Study guide · Core notes
Reference notes for service models, availability, migration, day-to-day operations, identity, and the DevOps tools Cloud+ keeps asking you to separate.
How to read these notes: Items tagged Extra sit outside the CV0-004 objective bullets, such as anti-affinity. Learn the unmarked items first. New to the exam? Start with the overview for the format, the 750 passing score, and how CV0-003 differs. RTO and RPO match the Network+ notes. Infrastructure-as-code depth beyond this exam is on Terraform Associate.
Domain 1 starts here. Say who operates each layer before you name a product.
| Model | You still own | The provider usually owns |
|---|---|---|
| IaaS | Guest operating system, applications, and data | Physical hosts, hypervisor, and the provider network |
| PaaS | Application code and data | Runtime, operating system, and the platform you deploy onto |
| SaaS | Accounts, configuration, and the data you put in | The application itself |
| FaaS | Function code and the events that invoke it | The runtime, scaling, and the servers you never see |
Public cloud is the provider's shared infrastructure. Private cloud is dedicated to one organization and can sit on premises. Hybrid connects private and public so workloads can move or burst. Community cloud is shared by organizations with a common mission, such as agencies that must meet the same rule set.
Pay-as-you-go charges for what you use, with no commitment. Reserved resources trade a term commitment for a lower rate. Spot capacity is cheap because the provider can reclaim it. A dedicated host is a physical server billed to you, which matters for licenses that count sockets. Tagging attributes spend to a team. Rightsizing matches the size to measured use. Metering is how the provider counts that use.
Relational databases store rows and enforce relationships. Non-relational databases store documents, keys, or wide columns and scale differently. Self-managed means you patch the engine. Provider-managed, sometimes called database as a service on the acronym list, means the provider patches the engine and you still own the data and access.
A region is not a zone. A hot site is not a short RPO by itself.
| Term | What it means |
|---|---|
| Region | A geographic area of the provider. Data residency and disaster scope are chosen here. |
| Availability zone | An isolated location inside a region, with separate power and network. Spread copies across zones to survive one location. |
| Edge | Compute or cache close to users or devices, which cuts latency. |
| Cloud bursting | Private capacity overflows into a public cloud when load exceeds what you keep on premises. |
| RTO | How long you can be down. The recovery time objective. |
| RPO | How much data you can lose, measured as time since the last good copy. |
| Hot site | Running and ready. It meets a short RTO and costs the most. |
| Warm site | Some systems are up. You still restore or start the rest. |
| Cold site | Space and little else. It misses a short RTO. |
Multicloud means more than one provider. Tenancy means how customers share the platform. CV0-004 places "multicloud tenancy" with service availability. Do not treat a second provider as a second availability zone inside the first provider. Zones fail independently. Providers can fail on a wider scope.
Name the layer of the load balancer and the kind of connection before you name a vendor product.
| Piece | Job |
|---|---|
| VPN | Encrypted tunnel over a shared network. Flexible, and it shares that network's latency. |
| Dedicated connection | A private circuit into the provider. More predictable than a VPN, and slower to turn up. |
| Network load balancer | Forwards by address and port. It does not read the HTTP path. |
| Application load balancer | Forwards by host or path. Use it when HTTP routes differ. |
| Application gateway | A layer-7 entry that can inspect web traffic, often next to a web application firewall. |
| CDN | Caches content near users. It is not a database replica. |
| VPC peering | Connects two virtual networks directly. It does not transit through a third network. |
| Transit gateway | A hub so many networks connect once instead of a full mesh of peerings. |
| SDN | The control plane is software. You change forwarding with policy instead of visiting each device. |
| BGP | Exchanges routes between autonomous systems. A static route is one prefix you type and that does not adapt. |
Pick the type for the access pattern, then the tier for how often you read it.
