CompTIA Cloud+ CV0-004 (CV0-004) — Questions 151–225

A PersistentVolumeClaim requests storage from a StorageClass, which triggers dynamic provisioning of a PersistentVolume. This satisfies the stem's requirement for dynamically provisioned persistent storage on Amazon EKS, unlike a PersistentVolume, which represents already-provisioned capacity, or a StorageClass, which only defines the provisioning template.

IaaS delivers virtual machines, storage and networking while the customer manages the guest operating system, patching and middleware. That leaves the greatest control over the OS layer, unlike PaaS or SaaS, which abstract it away.

A 500 error indicates server-side execution failure. Since the previous version worked, the newly deployed code most likely throws an unhandled exception or runtime error during execution, which the platform surfaces as an internal server error.

Insufficient VPN bandwidth saturates the tunnel during large backup transfers, causing TCP retransmissions and eventual timeout errors despite the VPN remaining up and stable. A relational database's daily full or incremental backup volume can exceed the tunnel's throughput, so the constraint of a stable-but-limited VPN link is satisfied by this explanation.

Scaling policies react to metric thresholds; if those metrics fluctuate naturally around the target, the group adds and removes instances repeatedly. Overly sensitive thresholds or short cooldowns cause this rapid oscillation between two and three instances, matching the exhibit.

A customer-managed key in the cloud KMS satisfies the auditor's control and 90-day rotation requirement, unlike provider-managed keys. Replacing the CIDR-wide rule with a security group reference restricts database access to the web server tier only.

Object lock in compliance mode makes objects immutable for the retention period, and even the root account cannot delete or alter them. This provides verifiable evidence that stored records have not been changed, which satisfies the tamper-evidence requirement. Combined with customer-managed encryption keys, it delivers both confidentiality and integrity assurance for regulated health data.

Upgrading to a higher-performance SSD volume type, such as provisioned IOPS SSD, can significantly reduce disk I/O wait times by providing more IOPS and lower latency. This is a direct solution when the current volume type is the bottleneck. The administrator should evaluate the workload's IOPS requirements and choose an appropriate volume type. This action addresses the root cause of high I/O wait.

Read replicas replicate asynchronously from the primary database, so a replica can lag behind by seconds or more. When the application queries that replica, it reads data committed before the lag interval elapsed, returning stale results until replication catches up.

Pod Security Standards define the restricted profile, which sets runAsNonRoot and readOnlyRootFilesystem enforcement via the securityContext, satisfying both constraints. Applied through namespace labels or admission control, they block root execution and writable root filesystems at pod admission.

High CPU ready time means the VM waited for physical cores while the scheduler ran other vCPUs. That occurs when the host's physical CPU is overcommitted, so the hypervisor cannot grant cycles promptly, directly explaining the slow VM.

Horizontal auto-scaling adds or removes instances, and CPU utilisation is the trigger metric that reflects load. This matches unpredictable spikes by scaling out at peak and in during lulls, minimising cost, whereas vertical scaling requires restarts and has fixed ceilings.

Reviewing attached policies exposes exactly which actions the role grants, letting the administrator identify unused or unnecessary permissions before editing anything. This directly satisfies the least-privilege constraint by scoping permissions to what the workload actually requires, rather than deleting the role or revoking access blindly, which could break dependent services.

A dedicated logging service aggregates log streams from multiple projects into a single centralised repository, removing the need to query each project separately. It provides unified retention, search and access control, which is precisely the centralisation the administrator requires across disparate projects.

Scheduled scaling triggers scale-out actions at predefined times, so capacity increases before the predictable business-hours spike begins. This satisfies the requirement to scale out ahead of the traffic increase, which dynamic or reactive policies cannot guarantee.

Azure Key Vault holds customer-managed RSA keys and integrates with Azure SQL Database and Azure Storage through Transparent Data Encryption and storage service encryption with CMK. Granting the resources access via managed identities lets the team disable or rotate the key to revoke access. This satisfies the requirement for internal key control and revocation capability.

Low CPU indicates the database itself is not the bottleneck, so the added round-trip latency between application and cloud-managed database is the likely cause. Moving off-premises lengthens the network path, slowing query response even when processing is idle.

Amazon S3 is a durable, highly available object storage service designed for storing and retrieving any amount of data. It provides HTTP/HTTPS access and is ideal for backups and media files. S3 offers 99.999999999% durability and can be accessed globally, meeting the requirements.

Geo-blocking filters traffic by source country, dropping requests from the unwanted region at the WAF before they reach the application. Legitimate users elsewhere remain unaffected, reducing the attack surface from that region's hostile traffic without disrupting the target customer base.

