Get 2025 Updated Free CompTIA CV0-004 Exam Questions & Answer [Q32-Q52]

July 4, 2025 latestexam 0 Comments

5/5 - (2 votes)

Get 2025 Updated Free CompTIA CV0-004 Exam Questions and Answer

CV0-004 Dumps PDF and Test Engine Exam Questions

NO.32 SIMULATION 5
A company has decided to scale its e-commerce application from its corporate datacenter to a commercial cloud provider to meet an anticipated increase in demand during an upcoming holiday.
The majority of the application load takes place on the application server under normal conditions. For this reason, the company decides to deploy additional application servers into a commercial cloud provider using the on-premises orchestration engine that installs and configures common software and network configurations.
The remote computing environment is connected to the on-premises datacenter via a site-to-site IPSec tunnel. The external DNS provider has been configured to use weighted round-robin routing to load balance connections from the Internet.
During testing, the company discovers that only 20% of connections completed successfully.
INSTRUCTIONS
Review the network architecture and supporting documents and fulfill these requirements:
Part 1:
Analyze the configuration of the following components: DNS, Firewall 1, Firewall 2, Router 1,

Router 2, VPN and Orchestrator Server.
Identify the problematic device(s).

Part 2:
Identify the correct options to provide adequate configuration for hybrid cloud architecture.

If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.
Part 1:
Cloud Hybrid Network Diagram

Part 2:
Only select a maximum of TWO options from the multiple choice question. (Choose two.)

Part 1: Router 2
The problematic device is Router 2, which has an incorrect configuration for the IPSec tunnel.
The IPSec tunnel is a secure connection between the on-premises datacenter and the cloud provider, which allows the traffic to flow between the two networks. The IPSec tunnel requires both endpoints to have matching parameters, such as the IP addresses, the pre-shared key (PSK), the encryption and authentication algorithms, and the security associations (SAs) .
According to the network diagram and the configuration files, Router 2 has a different PSK and a different address space than Router 1. Router 2 has a PSK of “1234567890”, while Router 1 has a PSK of “0987654321”. Router 2 has an address space of 10.0.0.0/8, while Router 1 has an address space of 192.168.0.0/16. These mismatches prevent the IPSec tunnel from establishing and encrypting the traffic between the two networks.
The other devices do not have any obvious errors in their configuration. The DNS provider has two CNAME records that point to the application servers in the cloud provider, with different weights to balance the load. The firewall rules allow the traffic from and to the application servers on port 80 and port 443, as well as the traffic from and to the VPN server on port 500 and port
4500. The orchestration server has a script that installs and configures the application servers in the cloud provider, using the DHCP server to assign IP addresses.
Part 2:
The correct options to provide adequate configuration for hybrid cloud architecture are:
– Update the PSK (Pre-shared key) in Router 2.
– Change the Address Space on Router 2.
These options will fix the IPSec tunnel configuration and allow the traffic to flow between the on- premises datacenter and the cloud provider. The PSK should match the one on Router 1, which is “0987654321”. The address space should also match the one on Router 1, which is
192.168.0.0/16.

NO.33 A cross-site request forgery vulnerability exploited a web application that was hosted in a public laaS network. A security engineer determined that deploying a WAF in blocking mode at a CDN would prevent the application from being exploited again. However, a week after implementing the WAF, the application was exploited again. Which of the following should the security engineer do to make the WAF control effective?

Configure the DDoS protection on the CDN.

Install endpoint protection software on the VMs

Add an ACL to the VM subnet.

Deploy an IDS on the laaS network.

After a WAF deployment fails to prevent an exploit, adding an Access Control List (ACL) to the Virtual Machine (VM) subnet can be an effective control. ACLs provide an additional layer of security by explicitly defining which traffic can or cannot enter a network segment. By setting granular rules based on IP addresses, protocols, and ports, ACLs help to restrict access to resources, thereby mitigating potential exploits and enhancing the security of the IaaS network.
Reference: CompTIA Cloud+ materials cover governance, risk, compliance, and security for the cloud, including the implementation of network security controls like ACLs, to protect cloud environments from unauthorized access and potential security threats.

NO.34 Which of the following types of storage provides the greatest performance advantage for a traditional relational database?

