Free CV0-004 Practice Test Questions and Answers (2026)

The Payment Card Industry Data Security Standard (PCI-DSS) is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. A fundamental principle of PCI-DSS is the protection of cardholder data. Specifically, Requirement 3 mandates the protection of stored cardholder data, requiring the Primary Account Number (PAN) to be rendered unreadable wherever it is stored. Requirement 4 mandates the encryption of cardholder data during transmission over open, public networks. These requirements directly address the prohibition of exchanging or storing credit card data in cleartext.

A. CSA: The Cloud Security Alliance (CSA) provides research and best practices for cloud security (e.g., the Cloud Controls Matrix), but it is not a regulatory standard specifically for credit card data.

B. GDPR: The General Data Protection Regulation (GDPR) is a European Union regulation focused on the protection of personal data and privacy of EU citizens, not exclusively on payment card information.

C. SOC 2: A Service Organization Control 2 (SOC 2) report is an audit of a service organization's controls related to security, availability, processing integrity, confidentiality, and privacy, but it is not the specific standard governing credit card data.

1. PCI Security Standards Council. (2022). Payment Card Industry (PCI) Data Security Standard: Requirements and Security Assessment Procedures

Version 4.0. Page 48

Requirement 3.5.1 states

"Primary account number (PAN) is rendered unreadable wherever it is stored." Page 58

Requirement 4.2.1 states

"Strong cryptography and security protocols are used to safeguard PAN during transmission over open

public networks."

2. Amazon Web Services (AWS). (2024). PCI DSS Compliance. AWS Compliance Documentation. Retrieved from https://aws.amazon.com/compliance/pci-dss-level-1-faqs/. The documentation states

"The PCI DSS is a proprietary information security standard for organizations that handle branded credit cards from the major card schemes."

3. Microsoft Azure. (2024). Azure compliance documentation: PCI DSS. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/azure/compliance/offerings/offering-pci-dss. The document clarifies

"The Payment Card Industry (PCI) Data Security Standards (DSS) is a global information security standard designed to prevent fraud through increased control of credit card data."

A Common Vulnerability and Exposure (CVE) identifies a specific, known software flaw. The standard and most direct method to remediate such a vulnerability is to apply the security patch released by the vendor. Given the critical CVSS score of 9.0 and a network attack vector, the vulnerability is remotely exploitable and poses a significant risk. Patching the operating systems directly addresses and eliminates the underlying security flaw, which is the most effective and appropriate mitigation strategy. This action is a fundamental component of vulnerability management and security hygiene.

Upgrading to beta software is not a recommended security practice for production systems as it is untested and likely contains its own bugs and vulnerabilities.

Encrypting operating system disks protects data at rest but offers no protection against a network-based attack that exploits a vulnerability in the running OS.

Disabling ports is a hardening measure but does not fix the vulnerability itself and may not be feasible if the flaw exists on a necessary, business-critical service.

1. National Institute of Standards and Technology (NIST) Special Publication 800-40r4 (Draft)

Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology. Section 2.1

"The Importance of Patch Management

" states

"Patch management is the process of identifying

acquiring

installing

and verifying patches for products and systems. Patches correct security and functionality problems in software and firmware." This establishes patching as the direct corrective action for vulnerabilities.

2. AWS Well-Architected Framework

Security Pillar (July 2023). Page 49

under "Vulnerability Management

" recommends

"Perform vulnerability scans and patching in a timely manner to reduce the attack surface... Automate patching to operating systems and applications to reduce the window of opportunity for an attacker." This highlights patching as a primary security control in a public cloud environment.

3. FIRST.org

Common Vulnerability Scoring System v3.1: Specification Document. Section 2.1

"Attack Vector (AV)

" defines the "Network" value

confirming the remote exploitability. Section 4

"Qualitative Severity Rating Scale

" categorizes a CVSS Base Score of 9.0-10.0 as "Critical

" underscoring the urgency for remediation.

4. Microsoft Azure Documentation

Remediate findings from Microsoft Defender for Endpoint. The documentation outlines the process for handling discovered vulnerabilities

stating

"After you've identified the devices at risk

you can remediate them with a security recommendation." These recommendations consistently prioritize applying vendor-supplied security updates (patches).

A direct connection, such as AWS Direct Connect, Azure ExpressRoute, or Google Cloud Interconnect, establishes a dedicated, private physical or logical network link between an on-premises data center and the cloud provider's network. By bypassing the public internet, this method avoids the variable performance, unpredictable routing, and congestion inherent to shared networks. This results in a highly consistent network experience with minimal latency and lower overhead compared to internet-based solutions like VPNs, which must contend with public network conditions and the processing overhead of encryption/decryption.

A. Site-to-site VPN: This method tunnels traffic over the public internet, which leads to unpredictable latency and performance. The encryption process also introduces computational overhead.

B. Peer-to-peer VPN: This is not the standard terminology for connecting an entire on-premises network to a cloud environment and still relies on the public internet, sharing the same drawbacks as a site-to-site VPN.

D. Peering: In a cloud context, this typically refers to connecting two virtual networks within the cloud (e.g., VPC Peering). It does not describe a dedicated connection from an on-premises location.

1. Microsoft Azure Documentation. (2023). What is Azure ExpressRoute? Microsoft Learn. In the "Benefits" section

it states

"ExpressRoute connections don't go over the public Internet. They offer more reliability

faster speeds

consistent latencies

and higher security than typical connections over the Internet."

2. Amazon Web Services Documentation. (2023). AWS Direct Connect FAQs. Under the question "How is AWS Direct Connect different from an IPsec VPN Connection?"

the documentation explains

"An IPsec VPN connection utilizes the internet... AWS Direct Connect bypasses the internet... [providing] a more consistent network experience than internet-based connections."