| Choice | Use it when |
|---|---|
| Block | A virtual machine needs a disk. Performance is IOPS and throughput. |
| File | Many systems must share one filesystem. Network-attached storage is the usual shape. |
| Object | You store blobs and read them over HTTP. It is the usual home for backups and static content. |
| Hot | Frequent reads. Highest storage price, lowest access penalty. |
| Warm | Occasional reads. A middle price. |
| Cold | Rare reads. Cheap to store, slower or costlier to read. |
| Archive | Retention you almost never read. The slowest retrieval. |
| SSD and HDD | SSD for IOPS and latency. HDD when capacity matters more than speed. |
A storage area network presents block storage over the network. Local disk stays on the host and does not survive a host loss unless you replicate it. Persistent container volumes outlive the container. Ephemeral storage disappears with the instance or container.
Orchestration is not the same thing as a single container or a single virtual machine.
A virtual machine is a guest with its own operating system. A container shares the host kernel and starts faster. Serverless, usually a function, runs only when invoked. Choose a virtual machine when you need a full guest or hardware pass-through. Choose a container when the unit of deploy is an image. Choose a function when you do not want an idle server.
Stand-alone means one host runs the container. Workload orchestration schedules many containers, restarts failures, and places them. Port mapping publishes a container port on the host. An image registry stores images. A public registry is reachable by anyone who has the name. A private registry requires access.
Stand-alone is one host. Clustering lets guests move or restart on another host. Cloning copies a machine. Host affinity pins a guest to a host. Hardware pass-through gives the guest a physical device. An overlay network is a virtual network on top of the physical one. A virtual-machine network is the guest's own interfaces.
Managed services remove a layer you would otherwise patch. Microservices split one application into independently deployed parts. Loosely coupled parts fail without taking the others down with them. Fan-out delivers one event to many consumers. Service discovery lets a caller find a healthy instance without a hard-coded address.
Extra Anti-affinity keeps two copies off the same host so one host failure cannot take both. CV0-004 names host affinity, not anti-affinity. Learn affinity as the tested term.
Domain 2. Name the strategy by how much of the application you change.
| Name | What changes |
|---|---|
| Blue-green | Two full environments. You switch traffic from the old color to the new one, and you can switch back. |
| Canary | A small share of traffic hits the new version first. You expand only if it holds. |
| Rolling | Instances update in batches. Old and new run together during the rollout. |
| In-place | You update the existing instances. Rollback is harder because the old copy is gone. |
| Rehost | Move as-is. No application change. Often called lift and shift. |
| Replatform | Small platform changes, such as a managed database, without a new architecture. |
| Refactor | Change application code so it can use cloud services. |
| Re-architect | Redesign the structure, for example into microservices. Broader than a refactor. |
| Retain | Leave it where it is. Not every system belongs in the cloud yet. |
| Retire | Turn it off. Do not migrate something you should decommission. |
Migration also has a direction: on premises to cloud, cloud back to on premises, or cloud to cloud. Check storage, compute, platform compatibility, networking, cost, management overhead, service availability, vendor lock-in, power and cooling, and the regulatory or compliance rule that forbids a region.
Infrastructure as code provisions resources from a definition, usually JSON or YAML. Configuration as code sets the operating system or application after the resource exists. Repeatability means the same definition builds the same result. Drift is live state that no longer matches that definition. Version the definition, test it, and document it. A script still uses variables, conditionals, operators, data types, and functions. Those are the logic pieces the objectives name.
When you provision, match the resource to the requirement in front of you: storage, performance, security, cost, availability, compliance, network, or compute. A cheaper disk that misses the IOPS target fails the performance requirement even when it passes the cost one.
