CV0-004 Sample Questions & Answers

This is the most comprehensive and automated solution. The CI/CD pipeline integration with Trivy provides 'shift-left' security by catching vulnerabilities early. The validating admission webhook with OPA acts as a final gatekeeper, enforcing the policy at the cluster level before any pod is created. This combination ensures that no container with critical vulnerabilities can run, regardless of how it was deployed, providing a robust defense-in-depth security posture.

Distributed tracing is specifically designed to track the entire lifecycle of a request as it travels through a distributed system. By instrumenting applications with a framework like OpenTelemetry, each request is assigned a unique trace ID, and each service call generates a span. This allows SREs to visualize the full request path, identify which service calls are contributing the most latency, and diagnose errors that occur deep within the call stack. While logging and metrics are crucial parts of observability, only distributed tracing provides the end-to-end visibility needed to effectively troubleshoot performance in a complex, multi-service environment.

This solution is the most cost-effective and operationally efficient. AWS Backup provides a centralized, automated way to manage backups across AWS services, meeting the 24-hour RPO with daily snapshots. EBS Snapshots allow for recovery within the 8-hour RTO. Transitioning the snapshots to S3 Glacier Deep Archive, the lowest-cost storage class, after a short period satisfies the 7-year retention requirement in the most economical way.

SAML 2.0 federation is the standard protocol for enabling single sign-on (SSO) and passing authentication information from a central identity provider (like AD FS) to service providers (like AWS and Azure). This allows users to authenticate once against their on-premises Active Directory and gain access to resources in both clouds without separate credentials.

After establishing federation, the next step is to implement RBAC. This is done by creating roles in each cloud provider that define specific permissions. These roles are then mapped to security groups in the on-premises Active Directory. When a user authenticates, their group memberships are passed in the SAML assertion, allowing them to assume the corresponding role and its permissions in AWS or Azure.

The most secure way to enforce encryption on upload is to explicitly deny any s3:PutObject action if the encryption header is missing. A bucket policy with "Effect": "Deny" and a condition checking if "Null": {"s3:x-amz-server-side-encryption": "true"} will reject any upload attempt that does not specify server-side encryption. This ensures that unencrypted objects can never be written to the bucket, providing a stronger guarantee than just setting a default encryption configuration.

A canary deployment is specifically designed for this scenario. It involves rolling out the new version of the application to a small subset of users or servers (the 'canary'). This allows the team to monitor its performance and error rates under real production traffic. If the new version performs well, traffic is gradually shifted until all users are on the new version. If issues are detected, traffic can be quickly routed back to the stable version, minimizing the impact of the bug.

An Application Load Balancer (ALB) is the correct service for this purpose. It is designed to operate at the application layer (Layer 7) and can distribute HTTP/HTTPS traffic across multiple targets, such as EC2 instances, in multiple Availability Zones. Crucially, it performs health checks on the targets and automatically routes traffic only to healthy instances, which is essential for building a highly available and fault-tolerant system.