CompTIA CV0-003 Online Practice Questions and Exam Preparation

CompTIA CV0-003 Online Questions & Answers

• Question 261:

  An organization has decided to implement the following network segregation:

  

  Below is a configuration of an application server:

  

  The application team is unable to establish connectivity to another server, which has the IP address 10.10.10.180. Which of the following is the MOST likely reason for the issue?

  A. Incorrect routing configuration
  B. Incorrect NIC1 configuration
  C. Incorrect gateway in NIC 1
  D. Incorrect subnet mask in NIC2
  A. Incorrect routing configuration

  ---

  Explanation

• Question 262:

  A systems administrator is writing a script for provisioning nodes in the environment. Which of the following would be BEST for the administrator to use to provision the authentication credentials to the script?

  A. password='curl https://10.2.3.4/api/sytemops?op=provision'
  B. password=$env_password
  C. password=$(cat /opt/app/credentials)
  D. password="MyS3cretP4sswordIsVeryL0ng"
  B. password=$env_password

  ---

  Explanation

• Question 263:

  An organization is hosting a DNS domain with private and public IP ranges. Which of the following should be implemented to achieve ease of management?

  A. Network peering
  B. A CDN solution
  C. A SDN solution
  D. An IPAM solution
  D. An IPAM solution

  ---

  Explanation

  An IP address management (IPAM) solution is a type of tool or system that automates and standardizes the allocation, tracking, and management of IP addresses in an IP network. An IPAM solution can help achieve ease of management for hosting a DNS domain with private and public IP ranges, as it can simplify and centralize the process of assigning and updating IP addresses for different DNS records or zones without manual intervention or errors. An IPAM solution can also help optimize DNS performance and security, as it can monitor and report any issues or conflicts related to IP addresses or DNS records.

  References: CompTIA Cloud+ Certification Exam Objectives, page 15, section 2.8

  https://www.infoblox.com/glossary/ipam-ip-address-management/

• Question 264:

  A systems administrator is responding to an outage in a cloud environment that was caused by a network-based flooding attack. Which of the following should the administrator configure to mitigate the attack?

  A. NIPS
  B. Network overlay using GENEVE
  C. DDoS protection
  D. DoH
  C. DDoS protection

  ---

  Explanation

  DDoS protection is what the administrator should configure to mitigate a network-based flooding attack that caused an outage in a cloud environment. A network- based flooding attack is a type of attack that sends a large amount of network traffic or requests to a target system or service, such as a server, website, application, etc., with the intention of overwhelming or exhausting its resources or capacity. A network-based flooding attack can cause an outage in a cloud environment by disrupting or degrading the availability or performance of the target system or service, as well as affecting other systems or services that share the same network or infrastructure. DDoS protection is a tool or service that detects and prevents network-based flooding attacks, also known as Distributed Denial of Service (DDoS) attacks. DDoS protection can mitigate a network- based flooding attack by providing features such as: Filtering: DDoS protection can filter network traffic or requests based on various criteria, such as source, destination, protocol, content, etc., and block or allow them accordingly. Diverting: DDoS protection can divert network traffic or requests away from the target system or service to another location or device, such as a scrubbing center, proxy, firewall, etc., where they can be analyzed and processed. Scaling: DDoS protection can scale network resources or capacity dynamically and automatically to handle the increased demand or load caused by the network- based flooding attack.

• Question 265:

  A cloud administrator is troubleshooting an issue regarding users at one location who are reporting that their API access tokens have become invalid. The users are issued tokens based on their credentials in a federated cluster. Which of the following should the administrator check to determine the cause of this issue?

  A. SAML
  B. DNS
  C. SSL
  D. NTP
  A. SAML

  ---

  Explanation

  The answer is A. SAML. SAML (Security Assertion Markup Language) is a standard for exchanging authentication and authorization data between different parties, such as a user and a service provider. In a federated cluster, SAML can be used to enable single sign-on (SSO) for users across multiple clusters or cloud providers. SAML relies on the exchange of XML-based assertions that contain information about the user's identity, attributes, and entitlements. If the users' API access tokens have become invalid, it could be because the SAML assertions have expired, been revoked, or corrupted. The administrator should check the SAML configuration and logs to determine the cause of this issue. Some possible sources of information about SAML and federated clusters are: Authenticating | Kubernetes: This page provides an overview of authenticating users in Kubernetes, including using SAML for federated identity. Authenticating to the Kubernetes API server - Google Cloud: This page explains how to authenticate to the Kubernetes API server on Google Cloud, including using SAML for federated identity with Google Cloud Identity Platform. Error 403 User not authorized when trying to access Azure Databricks API through Active Directory

  - Stack Overflow: This page discusses a similar issue of users getting an error when trying to access Azure Databricks API using SAML and Active Directory.

• Question 266:

  An IaaS application has a two-hour RTO and a four-hour RPO. The application takes one hour to back up its data or restore from a local backup file. A systems administrator is tasked with configuring the backup policy.

  Which of the following should the administrator configure to achieve the application requirements with the LEAST cost?

