CompTIA CompTIA Cloud+ CV0-003 Questions & Answers

• Question 41:

  A systems administrator is about to deploy a new VM to a cloud environment. Which of the following will the administrator MOST likely use to select an address for the VM?

  A. CDN

  B. DNS

  C. NTP

  D. IPAM

  Correct Answer: D

  IPAM (IP Address Management) is what the administrator will most likely use to select an address for the new VM that is about to be deployed to a cloud environment. IPAM is a tool or service that allows customers to plan, track, and manage the IP addresses and DNS names of their cloud resources or systems. IPAM can help to select an address for the new VM by providing information such as available IP addresses, IP address ranges, subnets, domains, etc., as well as ensuring that the address is unique and valid.

• Question 42:

  An organization has a public-facing API that is hosted on a cloud provider. The API performs slowly at times. Which of the following technologies should the cloud administrator apply to provide speed acceleration and a secure connection?

  A. WAF

  B. EDR

  C. IDS

  D. HIPS

  E. SSL

  Correct Answer: E

  The best technology to provide speed acceleration and a secure connection for a public-facing API that is hosted on a cloud provider is SSL (Secure Sockets Layer). SSL is a protocol that encrypts and authenticates the data between a client

  and a server over an HTTP connection. It also compresses the data to reduce its size and improve its transmission speed. SSL can enhance the security and performance of an API by preventing unauthorized access, tampering, or

  interception of the data. Reference:

  [CompTIA Cloud+ Certification Exam Objectives], Domain 2.0 Security, Objective 2.2 Given a scenario, implement appropriate network security controls for a cloud environment.

• Question 43:

  A production engineer is configuring a new application, which is running in containers, that requires access to a database. Which of the following methods will allow the application to authenticate to the database in the MOST secure way?

  A. Store the credentials in a variable on every worker node

  B. Store the credentials on a shared volume using whole-disk encryption

  C. Store the credentials in a configuration file using SHA-256 inside the container image

  D. Store the credentials using the orchestrator secret manager

  Correct Answer: D

  The most secure way to store the credentials for a new application that is running in containers and requires access to a database is to use the orchestrator secret manager. The orchestrator secret manager is a feature that allows storing and managing sensitive data, such as passwords, tokens, or keys, for containers in an encrypted and centralized way. It also provides access control, auditing, and rotation features for the secrets. This method will protect the credentials from being exposed or compromised by unauthorized parties or malicious actors. Reference: [CompTIA Cloud+ Certification Exam Objectives], Domain 2.0 Security, Objective 2.5 Given a scenario, apply data security techniques in the cloud.

• Question 44:

  A systems administrator wants to verify the word "qwerty" has not been used as a password on any of the administrative web consoles in a network. Which of the following will achieve this goal?

  A. A service availability scan

  B. An agent-based vulnerability scan

  C. A default and common credentialed scan

  D. A network port scan

  Correct Answer: C

  A default and common credentialed scan is what the administrator should use to verify the word "qwerty" has not been used as a password on any of the administrative web consoles in a network. A credentialed scan is a type of vulnerability scan that uses valid credentials or accounts to access and scan target systems or devices. A credentialed scan can provide more accurate and detailed results than a non- credentialed scan, as it can perform more actions and tests on target systems or devices. A default and common credentialed scan is a type of credentialed scan that uses default or common credentials or accounts, such as admin/admin, root/root, etc., to access and scan target systems or devices. A default and common credentialed scan can help to identify weak or insecure passwords on administrative web consoles, such as "qwerty", and recommend stronger passwords.

• Question 45:

  A systems administrator is working in a globally distributed cloud environment. After a file server VM was moved to another region, all users began reporting slowness when saving files. Which of the following is the FIRST thing the administrator should check while troubleshooting?

  A. Network latency

  B. Network connectivity

  C. Network switch

  D. Network peering

  Correct Answer: A

  Network latency is the first thing that the administrator should check while troubleshooting slowness when saving files after a file server VM was moved to another region in a globally distributed cloud environment. Network latency is a measure of how long it takes for data to travel from one point to another over a network or connection. Network latency can affect performance and user experience of cloud applications or services by determining how fast data can be transferred or processed between clients and servers or vice versa. Network latency can vary depending on various factors, such as distance, bandwidth, congestion, interference, etc. Network latency can increase when a file server VM is moved to another region in a globally distributed cloud environment, as it may increase the distance and decrease the bandwidth between clients and servers, which may result in delays or errors in data transfer or processing.

• Question 46:

  A DevOps administrator is building a new application slack in a private cloud. This application will store sensitive information and be accessible from the internet. Which of the following would be MOST useful in maintaining confidentiality?