File

Object

Block

Ephemeral

Block storage provides the greatest performance advantage for traditional relational databases due to its high performance and low-latency characteristics. Block storage allows databases to rapidly manage data in fixed-sized blocks, which is ideal for databases that require frequent read/write operations.
Reference: Understanding different storage types and their use cases, including block storage for databases, is part of the cloud computing knowledge base covered in CompTIA Cloud+.

NO.35 A security analyst reviews the daily logs and notices the following suspicious activity:

The analyst investigates the firewall logs and identities the following:

Which of the following steps should the security analyst take next to resolve this issue? (Select two).

Submit an IT support ticket and request Kali Linux be uninstalled from John Smith’s computer

Block all inbound connections on port 4444 and block the IP address 201.101.25.121.

Contact John Smith and request the Ethernet cable attached to the desktop be unplugged

Check the running processes to confirm if a backdoor connection has been established.

Upgrade the Windows x64 operating system on John Smith’s computer to the latest version.

Block all outbound connections from the IP address 10.150.71.151.

Given the suspicious activity and Kali Linux’s association with penetration testing and hacking tools, the security analyst should block all inbound connections on port 4444, as it is commonly used for malicious purposes, and block the IP address that’s potentially the source of the intrusion. Additionally, checking the running processes on John Smith’s computer is crucial to determine if a backdoor or unauthorized connection has been established.References: Incident response and threat mitigation steps such as these are part of the security protocols discussed in the CompTIA Cloud+ certification.

NO.36 The change control board received a request to approve a configuration change 10 deploy in the cloud production environment. Which of the following should have already been competed?

Penetration test

End-to-end security testing

Cost benefit analysis

User acceptance testing

NO.37 An engineer made a change to an application and needs to select a deployment strategy that meets the following requirements:
* Is simple and fast
* Can be performed on two Identical platforms
Which of the following strategies should the engineer use?

Blue-green

Canary

Rolling

in-place

The blue-green deployment strategy is ideal for scenarios where simplicity and speed are crucial. It involves two identical production environments: one (blue) hosts the current application version, while the other (green) is used to deploy the new version. Once testing is completed on the green environment and it’s ready to go live, traffic is switched from blue to green, ensuring a quick and efficient rollout with minimal downtime. This method allows for immediate rollback if issues arise, by simply redirecting the traffic back to the blue environment.References: CompTIA Cloud+ material emphasizes the importance of understanding various cloud deployment strategies, including blue-green, and their application in real-world scenarios to ensure efficient and reliable software deployment in cloud environments.

NO.38 A cloud engineer is reviewing the following Dockerfile to deploy a Python web application:

Which of the following changes should the engineer make lo the file to improve container security?

Add the instruction “JSER nonroot.

Change the version from latest to 3.11.

Remove the EHTRYPOIKT instruction.

Ensure myapp/main.pyls owned by root.

To improve container security, the engineer should add the instruction “USER nonroot” to the Dockerfile. This change ensures that the container does not run as the root user, which reduces the risk of privilege escalation attacks. Running containers as a non-root user is a best practice for enhancing security in containerized environments.

NO.39 Between 11:00 a.m. and 1:00 p.m. on workdays, users report that the sales database is either not accessible, sluggish, or difficult to connect to. A cloud administrator discovers that during the impacted time, all hypervisors are at capacity. However, when 70% of the users are using the same database, those issues are not reported. Which of the following is the most likely cause?

Oversubscription

Resource allocation

Sizing issues

Service quotas

The most likely cause of accessibility and performance issues during specific times is oversubscription. This happens when more users are trying to access the database than the hypervisors can handle, due to their resources being allocated to more virtual machines or processes than they can efficiently support.

NO.40 A cloud administrator set up a link between the private and public cloud through a VPN tunnel. As part of the migration, a large set of files will be copied. Which of the following network ports are required from a security perspective?

22, 53, 445

22, 443, 445

25, 123, 443

137, 139, 445

The following ports are required from a security perspective:
Port 22: This is the SSH port, which is used for secure remote access.
Port 443: This is the HTTPS port, which is used for secure web traffic.
Port 445: This is the SMB port, which is used for file sharing.

NO.41 A developer is deploying a new version of a containerized application. The DevOps team wants:
* No disruption
* No performance degradation
* Cost-effective deployment
* Minimal deployment time
Which of the following is the best deployment strategy given the requirements?

