CV0-004 Practice Questions

Text-to-voice, also known as text-to-speech (TTS), is an assistive technology that converts digital text into synthesized speech. For a person who is visually impaired, this is a fundamental technology for accessing digital information, including data stored in the cloud. Applications and operating systems use TTS engines, often as part of a screen reader, to read aloud on-screen text, menus, and documents, thereby enabling non-visual interaction with the user interface and content. Cloud services often provide TTS APIs to build accessible applications.

A. Object character recognition: This technology converts images containing text into machine-readable text data. It is a precursor to TTS for non-digital text but does not itself provide audible output.

C. Sentiment analysis: This is a Natural Language Processing (NLP) technique used to determine the emotional tone of text. It is an analytical tool, not an accessibility feature for reading content.

D. Visual recognition: This technology is used to identify and interpret objects, people, and scenes within images or videos. While it can describe visual content, it is not the primary tool for accessing text-based data.

1. Google Cloud Documentation. (n.d.). Text-to-Speech: Lifelike Speech Synthesis. Google Cloud. Retrieved from https://cloud.google.com/text-to-speech. The documentation states

"Improve accessibility for users with disabilities. For example

tools with speech synthesis capabilities can enable people with visual impairments to consume digital content."

2. Microsoft Azure Documentation. (2023

October 26). What is the Speech service?. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/azure/ai-services/speech-service/overview. Under the "Text to speech" section

it describes the service's capability to convert text to humanlike synthesized speech

a core function for accessibility tools like screen readers.

3. Wobbrock

J. O.

& Kane

S. K. (2022). Lecture 18: Ability-Based Design. University of Washington

CSE 440: Introduction to HCI. Page 21 of the lecture slides discusses screen readers (e.g.

JAWS

VoiceOver) which rely on text-to-speech synthesis as the primary output modality for visually impaired users.

4. Lazar

J.

Goldstein

D. F.

& Taylor

A. (2015). Ensuring Digital Accessibility through Process and Policy. Morgan Kaufmann. In Chapter 2

"Understanding How People with Disabilities Use the Web

" the authors detail the use of screen readers and text-to-speech (TTS) systems as the principal means by which blind users access digital content (pp. 29-31).

The scenario describes an application currently hosted on a "local VM cluster," which is an on-premises environment. The goal is to migrate it to better serve an "external user population." Migrating from an on-premises data center to a public or hybrid cloud environment is the standard approach to achieve greater scalability, high availability, and global accessibility for external users. This process is defined as an on-premises-to-cloud migration, often referred to as Physical-to-Cloud (P2C) or Virtual-to-Cloud (V2C). The cloud's inherent internet-facing infrastructure and distributed nature make it the ideal target for this requirement.

A. Cloud to on-premises: This describes repatriation, moving an application from a cloud provider back to a local data center, which is the opposite of the described scenario.

B. Cloud to cloud: This involves migrating an application between two different cloud environments. The application in the question originates from an on-premises location, not a cloud.

D. On-premises to on-premises: This describes moving an application between two local data centers. This migration type does not inherently provide the global reach and scalability needed for external users.

1. National Institute of Standards and Technology (NIST). (2011). NIST Cloud Computing Reference Architecture (NIST Special Publication 500-292).

Section 5.2

Cloud Migration

Page 23: The document defines cloud migration as "the process of moving an organization’s data and applications from the organization’s existing on-premise data center to the cloud infrastructure." This directly aligns with the scenario of moving from a local cluster to a platform suitable for external users.

2. Armbrust

M.

Fox

A.

Griffith

R.

Joseph

A. D.

Katz

R.

Konwinski

A.

... & Zaharia

M. (2009). Above the Clouds: A Berkeley View of Cloud Computing (Technical Report No. UCB/EECS-2009-28). University of California

Berkeley.

Section 3

Classes of Utility Computing: The paper discusses the economic and technical advantages of moving applications to the cloud

particularly for services that need to scale to serve a large

variable user base

which is characteristic of an "external user population." This supports the rationale for an on-premises-to-cloud migration.

3. Microsoft Azure Documentation. (2023). What is the Cloud Adoption Framework?

"Define strategy" and "Plan" sections: The framework outlines the motivations for moving to the cloud

including "reaching new customers" and "expanding to new geographies." It explicitly details the process of migrating workloads from on-premises environments to the Azure cloud to achieve these goals. This vendor documentation validates the on-premises-to-cloud path for serving external populations.

