware, unlike PaaS or SaaS, which abstract those layers away.

Network ACLs are stateless subnet-level filters separate from security groups. Even with security groups allowing traffic, an inbound rule in VPC B's NACL denying ICMP would silently drop echo requests, explaining why instances in VPC A cannot ping VPC B.

Auto-scaling matches capacity to demand for the stateless application tier, satisfying elasticity without over-provisioning. Read replicas offload read-heavy traffic from the primary database, improving throughput while writes remain on the primary. Together they deliver horizontal scaling and cost efficiency, since resources track actual load rather than peak estimates.

Amazon EFS provides a shared, elastic file system that can be mounted by multiple Fargate tasks simultaneously. It supports persistent storage that survives task restarts and can be used for database containers that require a file system. EFS is the recommended solution for persistent storage with Fargate because it integrates natively and supports the required durability and scalability.

Using kubectl describe pod surfaces Kubernetes events and the last termination reason for each container, including OOMKilled when a container exceeds its memory limit or Evicted when the node reclaims resources. This is the most direct, low-cost diagnostic step before changing any configuration, and it aligns with the operations task of identifying why pods are being terminated under load.

AWS recommends using IAM roles for EC2 instances to grant permissions without embedding long-term credentials. An instance profile is a container for an IAM role that can be attached to an EC2 instance at launch or later. The instance then retrieves temporary credentials from the instance metadata service, which are automatically rotated. This method is secure and aligns with best practices.

VPN creates a private encrypted tunnel over the internet.

Least privilege requires granting only the permissions needed for a user's tasks. A policy allowing all actions on all resources grants unrestricted access, directly violating that principle by exceeding any legitimate job function's required scope.

Service accounts provide dedicated identities with minimal permissions for apps.

Cloud Armor inspects incoming requests at the edge and can apply preconfigured WAF rules, including the SQL injection signature set, before traffic reaches the backend. Rules can run in preview mode first so the team tunes sensitivity and reduces false positives on legitimate search strings. This directly blocks the crafted statements at the perimeter.

Hybrid cloud is defined by integrating an on-premises private cloud with public cloud services, joined by secure connectivity so workloads span both. That combination of private and public infrastructure is precisely the characteristic the question asks for.

CPU ready time measures the milliseconds a virtual machine waits for a physical core, directly exposing contention. This satisfies the troubleshooting requirement by quantifying scheduling delay, unlike utilisation percentages that show demand but not competition.

Helm charts separate templated manifests from environment-specific values, so one chart deploys across accounts while each account supplies its own values file. This satisfies the requirement for a single set of manifests with per-account configuration, since overrides are injected at render time rather than duplicated per account.

Redis CPU at 90% and memory at 95% indicate the cache cluster is saturated, so session lookups slow or fail, cascading into high load balancer latency and fluctuating healthy hosts. This satisfies the observed bottleneck, since compute CPU and memory remain moderate.

AWS Elastic Disaster Recovery replicates block-level changes continuously from source EC2 instances and EBS volumes to a staging area, giving sub-second RPO and rapid recovery. This satisfies the 1-minute RPO and 15-minute RTO, unlike snapshot-based or scheduled replication, which cannot meet such tight recovery targets.

Anomaly detection establishes behavioural baselines for service accounts and flags deviations, such as unusual high-risk API calls, in real time. This satisfies the requirement to detect abnormal activity as it occurs rather than relying on static rules or periodic review.

StackSets extend a single CloudFormation template across multiple AWS accounts and regions from one administrator account, provisioning identical VPCs and security groups consistently. This directly meets the stem's requirement to deploy a common resource set to all accounts without duplicating stacks manually.

AWS::RDS::DBInstance is the correct resource for deploying a managed relational database. Setting StorageEncrypted to true ensures encryption at rest, and RDS automatically handles backups and patching, minimizing management overhead. This matches the requirements exactly and is the standard way to provision RDS via CloudFormation.

Canary deployment involves releasing the new version to a small subset of users or traffic, then gradually increasing the traffic while monitoring metrics. If issues are detected, the deployment can be automatically rolled back. This strategy minimizes risk by limiting exposure and allows for data-driven decisions based on real-time performance. It aligns perfectly with the requirements for gradual traffic shifting and automated rollback.

Block storage presents raw volumes that can be formatted with a file system and used by the database. It supports low-latency random read/write operations and allows the engineer to provision IOPS based on performance needs. Attaching the volume directly to the virtual machine ensures dedicated access and consistent performance, which is exactly what a high-performance database requires.

Scanning images in CI/CD catches vulnerable base layers before deployment, so the pipeline fails the build rather than letting the flaw reach production. This directly satisfies the stem's requirement to prevent known critical vulnerabilities recurring in future container images.

The shared responsibility model splits security duties by layer: the provider secures the physical data centres, hardware and hypervisor, while the customer secures everything above, including guest operating systems, patches and identity. This directly satisfies the stem's requirement that the company retains guest OS responsibility while the provider handles physical security.

Horizontal auto-scaling adds or removes stateless instances in response to CPU thresholds, matching capacity to flash-sale demand without manual intervention. Because the application holds no session state, new instances can serve traffic immediately, satisfying the sudden-spike constraint efficiently. Vertical scaling would require restarts and hit fixed instance-size ceilings.

IaaS delivers only virtualised compute, storage and networking, leaving the guest operating system, middleware and applications entirely under customer management. PaaS and SaaS abstract the OS away, so IaaS uniquely satisfies the requirement for maximum control over both operating system and applications.

Service control policies set the maximum permissions for accounts in an AWS Organization and can include conditions such as aws:RequestTag to deny create operations lacking the required tag. Applied at the root, the policy covers all accounts and blocks non-compliant deployments at the API layer. This provides preventive, organization-wide enforcement matching the requirement.

Azure Update Manager orchestrates OS patching for Azure and Arc-connected Linux VMs, scheduling assessments and deployments inside a defined maintenance window. It satisfies the automation and windowing constraints directly, unlike manual SSH patching or image rebuilds. Note that Update Management in Azure Automation is retired; Update Manager is the current service.

Cloud instances are ephemeral: a local log file resides only on that instance's disk and disappears when the instance terminates or is replaced. Centralised logging persists entries independently of instance lifecycle, satisfying the durability requirement the legacy local-file approach cannot meet.

Loose coupling lets each service fail or scale independently, so one component's outage does not cascade across the application. This directly supports the high availability goal by containing faults and permitting graceful degradation rather than total service loss.

Deploying across multiple availability zones within a single region ensures high availability while keeping data within the country's borders, satisfying data residency. Availability zones are isolated data centers within a region, providing fault tolerance without crossing legal boundaries, making this the most critical design consideration.

PaaS delivers managed runtimes and middleware, so customers deploy code and manage applications while the provider handles the operating system, patching and runtime. That matches the constraint of no OS or runtime management, unlike IaaS, which leaves those layers to the customer.

Lambda layers package shared libraries and dependencies separately from function code, so database connection logic is referenced by multiple functions rather than duplicated in each deployment package. This directly satisfies the requirement to reuse common code across functions while keeping individual deployment artefacts small.