CompTIA CV0-004 Online Practice Questions and Exam Preparation

CompTIA CV0-004 Online Questions & Answers

• Question 31:

  A cloud engineer is designing a cloud-native, three-tier application. The engineer must adhere to the following security best practices:

  1. Minimal services should run on all layers of the stack.

  2. The solution should be vendor agnostic.

  3. Virealization could be used over physical hardware.

  Which of the following concepts should the engineer use to design the system to best meet these requirements?

  A. Virtual machine
  B. Micro services
  C. Fan-out
  D. Cloud-provided managed services
  B. Micro services

  ---

  Explanation

  Microservices architecture is the most suitable design principle that aligns with the security best practices mentioned. It involves developing a suite of small services, each running in its own process and communicating with lightweight mechanisms, often an HTTP resource API. This architecture minimizes the services running on each layer, allows for vendor-agnostic solutions,and is well-suited for virtualization over physical hardware.

  References:

  Microservices as an architectural approach is discussed in the context of cloud-native applications within the CompTIA Cloud+ material.

• Question 32:

  Users report being unable to access an application that uses TLS 1.1. The users are able to access other applications on the internet.

  Which of the following is the most likely reason for this issue?

  A. The security team modified user permissions.
  B. Changes were made on the web server to address vulnerabilities.
  C. Privileged access was implemented.
  D. The firewall was modified.
  B. Changes were made on the web server to address vulnerabilities.

  ---

  Explanation

  If users are unable to access an application that uses TLS 1.1 but can access other internet applications, it is likely that changes were made on the web server to address vulnerabilities, such as disabling outdated and less secure protocols like TLS 1.1.

  References:

  CompTIA Cloud+ Study Guide (Exam CV0-004) - Chapter on Cloud Security

• Question 33:

  Which of the following is the most restrictive data classification label?

  A. Proprietary
  B. Private
  C. Sensitive
  D. Confidential
  D. Confidential

  ---

  Explanation

  Confidential data is typically assigned the highest level of protection among the listed classifications because unauthorized disclosure could cause significant harm to an organization, its customers, or its operations.

  Access is strictly limited to authorized individuals with a business need to know.

• Question 34:

  A technician receives an email from a vendor who is requesting payment of an invoice for human resources services. The email contains a request for bank account numbers.

  Which of the following types of attacks does this behavior most likely indicate?

  A. MaIware
  B. Cryptojacking
  C. Ransomware
  D. Phishing
  D. Phishing

  ---

  Explanation

  The behavior described in the question indicates a phishing attack. Phishing typically involves an attacker masquerading as a legitimate entity to trick individuals into providing sensitive information, such as bank account numbers, through seemingly trustworthy communication channels like email.

  References:

  Understanding security concerns and measures is part of the Governance, Risk, Compliance, and Security domain of the CompTIA Cloud+ objectives.

• Question 35:

  A company has decided to scale its e-commerce application from its corporate datacenter to a commercial cloud provider to meet an anticipated increase in demand during an upcoming holiday.

  The majority of the application load takes place on the application server under normal conditions. For this reason, the company decides to deploy additional application servers into a commercial cloud provider using the on-premises orchestration engine that installs and configures common software and network configurations.

  The remote computing environment is connected to the on-premises datacenter via a site-to-site IPSec tunnel. The external DNS provider has been configured to use weighted round-robin routing to load balance connections from the Internet.

  During testing, the company discovers that only 20% of connections completed successfully.

  INSTRUCTIONS

  Review the network architecture and supporting documents and fulfill these requirements: Part 1:

  1. Analyze the configuration of the following components: DNS, Firewall 1, Firewall 2, Router 1, Router 2, VPN and Orchestrator Server.

  2. Identify the problematic device(s).

  Part 2:

  1. Identify the correct options to provide adequate configuration for hybrid cloud architecture.

  2. If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

  Part 1:

  Cloud Hybrid Network Diagram

  

  

  

  

  

  

  

  

  Part 2:

  Only select a maximum of TWO options from the multiple choice question

  A. Update the PSK (Pre-shared key) in Router 2.
  B. Update the A record on the DNS from 2.2.2.2 to 1.1.1.1.
  C. Promote deny All to allow All in Firewall 1 and Firewall 2.
  D. Change the Address Space on Router 2.
  E. Change internal IP Address of Router 1.
  F. Reverse the Weight property in the two CNAME records on the DNS.
  G. Add the Application Server at on-premises to the Load Balancer.
  A. Update the PSK (Pre-shared key) in Router 2.
  D. Change the Address Space on Router 2.

  ---

  Explanation

  Part 1: Router 2

  The problematic device is Router 2, which has an incorrect configuration for the IPSec tunnel. The IPSec tunnel is a secure connection between the on-premises datacenter and the cloud provider, which allows the traffic to flow between the two networks. The IPSec tunnel requires both endpoints to have matching parameters, such as the IP addresses, the pre-shared key (PSK), the encryption and authentication algorithms, and the security associations (SAs) .

