CompTIA Cloud+ CV0-004 (CV0-004) — Questions 601–675

A cloud-native secrets management service (e.g., AWS Secrets Manager, GCP Secret Manager, Azure Key Vault) injects secrets at runtime via API calls or sidecar/mounted volumes, so credentials never live in the image or the orchestrator's static config. This enables rotation, fine-grained IAM access, and audit trails without rebuilding images when a credential changes.

AWS Compute Optimizer is the service specifically designed to analyze resource utilization metrics (such as CPU, memory, network, and disk) and generate rightsizing recommendations for EC2 instances, Auto Scaling groups, EBS volumes, and Lambda functions. It uses machine learning to identify over-provisioned or under-provisioned resources and provides actionable recommendations to downsize or upsize, directly addressing the goal of cost optimization. Unlike other tools that focus on billing or budgets, Compute Optimizer delivers instance-type-level guidance based on actual usage patterns.

IaaS, PaaS, SaaS, and FaaS are common cloud service models. IaaS provides virtualized hardware, PaaS provides a development platform, SaaS provides ready-to-use software, and FaaS provides event-driven code execution. Common confusions include swapping IaaS and PaaS definitions.

The compliance violation is the absence of required tags, not a problem with the instance itself. The administrator can use the AWS Management Console, CLI (e.g., `aws ec2 create-tags`), or SDK to apply the 'CostCenter' and 'Project' tags to the existing EC2 instance without disrupting its operation. This resolves the alert and maintains production continuity.

SAML (Security Assertion Markup Language) is the correct federation standard because it enables browser-based single sign-on (SSO) by exchanging authentication and authorization assertions between an identity provider (on-premises Active Directory via Azure AD Connect) and a service provider (cloud applications). SAML 2.0 is specifically designed for federated identity scenarios where users authenticate on-premises and gain access to cloud resources without re-entering credentials.

VPC Flow Logs capture IP traffic metadata (source/destination IP, ports, protocol, bytes, packets, action) for traffic flowing through ENIs, subnets, or VPCs. This metadata is exactly what's needed to diagnose connectivity issues between subnets, since it shows whether traffic is being accepted or rejected by security groups and NACLs. It can be published to CloudWatch Logs or S3 for analysis.

Target tracking scaling on the ECS service is the native mechanism for elastic task capacity. It monitors the service-level average CPU metric and adjusts the desired count toward the configured target, scaling out ahead of user-visible degradation and scaling in afterward. Adjusting task size, cluster-level settings, or EC2 capacity providers does not change the number of running Fargate tasks in response to demand.

AWS CodePipeline includes a built-in manual approval action that halts the pipeline until a designated approver responds. By inserting this action between the build and deploy stages, the team ensures that a release manager can inspect the build artifacts and approve or reject the release. This is the standard, least-effort method to implement a human gate without custom code.

Common CLI tools for network troubleshooting: ping tests reachability, traceroute shows the path, nslookup resolves DNS names. Confusing these functions is a typical mistake.

The rule has two parts: identity-aware brokering of interactive sessions and no external addresses on the instances. Identity-Aware Proxy TCP forwarding satisfies both because it authenticates the user's identity and IAM permissions before tunneling SSH over the internal address, and the firewall only needs to allow the IAP source range. External IPs, bastion hosts, and VPN-only access all authenticate network location rather than user identity.

High availability across two Availability Zones requires at least one subnet per AZ for each tier. Since the architecture needs both public-facing web servers and private database servers in each AZ, the minimum is two public subnets and two private subnets — one of each per AZ.

Asynchronous replication sends data changes from the primary site to the DR site with minimal delay, typically within seconds to minutes, which meets the 15-minute RPO. It does not require the low-latency link that synchronous replication demands, making it more cost-effective for geographically separated sites. The 2-hour RTO is achievable because the DR site can be activated quickly from the replicated data, without the overhead of restoring from backups.

High disk queue depth combined with saturated provisioned IOPS identifies the storage layer as the limiting factor for writes. Because write latency depends on durable commits to the volume, the fix is to raise provisioned IOPS and throughput so the primary can absorb the write rate. CPU is moderate and reads are healthy, so instance sizing, replica count, and zone placement are not the causes.

A PersistentVolumeClaim (PVC) is the correct resource because it abstracts the underlying storage details and allows a pod to request persistent storage that survives pod restarts. When a pod is recreated, the PVC ensures the same volume is reattached, preserving application state. This is essential for stateful applications in Kubernetes, as pods are ephemeral by default.

