CompTIA Cloud+ (CV0-004)

Question 1

A financial services company runs its primary application in a single cloud region. Regulatory requirements mandate a recovery point objective (RPO) of 15 minutes and a recovery time objective (RTO) of 1 hour in the event of a full regional outage. The business wants to minimize ongoing cost while still meeting these targets. Which disaster recovery design best satisfies these requirements?

Accepted Answer

Deploy a warm standby in a second region with a scaled-down replica of the application tier and continuous asynchronous database replication, scaling up compute during failover

Answer

Use a backup-and-restore strategy that stores nightly snapshots in a second region and rebuilds the environment on demand after an outage

Answer

Deploy a fully active-active multi-region architecture with synchronous database replication and equal capacity in both regions

Answer

Rely on multi-AZ deployment within the primary region with synchronous replication across availability zones

Question 2

A cloud operations team receives thousands of alerts daily from their monitoring platform. On-call engineers report that most alerts are transient CPU spikes that self-resolve within a minute, and they have started ignoring notifications, which caused a genuine outage to go unnoticed for 20 minutes. Which action should the team take FIRST to reduce alert fatigue while preserving detection of real incidents?

Accepted Answer

Configure alerts to trigger only when a metric breaches its threshold continuously for a defined evaluation period (e.g., sustained for 5 minutes) rather than on a single data point

Answer

Increase the CPU threshold to 100% so that no alerts fire until the instance is completely saturated

Answer

Route all monitoring alerts directly to an archived email folder and review them weekly during the operations meeting

Answer

Disable CPU monitoring entirely and rely on customer-reported tickets to detect performance problems

Question 3

A cloud operations team monitors a customer-facing API whose traffic varies significantly by time of day and day of week. Static threshold alerts on request latency generate misses during low-traffic periods (real spikes go unnoticed) and false alarms during known peak hours. Which monitoring approach best improves alert accuracy across these varying traffic patterns?

Accepted Answer

Enable anomaly-detection (dynamic baseline) alerting that learns normal patterns over time and alerts on statistically significant deviations

Answer

Raise the static latency threshold to a higher fixed value so peak-hour traffic no longer triggers alerts

Answer

Reduce the alert evaluation period to one minute so alerts fire faster during any latency increase

Answer

Disable latency alerting during peak hours and rely on manual dashboard checks instead

Question 4

A mobile app backend runs behind a managed API gateway. During a marketing promotion, users report intermittent failures. The application logs show a burst of HTTP 429 responses returned by the gateway itself, while backend service CPU, memory, and latency metrics all remain well within normal ranges. What is the MOST likely root cause?

Accepted Answer

The API gateway's configured rate/throttling limit is being exceeded by the surge in request volume

Answer

The backend instances are overloaded and rejecting new connections

Answer

TLS certificates on the gateway have expired, blocking client requests

Answer

A misconfigured DNS record is directing traffic to the wrong endpoint

Question 5

After deploying a new stateful firewall appliance in front of a two-subnet application tier, users report that some TCP connections to the web servers hang and eventually time out, while others succeed. Packet captures on the web servers show inbound SYN packets arriving and the servers sending SYN-ACK responses, but the clients never receive them. The firewall logs show the SYN packets passing through, but no matching entry for the return SYN-ACK traffic. What is the MOST likely root cause?

Accepted Answer

Return traffic is taking a different path than the inbound traffic, so the stateful firewall drops the SYN-ACK because it has no matching session state (asymmetric routing)

Answer

The web servers are configured with an MTU value larger than the firewall supports, causing fragmentation of the SYN-ACK packets

Answer

The TLS certificate on the web servers has expired, preventing the handshake from completing

Answer

The firewall's connection table is exhausted, dropping all new inbound SYN packets

Question 6

A financial services company must retain cloud audit logs for seven years to satisfy regulatory requirements. During a recent compliance audit, investigators raised concerns that a privileged administrator could tamper with or delete logs to hide malicious activity. Which control best ensures the integrity and non-repudiation of the retained audit logs?

Accepted Answer

Write logs to an object storage bucket configured with write-once-read-many (WORM) object lock in compliance mode

Answer

Enable server-side encryption on the log storage bucket using a customer-managed key

Answer

Grant only the security team read-only IAM permissions to the log bucket

Answer

Configure lifecycle policies to transition logs to archival storage after 30 days

Question 7

A retail company runs a stateless web application across an auto scaling group behind a load balancer. During a recent incident, the load balancer continued sending traffic to instances that had crashed at the application layer even though the operating system was still running, resulting in intermittent HTTP 500 errors for customers. The architect wants to ensure that unhealthy instances are automatically detected and replaced without manual intervention. Which design change BEST addresses this requirement?

Accepted Answer

Configure application-layer (HTTP) health checks on the load balancer and set the auto scaling group to use the load balancer's health check to trigger instance replacement

Answer

Increase the minimum instance count in the auto scaling group so more capacity is always available

Answer

Enable TCP-based health checks on the load balancer to verify each instance is reachable on the listening port

Answer

Add a scheduled scaling policy that recycles all instances every 24 hours to clear crashed processes

Question 8

A media company runs a nightly video transcoding pipeline that processes thousands of independent jobs. The work is fault-tolerant and can be restarted if a worker is terminated, and there is no strict deadline as long as jobs complete before morning. The cloud team wants to minimize compute cost for this batch workload while retaining the ability to scale out to hundreds of workers. Which compute purchasing and scaling strategy best fits these requirements?

