CV0-004 Practice Questions

Question 1

A cloud operations team needs to implement a monitoring solution for a microservices architecture. The solution must provide centralized logging, metrics, and alerting, and must be able to correlate data from multiple services. Which THREE of the following components should the team include?

Accepted Answer

A centralized logging system (e.g., ELK stack).. A centralized logging system like the ELK stack (Elasticsearch, Logstash, Kibana) aggregates logs from all microservices into a single searchable repository. This enables the team to correlate events across services by timestamp and metadata, which is essential for debugging distributed transactions and identifying root causes of failures.

Answer

A security information and event management (SIEM) system.

Answer

An application performance monitoring (APM) tool.

Question 2

A hybrid cloud deployment connects an on-premises data center to a public cloud. Which TWO components are typically required to establish this connectivity? (Select TWO.)

Accepted Answer

Direct peering or dedicated connection (e.g., AWS Direct Connect). A dedicated connection like AWS Direct Connect provides a private, high-bandwidth, low-latency link between an on-premises data center and a public cloud, bypassing the public internet for consistent performance and security. Option C is correct because a VPN gateway establishes an encrypted tunnel over the public internet (using protocols like IPsec) to securely connect the on-premises network to the cloud VPC, which is a standard requirement for hybrid cloud connectivity.

Answer

Load balancer in the cloud

Answer

Public internet with HTTPS

Answer

Cloud-based DNS resolver

Question 3

Refer to the exhibit. A cloud administrator runs the above command on a Linux virtual machine. What is the effect of the current firewall rules?

Accepted Answer

All incoming traffic is allowed except RDP, which is dropped.. The rules show ACCEPT for SSH (22), HTTP (80), and HTTPS (443), and DROP for RDP (3389). Since the default policy on the INPUT chain is ACCEPT, all other traffic is allowed, which is not secure. The administrator should set the default policy to DROP and only allow necessary ports.

Answer

All outgoing traffic is controlled by these rules.

Answer

The firewall is blocking all traffic by default.

Answer

Only SSH, HTTP, and HTTPS are allowed; all other traffic is dropped.

Question 4

A company's cloud environment uses a shared responsibility model. The security team notices that a data breach occurred due to misconfigured storage buckets in the public cloud. Which party is primarily responsible for this misconfiguration according to the shared responsibility model?

Accepted Answer

The customer. Under the shared responsibility model, the customer is responsible for configuring their cloud resources securely, including storage bucket permissions. The cloud provider is responsible for the security of the cloud (infrastructure) but not for customer misconfigurations. The third-party vendor and cloud auditor are not directly responsible for the misconfiguration.

Answer

The cloud service provider

Answer

The cloud auditor

Answer

A third-party security vendor

Question 5

A company wants to ensure high availability for a stateless web application. Which architecture should be recommended?

Accepted Answer

One VM in each of two availability zones with a load balancer. Deploying one VM in each of two availability zones with a load balancer ensures high availability by eliminating a single point of failure. If one availability zone fails, the load balancer automatically routes traffic to the healthy VM in the other zone, keeping the stateless web application accessible. This architecture aligns with the principle of fault tolerance for stateless applications, where no session state is lost during failover.

Answer

Two VMs in the same availability zone with a load balancer

Answer

Single VM with daily backups

Answer

A single large VM with auto-recovery

Question 6

Refer to the exhibit. This log message is from a cloud security scanner. Which principle did the scanner likely detect?

Accepted Answer

Least privilege. The message indicates that user credentials were stored in user data (such as instance metadata) and are accessible to all users with read access to that metadata. This violates the principle of least privilege because credentials should not be widely accessible.

Answer

Separation of duties

Answer

Defense in depth

Answer

Fail securely

Question 7

A company uses a cloud provider's key management service to encrypt data at rest. The security team wants to ensure that encryption keys are automatically rotated every 90 days to meet compliance requirements. Which feature should be enabled?

Accepted Answer

Key automatic rotation. Automatic rotation replaces key material periodically without manual intervention, meeting compliance needs.

Answer

Key import scheduling

Answer

Key revocation

Answer

Key policy enforcement

Question 8

A cloud architect is designing a multi-tier application that must be resilient to the failure of an entire availability zone. Which of the following strategies BEST meets this requirement?

Accepted Answer

Deploy application instances across three availability zones with a load balancer. Deploying across multiple availability zones provides high availability. Option A is wrong because vertical scaling does not address zone failure. Option B is wrong because auto-scaling within a single zone does not help if the zone fails. Option C is wrong because a single load balancer in one zone is a single point of failure.

Answer

Place all instances behind a single load balancer in one zone

Answer

Implement auto-scaling within the same availability zone

Answer

Use larger instance types to handle more load

Question 9

A cloud administrator runs a deployment script that creates multiple resources using Infrastructure as Code (IaC). The script fails with a "400 Bad Request" error when attempting to create a storage account. Which troubleshooting step should the administrator take first?

Accepted Answer

Review the error message details for a specific validation error.. A 400 error indicates a client error, so the first step is to examine the error details to understand what parameter is invalid. Option A is wrong because 400 is not a network error (would be 5xx). Option B is wrong but plausible; however, the error message would specify the exact issue. Option D is wrong because timeouts result in different errors.