  According to the network diagram and the configuration files, Router 2 has a different PSK and a different address space than Router 1. Router 2 has a PSK of "1234567890", while Router 1 has a PSK of "0987654321". Router 2 has an address space of 10.0.0.0/8, while Router 1 has an address space of

  192.168.0.0/16. These mismatches prevent the IPSec tunnel from establishing and encrypting the traffic between the two networks. The other devices do not have any obvious errors in their configuration. The DNS provider has two CNAME records that point to the application servers in the cloud provider, with different weights to balance the load. The firewall rules allow the traffic from and to the application servers on port 80 and port 443, as well as the traffic from and to the VPN server on port 500 and port 4500. The orchestration server has a script that installs and configures the application servers in the cloud provider, using the DHCP server to assign IP addresses.

  Part 2:

  The correct options to provide adequate configuration for hybrid cloud architecture are: Update the PSK (Pre-shared key) in Router 2.

  Change the Address Space on Router 2.

  These options will fix the IPSec tunnel configuration and allow the traffic to flow between the on-premises datacenter and the cloud provider. The PSK should match the one on Router 1, which is "0987654321".

  The address space should also match the one on Router 1, which is 192.168.0.0/16.

• Question 36:

  A cloud engineer is developing an operating expense report that will be used to purchase various cloud billing models for virtual machine instances. The cloud billing model must meet the following requirements:

  1. The instance cannot be ephemeral.

  2. The minimum life cycle of the instance is expected to be five years.

  3. The software license is charged per physical CPU count.

  Which of the following models would best meet these requirements?

  A. Dedicated host
  B. Spot instance
  C. Pay-as-you-go
  D. Reserved resources
  D. Reserved resources

  ---

  Explanation

  Reserved resources, or Reserved Instances, are ideal for workloads with predictable usage and a long-term commitment, such as a minimum lifecycle of five years. This model allows for significant cost savings compared to on-demand pricing, and the instance is not ephemeral, meaning it persists and is dedicated to the user for the duration of the reservation. The licensing charged per physical CPU count aligns with dedicated host or reserved instance models, but the long-term commitment points more towards reserved resources.

• Question 37:

  A certain user subset is seeing the error message 500 Internal Server Error on a newly launched distributed web application. The developers are unable to troubleshoot this issue because of limited visibility into the application's operations.

  Which of the following should the developers do first to effectively troubleshoot the issue?

  A. Modify the application code to display proper log files.
  B. Generate graphs and dashboards that show the rate of error.
  C. Implement incident response management.
  D. Provision log aggregation software.
  D. Provision log aggregation software.

  ---

  Explanation

  Log aggregation software centralizes logs from multiple components of a distributed application into a single system, providing visibility into application behavior and errors across services and servers. This allows developers to efficiently collect and analyze logs needed to identify the cause of the 500 Internal Server Error.

• Question 38:

  Several fitness centers in an area are collectively looking for a cost-effective way to migrate their servers to the cloud.

  Which of the following is the best cloud deployment model to meet these needs?

  A. Hybrid
  B. Public
  C. Community
  D. Private
  C. Community

  ---

  Explanation

  A community cloud is designed for multiple organizations that share similar requirements, goals, or regulatory concerns. In this scenario, several fitness centers can share cloud infrastructure and costs, making it a more cost-effective solution while still providing resources tailored to the needs of the participating organizations.

• Question 39:

  A network administrator is budding a site-to-site VPN tunnel from the company's headquarters office 10 the company's public cloud development network. The network administrator confirms the following: The VPN tunnel is established on the headquarter office firewall.

  While inside the office, developers report that they cannot connect to the development network resources.

  While outside the office on a client VPN, developers report that they can connect to the development network resources.

  The office and the client VPN have different IP subnet ranges.

  The firewall flow logs show VPN traffic is reaching the development network from the office.

  Which of the following is the next step the next network administrator should take to troubleshoot the VPN tunnel?

  A. Review the development network routing table.
  B. Change the ciphers on the site-to-site VPN.
  C. Restart the site-to-site VPN tunnel.
  D. Check the ACLS on the development workloads
  A. Review the development network routing table.

  ---

  Explanation

  The next step in troubleshooting the VPN tunnel issue is to review the development network routing table.

  This action will help determine if the routing configurations are correctly directing traffic from the headquarters office through the VPN tunnel to the development network resources. Proper routing ensures that data packets find their way to the correct destinationwithin the cloud environment, which is critical for establishing successful communication between different network segments.

  References:

  CompTIA Cloud+ materials stress the importance of networking fundamentals in cloud environments, including VPN configurations and routing, to ensure secure and efficient connectivity between on-premises infrastructure and cloud resources.

• Question 40:

  A company's website suddenly crashed. A cloud engineer investigates the following logs:

  

  Which of the following is the most likely cause of the issue?

  A. SQL injection
  B. Cross-site scripting
  C. Leaked credentials
  D. DDoS
  D. DDoS

  ---

  Explanation

  The logs indicate a sudden surge in access requests to the website's homepage, followed by 502 errors, which are indicative of server overload or failure to handle incoming requests. This pattern is typical of a Distributed Denial of Service (DDoS) attack, where multiple compromised systems flood the target with traffic, exceeding its capacity to handle requests, leading to service disruption.