3. Google Cloud Documentation. (2023). Choosing a Network Connectivity product. The comparison table shows that for the requirement of "Lowest latency

" the recommended solution is "Dedicated Interconnect

" which is a direct connection. It explicitly contrasts this with Cloud VPN

which operates over the internet.

Cloud-native monitoring services (like AWS CloudWatch, Azure Monitor, or Google Cloud's operations suite) provide high-level metrics from the hypervisor by default, such as overall CPU utilization for a VM. However, to collect detailed in-guest operating system data, such as process-level memory usage, it is necessary to install a dedicated monitoring agent. This agent software runs inside the VM, collects the specified metrics directly from the OS, and sends them to the cloud monitoring service. For an autoscaling group, the agent is installed on the base machine image, ensuring all new instances automatically report these detailed metrics, making it the most effective and scalable solution.

A. Configuring page file/swap metrics: This only tracks the usage of virtual memory on disk, which is an indicator of memory pressure, not a direct measurement of memory usage by individual processes.

C. Scheduling a script to collect the data: This is a custom, non-native solution. While possible, it requires manual development and maintenance and is less integrated and reliable than using the purpose-built agent provided by the cloud platform.

D. Enabling memory monitoring in the VM configuration: This option typically enables hypervisor-level memory metrics, which report the total memory consumed by the VM as a whole, but lack the visibility to report on individual processes running inside the guest OS.

1. Amazon Web Services (AWS) Documentation. The CloudWatch agent is required to collect guest OS-level metrics. "By default

EC2 instances send hypervisor-visible metrics to CloudWatch... To collect metrics from the operating system or from applications

you must install the CloudWatch agent."

Source: AWS Documentation

"The metrics that the CloudWatch agent collects

" Section: "Predefined metric sets for the CloudWatch agent."

2. Microsoft Azure Documentation. The Azure Monitor agent is used to collect in-depth data from the guest operating system of virtual machines. "Use the Azure Monitor agent to collect guest operating system data from Azure... virtual machines... It collects data from the guest operating system and delivers it to Azure Monitor."

Source: Microsoft Learn

"Azure Monitor agent overview

" Introduction section.

3. Google Cloud Documentation. The Ops Agent is Google's solution for collecting detailed telemetry from within Compute Engine instances. "The Ops Agent is the primary agent for collecting telemetry from your Compute Engine instances. It collects both logs and metrics." The agent can be configured to collect process metrics.

Source: Google Cloud Documentation

"Ops Agent overview

" What the Ops Agent collects section.

4. Armbrust

M.

et al. (2010). A View of Cloud Computing. This foundational academic paper from UC Berkeley discusses the challenges of cloud monitoring

implying the need for mechanisms beyond the hypervisor to understand application-level performance. The distinction between what the infrastructure provider can see (hypervisor-level) and what the user needs to see (in-guest) necessitates agent-based approaches for detailed monitoring.

Source: Communications of the ACM

53(4)

50-58. Section 5.3

"Monitoring and Auditing." DOI: https://doi.org/10.1145/1721654.1721672

Infrastructure as a Service (IaaS) is the most appropriate model as it provides fundamental computing resources, including virtual servers, networking, and storage. This gives the engineering department the maximum level of control needed to provision a large cluster of servers (100+), install custom operating systems and dependencies, and deploy their in-house software for a comprehensive scalability test. The on-demand, pay-as-you-go nature of IaaS is ideal for a temporary, month-long project, allowing the company to access massive computing power without the capital expense of purchasing physical hardware.

A. PaaS abstracts the underlying server infrastructure, which would limit the team's ability to control the environment and install the specific software stack required for their test.

B. SaaS provides ready-to-use software applications, not the underlying infrastructure needed to test a company's own custom-developed software.

C. DBaaS is a specialized service for managing databases. It does not provide the general-purpose server cluster needed to run the application itself.

1. Mell

P.

& Grance

T. (2011). The NIST Definition of Cloud Computing (NIST Special Publication 800-145). National Institute of Standards and Technology.

Page 2

Section "Infrastructure as a Service (IaaS)": "The capability provided to the consumer is to provision processing

storage

networks

and other fundamental computing resources where the consumer is able to deploy and run arbitrary software

which can include operating systems and applications." This directly supports the need to deploy in-house software on a large number of servers.

2. Armbrust

M.

Fox

A.

Griffith

R.

Joseph

A. D.

Katz

R.

Konwinski

A.

Lee

G.

Patterson

D.

Rabkin

A.

Stoica

I.

& Zaharia

M. (2009). Above the Clouds: A Berkeley View of Cloud Computing (Technical Report No. UCB/EECS-2009-28). University of California

Berkeley.

Page 5

Section 3.1: Discusses how IaaS enables "pay-as-you-go" access to infrastructure

which is ideal for short-term

large-scale needs like the month-long test described

a use case often termed "batch processing" or "elastic computing."

3. Microsoft Azure Documentation. (n.d.). What is Infrastructure as a Service (IaaS)?

Section "Common IaaS business scenarios": "Test and development. Teams can quickly set up and dismantle test and development environments

bringing new applications to market faster. IaaS makes it quick and economical to scale up dev-test environments up and down." This explicitly validates using IaaS for temporary

large-scale testing.

Ephemeral storage, also known as container-scoped storage, is intrinsically tied to the lifecycle of a container. It exists as the container's writable layer. When a container is stopped, restarted, or deleted, this writable layer is destroyed, and any data written to it is permanently lost. This type of storage is suitable for temporary files or cache data that an application needs during its runtime but does not need to persist. The data does not survive a restart, which directly answers the question.

