CompTIA Cloud+ CV0-004 (CV0-004) — Questions 526–600

The 1 Gbps interface cap is the bottleneck: periodic 500 Mbps outbound spikes plus burst overhead can saturate it, causing throttling and packet loss. A larger instance size raises the network bandwidth cap to 2 Gbps, removing that ceiling so peak traffic no longer queues at the interface.

In IaaS, the provider secures the physical hosts, hypervisor and network fabric, while the customer retains control of guest operating systems. Patching those VMs is therefore the customer's responsibility, satisfying the shared responsibility split at the OS layer.

Active-active across two Availability Zones runs identical workloads in both, so each AZ handles traffic independently. When one AZ fails, the surviving AZ absorbs the load, satisfying the requirement to keep serving traffic through a full AZ outage.

Amazon CloudWatch collects and tracks metrics such as CPU utilization for EC2 instances. It allows the creation of alarms that trigger when a metric breaches a threshold for a specified number of evaluation periods. In this scenario, an alarm can be set to fire when average CPU utilization exceeds 80% for 5 consecutive minutes, directly meeting the team's requirement for monitoring and alerting.

Continuous cross-region replication keeps a standby copy within seconds of the primary, satisfying the one-minute RPO, while automatic failover redirects traffic without manual intervention, meeting the fifteen-minute RTO. Neither scheduled snapshots nor single-region backups can achieve both targets.

Without VPC peering, no route exists between the two VPCs, so traffic is dropped regardless of route table or security group configuration. Establishing peering creates the private connectivity path required for instances in VPC A to reach VPC B.

Azure ExpressRoute provides a dedicated, private circuit through a connectivity provider, bypassing the public internet entirely. This satisfies the stem's requirement for private, high-bandwidth connectivity between the on-premises data centre and Azure, unlike VPN gateways which traverse the public internet and offer variable bandwidth.

Azure Backup for VMs uses an extension installed on the VM to take snapshot-based backups of the OS and data disks. Associating the VMs with the backup policy created in the Recovery Services vault ensures the daily schedule and 30-day retention are applied. This, combined with the vault and policy, enables file-level recovery from the VM backups, fully meeting the administrator's requirements.

Stale package metadata causes 'Package not found' when the repository has published a newer kernel; refreshing the cache with the package manager's update step before installation lets the script resolve the latest kernel package name.

An Auto Scaling group can be configured with multiple subnets across different Availability Zones. When the group scales, it launches instances evenly across the specified subnets, providing fault tolerance. This directly meets the requirement for multi-AZ deployment without additional complexity.

StackSets deploy a single CloudFormation template across multiple accounts and Regions from one administration account, satisfying the requirement to roll out shared logging configuration organisation-wide. Unlike ordinary stacks, which are scoped to one account and Region, StackSets use service-managed or self-managed permissions to target every account in the AWS Organization automatically.

Amazon SNS delivers alerts by fanning messages out to email, SMS, HTTP endpoints and Lambda subscribers, satisfying the notification channel requirement. It integrates natively with CloudWatch alarms, so critical threshold breaches reach operators without custom polling infrastructure.

Direct Connect provides a dedicated private connection with consistent performance.

Pod Security Standards enforce security contexts that limit pod capabilities.

Continuous replication to a standby database keeps a near-current copy available, so failover avoids restoring from backup and removes the slow restoration step. This directly reduces database recovery time, helping the application meet its one-hour RTO.

A shared database externalises all session and user state, so any instance can serve any request without relying on local memory. This satisfies the horizontal-scaling constraint, since instances remain interchangeable and can be added or removed freely.

SCT converts the SQL Server schema and stored procedures into Aurora MySQL-compatible DDL, which is essential because the two engines use different syntax. Without this conversion the migrated schema would fail on Aurora, so it satisfies the heterogeneous-engine requirement underpinning the minimal-downtime cutover.

AWS Systems Manager Patch Manager applies OS patches to Windows and Linux instances on a schedule, using maintenance windows and patch baselines. It supports compliance reporting and controlled rollback through baseline approval rules, meeting the maintenance-window and rollback requirements.

An Auto Scaling group can be configured to use EC2 status checks as health checks. When an instance fails a status check, the Auto Scaling group terminates it and launches a new instance from the launch template. This provides automatic replacement and maintains the desired capacity, meeting the requirement for unattended recovery.

Hybrid cloud joins on-premises infrastructure to a public cloud through VPN tunnels or dedicated private links such as AWS Direct Connect, keeping workloads split across both environments. That connectivity mechanism is exactly what the stem describes.