The fundamental difference between public and private container repositories is access control. Public repositories, such as those on Docker Hub, are accessible to anyone on the internet for pulling images without requiring authentication. Private repositories are restricted; a user must first authenticate (prove their identity) and then be authorized (have the correct permissions) to access the images within it. This mechanism is essential for organizations to securely store and manage proprietary or sensitive application images, ensuring they are not exposed to the public.

B. Browsing capabilities are a user interface feature of the repository service, not the core distinction, which is rooted in access control.

C. The choice of software license (open-source vs. proprietary) is independent of the repository's visibility setting; both license types can exist in either repository type.

D. A Dockerfile is used to build an image and is not typically stored within the image itself; its inspection is related to source code access, not the repository type.

1. Docker Documentation

"Repositories": "A repository can be public or private. Anyone can view and pull images from a public repository. You need permissions to pull images from a private repository. Private repositories are a great way to manage images you don't want to share publicly

such as images that contain proprietary source code or application data." (Reference: Docker Inc.

Docker Docs

"Repositories"

Section: "Public and private repositories").

2. Amazon Web Services (AWS) Documentation

"Amazon ECR User Guide": In its description of private repositories

the guide states

"...access can be controlled using both repository policies and IAM policies." For public repositories

it notes

"Anyone can browse and pull images from a public repository." This directly contrasts the access models

highlighting authorization for private and open access for public. (Reference: AWS

Amazon ECR User Guide

"Amazon ECR private repositories" and "Amazon ECR public repositories" sections).

3. Google Cloud Documentation

"Artifact Registry overview": "You can control access to your repositories by granting permissions to principals... Artifact Registry uses Identity and Access Management (IAM) to manage permissions." It further explains how to make a repository public by granting the reader role to allUsers

reinforcing that the default state is private and access is managed via authorization. (Reference: Google Cloud

Artifact Registry Documentation

"Configuring access control").

Rehosting, commonly known as "lift and shift," is the migration strategy of moving an application from its on-premises environment to a cloud IaaS platform with minimal or no modification. This approach is the fastest way to migrate because it does not require changes to the application's architecture or code. Given the strict constraints that the application cannot be changed and the migration must happen quickly, rehosting is the only suitable strategy. It allows the organization to meet its deadline by essentially replicating the existing environment in the cloud.

A. Retire: This strategy involves decommissioning the application entirely, which is contrary to the goal of migrating it.

B. Rearchitect: This involves fundamentally redesigning the application for cloud-native features, a time-intensive process that violates the "cannot be changed" constraint.

C. Refactor: This strategy requires modifying the application's code to better leverage cloud services, which is explicitly forbidden by the "cannot be changed" requirement.

1. Amazon Web Services (AWS) Documentation. In "6 Strategies for Migrating Applications to the Cloud

" AWS defines Rehosting ("lift-and-shift") as moving applications without changes. It states

"Most rehosting can be automated with tools... but it can be challenging to capture all the dependencies." This aligns with a fast migration where the application itself is not altered. (Source: AWS Prescriptive Guidance

"6 Strategies for Migrating Applications to the Cloud

" aws.amazon.com/cloud-migration/strategies/).

2. Microsoft Azure Cloud Adoption Framework. The framework details the "5 Rs of rationalization." It describes Rehost as: "Also known as a 'lift and shift' migration

a rehost option moves your current-state workload to the cloud with minimal changes to the application's code or architecture." This directly supports rehosting as the correct choice for a no-change

time-constrained scenario. (Source: Microsoft Docs

Azure Cloud Adoption Framework

"The 5 Rs of rationalization

" docs.microsoft.com/en-us/azure/cloud-adoption-framework/digital-estate/5-rs-of-rationalization).

3. Gartner. In "Use the 5 'Rs' of Rationalization to Evaluate Your Application Portfolio

" Gartner defines rehosting as redeploying an application component to a different infrastructure (physical

virtual

or cloud) without changing its code

features

or functions. This definition emphasizes the "no change" aspect critical to the question. (Source: Gartner Research

"Use the 5 'Rs' of Rationalization to Evaluate Your Application Portfolio

" Document ID G00257333

Section: "The Five Treatment Options").

