CertArea
All CompTIA exams

Free CV0-004 practice test: 30 questions with answers

30 original questions for CompTIA Cloud+, drawn from every topic area. Answer each one to see whether you got it right and why. No sign-up.

Free questions
30
Full bank
100 questions
Real exam
Maximum of 90 questions, 90 min
Passing score
750 (scale 100-900)

CV0-004 exam guide: topics, cost and format

All 30 CV0-004 questions with answers

The same questions as the test above, grouped by exam topic. Open any question to see the answer and explanation.

Operations and support (7 questions)

  1. Question 1

    A monitoring system shows that a database server's disk usage is growing about 5 percent each day. What should the cloud administrator do first?

    1. AReboot the database server every night during the maintenance window to free disk space
    2. BCreate an alert threshold and project when capacity will be exhausted, then plan expansion or cleanup
    3. CDelete the database logs immediately without checking their retention needs first
    4. DLeave the alert unacknowledged and ignore the growth trend until the disk reaches full capacity and writes fail
    Show answer and explanation
    Correct answer: B

    Trend-based alerting gives lead time to expand capacity or clean up data deliberately. Waiting until the disk is full causes an outage, and deleting logs or rebooting without analysis may remove needed data or do nothing lasting.

  2. Question 2

    Backups of a production database must be restorable to a point in time within the last 14 days, and they must be tested regularly. Which practice meets this requirement?

    1. AStore backups on the same disk as the production database, in the same volume, so restores are fast and simple
    2. BKeep one backup copy taken on the day the database was created and retain it indefinitely as the recovery point
    3. CEnable point-in-time recovery with a 14-day retention window and run scheduled restore tests
    4. DBack up the database once a year to archival storage with snapshots kept for twelve months in the same account
    Show answer and explanation
    Correct answer: C

    Point-in-time recovery with matching retention meets the restore window, and scheduled restore tests verify the backups actually work. A single old copy, annual backups, and co-located storage do not meet the requirement.

  3. Question 3

    A company wants to reduce the cost of a batch workload that runs for four hours each night and can be interrupted and resumed. Which pricing option is most suitable?

    1. AOn-demand capacity billed per second, with no checkpointing configured
    2. BReserved capacity for 24 hours of use each day under a one-year term
    3. CDiscounted spot or preemptible capacity with checkpointing so the job can resume
    4. DA dedicated bare-metal physical server billed at a fixed monthly fee
    Show answer and explanation
    Correct answer: C

    Interruptible jobs with checkpoints can use discounted spot or preemptible capacity safely. Reserved and dedicated options charge for idle hours, and on-demand capacity costs more without any benefit for an interruptible job.

  4. Question 4

    Operations staff want to see whether a service meets its availability target each month. Which measure should they track?

    1. AUptime percentage calculated from monitored availability over the reporting period
    2. BThe number of support emails escalated to tier-two engineers each week
    3. CThe number of physical servers racked and powered in the primary data center hall
    4. DThe total size of the application log files stored on local disks
    Show answer and explanation
    Correct answer: A

    Availability is measured as the percentage of time the service is usable against the target. Email volume, server counts, and log size do not measure availability.

  5. Question 5

    Which two items should be included in a change management record for a production cloud change? (Choose two.)

    1. AA list of unrelated tickets closed last month
    2. BA rollback plan describing how to revert the change if it fails
    3. CThe name of the person's favorite coffee shop
    4. DApproval from the designated change authority
    5. EThe color of the server rack
    Show answer and explanation
    Correct answer: B, D

    A rollback plan and documented approval are core elements of change control because they enable recovery and accountability. The other items do not affect risk or authorization of the change.

  6. Question 6

    A team reviews a cloud bill and finds a large spike caused by an unused load balancer. Which practice would have caught this earlier?

    1. AIgnoring line items on bills under a fixed threshold amount treated as minor costs
    2. BPaying the monthly invoice in full without a review by resource owners
    3. CDeleting the cost allocation tags from every resource across production so reports are simpler to read
    4. DBudget alerts and regular cost reports grouped by tags and reviewed by resource owners
    Show answer and explanation
    Correct answer: D

    Budget alerts and tag-based cost reports show spend by owner and flag unexpected increases early. Ignoring small bills, skipping review, and removing tags all hide the cause.

  7. Question 7

    A business states that it can tolerate losing no more than 15 minutes of transaction data, but service must be restored within 4 hours after an outage. Which pair of terms matches these requirements?

    1. AMTBF of 15 minutes and MTTR of 4 hours
    2. BRTO of 15 minutes and RPO of 4 hours
    3. CSLA of 15 minutes and SLO of 4 hours
    4. DRPO of 15 minutes and RTO of 4 hours
    Show answer and explanation
    Correct answer: D

    Recovery point objective limits acceptable data loss, and recovery time objective limits downtime. MTBF and MTTR describe reliability statistics, and SLA and SLO describe service commitments rather than recovery targets.