  A. NAC

  B. IDS

  C. DLP

  D. EDR

  Correct Answer: C

  The most useful tool in maintaining confidentiality for a new application stack that will store sensitive information and be accessible from the internet is data loss prevention (DLP). DLP is a type of security solution that monitors and controls the flow of data in and out of a system or network. It can detect and prevent unauthorized access, transmission, or leakage of sensitive data, such as personal information, financial records, or intellectual property. DLP can also enforce encryption, masking, or deletion of sensitive data to protect its confidentiality. Reference: CompTIA Cloud+ Certification Exam Objectives, Domain 2.0 Security, Objective 2.5 Given a scenario, apply data security techniques in the cloud.

• Question 47:

  A cloud administrator is setting up a new coworker for API access to a public cloud environment. The administrator creates a new user and gives the coworker access to a collection of automation scripts. When the coworker attempts to use a deployment script, a 403 error is returned. Which of the following is the MOST likely cause of the error?

  A. Connectivity to the public cloud is down.

  B. User permissions are not correct.

  C. The script has a configuration error.

  D. Oversubscription limits have been exceeded.

  Correct Answer: B

  User permissions are not correct is the most likely cause of the error 403 (Forbidden) that is returned when a coworker attempts to use a deployment script after being set up for API access to a public cloud environment by an administrator. API (Application Programming Interface) is a set of rules or specifications that defines how different software components or systems can communicate and interact with each other. API access is the ability to use or access an API to perform certain actions or tasks on a software component or system. User permissions are the settings or policies that control and restrict what users can do or access on a software component or system. User permissions can affect API access by determining what actions or tasks users can perform using an API on a software component or system. User permissions are not correct if they do not match or align with the intended or expected actions or tasks that users want to perform using an API on a software component or system. User permissions are not correct can cause error 403 (Forbidden), which means that the user does not have the necessary permission or authorization to perform the requested action or task using an API on a software component or system.

• Question 48:

  A cloud administrator is assigned to establish a connection between the on-premises data center and the new CSP infrastructure. The connection between the two locations must be secure at all times and provide service for all users inside the organization. Low latency is also required to improve performance during data transfer operations. Which of the following would BEST meet these requirements?

  A. A VPC peering configuration

  B. An IPSec tunnel

  C. An MPLS connection

  D. A point-to-site VPN

  Correct Answer: B

  An IPSec tunnel is what would best meet the requirements of establishing a connection between the on-premises data center and the new CSP infrastructure that is secure at all times and provides service for all users inside the organization with low latency. IPSec (Internet Protocol Security) is a protocol that encrypts and secures network traffic over IP networks. IPSec tunnel is a mode of IPSec that creates a virtual private network (VPN) tunnel between two endpoints, such as routers, firewalls, gateways, etc., and encrypts and secures all traffic that passes through it. An IPSec tunnel can meet the requirements by providing: Security: An IPSec tunnel can protect network traffic from interception, modification, spoofing, etc., by using encryption, authentication, integrity, etc., mechanisms. Service: An IPSec tunnel can provide service for all users inside the organization by allowing them to access and use network resources or services on both ends of the tunnel, regardless of their physical location. Low latency: An IPSec

  tunnel can provide low latency by reducing the number of hops or devices that network traffic has to pass through between the endpoints of the tunnel.

• Question 49:

  An administrator needs to back up all the data from each VM daily while also saving space. Which of the following backup types will BEST fit this scenario?

  A. Differential

  B. Incremental

  C. Synthetic full

  D. Full

  Correct Answer: B

  Incremental backups only back up the data that has changed since the last backup, which in this case is the previous day's backup. It saves space by not duplicating unchanged data and only capturing the changes made to the VMs since the last backup. This approach ensures efficient use of storage resources.

  Each day, the incremental backup will only capture and store the data that has been modified or added since the last backup. As a result, the size of each incremental backup is typically smaller than a full or differential backup, making it more space-efficient

• Question 50:

  A systems administrator is deploying a new cloud application and needs to provision cloud services with minimal effort. The administrator wants to reduce the tasks required for maintenance, such as OS patching, VM and volume provisioning, and autoscaling configurations. Which of the following would be the BEST option to deploy the new application?

  A. A VM cluster

  B. Containers

  C. OS templates

  D. Serverless

  Correct Answer: D

  Serverless is what would be the best option to deploy a new cloud application and provision cloud services with minimal effort while reducing the tasks required for maintenance such as OS patching, VM and volume provisioning, and

  autoscaling configurations. Serverless is a cloud service model that provides customers with a platform to run applications or functions without having to manage or provision any underlying infrastructure or resources, such as servers,

  storage, network, OS, etc.

  Serverless can provide benefits such as:

  Minimal effort: Serverless can reduce the effort required to deploy a new cloud application and provision cloud services by automating and abstracting away all the infrastructure or resource management or provisioning tasks from customers,

  and allowing them to focus only on writing code or logic for their applications or functions.

  Reduced maintenance: Serverless can reduce the tasks required for maintenance by handling all the infrastructure or resource maintenance tasks for customers, such as OS patching, VM and volume provisioning, autoscaling configurations,

  etc., and ensuring that they are always up-to-date and optimized.