Security groups are stateful and already permit MySQL from the App SG, so the block must come from the stateless layer: the database subnet's NACL. Its inbound rules are evaluated independently of outbound, and a missing allow for the application subnet's CIDR on port 3306 drops the traffic.

Bicep is a declarative domain-specific language that compiles to Azure Resource Manager templates, offering concise syntax with native Azure integration. It satisfies the stem's requirement for infrastructure as code in a declarative, concise form, unlike imperative scripting or JSON-based ARM templates.

Multi-cloud spans providers with differing IAM models, logging formats and encryption defaults. A single consistent security policy framework, applied uniformly across every cloud, prevents fragmented controls and audit gaps that vendor lock-in avoidance would otherwise introduce.

Verifying RTO and RPO confirms the DR plan meets its defined recovery targets, directly satisfying the drill's purpose of validating effectiveness. RTO measures restoration time; RPO measures tolerable data loss. Achieving both proves the failover actually works within business constraints, rather than merely documenting procedures that may fail under real conditions.

The Horizontal Pod Autoscaler adjusts replica counts from observed metrics such as CPU or request rate, letting microservices scale elastically with traffic. Kubernetes supplies the orchestration and scheduling layer, satisfying the dynamic-scaling requirement without manual intervention.

Canary deployment routes a small percentage of traffic to the new version while the majority still hits the stable release, enabling error monitoring and automatic rollback. This directly satisfies the requirement to limit initial user exposure and revert on detected issues.

Identifying which files consume the space reveals whether the growth is database data, logs or orphaned files, directing the remedy. This diagnostic step precedes deletion or expansion, satisfying the requirement to act first without risking data loss on a production database.

Change data capture reads ongoing inserts, updates and deletes from the source's transaction log and applies them to Aurora, keeping the target synchronised until cutover. This satisfies the minimal-downtime constraint by replicating changes continuously rather than requiring a stop-and-copy migration.

Kubernetes Secrets are designed to hold sensitive information such as passwords, tokens, and keys. They are stored in etcd and can be encrypted at rest if configured. Secrets can be mounted as files or exposed as environment variables, and they are only distributed to nodes running pods that require them. Using a Secret avoids hardcoding credentials in the image or manifest and follows security best practices.

Drift detection compares each stack resource's actual configuration against its expected template-defined state, reporting any divergence. This directly satisfies the requirement to identify manual changes made outside CloudFormation, since it flags resources whose live properties no longer match the stack's declared configuration.

The hypervisor log shows the guest OS out-of-memory killer terminating a process, which points to memory exhaustion inside the VM rather than a host or hypervisor fault. An application memory leak steadily consumes guest RAM until the kernel kills processes, shutting the VM down.

The exhibit shows an inbound rule permitting TCP port 22 with a source of 0.0.0.0/0, meaning any internet host can reach SSH. That violates the least-privilege constraint in the stem, since administrative access should be restricted to known management addresses rather than exposed globally.

A standby replica in another Availability Zone receives synchronous replication and can be promoted automatically when the primary zone fails. This provides a low recovery point and low recovery time because the standby is already in sync. It directly addresses the requirement that the database tier survive the loss of a single Availability Zone without manual intervention.

A workflow is the YAML-defined automation unit in GitHub Actions, containing the triggers and jobs that run. Defining it with an on: push trigger scoped to the main branch executes the test jobs automatically on every push, meeting the stated requirement.

A 504 from the front end while API instances are healthy points to connectivity between tiers rather than an application crash. A security group or network ACL that silently drops the web-to-API flow would let the target group health check pass (if it originates inside the API subnet) while user requests time out. Checking these rules first is the fastest way to confirm or eliminate a network path fault.

A readiness probe checks the health endpoint and only adds the pod to the Service endpoints once it returns HTTP 200. This directly satisfies the requirement that new pods receive traffic only after the health check passes, unlike a liveness probe, which restarts containers.

Amazon ElastiCache for Redis provides a centralized, in-memory data store that can be used to store session data. By configuring the application to use Redis as the session store, sessions become available to all instances in the Auto Scaling group. This requires no application code changes if the application already supports external session stores, or minimal configuration changes. It ensures sessions persist even if instances are added or removed.

After failover the read-write endpoint's DNS record points to the new primary, but a connection pool caching the old address keeps reconnecting to the failed node until its entries expire. This explains the outage far exceeding the two-minute failover time.

SAML 2.0 federation with an IAM identity provider lets the firm's existing directory authenticate auditors, and AWS issues temporary credentials through AssumeRoleWithSAML. No long-lived IAM users or keys are created, sessions expire automatically, and permissions come from a role scoped to S3 read-only. This satisfies limited duration and least overhead precisely.