Multi-cloud is the use of multiple public cloud providers to gain flexibility and avoid dependency on a single vendor.

Spot instances are ideal for batch processing jobs that can tolerate interruptions because they offer significant cost savings (up to 90% off on-demand) by utilizing spare cloud capacity. Since the job runs for a few hours each night and can be interrupted, spot instances provide the most cost-effective solution. They can be terminated by the cloud provider if capacity is needed, but for interruptible workloads, this is acceptable.

In a typical CI/CD pipeline, after build (compile) comes test (e.g., unit tests) to validate the code before proceeding to deploy.

The first step in troubleshooting a traffic spike is to analyze network traffic logs to identify the source, whether it is a DDoS attack, a misconfigured application, or a legitimate surge. Diagnosis must precede remediation so the fix addresses the actual cause. Restarting, contacting the provider, or adding bandwidth without diagnosis may mask the symptom or waste resources.

S3 server access logging records each request to a bucket with fields including the requester's IP address, the operation performed, and the response. That request-level detail is what allows the engineer to trace the egress charges back to specific clients and patterns, which the aggregated cost and metrics tools cannot provide.

A 504 Gateway Timeout error from a load balancer indicates that the load balancer sent the request to a backend server but did not receive a timely response. The load balancer has a configured timeout value (often 30-120 seconds), and if the backend server fails to respond within that window, the load balancer terminates the connection and returns a 504. This is the most common cause of 504 errors in load-balanced environments.

A '400 Bad Request' from a cloud API indicates a client-side validation error, such as an invalid parameter, missing required property, or malformed request body. The fastest and most accurate first step is to read the error message details, which typically name the exact field or constraint that failed. This avoids guessing at network, timeout, or region issues that would produce different error codes.

Option B is correct because using a lifecycle hook with a 'pending:wait' state allows you to pause the instance launch process until the custom script completes. After the script succeeds, you send a 'complete-lifecycle-action' signal to the auto-scaling group, which then proceeds to put the instance into service. This ensures the instance does not receive traffic until the script is done.

Amazon EBS Provisioned IOPS SSD (io2 Block Express) delivers the highest IOPS and lowest latency among EBS volume types, making it the correct choice for a performance-critical single-instance database. The other options are either throughput-oriented HDDs for sequential workloads or a general-purpose SSD that, while cost-effective, does not provide the extreme performance required in this scenario.

The global external Application Load Balancer is the only option that provides a single anycast IP address and automatically routes users to the closest healthy backend across Google Cloud regions. It is purpose-built for global, layer 7 applications that require minimal latency and high availability, making it the correct choice for this scenario.

Under the shared responsibility model, the cloud provider is responsible for security 'of' the cloud, which includes the physical data center, hardware, and infrastructure. Securing the physical data center is solely the provider's responsibility. The customer is responsible for security 'in' the cloud, such as data encryption, IAM policies, and guest OS patching.

Auto scaling based on CPU utilization thresholds is the correct strategy because it dynamically adjusts the number of compute instances in response to real-time demand, ensuring the application can handle sudden spikes while minimizing costs during low-traffic periods. This approach aligns with the startup's requirement for variable traffic and cost efficiency, as it only provisions resources when needed, unlike fixed schedules or manual interventions that cannot react to unpredictable spikes.

The log indicates a timeout during a nightly backup job that involves creating a snapshot. A high I/O load on the volume during the snapshot process can cause the snapshot to take longer than the configured timeout threshold, as the snapshot must capture a consistent point-in-time state while the volume is actively being written to. This is a common issue in cloud environments where the snapshot process competes for disk resources, leading to delays that exceed the timeout limit.

Amazon EFS is the correct choice because it is a managed NFS file system that can be mounted on multiple Linux EC2 instances, supports POSIX permissions, and is highly available and scalable. EBS is block storage for single-instance attachment, S3 is object storage, and FSx for Windows is for Windows workloads.

AWS CloudWatch Logs and Azure Log Analytics are the native log aggregation and querying services in their respective clouds. CloudWatch Logs centralizes logs from AWS resources and supports Logs Insights for querying, while Azure Log Analytics provides a powerful KQL-based query engine over data collected in a Log Analytics workspace. Using both together gives centralized collection and advanced querying across the multi-cloud environment.

Since the OS firewall is disabled and the security group allows HTTP from 0.0.0.0/0, the only remaining layer that could block connectivity is the application itself. If the web server service (e.g., Apache, Nginx, IIS) is not running on the VM, it will not listen on TCP port 80, so HTTP requests will be refused even though network-level access is permitted. The ability to ping the VM confirms IP-level reachability, isolating the issue to the application layer.