Cloud architecture (7 questions)

  1. Question 8

    A company runs a web application that must survive the failure of one data center within the same region. Which design meets this need with the least change to the application?

    1. ADeploy a second copy in a different cloud region with manual failover
    2. BDeploy instances across two availability zones behind a load balancer
    3. CIncrease the size of the single virtual machine
    4. DMove the database to a single larger server in the same zone
    Show answer and explanation
    Correct answer: B

    Spreading instances across availability zones within a region tolerates a single facility failure, and a load balancer distributes traffic between them. A larger single VM or single zone remains a single point of failure, and a manual cross-region failover is slower than the requirement implies.

  2. Question 9

    A development team needs an environment that can be created and destroyed quickly for each feature branch, with consistent configuration. Which approach best fits?

    1. AOne long-lived shared environment reused by several teams, updated by hand over time
    2. BInfrastructure as code templates applied by a pipeline for each branch
    3. CConfiguring each environment by hand in the portal, copying settings from notes
    4. DManually cloning a virtual machine from the production server's live disk image
    Show answer and explanation
    Correct answer: B

    Templates applied by a pipeline make environments repeatable and disposable. Cloning production copies unneeded data and drift, and shared or hand-built environments are slow to create and inconsistent.

  3. Question 10

    Which cloud deployment model gives a single organization exclusive use of the infrastructure, which may be hosted by a third party?

    1. APrivate cloud
    2. BCommunity cloud
    3. CPublic cloud
    4. DMultitenant SaaS
    Show answer and explanation
    Correct answer: A

    A private cloud serves one organization, whether hosted on premises or by a provider. Public clouds are shared among many customers, community clouds serve a group with shared concerns, and SaaS is a service model rather than a deployment model.

  4. Question 11

    A company wants to scale its web tier automatically when CPU usage stays above 70 percent for several minutes. Which feature provides this?

    1. AAn auto-scaling group with a scaling policy tied to a CPU metric
    2. BA larger instance type chosen once during initial provisioning
    3. CA DNS record with a long time-to-live value cached by recursive resolvers
    4. DA static private IP address assigned to each server's network interface
    Show answer and explanation
    Correct answer: A

    Auto-scaling policies add or remove instances based on metrics such as CPU utilization. A fixed larger instance, a static IP, or DNS TTL settings do not respond to load changes.

  5. Question 12

    A company needs to keep its customer data inside a specific country for regulatory reasons. Which design choice meets this requirement?

    1. AReplicate customer data to every region with a global load balancer for faster backups and disaster recovery
    2. BKeep the customer records on a company laptop in the office, copied to a USB drive for safekeeping
    3. CDeploy storage and processing in a region located in that country and restrict replication to it
    4. DStore customer data in whichever region currently has the lowest storage price after quarterly cost review
    Show answer and explanation
    Correct answer: C

    Choosing an in-country region and limiting replication keeps data within the required jurisdiction. Global replication, price-based placement, and local devices do not satisfy a residency requirement.

  6. Question 13

    A company is designing a shared service that many internal teams call. Which architecture pattern reduces the impact of one team's traffic spike on the others?

    1. ARate limiting and quotas per consumer at the API gateway
    2. BRequiring each consumer to restart the service on spikes
    3. CAllowing unlimited requests from every consumer
    4. DRouting all traffic through a single shared connection with no limits
    Show answer and explanation
    Correct answer: A

    Per-consumer quotas and rate limits isolate one consumer's spike from the others. Unlimited access or shared unbounded paths let one team degrade the service for everyone.

  7. Question 14

    Which storage type is most appropriate for files that many virtual machines in different zones must read and write at the same time?

    1. AA single attached block volume that can mount to only one VM at a time
    2. BLocal instance storage that is erased when the VM stops
    3. CArchive storage with multi-hour retrieval
    4. DShared network file storage
    Show answer and explanation
    Correct answer: D

    Shared network file storage supports concurrent access from many instances. Ephemeral local storage is lost on stop, a single block volume is typically attached to one instance, and archive tiers are not suited to active access.

Security (6 questions)

  1. Question 15

    Which two controls reduce the risk of exposing a cloud storage bucket to the public internet? (Choose two.)

    1. AGrant the group 'everyone' read access to simplify sharing
    2. BUse least-privilege identity policies for accounts that access the bucket
    3. CDisable encryption so that public tools can read the objects
    4. DPublish the bucket name on the company website
    5. EEnable the account-level public access block for storage
    Show answer and explanation
    Correct answer: B, E

    An account-level public access block prevents public exposure regardless of object policies, and least-privilege identity policies limit who can read. Public groups, disabled encryption, and publishing names all increase exposure.