Cloud CDN caches static assets at Google's global edge points of presence, cutting latency for images and CSS by serving users from nearby locations rather than the origin. It directly satisfies the stem's low-latency static-content constraint. SSL termination, however, is handled separately by the external Application Load Balancer, not Cloud CDN itself.

Block storage presents a raw volume directly to the VM, giving the database low-latency, consistent read/write performance on a single host. File and object storage add network protocol overhead and are unsuitable for database workloads needing predictable IOPS, so block satisfies the single-VM, consistent-performance constraint.

An HTTP health check against a dedicated application health endpoint evaluates whether the application is actually serving requests, which is the behavior the team wants. Setting a matcher of 200 confirms a valid response, and raising the unhealthy threshold prevents a single slow response from ejecting a target. Because CPU pressure alone does not affect an HTTP health check, busy-but-responsive instances stay in rotation during deployments.

Containerisation with orchestration gives each build job its own isolated runtime with dedicated filesystem and resource limits, so concurrent jobs cannot interfere. Orchestration schedules these ephemeral containers across nodes, directly satisfying the stem's requirement to isolate each build job.

Incompatible CPU instruction sets or features between source and target hosts directly cause migration failures because the target hypervisor cannot execute instructions the guest VM requires. This satisfies the stem's constraint of identifying common migration failure causes: live migration demands CPU feature parity, and mismatched instruction sets (for example, differing SSE or AVX support) halt the transfer.

AWS Secrets Manager natively stores and encrypts secrets, and its built-in rotation schedules Lambda functions to change credentials automatically. This directly satisfies the stem's 90-day rotation requirement, which AWS Systems Manager Parameter Store cannot perform without custom automation.

To use customer-managed encryption keys (CMEK) with Cloud Storage, you must create a Cloud KMS key and grant the Cloud Storage service account permission to use it. The cryptoKeyEncrypterDecrypter role allows the service to encrypt and decrypt data with the key. This is a required step for enabling CMEK on buckets.

Multi-site active-active runs identical workloads concurrently in separate regions, so traffic fails over instantly via global load balancing with no cold-start or data-restore delay. This satisfies the sub-5-minute RTO constraint, since recovery becomes near-immediate rather than requiring redeployment or backup restoration.

Increasing the cooldown period forces the auto-scaling group to wait after each scaling activity before triggering another, directly damping the rapid add-remove oscillation described. This satisfies the stability constraint by preventing consecutive scale-out and scale-in events from chasing transient metric spikes.

Geo-blocking inspects the source IP's geographic origin and denies requests from specified countries or regions, directly satisfying the requirement to drop traffic from regions that generate no customers. It filters at the WAF layer before requests reach the application, unlike rate limiting or signature-based rules.

Memory ballooning reveals host memory pressure: the hypervisor reclaims guest pages via the balloon driver, forcing the VM to swap and stall. Rising ballooning indicates the host is overcommitted on RAM, making it a direct contention signal alongside CPU ready time.

Mandatory, standardised tag keys with controlled values ensure every resource is attributable to a department and project, preventing untagged or inconsistently labelled resources from skewing cost reports. This enforces consistent cost attribution across the estate.

AWS DMS with change data capture continuously replicates ongoing changes from the live Oracle source to RDS, so the source stays running and cutover downtime is limited to final catch-up. Native tools like Data Pump require quiescing the database, which the minimal-downtime constraint rules out.

VPC peering creates direct, non-transitive routes between VPCs, so traffic bypasses any central inspection point. A transit VPC acts as a hub: spokes peer only with it, and route tables direct inter-VPC traffic through the firewall appliance hosted there, restoring centralised inspection.

Azure RBAC assignments are inherited by every child scope, so a Contributor role granted at subscription level flows down to all resource groups and resources inside that subscription. This satisfies the stem's subscription-scope constraint, rather than limiting access to a single resource group or resource.

Serverless functions that call external databases are highly sensitive to network latency and database responsiveness. If the database is slow to respond or connections are timing out, the function will exceed its timeout. This is a common cause of intermittent timeouts in serverless architectures, especially when the database is outside the cloud provider's network or under heavy load.

SSE-KMS with customer managed keys allows the company to create and manage their own KMS keys, control key policies, enable automatic key rotation, and audit key usage via AWS CloudTrail. This meets all requirements: customer-managed keys, auditing, rotation, and minimal operational overhead since KMS handles the encryption/decryption.

An IAM policy is the JSON document that defines which actions are allowed or denied on specified resources, and attaching a read-only policy to the developer's identity or the bucket grants exactly that scoped access. Roles, groups and ACLs alone cannot express this permission set.

