Free CV0-004 sample questions

Correct answer: PaaS

Correct answer: The company should have encrypted the data at rest.

Correct answer: WAF

Correct answer: A NAS uses a slower protocol than a SAN.

Correct answer: Enabling tracing to detect HTTP response times and codes

Correct answer: Add the instruction USER nonroot.

Correct answer: Implement a CI/CD pipeline stage using Trivy to scan images and configure a Kubernetes validating admission webhook with Open Policy Agent (OPA) to enforce the policy.

This is the most comprehensive and automated solution. The CI/CD pipeline integration with Trivy provides 'shift-left' security by catching vulnerabilities early. The validating admission webhook with OPA acts as a final gatekeeper, enforcing the policy at the cluster level before any pod is created. This combination ensures that no container with critical vulnerabilities can run, regardless of how it was deployed, providing a robust defense-in-depth security posture.

Correct answer: Implementing distributed tracing using OpenTelemetry.

Distributed tracing is specifically designed to track the entire lifecycle of a request as it travels through a distributed system. By instrumenting applications with a framework like OpenTelemetry, each request is assigned a unique trace ID, and each service call generates a span. This allows SREs to visualize the full request path, identify which service calls are contributing the most latency, and diagnose errors that occur deep within the call stack. While logging and metrics are crucial parts of observability, only distributed tracing provides the end-to-end visibility needed to effectively troubleshoot performance in a complex, multi-service environment.

Correct answer: Use AWS Backup to schedule daily snapshots of the EBS volume and transition them to Amazon S3 Glacier Deep Archive after 30 days.

This solution is the most cost-effective and operationally efficient. AWS Backup provides a centralized, automated way to manage backups across AWS services, meeting the 24-hour RPO with daily snapshots. EBS Snapshots allow for recovery within the 8-hour RTO. Transitioning the snapshots to S3 Glacier Deep Archive, the lowest-cost storage class, after a short period satisfies the 7-year retention requirement in the most economical way.

Correct answers: Establish a SAML 2.0 identity federation between the on-premises Active Directory Federation Services (AD FS) and both cloud providers.; Create IAM roles in AWS and custom roles in Azure that are mapped to Active Directory security groups.

SAML 2.0 federation is the standard protocol for enabling single sign-on (SSO) and passing authentication information from a central identity provider (like AD FS) to service providers (like AWS and Azure). This allows users to authenticate once against their on-premises Active Directory and gain access to resources in both clouds without separate credentials.

After establishing federation, the next step is to implement RBAC. This is done by creating roles in each cloud provider that define specific permissions. These roles are then mapped to security groups in the on-premises Active Directory. When a user authenticates, their group memberships are passed in the SAML assertion, allowing them to assume the corresponding role and its permissions in AWS or Azure.