Domain 3. Observe, scale, restore, and then retire.
| Practice | How to tell the options apart |
|---|---|
| Logs | Collect, aggregate, and retain them. Retention is a policy, not "keep everything forever." |
| Metrics | Numbers over time: CPU, latency, errors. Grafana is the dashboard tool the objectives name. |
| Traces | One request followed across services. A log line from one host is not a trace. |
| Alerts | Triage first, then respond. An alert with no owner is noise. |
| Horizontal scale | Add instances. Fits stateless workers behind a load balancer. |
| Vertical scale | Make one instance larger. Hits a maximum size and often restarts the guest. |
| Scale triggers | Trending, current load, or an event. Scheduled scale follows a clock. Manual scale is a person. |
| Full backup | Everything in scope. Slowest to take, simplest to restore. |
| Incremental | Changes since the last backup of any type. Fast to take, and a restore needs the chain. |
| Differential | Changes since the last full backup. A restore needs the full backup plus the latest differential. |
Keep copies on site and off site. Encrypt them. Replication copies data to another place and is not a substitute for a backup you can roll back. Test recoverability and integrity. Recover in place onto the damaged systems, or in parallel beside them. Restore in bulk, or granularly when only some objects are wrong. Life cycle work is patches, major and minor updates, and a test before production. Ephemeral data can die with the instance. Persistent data cannot. Decommission at end of life or end of support instead of leaving an unpatched image running.
Domain 4 is 19 percent. Separate authentication from authorization, and a scan from a fix.
Vulnerability management on CV0-004 follows four steps: set the scanning scope, identify findings, assess them, then remediate. A CVE is the identifier for a known vulnerability. CVSS, on the acronym list, is a score for severity. Assessment uses that score and your exposure. Remediation is the fix, not another scan.
| Control | What it does |
|---|---|
| SAML | Federates sign-in. The identity provider asserts who the user is to another system. |
| OpenID Connect | Sign-in built on OAuth 2.0. The objectives list it with authentication models. |
| OAuth 2.0 | Delegates authorization, such as an app reading a calendar. It is not the sign-in protocol by itself. |
| Directory and local users | Directory users live in a central store. Local users exist on one system and do not follow the person. |
| MFA | A second factor beyond the password. A leaked password alone should not be enough. |
| Role-based access | Permissions attach to a job role. Group-based access attaches them to a group. Discretionary access lets the owner grant rights. |
| Bastion host | The only jump host that may reach private systems. Do not publish SSH or RDP on every instance. |
| Least privilege | Only the rights the task needs. A broad admin key is the finding, not the design. |
| Zero trust | No network location is trusted by default. Each request is authenticated and authorized. |
| WAF | Inspects web requests. A network ACL filters by address and port and does not read the HTTP body. |
| IDS and IPS | An IDS alerts. An IPS can block because it sits in the path. |
| DLP | Stops data from leaving in a form the policy forbids. |
Sovereignty is which country's law applies. Locality is where the bytes sit. Ownership is who owns the data, which stays with the customer in a normal cloud contract. Classification labels sensitivity. Retention can be contractual, regulatory, or a litigation hold that freezes deletion. SOC 2, PCI DSS, ISO 27001, and the Cloud Security Alliance are the industry references the objectives name.
Phishing is social engineering. Ransomware is malware that encrypts data. A DDoS floods capacity. Cryptojacking spends your compute on mining. A zombie instance is compromised and acts for someone else. Metadata attacks read credentials from the instance metadata service. Outdated software and human error are the usual ways a vulnerability gets exploited. Watch for open ports you did not mean to publish and for metrics that leave the baseline.
Encrypt data in transit and at rest. Keep secrets in a secrets store, not in the image or the repository. Patch, and compare the build with a CIS or vendor benchmark. Privileged containers can escape toward the host. Unprivileged containers cannot. Object and file storage still need access policies. API access needs its own authentication and throttling.
The CV0-004 acronym list spells CLI as Common Language Infrastructure. In the access objective it sits beside the API, the SDK, and the web portal, which is the command-line path operators use. ICMP is spelled Internet Control Management Protocol on that list. The protocol people mean is Internet Control Message Protocol. VDI is spelled Virtual Desktop Interface. Learn the printed expansion and the job.