Cloud providers impose service quotas or limits on the number of resources an account can provision within a specific region. When a cloud administrator attempts to create new resources, such as VDI instances, the request will fail if the account has already reached its predefined limit for that resource type (e.g., vCPUs, virtual machines) in that particular region. Since quotas are typically managed on a per-region basis, this explains why the creation is successful in some locations (where the quota has not been met) but fails in others (where the quota has been exceeded). This is a common operational constraint in cloud environments.

A. Partial service outages: A service outage would likely affect both new and existing services and is typically a temporary, unscheduled event, not a consistent barrier to creating new resources.

B. Regional service availability: This would mean the VDI service is entirely unavailable in certain regions, preventing the creation of any instances, not just failing after some have been deployed.

D. Deprecation of functionality: Deprecation is the planned retirement of a service or feature. This would typically result in failures across all regions, not a location-specific issue.

1. Amazon Web Services (AWS) Documentation: "Service Quotas." AWS states

"Quotas

also referred to as limits in AWS

are the maximum number of resources that you can create in an AWS account... Many quotas are specific to an AWS Region." This confirms that resource limits are a regional constraint.

Source: AWS Documentation

"What Is Service Quotas?"

https://docs.aws.amazon.com/servicequotas/latest/userguide/intro.html

2. Microsoft Azure Documentation: "Azure subscription and service limits

quotas

and constraints." The documentation details how quotas are applied per subscription and per region. For example

under "Virtual machine vCPU quotas

" it states

"vCPU quotas are arranged in two tiers for each subscription

in each region."

Source: Microsoft Azure Documentation

"vCPU quotas

" https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits#vcpu-quotas

3. Google Cloud Documentation: "Working with quotas." The documentation specifies the scope of quotas: "Quotas are enforced on a per-project

per-region

or per-zone basis." This directly supports the concept of location-specific resource creation failures due to limits.

Source: Google Cloud Documentation

"About quotas

" https://cloud.google.com/docs/quota#aboutquotas

4. Armbrust

M.

et al. (2010). A view of cloud computing. Communications of the ACM

53(4)

50-58. This foundational academic paper on cloud computing discusses elasticity as a key feature but also notes the practical limitations imposed by providers to manage resources

which manifest as quotas. The paper implicitly supports the idea that resource provisioning is not infinite and is subject to provider-imposed controls.

DOI: https://doi.org/10.1145/1721654.1721672 (Section 3.1

"Elasticity and the Illusion of Infinite Resources")

Microservices is an architectural style that structures an application as a collection of small, autonomous, and loosely coupled services. Each service is self-contained, runs its own process, and communicates with others through well-defined APIs. This inherent modularity allows individual services to be developed, deployed, and maintained independently without impacting the entire system. This design directly promotes decentralization (no single point of control), decoupling (minimal dependencies), and easier maintenance, as changes are isolated to specific services. This contrasts sharply with monolithic architectures, which are centralized and tightly coupled.

A. Monolithic: This architecture is a single, tightly coupled unit, making it difficult to maintain and inherently centralized, the opposite of the requirements.

B. Hybrid cloud: This describes a cloud deployment model (a mix of public and private infrastructure), not an application architecture design.

C. Mainframe: This refers to a type of centralized computing hardware and its associated legacy software models, not a modern, decentralized cloud-native architecture.

1. National Institute of Standards and Technology (NIST). (2018). NIST Special Publication 500-322: Foundational Elements of the Microservices Architecture. Section 2.1

"Characteristics of Microservices

" states: "Microservices are loosely coupled... Each microservice can be deployed

upgraded

scaled

and restarted independently of other services in the application." This directly supports the principles of being easily maintained and decoupled.

2. Microsoft Azure Architecture Center. (2024). Microservices architecture style. In the "Benefits" section

it lists "Independent deployments

" "Independent development

" and "Decentralized governance" as key advantages

which align with the concepts of being easily maintained

decoupled

and decentralized.

3. Amazon Web Services (AWS). (n.d.). What are Microservices?. The documentation states

"Microservices are an architectural and organizational approach to software development where software is composed of small independent services that communicate over well-defined APIs." It highlights benefits like "Improved scalability" and "Increased agility

" which are direct results of the decoupled and decentralized nature of the architecture.

A Virtual Private Cloud (VPC) provides a logically isolated section of a public cloud, allowing an organization to define and control its own virtual network. To meet the requirement, an administrator can configure the VPC without a direct connection to the public internet (e.g., by not attaching an Internet Gateway). Instead, a VPN Gateway can be configured on the VPC to establish a secure, private connection to the corporate network. This architecture ensures that all traffic to and from the cloud resources must traverse the corporate VPN, effectively blocking direct public internet access and fulfilling the security mandate.