  2. Question 16

    A cloud administrator must allow a virtual machine to read secrets from a key management service without storing credentials on the machine. Which approach is correct?

    1. AAssign a managed identity or instance role to the VM with permission to read only the required secrets
    2. BStore an administrator password in the VM's startup script so the application can connect
    3. CCopy the private key material to the VM's home directory, where the application reads it with default permissions
    4. DShare the root account credentials with the application team so they can manage the host
    Show answer and explanation
    Correct answer: A

    A managed identity or instance role provides short-lived credentials scoped to the needed actions, so no secret is stored on the VM. Scripts, copied key material, and shared root credentials each expose the secret.

  3. Question 17

    An administrator must ensure that only encrypted connections reach a web application, and that certificates are renewed before they expire. Which combination satisfies this?

    1. AInstall a single certificate on the load balancer once, then let it expire without a renewal reminder
    2. BAccept self-signed certificates in production on each backend instance with no expiry monitoring
    3. CUse plain HTTP, relying on a perimeter firewall to hide traffic from inspection and routine audit
    4. DConfigure TLS on the load balancer with a managed certificate that renews automatically
    Show answer and explanation
    Correct answer: D

    TLS at the load balancer with an auto-renewing managed certificate enforces encryption and avoids expiry outages. Plain HTTP exposes traffic, and expired or unmonitored certificates cause outages and trust failures.

  4. Question 18

    A security team wants evidence that administrative actions in the cloud environment are recorded and cannot be changed by the administrators being monitored. Which control provides this?

    1. ACentralized audit logging to a separate account or storage with restricted write access and integrity checks
    2. BScreenshots of the console taken by administrators after each change, saved to a shared drive with timestamps
    3. CVerbal confirmation from each administrator during the weekly change review meeting, with no written record kept
    4. DLocal log files kept on each administrator's workstation and synced to the laptop when the admin reconnects to the office network
    Show answer and explanation
    Correct answer: A

    Centralized, tamper-resistant logs stored outside the administrators' control provide reliable evidence. Local logs and self-reported screenshots can be altered, and verbal confirmation leaves no record.

  5. Question 19

    A company must restrict which addresses can open the administrative console of its cloud management interface. Which control is most direct?

    1. ATurning off multi-factor authentication on the management console for administrators
    2. BAllowing connections from every address and relying on a warning banner to deter misuse
    3. CPublishing the console address and its login path on a public forum and in shared chat
    4. DAn allow list of trusted source addresses applied through the console's access policy or a firewall
    Show answer and explanation
    Correct answer: D

    An allow list of trusted sources blocks connections from everywhere else before authentication is attempted. Publishing the address, removing authentication, and relying on banners do not restrict access.

  6. Question 20

    A CI/CD pipeline needs permission to deploy to one application environment. The security team wants to avoid broad, long-lived credentials. What is the best approach?

    1. AShare the developer's personal credentials with the pipeline so builds can reuse their access
    2. BGive the pipeline a global administrator account with unrestricted rights over the subscription
    3. CStore a permanent password in the repository config file so the nightly job can authenticate
    4. DUse a short-lived role for the pipeline with permissions limited to that environment
    Show answer and explanation
    Correct answer: D

    A scoped, short-lived role limits what a compromised pipeline can do and avoids stored secrets. Global admin accounts, committed passwords, and personal credentials all violate least privilege.

Troubleshooting (6 questions)

  1. Question 21

    Users in one subnet report that they cannot reach an application server in another subnet, but other subnets can. Which item should the administrator check first?

    1. AThe server's desktop wallpaper and screen saver settings in the profile
    2. BThe shared email address and phone extension of the help desk team on call
    3. CThe network security rules and route table entries that apply to the affected subnet
    4. DThe application's logo image, footer text, and visual branding assets
    Show answer and explanation
    Correct answer: C

    Connectivity problems confined to one subnet usually come from routing or security rules that apply to that subnet. Application branding and help desk details do not affect network reachability.

  2. Question 22

    A virtual machine cannot resolve internal host names, but it can reach internal IP addresses directly. What is the most likely cause?

    1. AThe VM's system time zone is set to the wrong region
    2. BThe DNS server settings for the VM or its network are incorrect
    3. CThe application logs directory is full after weeks of unrotated debug output
    4. DThe VM is assigned too much memory for its workload
    Show answer and explanation
    Correct answer: B

    Name resolution failures with working IP connectivity point to DNS configuration. Memory, time zone, and log size do not affect name lookups.

  3. Question 23

    An application responds slowly only during peak hours. CPU and memory are normal, but the database connection pool is always exhausted. Which action is most appropriate?