Domain 5 is 10 percent. Match the tool to one job, and the call style to one shape.
| Tool | Job on this exam |
|---|---|
| Git | Source control: commit, branch, merge, and history. |
| GitHub Actions | Workflows that run in the Git host when code is pushed or a pull request opens. |
| Jenkins | A CI/CD server that builds, tests, and deploys from jobs you define. |
| Terraform | Infrastructure as code. It provisions resources. Drift is its mismatch with live state. |
| Ansible | Configuration as code. It configures systems that already exist. |
| Docker | Builds and runs containers, including stand-alone ones. |
| Kubernetes | Orchestrates containers: placement, restarts, and scale. |
| ELK | Elasticsearch, Logstash, and Kibana. Collect and search logs. |
| Grafana | Dashboards for metrics. It is not the log pipeline. |
A commit records a change locally. A push sends commits to the remote. A pull request asks for review before a merge. Branches isolate work. A pipeline automates integration, build, test, security checks, and deployment. Artifacts are the outputs: virtual-machine images, container images, RPM or Debian packages, zip or tar archives, and flat files. Repositories are public or private.
REST addresses resources with HTTP. SOAP wraps calls in an XML contract. RPC invokes a remote procedure. GraphQL lets the client ask for specific fields. Web sockets stay open for two-way messages. An event-driven design reacts to events instead of polling.
Domain 6. Separate a quota from throttling, and a missing route from a bad login.
| Symptom | Look here first |
|---|---|
| Apply fails after a provider removed an argument | Deprecation, or an outdated component definition. Update the module. This is not a full regional outage. |
| New instances never appear, and the API returns 429 | Throttling. A service quota is a ceiling on how many you may create, even when the API is not busy. |
| The service exists in one region and not another | Regional availability. Deploying "the same template" does not create a service the region does not offer. |
| Two networks will not peer | Overlapping address space. Peering needs non-overlapping ranges. |
| Instances boot with no address | DHCP scope exhaustion, or the instance cannot reach DHCP. |
| Names fail and addresses work | DNS. If addresses also fail, look at routes, not the name. |
| Certificates and logs disagree on time | NTP. Clock skew breaks authentication that depends on time. |
| A private subnet cannot reach the internet | A missing route or a missing NAT path. A security group is the next check if the route is present. |
| A trunk drops one VLAN | A tag mismatch, or an access port where a trunk was required. |
| HTTP 401 | Not authenticated. Send credentials. 403 means the identity is known and is not allowed. |
| Old clients fail a TLS handshake | A deprecated cipher suite. This is not a DNS failure. |
| An instance mines currency and the bill spikes | Cryptojacking, often from a leaked key or an open metadata path. Close the key, then investigate. |
Also separate a full outage from a partial one, oversubscription from a simple sizing mistake, and permission errors from capacity errors. Unauthorized software on an image is a security finding even when the instance still answers. Privilege escalation means a caller gained rights they were not granted.
No. They are an original summary of the public CV0-004 objectives, version 2.0. Confirm the current PDF with CompTIA before you book.
Extra marks a useful idea the CV0-004 objective bullets do not name, such as anti-affinity. Learn the unmarked items first.
A differential backup. An incremental backup copies changes since the last backup of any type. A full backup copies everything in scope.
Turn the tables into recall, then test them.
Exam format, the 750 passing score, six domain weights, and the CV0-003 comparison.
Reference notes for models, migration, scaling, identity, DevOps tools, and troubleshooting.
40 recall cards in four decks, plus memory notes for models, backups, and the tool list.
200 original questions with custom exams, explanations, and an unofficial score on the 100-900 scale.
Useful companions while you study.
Convert structured data between JSON and YAML with formatting and validation.
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Generate strong random passwords with custom length, characters, symbols, and security options.
Calculate elapsed time, add or subtract hours and minutes, and convert time to decimal hours.
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. CompTIA and Cloud+ are trademarks of CompTIA, Inc. Certicab is not affiliated with, endorsed by, or sponsored by CompTIA.
Certi