A. Object: Object storage is a persistent storage service external to the container. Data is managed as objects and is not lost when a container restarts.

B. Persistent volume: A persistent volume is an abstraction for a piece of storage that exists independently of a container's or pod's lifecycle, explicitly designed to preserve data.

D. Block: Block storage provides persistent volumes that can be attached to containers. The data on these volumes is independent of the container's lifecycle and survives restarts.

---

1. Kubernetes Documentation

"Volumes". The official Kubernetes documentation describes ephemeral volume types like emptyDir. It states

"When a Pod is removed from a node for any reason

the data in the emptyDir is deleted forever." This confirms that data in this type of volume is lost when the container's pod is terminated. (Source: Kubernetes.io

Concepts > Storage > Volumes

Section: emptyDir).

2. Docker Documentation

"Manage data in Docker". The official Docker documentation explains that data not stored in a volume is written to the container's writable layer. It clarifies

"The data doesn't persist when that container is no longer running

and it can be difficult to get the data out of the container if another process needs it." (Source: Docker Docs

Storage > Volumes > "Manage data in Docker").

3. Red Hat Official Documentation

"Understanding container storage". This vendor documentation distinguishes between ephemeral and persistent storage. For ephemeral storage

it notes

"The storage is tightly coupled with the container’s life cycle. If the container crashes or is stopped

the storage is lost." (Source: Red Hat Customer Portal

OpenShift Container Platform 4.10 > Storage > "Understanding container storage"

Section: "Ephemeral storage").

4. University of California

Berkeley

"CS 162: Operating Systems and System Programming"

Lecture 19: "Virtual Machines

Containers

and Cloud Computing". Course materials often describe the container file system as a series of read-only layers with a final writable layer for the specific container. This top writable layer is ephemeral and is discarded when the container is destroyed. (Reference concept covered in typical advanced OS/Cloud Computing university curricula).

The core of the question is protecting data from a natural disaster by using a geographically separate facility. This practice is known as off-site disaster recovery. By renting a colocation space in another part of the country, the organization establishes a secondary location that is unlikely to be affected by the same disaster that impacts the primary site. This geographic separation is the fundamental principle of an off-site strategy, ensuring business continuity and data availability in the event of a regional catastrophe.

A. On-site: This practice involves keeping data backups or redundant systems at the same physical location as the primary data, offering no protection against a site-wide disaster like a fire or flood.

B. Replication: This is the process of copying data. While replication is a mechanism used to send data to an off-site location, "off-site" is the specific disaster recovery practice described in the scenario.

C. Retention: This refers to policies that dictate how long data is stored. Data retention is unrelated to the physical location of data for disaster recovery purposes.

1. National Institute of Standards and Technology (NIST) Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems. Section 4.3.2

"Alternate Storage Site

" states: "An alternate storage site is used for storage of backup media... The site should be geographically separated from the primary site so as not to be susceptible to the same hazards." This directly supports the concept of using a geographically distant location (off-site) for disaster protection.

2. Amazon Web Services (AWS)

Disaster Recovery of Workloads on AWS: Recovery in the Cloud (July 2021). Page 6

in the section "Backup and Restore

" discusses storing backups in a separate AWS Region. It states

"By replicating your data to another Region

you can protect your data in the unlikely event of a regional disruption." This exemplifies the off-site practice in a cloud context.

3. Microsoft Azure Documentation

Disaster recovery and high availability for Azure applications. In the section "Azure services that provide disaster recovery

" it describes Azure Site Recovery

which "replicates workloads to a secondary location." The use of a secondary

geographically distinct location is the definition of an off-site strategy.

The optimal backup solution must meet three criteria: cost-effectiveness, granular recovery, and multilocation storage.

1. Multilocation: An off-site or cloud-based storage solution is essential for disaster recovery, satisfying the multilocation requirement by storing data in a geographically separate location from the primary site.

2. Cost-Effective & Granular Recovery: A strategy combining full, incremental, and differential backups provides the most flexibility. Incremental backups are highly cost-effective as they only copy data that has changed since the last backup of any type, minimizing storage space and network bandwidth usage—key cost drivers in the cloud. All three backup types (full, incremental, differential) support the granular recovery of specific files or data points. This combination offers the best balance of recovery speed, storage cost, and data granularity.

B. Cloud site, full, and differential

This option is less cost-effective than a strategy that includes incremental backups, which consume less storage and bandwidth for frequent backups.

C. On-site. full, and incremental

On-site storage fails the multilocation requirement, as it does not protect against a site-wide disaster (e.g., fire, flood) affecting the primary data and its backup.

D. On-site. full, and differential

On-site storage fails the multilocation requirement, offering no protection from localized disasters that could destroy both the original data and the backup.

---

1. National Institute of Standards and Technology (NIST) Special Publication 800-34 Rev. 1

Contingency Planning Guide for Federal Information Systems.

Section 3.4.2.1

"Backup Types": This section details full

differential

and incremental backups. It explains that incremental backups copy data modified since the last backup

making them efficient. "Incremental backups are the most efficient because they copy the least amount of data." (Page 29).

Section 3.4.2.2

"Off-site Storage": This section explicitly states

"To protect against a disaster that could damage the primary facility...backup media should be stored at an off-site location." (Page 30). This supports the "multilocation" requirement.

2. Amazon Web Services (AWS) Documentation

How AWS Backup works.