Accepted Answer

Use an autoscaling group of spot/preemptible instances that scales based on the job queue depth

Answer

Provision a fixed fleet of on-demand instances sized for peak concurrency and leave them running continuously

Answer

Purchase 1-year reserved instances sized for peak concurrency to guarantee availability every night

Answer

Deploy the transcoding logic to a single large dedicated host and process jobs sequentially

Question 9

A cloud operations team must retain daily backups for 7 days, weekly backups for 5 weeks, and monthly backups for 12 months while minimizing storage cost. Backups are currently created manually, which has led to inconsistent retention and growing storage bills. Which approach best automates this requirement?

Accepted Answer

Configure a backup policy with a grandfather-father-son rotation schedule and automated lifecycle rules that expire snapshots according to each tier's retention period

Answer

Create a single scheduled job that takes one snapshot per day and manually delete old snapshots during monthly maintenance windows

Answer

Increase snapshot frequency to hourly and rely on the storage provider to automatically purge the oldest data when the account nears its quota

Answer

Replicate all snapshots to a second region and keep every snapshot indefinitely to guarantee compliance with the retention requirement

Question 10

A financial services company runs nightly automated backups of its production database to a separate cloud region. During a quarterly audit, the compliance team asks for evidence that the backups can actually be used to recover the system within the documented RTO. The operations team confirms backup jobs complete successfully every night with no errors. What is the MOST important additional action the operations team should take to satisfy the auditor and reduce recovery risk?

Accepted Answer

Periodically perform test restores of the backups into an isolated environment and document the results

Answer

Increase backup frequency from nightly to hourly to reduce potential data loss

Answer

Enable additional cross-region replication of the backup files for redundancy

Answer

Extend the backup retention period to meet long-term compliance requirements

Question 11

A company performs a full backup of a 5 TB file server every night to cloud object storage, retaining 30 days of history. The daily data change rate is only about 2%. The cloud storage bill for backups has grown to an unsustainable level, and the backup window is beginning to exceed the overnight maintenance period. Which change will MOST effectively reduce both storage consumption and backup duration while preserving the 30-day recovery capability?

Accepted Answer

Switch to a synthetic full plus incremental-forever strategy, backing up only changed blocks after the initial full

Answer

Reduce the retention period from 30 days to 7 days to lower stored data volume

Answer

Compress each nightly full backup before uploading it to object storage

Answer

Move the nightly full backups to a colder archival storage tier immediately after upload

Question 12

A database administrator is migrating a transactional (OLTP) PostgreSQL database to a cloud IaaS virtual machine. The workload generates a high volume of small, random read/write operations and requires consistent sub-millisecond latency to meet application SLAs. The team must select the appropriate storage design for the database data volume. Which storage choice BEST meets these requirements?

Accepted Answer

Provisioned IOPS SSD block storage attached to the VM

Answer

Object storage accessed over an HTTP/REST API

Answer

A general-purpose network file share (NFS) mounted on the VM

Answer

Throughput-optimized HDD block storage attached to the VM

Question 13

A cloud engineer must deploy a new version of a customer-facing web application with zero downtime. Requirements state that the new version must be fully tested in a production-identical environment before receiving live traffic, and that traffic must be able to revert instantly to the previous version if post-deployment validation fails. Which deployment strategy BEST meets these requirements?

Accepted Answer

Blue-green deployment, standing up the new version on a parallel environment and switching the load balancer once validation passes

Answer

Rolling deployment, replacing instances in the existing environment in small batches

Answer

In-place deployment, updating the application binaries on the running production servers

Answer

Canary deployment, gradually shifting a small percentage of live users to the new version over several hours

Question 14

A financial services company must retain full control over the cryptographic key material used to encrypt data stored in a cloud provider's managed key service, per regulatory requirements. Auditors require that the company generate the key material on-premises and be able to revoke the provider's ability to use it at any time. Which approach best meets these requirements?

Accepted Answer

Use Bring Your Own Key (BYOK) to import externally generated key material into the cloud KMS, retaining the original copy on-premises for re-import or revocation

Answer

Enable automatic key rotation on a provider-managed key and store the rotation schedule in a compliance document

Answer

Use the provider's default service-managed encryption keys and rely on the shared responsibility model for compliance

Answer

Encrypt data client-side with a symmetric key and disable server-side encryption on the storage service entirely

Question 15

A DevOps team wants to reduce deployment risk for a high-traffic web service. They release a new version to only 5% of production traffic, monitor error rates and latency, and gradually increase the percentage to 100% if metrics remain healthy. If problems appear, they roll back the small exposed portion. Which deployment strategy is this team using?

Accepted Answer

Canary deployment

Answer

Blue-green deployment

Answer

Recreate (big-bang) deployment

Answer

Rolling deployment across all nodes at once

Question 16

A retail company runs its e-commerce platform on cloud VMs. Historical data shows normal traffic requires 20 VMs, but during a 6-week holiday season demand triples and remains sustained at that level for the entire period with little day-to-day variability. The finance team wants to minimize compute cost while guaranteeing capacity is available throughout the peak. Which capacity planning approach best meets these requirements?

Accepted Answer

Purchase reserved instances for the baseline 20 VMs year-round and use short-term/on-demand or seasonal reserved capacity to cover the additional sustained holiday load

Answer

Provision all 60 VMs as reserved instances on a 3-year commitment to guarantee the peak is always covered

Answer

Rely entirely on spot instances during the holiday season to obtain the lowest possible price for the extra capacity

Answer

Keep 20 on-demand VMs running and manually add on-demand VMs only when CPU utilization exceeds 90 percent during peak

Question 17

A media company hosts a video streaming website on a single region's object storage bucket fronted by a web server. Users in Europe and Asia complain of slow load times and buffering for static assets (images, thumbnails, and pre-recorded video segments), while North American users report acceptable performance. The company wants to reduce latency for global users with minimal changes to its origin infrastructure and predictable cost. Which design change should the architect implement?

