CompTIA CV0-004 Practice Test 28
Question 270
Before changing production at a regional health provider, a deployment pipeline accepts a YAML config with misnested environment variables and an application starts with defaults. Which evidence should the engineer check first?
- Compare resource snapshots, IaC state, policy baselines and audit events.
- Inspect indentation, parsed object tree and schema constraints.
- Examine conditional branches, request idempotency tokens and partial-state cleanup.
- Inspect manual drift, state management, dependencies and parameter separation.
Explanation
Correct Answer
B:Inspect indentation, parsed object tree and schema constraints. This distinguishes the relevant dependency before changing cloud resources. YAML whitespace can change structure; syntactically valid text may still violate the target resource schema.
Incorrect Answers
A:That approach would help when after a release, an operator manually broadens a cloud firewall rule and future IaC previews show unexpected changes. In this case, yAML whitespace can change structure; syntactically valid text may still violate the target resource schema.
C:YAML whitespace can change structure; syntactically valid text may still violate the target resource schema.
D:Inspect manual drift, state management, dependencies and parameter separation. The relevant cloud response here is: Inspect indentation, parsed object tree and schema constraints.
Question 271
The incident responder reviews a case where an IaC template has a production API token pasted into a committed plain-text parameter file. What should the team change first?
- Make creation conditional on resource existence and use idempotent API calls where available.
- Require a reviewed plan and constrain destructive changes with approval policy.
- Replace embedded secrets with approved secret-store references and least-privilege pipeline identity.
- Run drift detection against the versioned declaration and reconcile through approved review.
Explanation
Correct Answer
C:Configuration templates and version-control history can expose secrets even when deployment access is restricted. The change should be verified, not just applied: Static scanning finds no embedded secret and the deployment reads its credential through approved identity.
Incorrect Answers
A:That approach would help when a cloud provisioning script creates duplicate service accounts whenever an operator retries a partially failed run. In this case, configuration templates and version-control history can expose secrets even when deployment access is restricted.
B:IaC execution can delete resources to reconcile the desired state, so dry-run review matters. The relevant cloud response here is: Replace embedded secrets with approved secret-store references and least-privilege pipeline identity.
D:Drift is divergence between actual resources and the desired configuration, not necessarily an intentional new baseline. The relevant cloud response here is: Replace embedded secrets with approved secret-store references and least-privilege pipeline identity.
Question 272
An IaC template has a production API token pasted into a committed plain-text parameter file. What underlying cloud behavior should the engineer recognize?
- IaC execution can delete resources to reconcile the desired state, so dry-run review matters.
- YAML whitespace can change structure; syntactically valid text may still violate the target resource schema.
- Retry-safe automation must avoid duplicate side effects and handle partially completed prior work.
- Configuration templates and version-control history can expose secrets even when deployment access is restricted.
Explanation
Correct Answer
D:The evidence of success is: Static scanning finds no embedded secret and the deployment reads its credential through approved identity.
Incorrect Answers
A:That approach would help when a deployment template unexpectedly schedules a production database deletion during a simple storage change. Check the difference through: Review repository history, variable sources, secret references and pipeline scope.
B:The alternative is aimed at a different condition: A deployment pipeline accepts a YAML config with misnested environment variables and an application starts with defaults. It does not directly resolve the described failure. Configuration templates and version-control history can expose secrets even when deployment access is restricted. Check the difference through: Review repository history, variable sources, secret references and pipeline scope.
C:The proposed measure serves a related cloud task, but the present symptom calls for a more specific response. Configuration templates and version-control history can expose secrets even when deployment access is restricted. Check the difference through: Review repository history, variable sources, secret references and pipeline scope.
Question 273
During postchange validation at a global distribution company, an IaC template has a production API token pasted into a committed plain-text parameter file. What outcome would prove the intended safeguard works?
- Static scanning finds no embedded secret and the deployment reads its credential through approved identity.
- The final resource state matches the approved version and unauthorized changes are logged.
- Two fresh deployments produce equivalent authorized topology and report the same resource plan.
- A re-run converges an altered test server to the approved baseline without breaking the workload.
Explanation
Correct Answer
A:Static scanning finds no embedded secret and the deployment reads its credential through approved identity. This proves the service behavior rather than just showing a changed configuration. Configuration templates and version-control history can expose secrets even when deployment access is restricted.