"Backups" section: The documentation explains that AWS Backup leverages the native snapshot capabilities of services like Amazon EBS

which are incremental. "The first snapshot of a volume is always a full snapshot. Subsequent snapshots of the same volume are incremental... This saves on storage costs because data is not duplicated." This directly links the incremental method to the "cost-effective" requirement in a cloud context.

3. Microsoft Azure Documentation

About Azure VM backup.

"Backup process" section: The documentation states

"For Azure VMs

the initial backup is a full backup... Subsequent backups are incremental." This highlights that major cloud providers use incremental backups as a standard

cost-effective practice for virtual machine protection.

The requirements for immediate failover and a maximum replication latency of one second necessitate a continuous, near-real-time data protection strategy. Live replication, often implemented as synchronous or near-synchronous replication, continuously transmits data changes from the primary VM to a replica in a secondary data center as they occur. This method ensures the replica is always in a consistent and up-to-date state, enabling an immediate and automated failover with a Recovery Point Objective (RPO) of near-zero. This directly meets the stringent availability and low-latency demands described in the scenario for mission-critical applications.

A. Snapshot: Snapshot replication is periodic, creating copies at discrete intervals. This method cannot meet the immediate failover or sub-second latency requirements due to inherent data loss (RPO) between snapshots.

B. Transactional: Transactional replication is a database-specific technology that replicates database transactions. It does not apply to the entire virtual machine state, including the operating system and application files.

D. Point-in-time: This is a general term for creating a copy of data as it existed at a specific moment, which includes snapshots. It is not a continuous process and cannot support immediate failover.

1. VMware

Inc. (2023). vSphere Storage Documentation

Administering vSphere Virtual Machine Storage

Chapter 8: Virtual Machine Storage Policies. VMware. In the section "Site disaster tolerance

" the documentation explains that synchronous replication provides the highest level of availability with a Recovery Point Objective (RPO) of zero

which is essential for immediate failover scenarios. This aligns with the concept of "live" replication.

2. Kyriazis

D.

et al. (2013). Disaster Recovery for Infrastructure-as-a-Service Cloud Systems: A Survey. ACM Computing Surveys

46(1)

Article 10. In Section 3.2

"Replication Techniques

" the paper contrasts synchronous and asynchronous replication. It states

"Synchronous replication... offers a zero RPO... suitable for mission-critical applications with low tolerance for data loss." This supports the choice of a live/synchronous method for immediate failover. https://doi.org/10.1145/2522968.2522978

3. Microsoft Corporation. (2023). Azure Site Recovery documentation

About Site Recovery. Microsoft Docs. The documentation describes "continuous replication" for disaster recovery of VMs

which provides minimal RPOs. While specific RPO values vary

the principle of continuous or "live" data transfer is fundamental to achieving the low latency and immediate failover required.

The scenario describes an e-commerce website with performance degradation during "random periods," indicating unpredictable traffic spikes. Automatic elasticity is a fundamental cloud computing characteristic designed specifically for this use case. It allows the system to automatically scale resources (e.g., compute instances) up or down based on real-time demand, monitored through metrics like CPU utilization or network traffic. This ensures that the website has sufficient resources to maintain performance during unexpected surges and scales down to reduce costs when the demand subsides. This dynamic and automated approach is the most effective and efficient way to manage variable workloads.

A. Migrating to a dedicated host: This provides a fixed amount of resources. It does not dynamically scale to meet random demand and can lead to either under-provisioning or costly over-provisioning.

B. Purchasing additional servers: This is a static, capital-intensive solution. It lacks the agility to respond to real-time, random fluctuations in traffic and is not a typical cloud approach.

C. Scheduling resource allocation: This method is only effective for predictable, cyclical traffic patterns (e.g., daily or weekly peaks), not for the "random periods" mentioned in the question.

1. Mell

P.

& Grance

T. (2011). The NIST Definition of Cloud Computing (Special Publication 800-145). National Institute of Standards and Technology. On page 2

under "Essential Characteristics

" it defines Rapid elasticity: "Capabilities can be elastically provisioned and released

in some cases automatically

to scale rapidly outward and inward commensurate with demand."

2. Armbrust

M.

Fox

A.

Griffith

R.

Joseph

A. D.

Katz

R.

Konwinski

A.

... & Zaharia

M. (2010). A view of cloud computing. Communications of the ACM

53(4)

50-58. In Section 3.1

"Elasticity and the Illusion of Infinite Resources

" the UC Berkeley authors state

"Cloud Computing gives the illusion of infinite computing resources available on demand... This elasticity of resources

without paying a premium for large scale

is unprecedented in the history of IT." This directly addresses the need to handle variable demand effectively. DOI: https://doi.org/10.1145/1721654.1721672

3. Vaquero

L. M.

Rodero-Merino

L.

Caceres

J.

& Lindner

M. (2008). A break in the clouds: towards a cloud definition. ACM SIGCOMM Computer Communication Review

39(1)

50-55. In Section 3

"A Proposed Definition

" the paper highlights elasticity as a key property

stating that it "allows for the dynamic reconfiguration of the infrastructure according to the service's needs." This supports the use of elasticity for managing fluctuating performance requirements. DOI: https://doi.org/10.1145/1496091.1496100

The Service Level Agreement (SLA) mandates that each hypervisor SFP must match the maximum link speed of the SAN array. By inspecting the service processors, we see the SAN array's ports are operating at 8 Gbps. The hypervisor's ports were initially misconfigured to 16 Gbps, creating a link speed mismatch. This mismatch prevented successful link negotiation, which is why Service Processor A had "no initiators currently logged in." This failure breaks the required path redundancy, halves the available I/O bandwidth, and causes the observed low IOPS. Adjusting all four hypervisor ports to 8 Gbps resolves the configuration conflict, restores redundant paths to both service processors, and meets the performance and SLA requirements.