Accepted Answer

Deploy a content delivery network (CDN) with edge locations that cache static assets closer to end users

Answer

Migrate the object storage bucket to a larger storage tier with higher provisioned IOPS

Answer

Add a second web server behind a regional load balancer in the existing region

Answer

Configure DNS round-robin across two additional origin servers in the same region

Question 18

A media startup hosts a growing library of on-demand training videos in a single-region object storage bucket. Users worldwide report inconsistent buffering, and the company's monthly egress costs from the storage service have risen sharply as viewership expands. The architecture team must reduce global latency while lowering repeat data-transfer charges from origin storage. Which design change BEST meets both goals?

Accepted Answer

Enable a content delivery network (CDN) in front of the object storage origin to cache video files at edge locations closest to viewers

Answer

Migrate the videos to block storage volumes attached to compute instances in each region

Answer

Move the bucket to a lower-cost archival storage tier to reduce per-gigabyte storage pricing

Answer

Replicate the object storage bucket to every region and update each viewer to pull from the nearest bucket manually

Question 19

A cloud team manages dozens of public-facing services, each fronted by a TLS certificate that must be renewed annually. Last quarter, an expired certificate caused a customer-facing outage because no one noticed the renewal deadline. The team wants a durable solution that prevents recurrence while minimizing manual effort. Which approach BEST addresses the root cause?

Accepted Answer

Adopt a managed certificate service that automatically provisions and renews certificates before expiration, integrated with the load balancers

Answer

Extend all certificate validity periods to the maximum allowed and set a shared calendar reminder for renewals

Answer

Configure a monitoring alert that emails the team when a certificate has already expired

Answer

Store all certificates in a centralized secrets vault and document a manual renewal runbook

Question 20

A DevOps team builds an application artifact in their CI pipeline, deploys it to a staging environment for QA testing, and then rebuilds the artifact from the same source branch before deploying to production. QA-approved builds occasionally behave differently in production. Which change to the pipeline BEST resolves this inconsistency?

Accepted Answer

Build the artifact once, assign it an immutable version, and promote that same versioned artifact through staging to production

Answer

Add more automated unit tests to the production build stage to catch differences earlier

Answer

Deploy directly from the source branch to production and skip the staging environment

Answer

Rebuild the artifact in each environment but pin the compiler and dependency versions

Question 21

A development team practicing continuous delivery is struggling with long-lived feature branches that cause painful merge conflicts and delay integration by weeks. Leadership wants developers to integrate their code into the main line at least daily while still being able to hide incomplete functionality from end users in production. Which combination of practices best achieves this goal?

Accepted Answer

Adopt trunk-based development with frequent small commits to the main branch, using feature flags to keep unfinished functionality dormant in production

Answer

Continue using long-lived feature branches but require a mandatory two-week integration freeze before each release

Answer

Create a separate release branch per developer and merge all of them only at the end of the quarter

Answer

Disable automated builds until all feature branches are fully complete to avoid triggering broken pipelines

Question 22

A cloud engineering team has a CI/CD pipeline that automatically builds, tests, and deploys code to production whenever a merge to the main branch occurs. After a recent incident where an untested schema change reached production, leadership requires that changes to the production environment receive human sign-off while keeping all lower-environment deployments fully automated. Which change to the pipeline BEST satisfies this requirement?

Accepted Answer

Add a manual approval gate stage before the production deployment stage while leaving earlier stages automated

Answer

Disable the entire pipeline and require all deployments to be performed manually by an operator

Answer

Increase the number of automated integration tests so no human review is needed

Answer

Switch from trunk-based development to long-lived feature branches to slow down merges

Question 23

A DevOps team's CI/CD pipeline runs sequentially: it compiles code, then runs unit tests, then runs a set of independent integration test suites (database, API, and messaging), and finally packages the artifact. Total pipeline time has grown to 45 minutes, and developers complain about slow feedback. Analysis shows the three integration test suites do not depend on one another and collectively account for 25 minutes of runtime. Which change would MOST effectively reduce total pipeline duration without sacrificing test coverage?

Accepted Answer

Configure the three independent integration test suites to run as parallel jobs in the same stage

Answer

Remove the integration tests and rely solely on unit tests for faster feedback

Answer

Increase the pipeline runner's timeout value so builds are not marked as failed

Answer

Move all integration testing to a nightly scheduled pipeline instead of on each commit

Question 24

A development team currently runs security scans only after code is deployed to a staging environment, which frequently discovers vulnerabilities late and forces costly rework. The security team wants to catch coding flaws such as SQL injection and insecure functions as early as possible in the CI/CD pipeline, ideally before the application is even built. Which practice should the team implement to best achieve this goal?

Accepted Answer

Add a static application security testing (SAST) stage that analyzes source code on every commit before the build stage

Answer

Schedule a dynamic application security testing (DAST) scan against the running staging application each night

Answer

Perform a manual penetration test on the production environment once per release cycle

Answer

Enable runtime application self-protection (RASP) agents on the production servers

Question 25

A DevOps team's CI/CD pipeline runs the following stages in order: build, unit tests, container image scan, integration tests, and deploy to staging. Developers complain that they wait more than 30 minutes for feedback on syntax and logic errors because the slower integration tests run before failures in simpler checks surface. Which change to the pipeline best improves the speed of feedback for the most common defects while preserving overall quality gates?