Answer

Check the network connectivity to the cloud API endpoint.

Answer

Increase the timeout value for the API call.

Answer

Verify that the script has the correct region parameter.

Question 10

An organization's hybrid cloud environment uses a VPN connection between on-premises and the cloud. Intermittent connectivity drops are reported during peak hours. The VPN logs show rekeying failures. Which configuration is most likely the cause?

Accepted Answer

The IPSec dead peer detection interval is set too high. A dead peer detection (DPD) interval set too high delays detection of lost peers, causing rekeying failures under load. Option A is wrong because pre-shared keys don't expire. Option C is wrong because throughput exceeded would show packet loss or high latency, not rekeying failures. Option D is wrong because blocking IKE packets would prevent the VPN from establishing at all.

Answer

The VPN tunnel is using a pre-shared key that has expired

Answer

The VPN gateway throughput is exceeded

Answer

The on-premises firewall is blocking IKE packets

Question 11

A cloud architect is designing a VPC with public and private subnets. Which component is required to allow instances in the private subnet to access the internet for software updates?

Accepted Answer

NAT gateway. A NAT gateway is required to enable instances in a private subnet to initiate outbound connections to the internet (e.g., for software updates) while preventing the internet from initiating inbound connections to those instances. It translates the private IP addresses of the instances to the NAT gateway's Elastic IP address using source network address translation (SNAT). An Internet gateway alone cannot serve private subnets because it requires a route table entry pointing to a public subnet with a public IP address.

Answer

Elastic IP

Answer

VPN connection

Answer

Internet gateway

Question 12

A company is adopting a shared responsibility model for a PaaS cloud deployment. Which THREE responsibilities belong to the customer?

Accepted Answer

Data classification and encryption. In a PaaS shared responsibility model, the customer is responsible for data classification and encryption of data at rest and in transit. The cloud provider manages the underlying infrastructure, but the customer must classify data according to sensitivity and apply encryption mechanisms, such as using TLS 1.2/1.3 for data in transit and AES-256 for data at rest, as the provider cannot access or classify customer data.

Answer

Management of the runtime environment

Answer

Physical security of data centers

Question 13

A cloud architect is designing an auto-scaling policy for a web application that experiences predictable traffic spikes every weekday morning from 8 to 10 AM. The application runs on a group of virtual machines behind a load balancer. Which scaling approach is MOST cost-effective while ensuring performance during the spike?

Accepted Answer

Scheduled scaling to increase capacity before 8 AM and decrease after 10 AM. Scheduled scaling is the most cost-effective approach because the traffic pattern is predictable (every weekday 8–10 AM). By configuring the auto-scaling group to add instances before the spike and remove them after, you avoid paying for idle resources during off-peak hours while ensuring capacity is ready when needed. This approach directly matches the known schedule without relying on reactive metrics or manual intervention.

Answer

Dynamic scaling based on CPU utilization threshold

Answer

Proactive scaling using machine learning to predict spikes

Answer

Manual scaling by the operations team each morning

Question 14

A cloud engineer is troubleshooting a VM that is experiencing high latency. The VM is hosted on a hypervisor with other VMs. Which TWO metrics should the engineer review to identify if resource contention is occurring?

Accepted Answer

Memory ballooning. Memory ballooning (A) is a VMware mechanism where the hypervisor reclaims idle memory from a VM by inflating a balloon driver, forcing the VM to swap. High ballooning indicates memory overcommitment and contention, directly causing latency. CPU ready time (B) measures the time a VM is ready to run but waiting for a physical CPU core; elevated ready time signals CPU contention among VMs on the same hypervisor.

Answer

Network packet drops

Answer

Swap usage

Answer

Disk queue length

Question 15

A company has deployed a multi-tier application on a public cloud platform. The security team discovers that a Compute Instance is communicating with an external IP address known for malicious activity. The instance is part of an auto scaling group. What is the BEST immediate action to contain the threat while minimizing downtime?

Accepted Answer

Remove the instance from the auto scaling group and attach a security group that blocks all traffic.. Isolating the compromised instance by detaching it from the auto scaling group and applying a security group that denies all traffic can quickly contain the threat. Network ACLs are attached to subnets and changing them could affect other instances. Suspending the auto scaling group alone may not stop the current instance. Updating routing tables is complex and could disrupt legitimate traffic.

Answer

Suspend the auto scaling group to prevent additional instances from being launched.

Answer

Use a routing table blackhole to drop traffic from the instance.

Answer

Modify the network ACL for the subnet to deny traffic to the malicious IP.

CompTIA Cloud+ CV0-004 practice test

Three ways to study

Study CV0-004 by domain

Study CV0-004 by topic

Cloud Architecture and Design practice questions

Deployment practice questions

Security practice questions

Operations and Support practice questions

Troubleshooting practice questions

CV0-004 fundamentals practice questions

CV0-004 scenario practice questions

CV0-004 troubleshooting practice questions

Top CV0-004 questions

CompTIA Cloud+ CV0-004 practice questions

How to use these CV0-004 questions

Quick answer