Dell EMC Unity: High Availability - A Detailed Review, White Paper, August 2020. Page 9, in the "Front-End Connectivity" section, describes how hosts connect to both Service Processors (SPs) to ensure no single point of failure. This design is contingent on all physical paths being correctly configured and operational, which a link speed mismatch would prevent.

Brocade Fabric OS Administration Guide (9.0.x). In the chapter on "Port Configuration," the description of the portcfgspeed command explains that for a link to be established, port speed settings must be compatible. Forcing a speed (e.g., 16 Gbps) on a port connected to a device that only supports a lower maximum speed (e.g., 8 Gbps) will result in a failed link state, such as "No_Sync."

Clark, T. (2017). Designing Storage Area Networks (3rd ed.). Addison-Wesley Professional. Chapter 4, "Fibre Channel Cabling and Components," specifies that Fibre Channel ports auto-negotiate to the highest common speed. If one port is fixed to a speed not supported by the connecting port, the link will not initialize, leading to path failure in a SAN fabric.

The process involves calculating the average usage for each resource, adding a 20% overhead, and selecting the smallest available specification that meets the new requirement.

• CPU: The average CPU usage is 16.57% of 4 vCPUs, which is 0.66 vCPUs. With a 20% overhead, the requirement is $0.66 \times 1.20 = 0.79$ vCPUs. The smallest option is 1 vCPU.
• RAM: Average RAM usage is 15% of 16GB, which is 2.4GB. With a 20% overhead, the requirement is $2.4\text{GB} \times 1.20 = 2.88\text{GB}$. The smallest option is 4GB.
• Disk: Average disk throughput is 4.43 MBps. With a 20% overhead, the requirement is $4.43 \times 1.20 \approx 5.32$ MBps. The smallest option is 10MBps.

Following the same right-sizing methodology as the web server:

• CPU: The average CPU usage is 65.57% of 4 vCPUs, which is 2.62 vCPUs. With a 20% overhead, the requirement is $2.62 \times 1.20 \approx 3.15$ vCPUs. The best-fit option is 4 vCPU.
• RAM: Average RAM usage is 80% of 16GB, which is 12.8GB. With a 20% overhead, the requirement is $12.8\text{GB} \times 1.20 = 15.36\text{GB}$. The smallest available option that meets this is 16GB.
• Disk: Average disk throughput is 86.71 MBps. With a 20% overhead, the requirement is $86.71 \times 1.20 \approx 104.05$ MBps. The next available tier is 110MBps.

AWS Well-Architected Framework, Cost Optimization Pillar (Whitepaper).

Reference: "Right Sizing" section under "Cost-effective resources."

Content: This official AWS document outlines the best practice of analyzing utilization metrics over time to select the instance type that meets performance requirements at the lowest cost. It explicitly advises against overprovisioning and recommends using monitoring data to make informed decisions, which is the core principle applied in this question.

Microsoft Azure Well-Architected Framework.

Reference: "Cost optimization" pillar, "Right-size resources" principle.

Content: Similar to AWS, this official Microsoft documentation emphasizes analyzing performance data such as CPU, memory, and IOPS to identify and deallocate underutilized resources. This directly supports the task of examining usage graphs to select smaller, more cost-effective server specifications.

Armbrust, M., et al. "A view of cloud computing." Communications of the ACM, vol. 53, no. 4, 2010, pp. 50-58.

Reference: Section 3, "Classes of Utility Computing," paragraph on pay-for-use models.

Content: This foundational academic paper discusses the economic benefits of cloud computing, including the ability to finely tune resource allocation to workload demands. The concept of right-sizing is a practical application of this principle, allowing users to avoid the costs of idle capacity inherent in statically provisioned on-premises environments.

DOI: https://doi.org/10.1145/1721654.1721672

This configuration correctly implements the required security layers for a low-risk tolerance identity solution.

1. SSO (Single Sign-On): This control addresses the requirement to minimize user logins. It allows authenticated users to access multiple applications and resources within the cloud environment without needing to log in repeatedly.
2. MFA (Multi-Factor Authentication): This control fulfills the need for secondary authentication. It enhances security by requiring users to provide two or more verification factors, making it significantly harder for unauthorized users to gain access.
3. SIEM (Security Information and Event Management): This server is essential to track user activity and monitor for anomalies. A SIEM system collects, aggregates, and analyzes log data from across the network, including authentication events from SSO and MFA, to detect and alert on suspicious behavior.

National Institute of Standards and Technology (NIST) Special Publication 800-63-3, Digital Identity Guidelines. This document details modern identity solutions.

For SSO: Section 4.2 discusses federation and SSO as a mechanism to provide a "seamless user experience when accessing multiple applications."

For MFA: Section 5.1, "Authenticator and Verifier Requirements," outlines the use of multiple factors for authentication to achieve higher assurance levels.

Source: https://doi.org/10.6028/NIST.SP.800-63-3

National Institute of Standards and Technology (NIST) Special Publication 800-92, Guide to Computer Security Log Management. This guide provides a foundation for security monitoring.

For SIEM: Section 2.3.4, "Log Analysis Tools," describes how SIEMs centralize log storage and analysis, providing "correlation of events among multiple log sources" which is crucial for detecting anomalous activity.

Source: https://doi.org/10.6028/NIST.SP.800-92

Saltzer, J. H., & Kaashoek, M. F. (2009). Principles of Computer System Design: An Introduction. Morgan Kaufmann. This textbook covers foundational security principles.