Accepted Answer

Reorder the pipeline so that fast-running unit tests and static checks execute early and fail the pipeline immediately, before the slower integration tests

Answer

Remove the integration test stage entirely and rely on manual testing in the staging environment

Answer

Increase the pipeline runner's CPU and memory so all stages complete faster

Answer

Run all stages in parallel regardless of their dependencies to reduce total pipeline duration

Question 26

A DevOps team pushes a new application version through their CI/CD pipeline to production. Minutes after deployment completes, monitoring shows a spike in HTTP 500 errors caused by a defect that passed automated tests. The team needs the fastest, most reliable way to restore service while they investigate. Which capability should the pipeline provide to meet this need?

Accepted Answer

An automated rollback mechanism that redeploys the last known-good immutable artifact from the registry

Answer

A manual hotfix branch that developers patch and rebuild directly on the production servers

Answer

Increased logging verbosity on the production nodes to capture more diagnostic detail

Answer

A scheduled nightly rebuild of the environment to overwrite the faulty release

Question 27

Users of a newly deployed application server are intermittently unable to authenticate against the corporate identity provider using OIDC tokens. The error logs on the application server show 'token used before issued' and 'token expired' messages even for freshly issued tokens. Other application servers behind the same load balancer authenticate successfully. Following a structured troubleshooting methodology, what should the administrator investigate FIRST on the failing server?

Accepted Answer

The system clock and NTP synchronization status on the affected application server

Answer

The TLS certificate chain presented by the identity provider endpoint

Answer

The security group rules controlling outbound traffic to the identity provider

Answer

The client secret configured in the application's OIDC settings

Question 28

A financial services company must store the root encryption keys for its payment processing platform in the cloud. Regulatory auditors require that the keys never leave a FIPS 140-2 Level 3 validated hardware boundary and that the cloud provider itself has no ability to access or export the key material. Which key management approach should the cloud engineer implement?

Accepted Answer

Use a dedicated cloud HSM (single-tenant hardware security module) that provides FIPS 140-2 Level 3 validation and customer-controlled key material with no provider access

Answer

Use the provider's standard multi-tenant KMS with provider-managed keys and enable automatic rotation

Answer

Store the keys in a secrets manager encrypted with a customer-managed KMS key and restrict access with IAM policies

Answer

Encrypt the keys with a passphrase and store them in an object storage bucket with server-side encryption enabled

Question 29

During a compliance audit, a security engineer discovers that an object storage bucket containing customer PII is accessible to anyone on the internet because its access control policy grants read permissions to all principals. The organization must remain compliant with data protection regulations while keeping the data available to an internal analytics application running in the same cloud account. Which action BEST remediates the exposure while preserving required functionality?

Accepted Answer

Remove the public access grant and apply a bucket policy that allows access only to the analytics application's IAM role, while enabling account-level public access blocking

Answer

Enable default server-side encryption on the bucket and leave the existing access policy unchanged

Answer

Move the bucket to a private subnet and attach a network security group that denies inbound internet traffic

Answer

Enable object versioning and access logging so that any unauthorized reads can be investigated after the fact

Question 30

A security team discovers that after a single compromised application server in the web tier, an attacker was able to reach and pivot to database servers, internal APIs, and a logging service — all within the same subnet. The workloads all reside in one flat network segment. The team wants to limit the blast radius of any future compromise so that a breached workload cannot freely communicate with unrelated workloads. Which approach BEST addresses this requirement?

Accepted Answer

Implement microsegmentation with identity- or workload-based policies that permit only explicitly required flows between individual workloads

Answer

Enable full-disk encryption on all workloads in the segment to protect data during a breach

Answer

Deploy a single perimeter firewall at the VPC edge to inspect all inbound internet traffic

Answer

Enforce multi-factor authentication for all administrators who log in to the servers

Question 31

A cloud operations team monitors a fleet of Linux virtual machines running a memory-intensive analytics application. The provider's default monitoring dashboard shows CPU, disk, and network metrics, but the team keeps missing out-of-memory crashes because memory usage is not visible. What is the MOST appropriate way to gain visibility into memory consumption?

Accepted Answer

Install a monitoring agent on each instance to collect and publish memory utilization as a custom metric

Answer

Increase the sampling frequency of the existing default CPU and disk metrics

Answer

Enable the provider's flow logs to capture memory pressure events from the hypervisor

Answer

Resize the instances to a larger memory tier so out-of-memory crashes stop occurring

Question 32

A cloud operations team manages 300 Linux servers across multiple environments. Over time, engineers have manually applied hotfixes, causing inconsistent package versions and service configurations. The team wants a solution that continuously enforces a defined desired state, automatically correcting any manual changes on the servers without requiring the servers to be rebuilt. Which approach best meets this requirement?

Accepted Answer

Deploy a configuration management tool that periodically applies declarative manifests and remediates drift on existing servers

Answer

Rebuild all servers from a golden image whenever a configuration inconsistency is detected

Answer

Add a manual peer-review checklist to the change management process before engineers apply hotfixes

Answer

Enable verbose logging on each server so administrators can audit configuration changes after they occur

Question 33

A DevOps team deploys containerized microservices to a managed Kubernetes cluster. During a recent security review, auditors discovered that several running containers were built from base images containing known critical CVEs. The team wants to prevent vulnerable images from ever reaching production while minimizing manual effort. Which control BEST addresses this requirement?

