CompTIA Cloud+ (CV0-004) Practice Exam

What the CompTIA Cloud+ (CV0-004) exam covers

• Cloud Architecture178 questions
• Deployment148 questions
• Operations131 questions
• Security148 questions
• DevOps Fundamentals77 questions
• Troubleshooting93 questions

Free CompTIA Cloud+ (CV0-004) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 775.

1. Question 1Cloud Architecture

   A company wants full control over the guest operating system, middleware, and runtime while the provider manages only the physical hardware, virtualization, and network. Which cloud service model best fits this requirement?

   • APlatform as a Service (PaaS)
   • BSoftware as a Service (SaaS)
   • CInfrastructure as a ServiceCorrect
   • DFunction as a Service (FaaS)
   ✓ Correct answer: C

   IaaS provides virtualized compute, storage, and networking while the provider manages only the physical hardware, the hypervisor, and the underlying network fabric. Because the customer receives a raw virtual machine, they install, configure, and patch the guest operating system, middleware, and runtime themselves, which delivers the described control split and the most granular customization of any service model.

   Why the other options are wrong

   • APaaS hides the operating system and runtime from the customer, so full middleware control is unavailable.
   • BSaaS is managed end to end by the provider, leaving no OS, middleware, or runtime access at all.
   • DFaaS executes code on an ephemeral, provider-managed runtime with no persistent OS for the customer to configure.
2. Question 2Cloud Architecture

   Two separate virtual networks need private connectivity to each other's resources without routing traffic over the public internet, and without deploying a VPN gateway. Which solution fits best?

   • AVPC/VNet peeringCorrect
   • BA public DNS zone
   • CA content delivery network
   • DAn internet gateway
   ✓ Correct answer: A

   Peering establishes a private, direct network connection between two virtual networks using the provider's internal backbone, letting resources in each communicate using private addresses without a VPN gateway or any traversal of the public internet.

   Why the other options are wrong

   • BA public DNS zone resolves domain names to addresses and does not create private network connectivity between two VPCs.
   • CA CDN caches content for end users and has no role in connecting two private virtual networks together.
   • DAn internet gateway provides a path to the public internet, which is the opposite of a private, internet-avoiding connection.
3. Question 3Cloud Architecture

   A workload runs continuously at a predictable level around the clock for the foreseeable future. Which pricing approach generally provides the LOWEST cost compared to standard on-demand pricing?

   • AReserved capacity or a savings planCorrect
   • BSpot or preemptible pricing
   • CStandard on-demand pricing
   • DHourly burstable pricing
   ✓ Correct answer: A

   Because this workload's usage is steady and highly predictable, committing to a reservation or savings plan captures a guaranteed discount without the interruption risk that spot capacity carries, unlike a workload with fluctuating demand or a short, disposable lifespan.

   Why the other options are wrong

   • BSpot pricing is cheaper only when interruption is genuinely acceptable, making it a poor fit for a continuous, predictable workload.
   • COn-demand pricing carries no discount at all and costs more than a committed option for steady, long-term usage.
   • DBurstable pricing targets variable short spikes in demand, not a workload running continuously at one steady level.
4. Question 4Deployment

   What is a common tradeoff organizations accept when choosing to repurchase a workload instead of migrating it?

   • ALess maintenance burden, but possible loss of custom features and retrainingCorrect
   • BGuaranteed feature parity paired with zero required data migration effort
   • CNo need to evaluate the new product at all before adoption begins
   • DElimination of any ongoing subscription or licensing cost going forward
   ✓ Correct answer: A

   Moving to a different commercial or SaaS product usually shifts maintenance and update responsibility to the vendor, but the replacement rarely matches every custom feature the old application had, and staff must learn new workflows. Data still has to be migrated into the new product, so this tradeoff is the realistic expectation.

   Why the other options are wrong

   • BRepurchase rarely guarantees feature parity, and data migration into the new product is still required.
   • CSkipping evaluation of the replacement product is poor practice, not a benefit of repurchasing.
   • DMost SaaS repurchase options still carry an ongoing subscription cost rather than eliminating it.
5. Question 5Operations

   What is the primary purpose of application performance monitoring (APM) tooling in a cloud environment?

   • ATo measure code-level and transaction performance in an appCorrect
   • BTo encrypt application data while it is stored on disk
   • CTo provision new virtual machines from a service catalog
   • DTo enforce network access control lists between subnets
   ✓ Correct answer: A

   APM solutions insert instrumentation into application code or runtimes to capture metrics such as method execution time, database call duration, and transaction throughput. This visibility lets teams pinpoint slow code paths, failing dependencies, and performance bottlenecks that generic infrastructure metrics alone cannot reveal. This instrumentation typically adds low-overhead hooks to methods, database drivers, and external calls so timing data is captured without materially slowing the application.

   Why the other options are wrong

   • BEncryption protects data confidentiality; it is unrelated to performance instrumentation.
   • CProvisioning virtual machines is an infrastructure automation task, not a monitoring function.
   • DAccess control lists filter network traffic and do not measure application performance.
6. Question 6Operations

   How does consistent resource tagging support lifecycle management across a large cloud environment?