For all concepts: Chapter 10, "Security and Protection," discusses the principles of authentication (including multi-factor) and auditing (the basis of SIEM) as fundamental components for securing systems, particularly in networked environments. (Refer to sections on authentication and accountability).

The user's inability to access the web-based login prompt points to a misconfiguration in the Web Application Firewall (WAF). The finance application (FIN) is hosted on webapp1 as per its service details. Upon reviewing the WAF configuration, Rule ID 1006 is specifically configured to Block traffic destined for the URL ^https://webapp[1].jcompita[.]org/login[.]html$. This rule is the direct cause of the login page failing to load. Changing the action for this specific rule from Block to Allow will permit traffic to the login page and resolve the client's access issue.

Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice (4th ed.). Pearson.

Reference: Chapter 21, "Firewalls and Intrusion Prevention Systems," Section 21.1 Firewall Characteristics. This section discusses how firewalls, including WAFs, use rule-based policies to filter traffic. A misconfigured rule that incorrectly blocks a specific URL or path is a common cause for legitimate traffic being denied access to a web application resource.

Amazon Web Services. (2025). AWS WAF Developer Guide.

Reference: Section "Rule action." The documentation explicitly defines the Block action, which instructs AWS WAF to stop the web request. This aligns with the scenario where the user's access to login.html is being stopped by the WAF. The guide also defines the Allow action as the remedy to permit such requests.

Saltzer, J. H., & Kaashoek, M. F. (2009). Principles of Computer System Design: An Introduction. Morgan Kaufmann.

Reference: Chapter 8, "The Network," Section 8.4.3 Firewalls. The text explains that a firewall's effectiveness is entirely dependent on its configured policy. An incorrect "deny" (or "block") rule within the policy is a primary cause of access problems, where the system incorrectly identifies legitimate traffic as hostile and prevents it from reaching its destination.

Part 1:

The problematic devices are Router 1 and Router 2, which are failing to establish a stable Site-to-Site IPsec VPN tunnel.

This failure is due to two specific misconfigurations:

1. Mismatched Pre-Shared Keys (PSK): Router 1 is configured with the PSK Cloud001, while Router 2 is configured with Cloud002. For a successful IKE Phase 1 negotiation, the PSKs on both VPN gateways must be identical.
2. Incorrect Remote Network on Router 1: The VPN configuration for Router 1 incorrectly defines the remote "Address Space" as 10.1.1.0/24, which is its own local network. It should be configured to route for the remote cloud network, 10.1.2.0/24.

The consequence of this failed VPN connection is that the application servers in the cloud (10.1.2.0/24 network) cannot communicate with the database server in the on-premises datacenter (10.1.1.0/24 network), causing the 80% of user sessions routed to the cloud to fail.

Part 2:

The selected options resolve the issue through two different strategies.

1. Fixing the VPN Connectivity: Updating the PSK on Router 2 to match Router 1 (Cloud001) is a required step to correct the IPsec tunnel configuration. A mismatched PSK is a fundamental error that prevents the VPN tunnel from being established.
2. Architectural Improvement: Deploying a database replica in the cloud is a strategic solution that resolves the application failure by removing the real-time dependency on the cross-site VPN connection for database queries. This is a common best practice in hybrid cloud architectures to improve application performance, increase resilience, and reduce data transfer latency. By placing a database replica close to the cloud application servers, the application can function even if the VPN tunnel is unstable or has high latency.

These two actions combined ensure both the immediate connectivity issue is addressed and the long-term architectural stability of the hybrid application is improved.

On IPsec Pre-Shared Key (PSK) Matching:

Microsoft Azure Documentation, "About cryptographic requirements and VPN devices for Site-to-Site VPN gateway connections," states that for IKEv1, the Pre-Shared Key must match on both VPN devices. Refer to the section on IKEv1 parameters.

Kurose, J. F., & Ross, K. W. (2017). Computer Networking: A Top-Down Approach (7th ed.). Pearson. Chapter 8 discusses the principles of network security, where the establishment of a shared secret (like a PSK) is fundamental for authentication in protocols like IPsec.

On IPsec Remote Network (Address Space) Configuration:

Cisco, "IPsec Site-to-Site VPN Tunnel Configuration Example," illustrates that the access list or crypto map used in the IPsec configuration must define the traffic to be encrypted, which corresponds to the subnets at the local and remote sites. For Router 1, this means defining traffic between 10.1.1.0/24 (local) and 10.1.2.0/24 (remote). Refer to the sections on configuring access lists for the crypto map.

On Hybrid Cloud Database Architecture:

Armbrust, M., et al. (2010). "A view of cloud computing." Communications of the ACM, 53(4), 50-58. This seminal paper discusses the architectural patterns of cloud computing, including the challenges of data locality and latency in hybrid models, implicitly supporting architectures that replicate data closer to the compute resources. DOI: 10.1145/1721654.1721672

AWS Whitepaper, "Hybrid Cloud with AWS," discusses patterns for creating resilient hybrid architectures. One common pattern is creating read replicas of on-premises databases in the cloud to serve read traffic from cloud-based applications, thereby reducing latency and dependence on the site-to-site connection. Refer to the section on Data and Database Integration strategies.

The user's "Browser cannot display the webpage" error is primarily caused by Firewall 2, which lacks rules to allow traffic from the Network Load Balancers (NLBs) to the CTM server. Rules must be added to permit TCP traffic on ports 80 (HTTP) and 443 (HTTPS) from the NLB IPs (192.168.1.51, 192.168.1.52) to the CTM server IP (192.168.2.15), as defined in dataflow 1A.