Accepted Answer

Integrate automated image vulnerability scanning into the CI/CD pipeline and configure the registry to block images that fail policy thresholds

Answer

Enable network segmentation between namespaces so compromised containers cannot reach other workloads

Answer

Require MFA for all developers pushing images to the container registry

Answer

Deploy a runtime intrusion detection agent to each node to alert on suspicious container behavior

Question 34

A cloud engineer notices that a containerized microservice on a Kubernetes cluster repeatedly restarts under load. Reviewing the pod, the engineer sees the container's last state shows 'Reason: OOMKilled' with 'Exit Code: 137'. CPU utilization remains low, and node-level memory has ample free capacity. What is the MOST likely cause of the restarts?

Accepted Answer

The container exceeded its configured memory limit and was terminated by the kernel's out-of-memory killer

Answer

The node ran completely out of physical memory, triggering a cluster-wide eviction

Answer

The liveness probe timed out because CPU throttling delayed health check responses

Answer

The container image pull failed intermittently, causing the pod to crash-loop

Question 35

A DevOps team is migrating a PostgreSQL database into a Kubernetes cluster running on managed cloud infrastructure. The database must retain its data even if the pod is rescheduled to a different worker node after a failure. Which architectural approach should the team implement to meet this requirement?

Accepted Answer

Deploy the database using a StatefulSet backed by a PersistentVolume provisioned from network-attached block storage

Answer

Store the database files on the container's local ephemeral filesystem to maximize I/O performance

Answer

Run the database as a Deployment with multiple replicas sharing the node's temporary emptyDir volume

Answer

Bake the current database contents into the container image and redeploy the image on each node change

Question 36

A DevOps team is deploying a containerized microservice across development, staging, and production environments. During validation they discover that the image tested in staging is not byte-for-byte identical to the image running in production, because the CI pipeline rebuilds the image from source at each environment stage. This has caused a defect that passed staging to surface only in production. Which change to the deployment workflow BEST prevents this inconsistency?

Accepted Answer

Build the image once, push it to a container registry with an immutable tag or digest, and promote that same artifact through each environment

Answer

Add more automated integration tests to the staging build so defects are caught before the production rebuild

Answer

Configure each environment to always pull the 'latest' tag from the registry to ensure the newest code is deployed

Answer

Increase the compute resources in staging so it more closely matches the production runtime environment

Question 37

A security review of a Kubernetes production cluster finds that several application containers run as the root user and can write to the host filesystem through mounted volumes. A recent penetration test showed that a compromised container could escalate to the underlying node. Which control should the security team prioritize to reduce the impact of a container compromise?

Accepted Answer

Apply a Pod Security policy that enforces runAsNonRoot, a read-only root filesystem, and dropped Linux capabilities

Answer

Enable network policies to restrict east-west traffic between pods in the namespace

Answer

Rotate the container registry credentials and enforce image signing on all deployments

Answer

Increase the CPU and memory resource limits on the affected pods to prevent resource exhaustion

Question 38

A single-page web application hosted on a static object storage bucket makes JavaScript fetch calls to a REST API on a different domain. Users report that the page loads correctly, but the data never appears. The browser developer console shows the API requests failing with a message indicating the response was blocked by the same-origin policy, while direct calls to the API using a command-line HTTP client return valid JSON with a 200 status. What is the MOST likely root cause?

Accepted Answer

The API is missing the appropriate Access-Control-Allow-Origin response header for cross-origin requests

Answer

The API's TLS certificate has expired, causing the browser to reject the response

Answer

The object storage bucket's DNS record has not fully propagated to all resolvers

Answer

The API server's connection pool is exhausted, dropping the browser's requests

Question 39

A cloud operations team receives the monthly bill and discovers that spend increased 40% over the prior month. Most of the increase comes from resources that carry no cost-allocation tags, so finance cannot attribute the charges to any team or project. The team wants to detect and investigate cost spikes as they happen rather than at month-end. Which action provides the FASTEST ongoing visibility into unexpected cost increases?

Accepted Answer

Configure a cloud cost anomaly detection service with budget alerts that notify the team when daily spend deviates from the expected baseline

Answer

Wait for the next monthly invoice and perform a manual line-item review to identify the source of the charges

Answer

Purchase reserved instances for all running compute to reduce the overall bill going forward

Answer

Enable detailed billing exports to object storage and query them quarterly for reporting

Question 40

A company runs a production database server on a public cloud that must operate 24/7 with predictable, steady CPU and memory usage. The workload has run consistently for over a year and is expected to continue unchanged for at least three more years. Finance wants the lowest possible compute cost for this always-on resource without sacrificing availability or accepting the risk of interruption. Which purchasing model should the architect recommend?

Accepted Answer

Purchase a three-year reserved instance commitment for the database server

Answer

Run the database on spot instances to minimize the hourly rate

Answer

Keep the server on standard on-demand pricing for maximum flexibility

Answer

Deploy the database as a serverless function invoked per query

Question 41

A production application VM on a shared-tenancy public cloud instance is experiencing intermittent performance degradation. The guest OS reports low CPU utilization (around 30%), yet application response times are slow and requests occasionally time out. When you review the hypervisor-level metrics, you notice a consistently high 'CPU steal time' value. What is the MOST likely cause of the degradation?