A canary deployment routes a small percentage of traffic to the new version, allowing monitoring and automatic rollback if issues arise, meeting the requirements.

AWS Lambda with an S3 event trigger is the correct choice because it directly responds to object creation events in Amazon S3 without requiring any server management. The integration is native, so the function runs only when new images are uploaded, aligning with the need for minimal operational overhead and automatic processing. Other options involve more management or are not event-driven.

Automatic replacement of instances that fail load balancer health checks requires an Auto Scaling group whose health check type is set to ELB. In that mode, the group treats an instance as unhealthy when the load balancer reports it as unhealthy, terminates it, and launches a replacement to preserve desired capacity. Other options either react to metrics rather than health checks or only evaluate EC2-level status.

Deploying instances in a placement group within the same Availability Zone ensures they are physically close together, often in the same rack or cluster, which minimizes network hops and achieves the lowest possible latency. This configuration is ideal for latency-sensitive applications because it leverages non-blocking, high-bandwidth inter-instance communication without traversing additional network infrastructure.

In Kubernetes, pods assume a Kubernetes service account, and cloud providers support mapping that service account to a cloud IAM role via workload identity (for example, IRSA on EKS or Workload Identity on GKE/AKS). This lets the pod obtain short-lived credentials scoped to only the permissions in the role, enforcing least privilege without embedding static credentials.

AWS Security Hub is a centralized security and compliance service that aggregates findings from multiple AWS services (like GuardDuty, Inspector, Macie) and third-party tools across accounts, and it runs automated compliance checks against standards such as CIS AWS Foundations, AWS Foundational Security Best Practices, and PCI DSS. It is purpose-built for cross-account security aggregation and compliance monitoring, making it the correct choice.

With CPU utilization at 95% on the application server, the bottleneck is compute capacity, so the first remediation step is to scale out by adding another instance to distribute the load. Horizontal scaling directly addresses sustained high CPU by adding parallel processing capacity. This is the least disruptive and most appropriate first action before considering vertical scaling or restarts.

Lambda can be triggered by SQS, S3, API Gateway, etc. For SQS, the trigger is SQS. S3 triggers on object events; API Gateway for HTTP; EventBridge for events.

AWS Systems Manager Patch Manager automates the process of patching managed nodes with both security-related and other types of updates. It uses a patch baseline to define which patches should be installed and can schedule patching across a fleet of EC2 instances, making it the correct service for this task.

Retrieving logs from the previous container instance surfaces the actual termination error without altering the Deployment or node configuration. Because CrashLoopBackOff restarts containers, the current instance may not have logged anything yet, so the --previous flag is essential. Disruptive actions like deleting, scaling, or replacing nodes neither reveal the cause nor respect the constraint of not modifying the running workload.

Azure Files provides fully managed file shares in the cloud that are accessible via the industry-standard SMB and NFS protocols, making it the correct choice for shared file storage across multiple Linux VMs. Linux VMs can mount Azure Files shares using SMB 3.0 or NFS 4.1, enabling concurrent access from multiple instances. The other storage types do not support standard file-sharing protocols for multi-VM access.

When memory usage is at 95% and CPU utilization is low, the system is likely thrashing—the operating system is forced to page memory to disk (swap) to free RAM. Disk I/O is orders of magnitude slower than RAM, so even with idle CPU, the application stalls waiting for swap operations. This explains the performance degradation despite low CPU load.

The first priority in a confirmed security incident is containment. Modifying the security group to deny all traffic immediately stops the outbound communication to the malicious IP, preventing data exfiltration or further compromise while preserving the instance for forensic analysis. This aligns with the incident response process, where isolation precedes investigation.

Azure Log Analytics is the service designed to collect, store, and query log data from multiple sources, including applications, VMs, and Azure resources. It supports configurable retention (including long-term retention beyond the default 30 days) and provides KQL-based querying for security analysis. This makes it the correct choice for centralizing logs with a 2-year retention requirement.

CPU ready time (B) measures the time a virtual machine is ready to execute but must wait for the hypervisor to schedule it on a physical core. High ready time directly indicates CPU contention, as the VM is being starved of CPU cycles. CPU co-stopping time (E) occurs when multiple vCPUs in a single VM must wait to be scheduled simultaneously, which also signals CPU overcommitment and contention on the hypervisor.