A. WAF: A Web Application Firewall (WAF) operates at the application layer to protect web services, but it does not provide the fundamental network-level isolation required.

B. ACL: An Access Control List (ACL) is a set of rules that filters traffic at the subnet or resource level; it is a component used within a VPC, not the overarching isolation solution itself.

D. SSH: Secure Shell (SSH) is a protocol used for secure administrative access to a specific server; it does not create or manage the isolated network environment.

1. Amazon Web Services (AWS) Documentation. "A virtual private cloud (VPC) is a virtual network dedicated to your AWS account. It is logically isolated from other virtual networks in the AWS Cloud... You can connect your VPC to your on-premises data center by using AWS Site-to-Site VPN."

Source: AWS VPC User Guide

"What is Amazon VPC?". Retrieved from https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html

2. Microsoft Azure Documentation. "Azure Virtual Network (VNet) is the fundamental building block for your private network in Azure... You can connect on-premises networks to virtual networks using... Site-to-site virtual private network (VPN) gateway."

Source: Microsoft Learn

"What is Azure Virtual Network?". Retrieved from https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-overview

3. University of California

Berkeley Courseware. Lecture slides on Cloud Computing describe a VPC as a "Logically isolated network for customer" and a VPN Gateway as the component that "Connects VPC to customer’s on-premise network."

Source: Patterson

D. & Kubiatowicz

R. (2019). CS 162: Operating Systems and System Programming

Lecture 23: Cloud Computing. University of California

Berkeley

Slide 35. Retrieved from https://inst.eecs.berkeley.edu/~cs162/fa19/static/lectures/23-Cloud.pdf

The key phrase in the scenario is "long-term reporting purposes," which is a direct reference to data retention requirements. In highly regulated industries like banking, there are legal and compliance mandates (e.g., SOX, FINRA, Basel II/III) that specify the minimum duration for which financial records and related data must be stored. Therefore, adjusting the backup retention policy to ensure data is kept for the required number of years is the most critical change to meet these long-term obligations for auditing and reporting.

A. Location of the backups: This primarily addresses disaster recovery (geographic redundancy) and data sovereignty regulations, not the duration of data storage.

B. Type of the backups: This (full, incremental, differential) affects restore time and storage space consumption, but does not define how long the backups are preserved.

D. Schedule of the backups: This determines the frequency of backups and the Recovery Point Objective (RPO), not the length of time the data is kept available.

1. National Institute of Standards and Technology (NIST) Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems.

Reference: Section 4.3.2

"Backup and Storage

" page 4-11.

Quote/Paraphrase: The document states

"The backup strategy should also identify the retention periods for all backups." This establishes retention as a fundamental component of a compliant backup strategy

directly addressing how long data must be kept.

2. AWS Backup Developer Guide

Managing backups using backup plans.

Reference: Section on "Backup rule settings."

Quote/Paraphrase: The documentation specifies that a backup rule must include a lifecycle policy. This policy defines "when a recovery point is transitioned to cold storage and when it expires." The expiration setting is the direct implementation of a retention period

which is essential for long-term archival and compliance.

3. ISO/IEC 27001:2022

Information security

cybersecurity and privacy protection — Information security management systems — Requirements.

Reference: Annex A

Control 8.10 "Information backup."

Quote/Paraphrase: This international standard for information security management specifies that a backup policy should be defined and implemented. The guidance for this control explicitly includes the need to define "retention requirements" for backups

underscoring its importance for governance and compliance.

A Distributed Denial of Service (DDoS) attack is fundamentally a network-based attack designed to overwhelm a target with a massive volume of traffic from multiple sources. Network flow logs capture metadata about all IP traffic traversing a network interface, including source/destination IP addresses, ports, protocols, and the volume of packets/bytes. By monitoring and analyzing these logs, a cloud engineer can identify the characteristic signatures of a DDoS attack, such as an abnormally high volume of traffic from a large number of disparate IP addresses targeting the CMS service. This provides the necessary network-level visibility to detect the attack in its early stages.

B. Endpoint detection and response logs: EDR focuses on malicious activity on an endpoint (e.g., malware, unauthorized processes), not on analyzing incoming network traffic volume from distributed sources.

C. Cloud provider event logs: These logs (e.g., AWS CloudTrail, Azure Activity Log) track management plane API calls and user activity, not the data plane network traffic that constitutes a DDoS attack.