Accepted Answer

The physical host is oversubscribed and the hypervisor is delaying CPU cycles to this VM while servicing other co-located tenants

Answer

The application has a memory leak that is triggering excessive garbage collection

Answer

The VM's network security group is dropping return traffic, causing retransmissions

Answer

The attached block volume has exceeded its provisioned IOPS limit and is throttling disk reads

Question 42

A company acquires a partner organization that uses a separate cloud provider account. Developers from the partner need occasional read-only access to a set of resources in the company's account. Security policy prohibits creating long-lived credentials or sharing account root access. Which approach best satisfies these requirements?

Accepted Answer

Configure cross-account role assumption with a trust policy, allowing partner identities to assume a scoped read-only role that issues temporary credentials

Answer

Create individual IAM users in the company account for each partner developer and distribute long-lived access keys

Answer

Share the company account's root user credentials with the partner's security team for controlled distribution

Answer

Embed a static API key with read-only permissions into the partner's application configuration files

Question 43

A media company stores large volumes of user-uploaded assets in a single-region object storage bucket. Leadership requires that the assets remain accessible for read operations even if an entire cloud region becomes unavailable, and they want a solution that requires minimal ongoing operational effort. Which design approach best meets these requirements?

Accepted Answer

Enable cross-region replication so objects are automatically copied to a bucket in a second region

Answer

Enable object versioning on the existing single-region bucket to retain multiple copies of each asset

Answer

Schedule a nightly script that downloads the bucket contents and uploads them to on-premises storage

Answer

Move the bucket to a lower-cost archival storage tier to reduce the risk of data loss

Question 44

A healthcare company stores patient records in a cloud provider's managed object storage. Compliance auditors require that even the cloud provider's own administrators and support staff be technically incapable of decrypting the data, and the company must retain full control over the encryption keys within their on-premises facility. Which approach best satisfies this requirement?

Accepted Answer

Encrypt the data client-side before upload using keys stored and controlled entirely in the company's on-premises key management system

Answer

Enable server-side encryption using provider-managed keys (SSE) and rely on the provider's access controls

Answer

Use the provider's default encryption at rest and restrict bucket policies to the company's IAM roles only

Answer

Enable customer-managed keys (CMK) in the provider's key management service with automatic rotation

Question 45

A financial services company stores sensitive customer records in a cloud object storage bucket. A new compliance mandate requires that the organization retain full control over the encryption keys, be able to revoke access to all encrypted data instantly, and enforce automatic annual key rotation. The security team wants to minimize operational overhead while meeting these requirements. Which approach BEST satisfies the mandate?

Accepted Answer

Use customer-managed keys (CMK) in the cloud key management service with rotation enabled and envelope encryption

Answer

Enable server-side encryption using provider-managed keys (SSE with the cloud provider's default key)

Answer

Encrypt files client-side with a static symmetric key stored in the application configuration file

Answer

Rely on TLS encryption in transit and enable bucket versioning for data protection

Question 46

A cloud operations engineer configures a monitoring dashboard for a customer-facing API. The dashboard displays CPU utilization aggregated as a 5-minute average and shows steady values around 45%. However, users report intermittent timeouts, and support tickets indicate slow responses during brief periods. The underlying compute instances autoscale on CPU, but scaling rarely triggers. What is the MOST likely reason the dashboard fails to reveal the problem, and what should the engineer change?

Accepted Answer

The average aggregation smooths out short-lived spikes; the engineer should add a maximum (or high-percentile) aggregation over a shorter period to expose transient saturation.

Answer

The metric collection interval is too short; the engineer should increase it to 15 minutes so trends are clearer.

Answer

CPU is the wrong metric entirely; the engineer should replace it with total request count only.

Answer

The dashboard time zone is misconfigured; the engineer should align it to UTC to match the incident reports.

Question 47

A DevSecOps team already runs static code analysis and dependency scanning early in their CI/CD pipeline. However, a recent penetration test found authentication bypass and session-handling flaws that only manifest when the application is actually running. Which additional automated testing stage should the team add to catch these runtime vulnerabilities before production release?

Accepted Answer

Dynamic application security testing (DAST) against a deployed test instance

Answer

Additional static application security testing (SAST) rules on the source code

Answer

Software composition analysis (SCA) on third-party libraries

Answer

Infrastructure-as-code static analysis on the deployment templates

Question 48

A financial services company stores customer records across multiple cloud object storage buckets and databases. Auditors found that sensitive PII was being copied into buckets intended for non-sensitive analytics data, and no controls prevented this. The security team wants an automated, scalable way to identify sensitive data as it lands and enforce handling rules that block or quarantine misplaced PII. Which approach best addresses this requirement?

Accepted Answer

Deploy a Data Loss Prevention (DLP) service that automatically discovers and classifies data, then enforces policies to block or quarantine PII in unauthorized locations

Answer

Enable server-side encryption with customer-managed keys on all buckets and databases to protect the sensitive data

Answer

Restrict access to all analytics buckets using IAM policies that grant read-only permissions to the analytics team

Answer

Configure lifecycle rules to move all objects older than 30 days into an archival storage tier for long-term retention

Question 49

A financial services company runs a microservices application across multiple nodes in a Kubernetes cluster. A recent audit found that traffic between internal services travels unencrypted over the pod network, violating a regulatory requirement that all data in transit be encrypted regardless of network location. The security team needs to enforce encryption for all service-to-service communication with minimal changes to application code. Which solution best meets this requirement?