Pod Security Admission enforces pod security standards at admission time and the restricted profile blocks root execution, privilege escalation, and other unsafe capabilities. Applying it to the namespace enforces the policy without editing individual deployment manifests, and violations are rejected before the pod is created. This directly satisfies the auditor's enforcement and non-modification requirements.

Separate subnets per tier let security groups enforce least-privilege traffic flows between web, application, and database layers, directly minimising the attack surface as the stem requires. Because security groups filter at the instance level, lateral movement after a web-tier compromise is contained, unlike flat-network alternatives that expose every tier to every other.

Amazon S3 provides high durability and availability for unstructured data. Cross-Region Replication automatically replicates objects to another region, enabling low-latency access from multiple regions. S3 Lifecycle policies can transition infrequently accessed data to S3 Glacier Deep Archive for long-term retention at low cost. This combination meets all requirements.

Conditional Access in Microsoft Entra ID evaluates sign-in signals and enforces MFA tenant-wide, covering every Azure subscription because subscriptions inherit directory-level authentication. This satisfies the central management constraint: one policy applies to all administrative users across all cloud apps, rather than per-subscription configuration.

Horizontal pod autoscaling adds or removes pod replicas based on CPU utilisation, matching capacity to demand so the cluster scales out rapidly during spikes and shrinks afterwards. This pay-for-what-you-use elasticity minimises cost compared with over-provisioning static nodes.

Canary deployment routes a small percentage of traffic to the new version first, then gradually shifts the remainder while monitoring error rates. If errors exceed the threshold, traffic reverts to the old version, delivering the gradual shift, monitoring and automatic rollback the team requires.

Least privilege grants each service account only the IAM roles its task requires, nothing broader. Applied through predefined or custom roles on GCP, it directly satisfies the stem's constraint that service accounts hold only the permissions necessary for their work.

Security groups are stateful virtual firewalls attached directly to EC2 elastic network interfaces, so rules are evaluated per instance rather than per subnet. Allowing only TCP ports 80 and 443 inbound satisfies the instance-level constraint, with return traffic automatically permitted regardless of outbound rules.

Scheduled scaling provisions capacity at fixed times, matching the predictable weekday 9 AM spike and 5 PM decline without relying on reactive metrics. This avoids over-provisioning during known idle periods, directly satisfying the cost-effectiveness constraint in the stem.

Configuring auto-scaling lets the PaaS platform add and remove compute instances automatically as demand rises, directly meeting the no-downtime requirement under increased load. Because the provider manages the underlying infrastructure, scaling occurs without manual intervention or service interruption, unlike vertical resizing, which typically needs a restart.

Using multiple providers reduces dependence on one vendor's proprietary services, pricing and roadmap, so workloads can be moved or rebalanced. This directly addresses the lock-in constraint by keeping architectures portable across providers rather than tied to a single platform's APIs.

An Auto Scaling group with a launch template can span multiple Availability Zones, automatically replacing unhealthy instances and launching new ones to meet demand. An Application Load Balancer operates at Layer 7, supports HTTP/HTTPS health checks, and can route traffic based on path or host. Together, they provide automatic recovery and high availability for a stateless web application, directly satisfying the engineer's requirements.

The OWASP rule set supplies preconfigured signatures that detect and block SQL injection patterns in inbound requests, directly satisfying the requirement to protect the web application. Unlike generic rate limiting or IP reputation, these rules inspect payload syntax against known injection techniques, so enabling the OWASP core rule set on the WAF mitigates the attack class named in the stem.

Moving session state to a shared database or cache externalises it from individual instances, so any server behind the load balancer can serve any request. This directly satisfies the horizontal scaling requirement, since locally stored sessions would otherwise pin users to one server and break scaling.

HashiCorp Vault is cloud-agnostic, running centrally to issue and audit secrets across AWS, Azure and Google Cloud through one API. This satisfies the multi-cloud centralisation constraint, whereas native secret managers such as Azure Key Vault remain scoped to their own provider.

An SQS trigger uses event source mapping, letting Lambda poll the queue and invoke the function with batched messages. This pull-based integration handles scaling and failed-message handling natively, matching the requirement to process queue messages.

A repeating daily 100% CPU spike at a fixed time points to a scheduled workload rather than organic demand. Inspecting the VM's local task scheduler identifies recurring jobs triggering the load, confirming the cause before any capacity or monitoring changes are made.