D. Instance syslog: This log contains operating system and application-level events from a single instance. It lacks the network-wide perspective needed to identify a distributed attack pattern.

1. Amazon Web Services (AWS) Documentation. VPC Flow Logs. Amazon states that a key use case for VPC Flow Logs is "Monitoring the traffic that is reaching your instance... For example

you can use flow logs to help you diagnose overly restrictive security group rules." This same data is used to identify anomalous traffic patterns indicative of a DDoS attack. Retrieved from: https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html (See section: "Flow log basics").

2. Microsoft Azure Documentation. Azure DDoS Protection overview. Microsoft explains that its protection service works by "monitoring actual traffic utilization and constantly comparing it against the thresholds... When the traffic threshold is exceeded

DDoS mitigation is initiated automatically." This monitoring is based on network flow telemetry

the same data captured in flow logs. Retrieved from: https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-protection-overview (See section: "How DDoS Protection works").

3. Google Cloud Documentation. VPC Flow Logs overview. Google lists "Network monitoring" and "Network forensics" as primary use cases. For forensics

it states

"If an incident occurs

VPC Flow Logs can be used to determine... the traffic flow." This is essential for analyzing a DDoS incident. Retrieved from: https://cloud.google.com/vpc/docs/flow-logs (See section: "Use cases").

4. Carnegie Mellon University

Software Engineering Institute. Situational Awareness for Network Monitoring. In CERT/CC's guide to network monitoring

it emphasizes the importance of flow data (like NetFlow

the precursor to cloud flow logs) for "detecting and analyzing security events

such as denial-of-service (DoS) attacks." Retrieved from: https://resources.sei.cmu.edu/assetfiles/technicalnote/200400400114111.pdf (See Page 11

Section 3.2.2).

A REST (Representational State Transfer) API (Application Programming Interface) is the industry-standard architectural style for integrating web services. For an e-commerce site to communicate with a payment processor, it needs a secure, scalable, and stateless method. REST APIs use standard HTTP methods (like POST for submitting payment data) and are designed for this type of client-server interaction. Encapsulating the communication within HTTPS (HTTP Secure) ensures that sensitive payment information is encrypted in transit, which is a critical security requirement for handling financial data. This combination provides a robust, secure, and widely supported solution for this integration task.

A. RPC over SSL: Remote Procedure Call (RPC) is an older paradigm that is often more tightly coupled and less flexible than REST for web-based integrations. While secure over SSL, it's not the modern standard.

B. Transactional SQL: This is incorrect. SQL is a language for querying databases. Directly exposing a database to an external payment processor via SQL would be a major security vulnerability and is not an integration protocol.

D. Secure web socket: Web sockets provide persistent, bidirectional communication channels, ideal for real-time applications like chat or live data feeds. This is unnecessary for a standard payment transaction, which is a simple request-response event.

1. Fielding

R. T. (2000). Architectural Styles and the Design of Network-based Software Architectures. Doctoral dissertation

University of California

Irvine. In Chapter 5

"Representational State Transfer (REST)

" Fielding defines the principles of REST

highlighting its advantages for hypermedia systems like the World Wide Web

including scalability

simplicity

and portability

which are essential for e-commerce integrations. (Available at: https://www.ics.uci.edu/~fielding/pubs/dissertation/restarchstyle.htm)

2. Amazon Web Services (AWS) Documentation. "What is a RESTful API?". AWS

a major cloud provider

defines RESTful APIs as the standard for web-based communication. The documentation states

"REST determines how the API looks like. It stands for “Representational State Transfer”. It is a set of rules that developers follow when they create their API... Most applications on the internet use REST APIs to communicate." This confirms its status as the best fit for web service integration. (Reference: aws.amazon.com/what-is/restful-api/)

3. Microsoft Azure Documentation. "What are APIs?". The official documentation describes how APIs enable communication between applications

with REST being the predominant architectural style for web APIs. It emphasizes the use of HTTP/HTTPS protocols for these interactions

aligning perfectly with the scenario. (Reference: azure.microsoft.com/en-us/resources/cloud-computing-dictionary/what-are-apis)

4. Google Cloud Documentation. "API design guide". Google's guide for building APIs for its cloud platform is based on REST principles. It details the use of standard HTTP methods and resource-oriented design

which is the foundation for modern integrations like payment processors. (Reference: cloud.google.com/apis/design)