Accepted Answer

Deploy a service mesh that enforces mutual TLS (mTLS) between all service endpoints

Answer

Enable encryption at rest on the persistent volumes used by each service

Answer

Configure network security groups to restrict traffic to known service ports only

Answer

Place a web application firewall in front of the cluster's ingress controller

Question 50

A financial services company stores customer PII in a managed relational database in the cloud. An auditor requires that even the cloud provider's employees cannot decrypt the stored data, and that the encryption keys are fully under the customer's control and can be revoked instantly to render the data inaccessible. Which approach best satisfies these requirements?

Accepted Answer

Use customer-managed keys (CMK) in the cloud KMS, or bring-your-own-key/external key store, with tightly controlled key policies

Answer

Enable provider-managed default encryption at rest with the provider's own service key

Answer

Enable TLS for all connections to the database and rely on transport encryption

Answer

Store the data in the database and apply full-disk encryption on the underlying host volumes only

Question 51

A company is migrating a 4 TB on-premises production PostgreSQL database to a managed cloud database service. The application must remain available during the migration, and the business will only tolerate a few minutes of downtime during the final cutover. Which data migration approach best meets these requirements?

Accepted Answer

Take a full backup, restore it to the cloud database, then enable continuous replication (change data capture) to keep it in sync until a brief cutover

Answer

Perform a one-time offline export of the database to a dump file, upload it to cloud storage, and import it into the managed service during a scheduled maintenance window

Answer

Set up a VPN tunnel and point the on-premises application directly at the cloud database to avoid any data copy

Answer

Provision a larger instance in the cloud and rely on the managed service's auto-scaling to pull the data over automatically

Question 52

A development team ships a microservice that heavily relies on open-source third-party libraries pulled from public package repositories during the build. Security wants the CI/CD pipeline to automatically flag known vulnerabilities (CVEs) and license risks in these external dependencies before the artifact is promoted. Which tool type should be integrated into the pipeline to meet this requirement?

Accepted Answer

Software composition analysis (SCA) scanning of the dependency manifest

Answer

Dynamic application security testing (DAST) against the running service

Answer

Infrastructure as code static analysis of the deployment templates

Answer

Web application firewall (WAF) rules tuned to OWASP signatures

Question 53

A cloud engineer deploys a new version of a web application behind a load balancer. Immediately after deployment, users report intermittent HTTP 502 errors. The load balancer health checks show all backend instances as healthy, and CPU, memory, and network metrics on the instances are well within normal ranges. Application logs on the instances show requests being served successfully with 200 responses, but the load balancer access logs record a mix of 200 and 502 responses. Following a structured troubleshooting methodology, what is the MOST likely cause of the 502 errors?

Accepted Answer

The backend application's idle keep-alive timeout is shorter than the load balancer's, causing the backend to close connections the load balancer still tries to reuse

Answer

DNS records for the application have not fully propagated, so some users reach an old endpoint

Answer

The backend instances are undersized and exhausting CPU during peak traffic

Answer

The load balancer's TLS certificate has expired, breaking the handshake for some clients

Question 54

After promoting a standby web server to a new public IP, an operations engineer updates the application's DNS A record and confirms the change is correct on the authoritative name server. However, roughly 40% of users continue to reach the old, now-unreachable IP address for over an hour, while the rest connect successfully. Using a structured troubleshooting methodology, what is the MOST likely root cause?

Accepted Answer

The DNS record's TTL was set to a high value, so many resolvers and clients are still serving the cached old IP until it expires.

Answer

The authoritative name server is returning both the old and new IP addresses in a round-robin configuration.

Answer

The new web server's security group is blocking inbound traffic from 40% of the client source IP ranges.

Answer

The load balancer health check is intermittently marking the new server unhealthy, removing it from rotation.

Question 55

A cloud engineer is investigating a reporting application that runs on a VM using a general-purpose (burstable) SSD volume. The application performs well for the first several hours after a reboot, but by mid-afternoon users report the reports take much longer to generate. Metrics show that disk read/write throughput and IOPS drop sharply at the same time each day, while CPU and memory utilization remain normal. What is the MOST likely root cause?

Accepted Answer

The volume has exhausted its accumulated burst credits and is now throttled to its baseline performance level

Answer

The VM's network interface is saturating available bandwidth during peak reporting hours

Answer

The instance is experiencing CPU steal time from a noisy neighbor on the shared host

Answer

The volume's encryption keys are rotating on a daily schedule, temporarily blocking I/O

Question 56

A cloud engineer deploys an analytics application on a fleet of VMs that write intermediate processing results to a locally attached instance store volume. After a routine maintenance event forces several VMs to stop and start, users report that previously completed job results are missing, though the application itself restarts normally. Application and network logs show no errors. What is the MOST likely root cause of the missing data?

Accepted Answer

The instance store is ephemeral, so data written to it is lost when the underlying VM is stopped and restarted on new host hardware.

Answer

The security group rules were reset during the maintenance event, blocking access to the stored results.

Answer

The object storage lifecycle policy expired and permanently deleted the intermediate results.

Answer

The IAM role attached to the VMs lost read permissions to the storage volume after the restart.

Question 57

A cloud engineer is migrating 8 TB of archived research files from an on-premises NAS to a cloud object storage bucket over a dedicated 1 Gbps link. After the transfer job completes, the compliance team requires proof that no files were altered or corrupted during transit before the on-premises copy is decommissioned. Which action should the engineer take to satisfy this requirement?