Spot instances offer substantial discounts over on-demand pricing and can be reclaimed with little notice, which suits a CPU-intensive batch job that tolerates interruptions. The 30-minute daily runtime means reclamation risk is low and cost savings are maximised.

AWS Security Hub aggregates findings from GuardDuty, Inspector, Macie and Config, then runs automated compliance checks against standards including PCI DSS. This centralised aggregation and automated assessment satisfies the compliance team's evidence requirement, unlike standalone services.

Checking VPN bandwidth and latency directly addresses the hybrid cloud bottleneck: the 100 Mbps on-premises link and any tunnel overhead cap throughput for cloud file access. Measuring both reveals whether encryption, routing or congestion is throttling transfers, satisfying the stem's constraint of diagnosing slow cloud file access across the hybrid connection.

Distributing the web and application tiers across multiple availability zones ensures that if one zone fails, the remaining zones can continue to serve requests. A load balancer health-checks instances and routes traffic only to healthy targets. This eliminates single points of failure at the compute layer and is a fundamental practice for zone-resilient architectures.

Synchronous replication commits each transaction on both primary and standby before acknowledgement, so a failover loses zero committed data — comfortably inside the one-minute RPO. The hot standby is already running and current, allowing promotion within the 15-minute RTO. Asynchronous replication could not guarantee that one-minute data-loss limit.

CPU ready time measures how long a vCPU waited in the hypervisor's run queue for a physical core, which is the precise metric for CPU contention on an overcommitted host. Only the hypervisor console exposes it; guest tools cannot see scheduling delay.

TLS 1.2 or higher encrypts data in transit between the cloud application and users, satisfying the PCI DSS requirement for protecting cardholder data over public networks. Earlier protocol versions contain known weaknesses, so enforcing TLS 1.2 as the minimum cipher suite baseline is mandatory.

A load balancer distributes incoming traffic across instances in multiple availability zones and health-checks them, routing around a failed zone. This directly delivers the fault tolerance the scenario demands by removing any single instance or zone as a point of failure.

The SP metadata was updated 45 days ago, but the IdP rotated its signing certificate 30 days ago. SAML signature validation relies on the certificate in the SP's trusted metadata; if it still holds the old certificate, assertions signed with the new key fail validation. This matches the symptom of successful IdP authentication but SP-side signature errors, and the timing discrepancy confirms the metadata is stale.

High CPU ready time indicates the VM is waiting for physical CPU resources because the hypervisor is oversubscribed. Moving the VM to a dedicated host or a host with lower oversubscription reduces contention, directly addressing the root cause. This is the most appropriate first step because it targets the resource bottleneck without unnecessary changes to the VM's configuration.

AWS CloudFront caches static content at edge locations worldwide, directly satisfying the global low-latency requirement. Requests terminate at the nearest point of presence rather than the origin region, cutting round-trip time. Unlike regional services such as S3 alone, CloudFront's distributed edge network is purpose-built for this caching scenario.

An Auto Scaling group with a scaling policy that references the Amazon CloudWatch CPUUtilization metric automatically adjusts the desired capacity of the web tier instances when average CPU crosses defined thresholds. This is the standard, declarative way to implement dynamic scaling in CloudFormation, ensuring the application can handle traffic spikes without manual intervention.

Elastic Beanstalk supports integrating an RDS database directly through the console, which automates the creation of the database and configures the necessary security groups and environment properties. This minimizes management overhead because Beanstalk handles provisioning, scaling, and monitoring of both the application and the database lifecycle. The web server tier handles HTTP requests and can scale automatically based on load.

IaC with Terraform allows defining infrastructure in declarative configuration files that can be version-controlled and applied consistently across multiple providers. This automates provisioning and configuration, reduces manual errors, and ensures repeatability, directly addressing the requirement for automated, consistent multi-cloud deployments.

esxtop runs on the ESXi host itself, exposing per-world CPU scheduling metrics such as %RDY, which directly quantifies the time a vCPU waits for physical cores. This satisfies the stem's requirement to identify CPU contention at the hypervisor layer, unlike guest-level tools that cannot see host scheduling pressure.

Secrets Manager stores secrets and supports automatic rotation.

Run Command is part of AWS Systems Manager and allows the administrator to run scripts or commands on managed instances without SSH access. It uses the Systems Manager agent and IAM permissions, so no SSH keys are needed. It can be scheduled through a maintenance window or EventBridge, satisfying the nightly execution requirement.

An auto-scaling group spanning multiple availability zones with a load balancer directly satisfies both constraints: horizontal scaling driven by CPU utilisation and resilience across zones. The load balancer distributes traffic to healthy instances, while the scaling group adds or removes capacity as demand changes.