SSE-KMS with a customer-managed key gives the organization control over key policies, rotation, and usage auditing while allowing S3 to handle encryption transparently. Setting it as the bucket default means applications do not need modification to encrypt new objects. Other options either leave key control with AWS or require significant application changes.

AWS Lambda has a hard limit of 250 MB unzipped for the combined deployment package and all layers. When layers exceed this, packaging the function as a container image (up to 10 GB) is the supported workaround. Container images can include large third-party libraries directly in the image, bypassing the layer size limit while still allowing reuse via shared base images.

For ECS tasks on Fargate, container stdout and stderr must be directed to a logging destination through a log driver in the task definition. The awslogs driver forwards those streams to CloudWatch Logs, where the engineer can review output from both running and stopped tasks. SSH is unavailable, ECS Exec only works on running tasks, and ECR stores images rather than runtime logs.

AWS DMS can perform ongoing replication using CDC, and SCT converts schemas between different database engines.

Session data held only in instance memory is lost when that instance fails. Storing sessions in a shared external service such as Amazon ElastiCache for Redis lets any replacement instance retrieve the same session data. This decouples session state from compute, so failover restores both capacity and user continuity with minimal disruption.

High disk I/O latency on a standard network-attached volume indicates that the storage tier is the bottleneck. Upgrading to an SSD-based volume, such as a provisioned IOPS SSD, provides lower latency and higher throughput. This is the most direct and effective way to improve disk performance for a database workload that is sensitive to I/O latency.

HIPAA (Health Insurance Portability and Accountability Act) sets standards for protecting sensitive patient data. PCI DSS is for payment card data, SOC 2 is for service organizations, ISO 27001 is for information security management.

Configuring automated snapshots of the managed disk provides a cost-effective, incremental backup mechanism that enables rapid recovery of the VM in case of failure. Snapshots capture point-in-time copies of the disk and can be used to create a new managed disk or restore the VM quickly, meeting the recovery objective without the expense of maintaining a separate, always-on replica.

The `spec.strategy.rollingUpdate.maxUnavailable` field in a Kubernetes Deployment manifest explicitly controls the maximum number of Pods that can be unavailable during a rolling update. This field can be set as an absolute number or a percentage of the desired Pod count, ensuring that the update proceeds without dropping below a specified availability threshold.

IAM policies are essential for enforcing the principle of least privilege in cloud KMS. By restricting who can use (encrypt/decrypt) and manage (rotate/disable/destroy) customer-managed keys, the security team ensures that only authorized principals can access the key material. This prevents unauthorized users or services from compromising data at rest, which is a core requirement for compliance frameworks like PCI DSS or HIPAA.

CloudFormation StackSets allow you to deploy a single template across multiple AWS accounts and regions in one operation, using either self-managed permissions or AWS Organizations integration. This is the designed feature for organization-wide resource deployment like VPCs and IAM roles. StackSets handle the orchestration, rollback, and drift detection across all target accounts.

Under the shared responsibility model, the customer is responsible for data encryption, OS patching, and IAM configuration, while the provider secures the physical infrastructure.

A slowdown in an external dependency pushes worker threads into long waits, so a fixed-size thread pool saturates and requests queue behind blocked workers. CPU remains low because the threads are waiting on I/O, not executing. The trace data localizing latency to the third-party call identifies the trigger, and the service's concurrency model explains the amplification.

Amazon CloudWatch Logs is the native centralized log management service that ingests logs from EC2, Lambda, VPC Flow Logs, CloudTrail, and application sources, and provides Logs Insights for searching and querying. It supports metric filters, alarms, and subscription filters for downstream processing, making it the correct choice for centralized search and query across multiple AWS services.

Health check flapping during bursts is addressed by tuning the probe itself: a longer interval and timeout reduce probe intensity and tolerate brief slowdowns, while higher healthy and unhealthy thresholds require more consistent evidence before an instance's state changes. Together these settings distinguish transient latency from genuine failure. Caching, changing load balancer type, or removing instances do not reduce false health check failures.

AWS CloudFormation StackSets allow you to deploy stacks across multiple accounts and Regions from a single administrator account. They are designed for consistent, scalable deployments, enabling you to create, update, or delete stacks in many accounts simultaneously using a single CloudFormation template and set of parameters.

Pod Security Standards (formerly PSP) define security contexts, including runAsNonRoot and readOnlyRootFilesystem, to enforce these policies.

Unauthorized users can list and download encrypted objects, even if the data is encrypted at rest. The primary risk is data exfiltration if the encryption key is compromised or the data is not properly encrypted.