  A. Back up to long-term storage every night
  B. Back up to object storage every three hours
  C. Back up to long-term storage every four hours
  D. Back up to object storage every hour
  B. Back up to object storage every three hours

  ---

  Explanation

  Object storage is a type of storage service that stores data as objects with unique identifiers and metadata in a flat namespace or structure. Backing up to object storage every three hours can help achieve the application requirements with the least cost for an IaaS application that has a two-hour RTO and a four-hour RPO, as it can provide scalable, durable, and cost-effective storage for backup data while meeting the recovery time and point objectives. Backing up to object storage every three hours can ensure that the backup data is no more than four hours old and can be restored within two hours in case of a disaster or failure.

  References: CompTIA Cloud+ Certification Exam Objectives, page 9, section 1.4

• Question 267:

  A system administrator has provisioned a new web server. Which of the following, in combination, form the best practice to secure the server's OS? (Choose three.)

  A. Install TLS certificates on the server.
  B. Forward port 80 traffic to port 443.
  C. Disable TLS 1.0/1.1 and SSL.
  D. Disable password authentication.
  E. Enable SSH key access only.
  F. Provision the server in a separate VPC.
  G. Disable the superuser/administrator account.
  H. Restrict access on port 22 to the IP address of the administrator's workstation.
  E. Enable SSH key access only.
  G. Disable the superuser/administrator account.
  H. Restrict access on port 22 to the IP address of the administrator's workstation.

  ---

  Explanation

• Question 268:

  A systems administrator has migrated an internal application to a public cloud. The new web server is running under a TLS connection and has the same TLS certificate as the internal application that is deployed. However, the IT department reports that only internal users who are using new versions of the OSs are able to load the application home page.

  Which of the following is the MOST likely cause of the issue?

  A. The local firewall from older OSs is not allowing outbound connections
  B. The local firewall from older OSs is not allowing inbound connections
  C. The cloud web server is using a self-signed certificate that is not supported by older browsers
  D. The cloud web server is using strong ciphers that are not supported by older browsers
  D. The cloud web server is using strong ciphers that are not supported by older browsers

  ---

  Explanation

  Ciphers are algorithms or methods that are used to encrypt and decrypt data for secure communication. Strong ciphers are ciphers that use high-level encryption techniques and keys to provide stronger security and protection for data. The cloud web server is using strong ciphers that are not supported by older browsers is the most likely cause of the issue of only internal users who are using new versions of the OSs being able to load the application home page after the administrator configured a redirect from HTTP to HTTPS on the web server. Older browsers may not support the strong ciphers used by the cloud web server for HTTPS connections, which can result in a failure to establish a secure connection and load the application home page.

  References: CompTIA Cloud+ Certification Exam Objectives, page 15, section 2.8

• Question 269:

  Which of the following cloud services is fully managed?

  A. IaaS
  B. GPU in the cloud
  C. IoT
  D. Serverless compute
  E. SaaS
  E. SaaS

  ---

  Explanation

  SaaS (Software as a Service) is a cloud service model that provides fully managed applications to the end users. The users do not have to worry about installing, updating, or maintaining the software, as the cloud provider handles all these tasks. Examples of SaaS are Gmail, Office 365, Salesforce, etc.

• Question 270:

  CORRECT TEXT

  A company has decided to scale its e-commerce application from its corporate datacenter to a commercial cloud provider to meet an anticipated increase in demand during an upcoming holiday.

  The majority of the application load takes place on the application server under normal conditions. For this reason, the company decides to deploy additional application servers into a commercial cloud provider using the on-premises

  orchestration engine that installs and configures common software and network configurations.

  The remote computing environment is connected to the on-premises datacenter via a site-to-site IPSec tunnel. The external DNS provider has been configured to use weighted round-robin routing to load balance connections from the Internet.

  During testing, the company discovers that only 20% of connections completed successfully.

  INSTRUCTIONS

  Review the network architecture and supporting documents and fulfill these requirements:

  Part 1:

  1.Analyze the configuration of the following components: DNS, Firewall 1, Firewall 2, Router 1, Router 2, VPN and Orchestrator Server.

  2.Identify the problematic device(s).

  Part 2:

  1.Identify the correct options to provide adequate configuration for hybrid cloud architecture.

  2.If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

  Part 1:

  Cloud Hybrid Network Diagram

  

  

  

  

  Part 2:

  Only select a maximum of TWO options from the multiple choice question

  A. Update the PSK (Pre-shared key) in Router 2.
  B. Update the A record on the DNS from 2.2.2.2 to 1.1.1.1.
  C. Promote deny All to allow All in Firewall 1 and Firewall 2.
  D. Change the Address Space on Router 2.
  E. Change internal IP Address of Router 1.
  F. Reverse the Weight property in the two CNAME records on the DNS.
  G. Add the Application Server at on-premises to the Load Balancer.
  A. Update the PSK (Pre-shared key) in Router 2.
  D. Change the Address Space on Router 2.

  ---

  Explanation