Scale-in requires its own trigger because the threshold differs from scale-out. A separate CloudWatch alarm with a less-than-30-percent condition, evaluated over the same period, provides the discrete signal the Auto Scaling group needs to remove capacity only after utilization genuinely drops, matching the scenario's stated scale-in condition.

A managed Kubernetes service provides a control plane that schedules containers, restarts failed pods through the ReplicaSet controller, and abstracts the worker nodes. Horizontal Pod Autoscalers adjust replica counts per service based on metrics, so each microservice scales independently. Because the provider manages the control plane, the operations team's limited cluster expertise is less of an obstacle.

User-defined routes allow the administrator to override Azure's default system routes. By creating a UDR on the spoke subnets with the next hop type set to 'Virtual appliance' and specifying the NVA's private IP address, all traffic destined for the internet or other networks can be forced through the NVA for inspection. This directly satisfies the requirement to route spoke traffic through the NVA in the hub.

Amazon CloudWatch Logs is a managed service that ingests log data from EC2 instances via the CloudWatch agent, from AWS services, and from custom sources. It stores logs durably in log groups and supports querying with CloudWatch Logs Insights, a query language for searching and analyzing log events, which matches the central collection and ad hoc query requirements.

Centralising logs in a log management system aggregates entries from all sources into one queryable store, enabling correlation and consistent alert rules across services. Without centralisation, security events scattered across hosts cannot be searched or alerted on reliably, undermining structured log-based detection.

Session persistence pins each client to the backend that first served it, so subsequent requests bypass normal distribution algorithms. With all servers healthy, this stickiness explains the uneven spread described in the stem rather than any health-check or capacity issue.

Public accessibility arises when the bucket policy or object ACL grants read permission to AllUsers or AuthenticatedUsers. That explicit grant overrides default private settings, exposing the sensitive customer data. Misconfigured permissions, not encryption or versioning, are the direct cause of anonymous access.

High %util with elevated await and queue depth on the device confirms the disk subsystem is saturated, so requests queue faster than they complete. This matches the slow VM symptom, since CPU and memory metrics remain normal while I/O wait dominates.

Read replicas offload read traffic from the primary and can be added or removed while the database stays online. A reader endpoint or proxy presents a stable address, so the application keeps the same connection string while read capacity scales horizontally. This directly addresses unpredictable read spikes without downtime or application changes.

AWS DMS performs the actual data migration and continuous replication, capturing ongoing changes from the source Oracle database so the target stays synchronised. This change data capture capability minimises downtime during cutover to Amazon RDS for PostgreSQL.

VPC Flow Logs capture accepted and rejected IP traffic metadata for elastic network interfaces, subnets or VPCs, including source, destination, port and action. Publishing them to CloudWatch Logs or S3 satisfies the troubleshooting requirement, since the records reveal whether traffic between the two VPCs is reaching its destination.

AWS Compute Optimizer analyses CloudWatch metrics and resource configuration to generate rightsizing recommendations for EC2 instances, identifying over-provisioned or underutilised capacity. This directly satisfies the goal of finding underutilised instances, unlike billing or inventory tools that only report spend.

Data sensitivity and classification directly constrain where workloads may reside, since regulated or confidential data often mandates private or hybrid placement rather than public multitenancy. Classification therefore determines the deployment model's compliance boundary, satisfying the stem's requirement to weigh factors shaping the public, private or hybrid choice.

AWS Systems Manager Patch Manager with a maintenance window satisfies the no-business-hours constraint by targeting the 50 Linux instances via tags and running patch baselines only within a defined schedule, using an IAM service role rather than SSH. This avoids manual intervention and prevents patching outside the approved window.

CloudTrail records API activity in an AWS account, capturing the identity of the caller, timestamp, source IP and request parameters for every call. Enabling it satisfies the requirement to audit all API calls, since CloudWatch monitors metrics and Config tracks resource state rather than API events.

An organization trail automatically applies to all accounts in the organization, including accounts added later, and delivers events to a central S3 bucket. The SCP then removes the ability of member account principals to stop or delete the trail, satisfying the tamper-resistance requirement without per-account configuration.

Canary releases route a small percentage of live traffic to the new container version while the majority still hits the stable version, enabling validation with real users before full rollout. Blue-green would shift all traffic at once, failing the small-subset requirement.

Composite alarms evaluate the state of multiple child alarms and fire only when the Boolean expression is true, which directly suppresses the storm of individual notifications. Routing only the composite alarm to the SNS topic means the on-call engineer receives one actionable alert that represents the correlated condition, preserving the underlying child alarms for diagnostics.