Accepted Answer

Compare source and destination file checksums (hashes) and confirm they match for every object

Answer

Verify the total object count in the destination bucket matches the source directory count

Answer

Enable versioning on the destination bucket and retain all previous object versions

Answer

Review the transfer tool's completion log to confirm it reported zero failed transfers

Question 58

A gaming company runs a multiplayer platform with active players across North America, Europe, and Asia. Player state (inventory, progress) must be written and read with low latency in each region, and the application requires that writes in any region be acknowledged locally without waiting for a distant primary. The team wants a managed database design that keeps write latency low for all regions simultaneously. Which database design best meets this requirement?

Accepted Answer

Deploy a globally distributed database with multi-region active-active (multi-master) write capability

Answer

Deploy a single-region relational primary with read replicas in each other region

Answer

Deploy a single-region database and place a CDN in front of it to cache writes at the edge

Answer

Deploy a single-region database with a caching layer in each region to accelerate reads and writes

Question 59

A platform team wants to manage their Kubernetes cluster configuration so that the desired state is stored declaratively in a Git repository, and an automated agent continuously compares the live cluster state against the repository, automatically correcting any manual changes made directly to the cluster. Which approach BEST meets these requirements?

Accepted Answer

Implement a GitOps workflow where a controller continuously reconciles cluster state against the Git-defined desired state

Answer

Grant developers kubectl access and require them to document all manual changes in a shared change log

Answer

Schedule a nightly cron job that snapshots the cluster configuration and emails it to the operations team

Answer

Use an imperative deployment script triggered manually whenever a new application version is released

Question 60

After a routine deployment, users intermittently receive HTTP 502 Bad Gateway errors from an application behind a cloud load balancer. The load balancer health checks pass most of the time, backend instances show low CPU and memory, and the application logs show no exceptions. However, the load balancer access logs reveal that failed requests correspond to entries where the backend response time exceeds the load balancer's configured idle/response timeout. Which action is the MOST appropriate next step to resolve the errors?

Accepted Answer

Align the load balancer's backend response/idle timeout with the application's processing time and investigate slow endpoints

Answer

Increase the number of backend instances in the target group to add more capacity

Answer

Enable sticky sessions on the load balancer so requests reach a consistent backend

Answer

Replace the load balancer health check protocol from HTTP to TCP to reduce false negatives

Question 61

A financial services company runs a legacy transaction-processing system in its on-premises data center that must exchange large volumes of sensitive data with new analytics workloads in a public cloud provider. Compliance requires that this traffic never traverse the public internet, and the analytics team reports that batch transfers must complete within a predictable time window each night. The current site-to-site VPN over the internet suffers from variable latency and throughput. Which connectivity option should the cloud architect recommend?

Accepted Answer

Provision a dedicated private connection (e.g., a direct/express interconnect) between the data center and the cloud provider

Answer

Deploy a second internet-based IPsec VPN tunnel and enable equal-cost multipath routing to increase aggregate throughput

Answer

Route the analytics traffic through a public CDN edge location to accelerate the nightly batch transfers

Answer

Place the on-premises system behind a cloud load balancer with a public IP and restrict access using security groups

Question 62

A cloud engineering team stores all infrastructure definitions in a Git repository. Recently, a single engineer pushed a change directly to the main branch that inadvertently opened a security group to the public internet, and the change was applied before anyone noticed. The team wants to prevent unreviewed infrastructure changes from reaching the main branch while preserving an auditable history of who approved each change. Which practice should the team implement?

Accepted Answer

Enable branch protection requiring pull requests with mandatory peer review approval before merging to main

Answer

Increase the frequency of automated drift detection scans against the deployed environment

Answer

Configure the pipeline to automatically roll back any change that triggers a monitoring alert

Answer

Grant all engineers administrator access so changes can be corrected faster after deployment

Question 63

A deployment team provisions dozens of identical application servers each week. Currently, engineers launch a base OS image and then run lengthy configuration scripts on each instance after boot, which sometimes produces servers with slightly different package versions and settings. The team wants to eliminate this post-boot variability and speed up provisioning. Which approach best addresses the requirement?

Accepted Answer

Build a pre-configured golden machine image with all packages and settings baked in, then provision instances directly from that image

Answer

Increase the instance size so the post-boot configuration scripts complete faster and more consistently

Answer

Add a manual verification checklist that engineers complete after each server finishes its configuration scripts

Answer

Schedule the configuration scripts to re-run every night to correct any drift on already-deployed servers

Question 64

A cloud engineer maintains production infrastructure using an infrastructure-as-code tool. Before merging a large refactor of network modules, the team wants to see exactly which resources will be created, modified, or destroyed—without making any actual changes to the live environment. Which step should the engineer run to obtain this preview?

Accepted Answer

Generate an execution plan (dry run) that compares the desired configuration against current state and outputs the proposed changes

Answer

Apply the configuration directly to a production workspace and roll back if the output is unexpected

Answer

Manually inspect the cloud console to compare each resource against the code repository

Answer

Delete the existing state file so the tool rebuilds all resources from scratch

Exam domain	Exam weight	Practice
Cloud Architecture	23%	Practice this topic
Deployment	19%	Practice this topic
Security	19%	Practice this topic
Operations	17%	Practice this topic
Troubleshooting	12%	Practice this topic
DevOps Fundamentals	10%	Practice this topic

CompTIA Cloud+ (CV0-004) (CV0-004) practice exam & study guide

Start studying CV0-004

All CV0-004 study resources

CV0-004 exam domains

Sample CV0-004 questions

Key CV0-004 terms

CV0-004 frequently asked questions

Cloud Architecture (23%)

Deployment (19%)

Security (19%)

Operations (17%)

Troubleshooting (12%)

DevOps Fundamentals (10%)