Amazon EFS is a fully managed, POSIX-compliant file system that can be mounted on multiple EC2 instances simultaneously. It is durable across multiple Availability Zones and supports high throughput with Bursting or Provisioned Throughput modes. EFS is designed for shared access and automatically scales. This matches the requirements for a shared file system with multi-AZ durability and high throughput.

Requiring MFA at role assumption adds a second authentication factor, so a compromised user's stolen credentials alone cannot assume the instance IAM role. This directly blocks the credential-based privilege escalation path that granted database read access, satisfying the prevention requirement.

CloudTrail data events capture object-level API activity such as GetObject and PutObject for the specified bucket, providing a reliable, structured audit record of every access attempt. Delivering the trail to a separate log archive account supports immutability and separation of duties, which is the expected pattern for regulated data.

In PaaS, the provider manages the runtime, middleware, and operating system, but the customer still writes, deploys, and patches the application code itself. This retained responsibility satisfies the scenario's requirement to identify what the customer still manages.

Least privilege grants only the permissions required for a user's tasks, directly removing the excessive access the AWS IAM user currently holds. Unlike broader controls such as separation of duties, it targets permission scope itself, satisfying the stem's constraint of more permissions than necessary.

Egress charges apply whenever data leaves a provider's network, so cross-cloud replication and failover traffic incur fees that single-cloud designs avoid. This directly addresses the resilience-versus-cost trade-off the architect must weigh, since continuous synchronisation between clouds multiplies billable egress volume.

Rate limiting caps requests per client within a defined window, mitigating brute-force credential stuffing, enumeration and denial-of-service floods that would otherwise exhaust gateway and backend capacity. It satisfies the stem's cloud constraint, where internet-exposed gateways face untrusted, high-volume traffic that must be throttled before reaching origin services.

Workload Identity federates Kubernetes service accounts with Google Cloud IAM, allowing pods to obtain short-lived access tokens through the metadata server without any static key files. Each Kubernetes service account maps to a Google service account, so IAM roles can be scoped per workload, satisfying the keyless authentication and least-privilege requirements for the microservices deployment.

Policy-as-code evaluates resource definitions against tagging rules and triggers automatic remediation, applying missing cost centre and environment tags. This enforces the governance requirement continuously rather than relying on manual audits, satisfying the automatic remediation constraint.

Security Hub supports designating a delegated administrator account and aggregating findings from all member accounts into a single pane. It integrates findings from services like GuardDuty and Inspector and supports automation rules and suppression filters to mute findings matching approved exceptions, which directly satisfies the centralized visibility and suppression requirements described.

AWS CloudWatch Alarm evaluates metric thresholds over defined evaluation periods, so it directly satisfies the five-minute sustained average CPU condition. It monitors the auto-scaling group's aggregate metric and triggers notification actions when the 80% threshold is breached, unlike log-based or event-driven mechanisms that cannot assess rolling metric averages.

Setting `associate_public_ip_address` to `false` directly removes the public IP assignment from the instance's network interface, satisfying the policy that all instances in this subnet remain private. This argument controls the instance-level public addressing behaviour, so the plan no longer provisions a public address before apply.

RollingUpdate replaces pods incrementally, honouring maxSurge and maxUnavailable so new pods reach readiness before old ones terminate. A bare ReplicaSet cannot orchestrate this ordering during updates, so the Deployment controller is required to satisfy the zero-downtime constraint.

Pod Security Admission with the restricted profile enforces hardened pod settings, including running as non-root, disallowing privilege escalation, dropping capabilities, and requiring a seccomp profile. Applying it at the namespace level ensures every pod meets the security team's baseline. It directly maps to the non-root, read-only, and no-new-capabilities requirements.

Continuous replication to a warm standby keeps a running scaled-down copy current, so automated failover recovers within the 15-minute RTO while replication lag under one hour satisfies the RPO. Pilot light or backup-restore approaches cannot meet that recovery time.

S3 emits event notifications when objects are created, so configuring an S3 event trigger invokes the serverless function on upload. This directly satisfies the requirement that the function runs when a new object lands in the bucket, without polling.

The INPUT chain rule for port 443 specifies source 10.0.0.0/8, a private range covering only internal addresses. External users' public source IPs never match this criterion, so the packet is dropped before reaching the web server. Port 80 lacks this restriction, explaining why only HTTPS fails.

The health check queries a specific URL path; if that path returns 404 or is absent, every instance fails the check and is marked unhealthy. The load balancer's probe therefore reports all instances down despite the instances themselves running.