For the entire application to function correctly, two other sets of misconfigurations must be corrected:

1. Improper VLAN assignments prevent network segmentation. The BI Server must be moved from VLAN 104 to VLAN 102 (BI), and the Database Server must be moved from VLAN 106 to VLAN 104 (DB).
2. Firewall 3 contains a DENY ALL rule at the top of its access list, which incorrectly blocks all subsequent traffic, including the necessary communications between the CTM, BI, and Database servers (dataflows 2A, 2B, 3B). This rule must be removed to allow the specific ALLOW rules to be processed. A DENY ALL should be the final rule to enforce a policy of least privilege.

National Institute of Standards and Technology (NIST), Special Publication 800-41 Revision 1, Guidelines on Firewalls and Firewall Policy. Section 4.3, "Firewall Rule Sets," discusses the importance of rule set order, stating, "The firewall examines the packet’s header against the rules in its rule set, in order, from first to last. When it finds a rule that matches the packet, the firewall follows the instructions in that rule...". This supports the correction of the DENY rule placement on Firewall 3.

IEEE Std 802.1Q™-2018, IEEE Standard for Local and metropolitan area networks—Bridges and Bridged Networks. Section 3.14, "VLAN," provides the foundational definition of Virtual Local Area Networks (VLANs) as a mechanism to create logically separate broadcast domains on a shared physical network infrastructure. Proper VLAN assignment, as corrected in the BI and DB tiers, is essential for implementing this segmentation.

Kurose, J., & Ross, K. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. Chapter 5 discusses the network layer, including the function of firewalls and Access Control Lists (ACLs) to filter packets based on source/destination IP addresses and port numbers. The configuration changes align with the fundamental principles of packet filtering described.

A Content Delivery Network (CDN) is a geographically distributed network of proxy servers and data centers designed to provide high availability and performance. For a static website accessed globally, a CDN caches the site's content (e.g., HTML, CSS, images) at edge locations around the world. When a user requests the website, the content is served from the nearest edge location, which significantly reduces the physical distance the data must travel. This minimization of distance is the most effective way to reduce network latency for end-users.

A. VPC: A Virtual Private Cloud (VPC) provides a logically isolated network environment within a public cloud. Its primary purpose is security and network segmentation, not global performance optimization or latency reduction.

B. Application load balancer: An Application Load Balancer (ALB) distributes traffic across multiple targets (like virtual machines) within a specific region to enhance availability and scalability, but it does not distribute content globally to reduce latency.

D. API gateway: An API gateway acts as a reverse proxy to manage, secure, and route API requests to backend services. It is not designed for caching and delivering static website content to reduce latency.

1. Amazon Web Services (AWS) Documentation. (2023). What Is Amazon CloudFront? Amazon Web Services

Inc. Retrieved from https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html. In the "How CloudFront delivers content" section

it states

"When a user requests content that you're serving with CloudFront

the request is routed to the edge location that provides the lowest latency (time delay)

so that content is delivered with the best possible performance."

2. Microsoft Azure Documentation. (2023). What is a content delivery network (CDN) on Azure? Microsoft. Retrieved from https://learn.microsoft.com/en-us/azure/cdn/cdn-overview. The overview section states

"A content delivery network (CDN) is a distributed network of servers that can efficiently deliver web content to users. CDNs store cached content on edge servers in point-of-presence (POP) locations that are close to end users

to minimize latency."

3. Google Cloud Documentation. (2023). Cloud CDN overview. Google. Retrieved from https://cloud.google.com/cdn/docs/overview. The document explains

"Cloud CDN (Content Delivery Network) uses Google's global edge network to bring content closer to your users. Bringing content closer to your users accelerates response times for your websites and applications."

4. Kurose

J. F.

& Ross

K. W. (2021). Computer Networking: A Top-Down Approach (8th ed.). Pearson. In Chapter 2

Section 2.6

"Content Distribution Networks

" the text details how CDNs place servers in multiple geographically distributed locations to serve content to users from the closest edge server

thereby reducing latency and improving user experience.

A managed SQL database, often referred to as Database as a Service (DBaaS) or a Platform as a Service (PaaS) offering, is the most suitable choice for minimizing operational overhead. In this model, the cloud service provider is responsible for managing the underlying infrastructure, operating system, database software patching, backups, and high availability. This allows the company's development team to focus on schema design and application integration rather than the time-consuming tasks of database administration, directly fulfilling the core requirement of the question.

A. A database installed on a virtual machine: This Infrastructure as a Service (IaaS) approach maximizes operational overhead, as the company is responsible for managing the OS, patching, backups, and all database software administration.

C. A database migration service: This is a tool or service used to move existing databases to the cloud. It is not a hosting solution for a new application's database.

D. A hybrid database setup: A hybrid model, which combines on-premises and cloud resources, typically increases complexity and operational overhead due to the need to manage and synchronize two distinct environments.

1. Mell

P.

& Grance

T. (2011). The NIST Definition of Cloud Computing (Special Publication 800-145). National Institute of Standards and Technology.

Section: "Platform as a Service (PaaS)": This section defines PaaS

stating

"The consumer does not manage or control the underlying cloud infrastructure including network

servers

operating systems

or storage

but has control over the deployed applications..." This directly supports the concept of reduced operational overhead for the consumer.

2. Amazon Web Services (AWS). (n.d.). Amazon RDS Features.

Section: "Easy to Administer": The documentation states

"Amazon RDS makes it easy to go from project conception to deployment. Use the AWS Management Console... to access the capabilities of a production-ready relational database in minutes. No need for infrastructure provisioning

and no need for installing and maintaining database software." This contrasts directly with the high overhead of managing a database on a VM (IaaS).