Incorrect Answers
B:That approach would help when after a release, an operator manually broadens a cloud firewall rule and future IaC previews show unexpected changes. The required acceptance result is: Static scanning finds no embedded secret and the deployment reads its credential through approved identity.
C:Configuration templates and version-control history can expose secrets even when deployment access is restricted.
D:A re-run converges an altered test server to the approved baseline without breaking the workload. The relevant cloud response here is: Static scanning finds no embedded secret and the deployment reads its credential through approved identity.
Question 274
A review identifies this symptom: an IaC template has a production API token pasted into a committed plain-text parameter file. Which read-only investigation is most useful?
- Inspect manual drift, state management, dependencies and parameter separation.
- Review repository history, variable sources, secret references and pipeline scope.
- Examine conditional branches, request idempotency tokens and partial-state cleanup.
- Inspect indentation, parsed object tree and schema constraints.
Explanation
Correct Answer
B:Review repository history, variable sources, secret references and pipeline scope. This distinguishes the relevant dependency before changing cloud resources. Configuration templates and version-control history can expose secrets even when deployment access is restricted.
Incorrect Answers
A:That approach would help when engineers manually create each testing environment, resulting in different subnets and load-balancer settings. Review repository history, variable sources, secret references and pipeline scope.
C:Examine conditional branches, request idempotency tokens and partial-state cleanup. The relevant cloud response here is: Review repository history, variable sources, secret references and pipeline scope.
D:Inspect indentation, parsed object tree and schema constraints. The relevant cloud response here is: Review repository history, variable sources, secret references and pipeline scope.
Question 275
At a global distribution company, a cloud provisioning script creates duplicate service accounts whenever an operator retries a partially failed run. Which response most directly addresses this specific cloud challenge?
- Require a reviewed plan and constrain destructive changes with approval policy.
- Apply versioned configuration-as-code policies to the guest systems.
- Make creation conditional on resource existence and use idempotent API calls where available.
- Use reviewed declarative IaC modules and environment-specific parameters.
Explanation
Correct Answer
C:Retry-safe automation must avoid duplicate side effects and handle partially completed prior work. The change should be verified, not just applied: Two consecutive executions converge to one resource identity with no duplicate permissions.
Incorrect Answers
A:That approach would help when a deployment template unexpectedly schedules a production database deletion during a simple storage change. In this case, retry-safe automation must avoid duplicate side effects and handle partially completed prior work.
B:Configuration as code enforces operating system and application settings after infrastructure provisioning. The relevant cloud response here is: Make creation conditional on resource existence and use idempotent API calls where available.
D:Declarative IaC encodes desired resource state and improves repeatability without removing the need for access controls. The relevant cloud response here is: Make creation conditional on resource existence and use idempotent API calls where available.
Question 276
In a technical review for a regional health provider, a cloud provisioning script creates duplicate service accounts whenever an operator retries a partially failed run. Which cloud principle is most relevant?
- YAML whitespace can change structure; syntactically valid text may still violate the target resource schema.
- Declarative IaC encodes desired resource state and improves repeatability without removing the need for access controls.
- Configuration as code enforces operating system and application settings after infrastructure provisioning.
- Retry-safe automation must avoid duplicate side effects and handle partially completed prior work.
Explanation
Correct Answer
D:The evidence of success is: Two consecutive executions converge to one resource identity with no duplicate permissions.
Incorrect Answers
A:That approach would help when a deployment pipeline accepts a YAML config with misnested environment variables and an application starts with defaults. Check the difference through: Examine conditional branches, request idempotency tokens and partial-state cleanup.
B:The alternative is aimed at a different condition: Engineers manually create each testing environment, resulting in different subnets and load-balancer settings. It does not directly resolve the described failure. Retry-safe automation must avoid duplicate side effects and handle partially completed prior work. Check the difference through: Examine conditional branches, request idempotency tokens and partial-state cleanup.
C:The proposed measure serves a related cloud task, but the present symptom calls for a more specific response. Retry-safe automation must avoid duplicate side effects and handle partially completed prior work. Check the difference through: Examine conditional branches, request idempotency tokens and partial-state cleanup.
Question 277
The release owner has addressed this condition: a cloud provisioning script creates duplicate service accounts whenever an operator retries a partially failed run. Which observation verifies the outcome?
- Two consecutive executions converge to one resource identity with no duplicate permissions.
- Two fresh deployments produce equivalent authorized topology and report the same resource plan.
- Static scanning finds no embedded secret and the deployment reads its credential through approved identity.