    1. ADisable connection pooling on the application servers so each request opens a new database session
    2. BInvestigate connection usage, tune the pool size and query efficiency, and verify connections are released
    3. CAdd more vCPU cores to the web servers without changing the database tier or pool settings
    4. DRestart the web servers every hour to clear stale sessions and reset the connection count
    Show answer and explanation
    Correct answer: B

    A consistently exhausted pool suggests connections are held too long or the pool is undersized, so the database side and connection handling need review. Extra CPU on web servers does not address the bottleneck, and disabling pooling usually makes saturation worse.

  4. Question 24

    Which two checks help isolate a failed connection from a client in one cloud network to a service in another? (Choose two.)

    1. AChange the client's display resolution
    2. BVerify security rules allow the required port in the needed direction
    3. CCount the team's coffee breaks during the incident
    4. DReplace the client's operating system wallpaper
    5. EConfirm routes exist between both networks and that peering or gateway attachments are active
    Show answer and explanation
    Correct answer: B, E

    Missing routes or inactive peering block traffic before it reaches the service, and security rules can silently drop it. Display settings, break counts, and wallpapers have no effect on network connectivity.

  5. Question 25

    A load balancer shows that half of its backend instances are marked unhealthy, and users receive intermittent errors. Which setting should the administrator verify first?

    1. AThe client's browser version and user-agent string as reported in the browser's developer tools
    2. BThe time zone of the administrator's office and daylight saving rules
    3. CThe health check path, port, and expected response for the backend application
    4. DThe load balancer's logo, color palette, and its marketing splash page text
    Show answer and explanation
    Correct answer: C

    Unhealthy marks come from failing health checks, so the check configuration and the application's response are the first things to confirm. Branding, browser versions, and time zones are unrelated to backend health.

  6. Question 26

    Users of a cloud application see intermittent slow responses that only occur for requests served from one availability zone. What is the best next step?

    1. ADisable application and access logging on the affected zone's instances to reduce monitoring overhead
    2. BRestart the entire application stack in every zone at once during peak traffic to clear cached state
    3. CCompare latency and error metrics per zone and inspect the resources in the affected zone
    4. DIncrease the font size and line spacing of the web pages for better readability
    Show answer and explanation
    Correct answer: C

    Per-zone metrics isolate whether the problem is in one zone's resources or network path. Restarting everywhere causes unnecessary disruption, and font size and logging changes do not address performance.

Deployment (4 questions)

  1. Question 27

    A team must deploy a new application version with no downtime and the ability to revert quickly if errors appear. Which strategy is most appropriate?

    1. AEditing production configuration files directly on each web server
    2. BDeploying the release to every server at once without health checks
    3. CBlue-green deployment with traffic switched between two identical environments
    4. DStopping the service, copying new files over the old ones, and restarting it afterward
    Show answer and explanation
    Correct answer: C

    Blue-green deployment keeps the current version running while the new one is verified, and switching traffic back provides a fast rollback. The other approaches create downtime or remove a safe way to revert.

  2. Question 28

    Which two practices help ensure that a new virtual machine template is consistent and secure before it is used at scale? (Choose two.)

    1. ALeave the image unversioned so teams can update it at will
    2. BBuild the image from a versioned definition that installs approved patches and hardening
    3. CCopy a personal laptop's configuration into the image
    4. DScan the image for vulnerabilities before it is published
    5. EDisable the host firewall so the image installs faster
    Show answer and explanation
    Correct answer: B, D

    Versioned builds with approved hardening make images reproducible, and vulnerability scanning catches problems before rollout. Copying personal configuration, disabling firewalls, and unversioned images all reduce consistency and security.

  3. Question 29

    A cloud team must move a virtual machine workload to a new provider with minimal changes. Which migration approach is best?

    1. ADelete the workload from the old provider and ask every user to rebuild it from scratch in the new environment
    2. BKeep the workload running on the old provider and forward users with a DNS redirect script while teams plan a later migration window
    3. CRewrite the entire application in a new language and framework before moving workloads to the cloud platform
    4. DRehost by exporting the machine image and importing it into the new environment, then validating networking and dependencies
    Show answer and explanation
    Correct answer: D

    Rehosting moves the existing machine with minimal application change, and validation confirms dependencies and networking work. Rewrites take longer than the requirement, and deletion or permanent forwarding do not complete the migration.

  4. Question 30

    A team wants to release a new version to a small share of users first, watch error rates, and expand only if metrics stay healthy. Which deployment strategy fits?

    1. AEditing the production code live during business hours
    2. BCanary release
    3. CRemoving monitoring during the release
    4. DBig-bang release to all users at once
    Show answer and explanation
    Correct answer: B

    A canary release exposes a small subset of users first and expands based on observed health. A big-bang release removes that safety step, and live editing or removing monitoring remove visibility.