3. Microsoft Azure. (n.d.). What is Azure SQL Database?.

Section: "Overview": The documentation describes Azure SQL Database as a "fully managed platform as a service (PaaS) database engine that handles most of the database management functions like upgrading

patching

backups

and monitoring without user involvement." This explicitly confirms that managed services are designed to minimize administrative burden.

4. Armbrust

M.

Fox

A.

Griffith

R.

Joseph

A. D.

Katz

R.

Konwinski

A.

... & Zaharia

M. (2010). A view of cloud computing. Communications of the ACM

53(4)

50-58.

DOI: https://doi.org/10.1145/1721654.1721672

Page 51

Section 2.1 "Classes of Utility Computing": The paper explains that with PaaS

the provider manages the "operating system

and the collective hardware

" which "lowers the barrier to entry for deploying applications" by reducing the need for system administration expertise.

Deploying application instances in multiple geographic regions is a fundamental strategy for serving a global user base. The primary motivation for placing resources closer to end-users, such as deploying a website in Europe for European customers, is to reduce network latency. Latency is the delay in data transmission, which is significantly influenced by the physical distance between the user and the server. By serving requests from a geographically proximate server, the round-trip time is minimized, leading to faster page loads and a better user experience.

A. To simplify workflow: Managing a multi-region deployment adds complexity to workflows, including data synchronization, configuration management, and monitoring, rather than simplifying them.

B. To enhance security: While a multi-region setup can improve availability and disaster recovery (which are aspects of security), it is not the primary driver for this specific action compared to the direct performance benefit.

D. To decrease cost: Operating infrastructure in an additional region incurs extra costs for compute, storage, and inter-region data transfer, thus increasing overall expenditure.

1. AWS Well-Architected Framework

Performance Efficiency Pillar (July 2023): In the section "PERF 2: How do you select the best performing architecture?"

the framework states

"To reduce latency

you can locate your infrastructure closer to your users or locate your data closer to your infrastructure." It further advises to "Select the right AWS Region(s) and Edge locations based on where your customers are located to reduce latency." (Page 11).

2. Microsoft Azure Documentation

"Multi-region N-tier application": In the architecture overview

it is stated

"Deploying the application in multiple regions can reduce latency for users. If you route users to the nearest region

they will experience lower network latency." This is listed as a primary benefit of the multi-region pattern. (Reference Architecture ID: architectures/n-tier/multi-region-n-tier.yml).

3. Google Cloud Documentation

"Choosing a network service tier": This document explains how network design impacts performance for global users. It notes

"For the lowest possible latency

Google Cloud recommends that you serve your traffic from a region that is closest to your users." (Section: "When to use Standard Tier and Premium Tier").

4. Armbrust

M.

et al. (2009). Above the Clouds: A Berkeley View of Cloud Computing. University of California

Berkeley. In Section 3.2

"Classes of Utility Computing

" the paper discusses the importance of geographic location for latency-sensitive applications: "For a user in New York

a datacenter in California can easily add 80 ms of latency to every interaction due to the speed of light

versus a datacenter in New York." (Page 10

EECS Department

Technical Report No. UCB/EECS-2009-28).

The scenario describes heavy performance degradation during specific times, which indicates a resource bottleneck under peak load. When a Virtual Machine's (VM) workload demands more memory than the physically allocated RAM (8 GB in this case), the hypervisor or the VM's guest operating system will resort to swapping. This process involves moving memory pages to much slower disk storage to free up RAM. The high latency of disk I/O compared to RAM access causes a severe and noticeable drop in application and system performance, a condition often called "thrashing." This directly matches the symptoms described.

A. The host requires additional physical CPUs.

While CPU contention can cause slowdowns, the "heavy degradation" described is more characteristic of memory exhaustion and swapping than CPU queuing.

B. A higher number of processes occur at those times.

This describes the cause of the increased load but is not the root explanation for the performance failure; the failure is the system's inability to handle that load due to a resource limit.

D. The storage is overutilized.

This is a possible outcome of heavy swapping but not the root cause. The primary issue is the lack of RAM, which forces the system to overutilize storage for swapping operations.

---

1. VMware Official Documentation. (2023). vSphere Resource Management for VMware vSphere 8.0. Chapter 8: Managing Memory Resources

Section: Host-Level Swapping. The guide states

"Host-level swapping is a last resort for ESXi to reclaim memory... The performance of a virtual machine can degrade significantly when the guest operating system or the host swaps." This confirms that swapping due to memory pressure causes severe performance degradation.

2. University Courseware. Arpaci-Dusseau

R. H.

& Arpaci-Dusseau

A. C. (2018). Operating Systems: Three Easy Pieces. Arpaci-Dusseau Books. In Chapter 22

"Swapping: Mechanisms

" the text explains that when physical memory is full

the OS will swap pages to disk. Chapter 23

"The Memory Hierarchy

" quantifies the performance difference

noting that accessing disk is orders of magnitude (100

000x) slower than accessing DRAM

which explains the "heavy" performance degradation.

3. Peer-Reviewed Academic Publication. Waldspurger

C. A. (2002). Memory resource management in VMware ESX server. In Proceedings of the 5th symposium on Operating systems design and implementation (OSDI '02). USENIX Association

USA

181–194. Section 4.4

"Swapping

" explicitly states

"As a last resort

ESX can reclaim memory by swapping pages from a VM to a server swap file... Since swapping requires disk I/O

it can impose a large performance overhead." This foundational paper validates that swapping is a high-overhead

last-resort mechanism.