   • AIt flags owner, environment, and expiration for automationCorrect
   • BIt automatically encrypts every tagged resource
   • CIt replaces the need for a provisioning template
   • DIt prevents any resource from ever being deleted
   ✓ Correct answer: A

   Tags such as owner, environment, or a planned expiration date give automation something concrete to query against, so a lifecycle policy can find, for example, every test-tagged resource older than thirty days and act on it. Without consistent tagging, that same policy has no reliable way to distinguish resources that are safe to reclaim from ones still in active use.

   Why the other options are wrong

   • BTagging is metadata; it has no effect on whether a resource's data is encrypted.
   • CTags describe a resource after it exists; they do not substitute for a provisioning template.
   • DTagging supports informed deletion decisions, it does not block deletion from ever happening.
7. Question 7SecuritySelect all that apply

   A developer accidentally commits a service account key file to a public source code repository. Which response actions are appropriate? (Select all that apply.)

   • ARevoke or disable the exposed service account key nowCorrect
   • BPurge or rotate the key so the leaked copy is uselessCorrect
   • CLeave the key active since removing the commit is enough
   • DWait a few weeks to see if the key gets misused first
   ✓ Correct answer: A, B

   Once a key has been pushed to a public repository, it must be treated as compromised even after the commit is removed, since it may already be cached, forked, or scraped by automated bots that scan public repositories continuously. Revoking or rotating the key immediately renders the leaked copy useless, which is the only way to fully close the exposure.

   Why the other options are wrong

   • CRemoving the commit from the repository does not undo the exposure; the key may already be cached or scraped elsewhere.
   • DWaiting to see if the key gets misused leaves a known-exposed credential valid the entire time, unnecessarily.
8. Question 8Security

   An API endpoint is being overwhelmed by an excessive number of requests per second from a small set of source addresses, degrading service for all users. Which control specifically addresses this application-layer abuse?

   • ARate limiting requests per clientCorrect
   • BIncreasing the subnet size
   • CAdding network ACL rules for unrelated ports
   • DRotating the SSH host key
   ✓ Correct answer: A

   Rate limiting caps how many requests a given client can make within a defined time window, directly throttling the abusive callers responsible for the spike without affecting the underlying network path or the experience of unrelated legitimate clients.

   Why the other options are wrong

   • BSubnet sizing affects how many addresses are available for allocation, not the rate of requests an endpoint accepts.
   • CAdding ACL rules on unrelated ports does not throttle the volume of requests actually hitting the abused API endpoint.
   • DRotating an SSH host key relates to remote administrative access, not to the volume of API requests being received.
9. Question 9DevOps Fundamentals

   What is the main purpose of using namespaces within a container orchestration cluster?

   • ATo logically partition cluster resources so teams or environments stay isolatedCorrect
   • BTo physically separate the cluster into multiple independent hardware racks
   • CTo permanently merge every deployed application into a single running pod
   • DTo replace the need for any role-based access control policy across the cluster
   ✓ Correct answer: A

   A namespace creates a scoped view of cluster resources, letting names, quotas, and access policies be applied separately per team, project, or environment on the same shared cluster. It is a logical, not physical, division, which keeps resource usage and configuration organized without needing separate clusters.

   Why the other options are wrong

   • BNamespaces are a logical construct within one cluster, not a way of splitting hardware into separate physical racks.
   • CNamespaces organize many separate workloads side by side; they do not force applications into a single shared pod.
   • DNamespaces work alongside role-based access control, scoping where policies apply, rather than replacing the access control system.
10. Question 10Troubleshooting

    A load balancer serves traffic for app.example.com using a certificate issued for api.example.com. Clients connecting to app.example.com report a security warning about the certificate not matching the site. What caused this?

    • AThe certificate's SAN entries do not cover the requested hostnameCorrect
    • BThe load balancer is routing traffic to the wrong region
    • CThe client's browser cache needs to be cleared
    • DThe certificate was signed using a deprecated hashing algorithm
    ✓ Correct answer: A

    TLS clients compare the hostname being requested against the names listed on the certificate, either the common name or the subject alternative names. Since the certificate was issued for a different hostname than the one being visited, the client correctly flags a mismatch, and the resolution is to issue or attach a certificate covering the actual hostname.

    Why the other options are wrong

    • BRegion routing would affect latency or availability, not certificate hostname validation.
    • CA cache clear would not resolve a genuine server side hostname mismatch.
    • DAn outdated algorithm would trigger a different, algorithm specific warning, not a name mismatch.

Who this CompTIA Cloud+ (CV0-004) practice exam is for

This practice set is for anyone preparing for the CompTIA Cloud+ (CV0-004) exam - from first-time candidates building a foundation to experienced professionals doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this CompTIA Cloud+ (CV0-004) practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real CompTIA Cloud+ (CV0-004) exam.

Related Security resources

• Security practice examsAll Security
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• (ISC)² CISSP practice examRelated
• CompTIA SecurityX (CAS-005, formerly CASP+) practice examRelated
• (ISC)² Certified in Cybersecurity (CC) practice examRelated

CompTIA Cloud+ (CV0-004) practice exam FAQ