- The deployment plan shows no unapproved deletion before production approval.
Explanation
Correct Answer
A:Two consecutive executions converge to one resource identity with no duplicate permissions. This proves the service behavior rather than just showing a changed configuration. Retry-safe automation must avoid duplicate side effects and handle partially completed prior work.
Incorrect Answers
B:That approach would help when engineers manually create each testing environment, resulting in different subnets and load-balancer settings. The required acceptance result is: Two consecutive executions converge to one resource identity with no duplicate permissions.
C:Retry-safe automation must avoid duplicate side effects and handle partially completed prior work.
D:The deployment plan shows no unapproved deletion before production approval. The relevant cloud response here is: Two consecutive executions converge to one resource identity with no duplicate permissions.
Question 278
During initial triage, a cloud provisioning script creates duplicate service accounts whenever an operator retries a partially failed run. Which check best narrows down the cause?
- Inspect indentation, parsed object tree and schema constraints.
- Examine conditional branches, request idempotency tokens and partial-state cleanup.
- Compare resource snapshots, IaC state, policy baselines and audit events.
- Inspect desired package versions, service states, users and idempotency behavior.
Explanation
Correct Answer
B:Examine conditional branches, request idempotency tokens and partial-state cleanup. This distinguishes the relevant dependency before changing cloud resources. Retry-safe automation must avoid duplicate side effects and handle partially completed prior work.
Incorrect Answers
A:That approach would help when a deployment pipeline accepts a YAML config with misnested environment variables and an application starts with defaults. Examine conditional branches, request idempotency tokens and partial-state cleanup.
C:Compare resource snapshots, IaC state, policy baselines and audit events. The relevant cloud response here is: Examine conditional branches, request idempotency tokens and partial-state cleanup.
D:Inspect desired package versions, service states, users and idempotency behavior. The relevant cloud response here is: Examine conditional branches, request idempotency tokens and partial-state cleanup.
Question 279
For the affected cloud environment, a batch analytics workload needs compatible accelerators but its selected region has no supported GPU instance family. Which remedy best fits the requirement?
- Provision multi-zone application and database tiers with suitable failover configuration.
- Provision protected backup storage with required encryption, separate access and retention.
- Choose an available region and accelerator quota matching the application framework.
- Create a scoped sandbox with budget alerts, approved quotas, tags and expiration policy.
Explanation
Correct Answer
C:Specialized compute provisioning depends on regional SKUs, accelerator driver compatibility and quota. The change should be verified, not just applied: A benchmark job uses the required accelerator within budget and remains in an approved data location.
Incorrect Answers
A:That approach would help when a customer service application has a strict availability target but its proposed design uses a single-zone database. In this case, specialized compute provisioning depends on regional SKUs, accelerator driver compatibility and quota.
B:Recovery resources are part of deployment design, not something guaranteed by a primary-volume replica. The relevant cloud response here is: Choose an available region and accelerator quota matching the application framework.
D:Provisioning should satisfy functional needs while preventing uncontrolled costs and insecure defaults. The relevant cloud response here is: Choose an available region and accelerator quota matching the application framework.
Question 280
The cloud engineer at a regional health provider investigates this condition: a batch analytics workload needs compatible accelerators but its selected region has no supported GPU instance family. Which explanation best accounts for it?
- Recovery resources are part of deployment design, not something guaranteed by a primary-volume replica.
- Provisioning should satisfy functional needs while preventing uncontrolled costs and insecure defaults.
- Availability requirements should influence both compute placement and stateful database replication.
- Specialized compute provisioning depends on regional SKUs, accelerator driver compatibility and quota.
Explanation
Correct Answer
D:The evidence of success is: A benchmark job uses the required accelerator within budget and remains in an approved data location.
Incorrect Answers
A:That approach would help when a customer data service requires encrypted offsite backups, tested restore, retention and limited administrator access. Check the difference through: Check GPU model, runtime dependencies, SKU availability and quota.
B:The alternative is aimed at a different condition: A temporary training environment must allow experimentation without unlimited compute spending or public network exposure. Specialized compute provisioning depends on regional SKUs, accelerator driver compatibility and quota.
C:The proposed measure serves a related cloud task, but the present symptom calls for a more specific response. Specialized compute provisioning depends on regional SKUs, accelerator driver compatibility and quota. Check the difference through: Check GPU model, runtime dependencies, SKU availability and quota.