Canary

In-place

Blue-green

Rolling

The blue-green deployment strategy is the best given the requirements for no disruption, no performance degradation, cost-effective deployment, and minimal deployment time. It involves maintaining two identical production environments (blue and green), where one hosts the current application version and the other is used to deploy the new version. Once testing on the green environment is complete, traffic is switched from blue to green, ensuring a seamless transition with no downtime.References: Understanding various cloud deployment strategies, such as blue-green deployments, is essential for managing cloud environments effectively, as highlighted in the CompTIA Cloud+ objectives, to ensure smooth and efficient application updates.

NO.42 A CI/CD pipeline is used to deploy VMs to an laaS environment. Which of the following can be used to harden the operating system once the VM is running?

Docker

Kubernetes

Git

Ansible

Ansible can be used to harden the operating system once the VM is running. It is an automation tool that can configure systems, deploy software, and orchestrate more advanced IT tasks such as continuous deployments or zero downtime rolling updates.

NO.43 A systems administrator has finished installing monthly updates to servers in a cloud environment. The administrator notices certain portions of the playbooks are no longer functioning. Executing the playbook commands manually on a server does not work as well.
There are no other reports of issues. Which of the following is the MOST likely cause of this issue?

Change management failure

Service overload

Patching failure

Job validation issues

Deprecated features

NO.44 An DevOps engineer is receiving reports that users can no longer access the company’s web application after hardening of a web server. The users are receiving the following error:
ERR_SSLJ/ERSION_OR_CIPHER_MISMATCH.
Which of the following actions should the engineer take to resolve the issue?

Restart the web server.

Configure TLS 1.2 or newer.

Update the web server.

Review logs on the WAF

To resolve the ERR_SSL_VERSION_OR_CIPHER_MISMATCH error after hardening a web server, the engineer should configure the server to use TLS 1.2 or newer. This error often occurs when the server or client supports an outdated version of SSL/TLS or incompatible cipher suites. Updating to a modern, secure version of TLS ensures compatibility and enhances security.
Reference: The CompTIA Cloud+ certification includes governance, risk, compliance, and security for the cloud, emphasizing the importance of implementing up-to-date security protocols like TLS to protect data in transit and ensure secure communications in cloud environments.

NO.45 A company experienced a data leak through its website. A security engineer, who is investigating the issue, runs a vulnerability scan against the website and receives the following output:

Which of the following is the most likely cause of this leak?

RTMP port open

SQL injection

Privilege escalation

Insecure protocol

The data leak is most likely caused by the use of an insecure protocol. The vulnerability scan output shows that port 21/tcp for FTP (File Transfer Protocol) is open. FTP is known for transmitting data unencrypted, which could allow sensitive data to be intercepted during transfer.References: The security risks associated with the use of insecure or unencrypted protocols are covered under cloud security best practices in the CompTIA Cloud+ curriculum.

NO.46 A cloud administrator needs to collect process-level, memory-usage tracking for the virtual machines that are part of an autoscaling group. Which of the following is the best way to accomplish the goal by using cloud-native monitoring services?

Configuring page file/swap metrics

Deploying the cloud-monitoring agent software

Scheduling a script to collect the data

Enabling memory monitoring in the VM configuration

To collect process-level, memory-usage tracking for virtual machines, deploying cloud-monitoring agent software is the best approach. The agent can gather detailed system metrics and send them to the cloud-native monitoring services for analysis and visualization. Reference: CompTIA Cloud+ Study Guide (Exam CV0-004) – Chapter on Cloud Monitoring

NO.47 A company’s content management system (CMS) service runs on an laaS cluster on a public cloud. The CMS service is frequently targeted by a malicious threat actor using DDoS. Which of the following should a cloud engineer monitor to identify attacks?

Network flow logs

Endpoint detection and response logs

Cloud provider event logs

Instance syslog

To identify DDoS attacks against a CMS service, a cloud engineer should monitor network flow logs. These logs provide data about the IP traffic going to and from network interfaces in a public cloud, which is essential for detecting the increased traffic volumes typically associated with DDoS attacks.

NO.48 Which of the following service options would provide the best availability for critical applications in the event of a disaster?

Edge computing

Cloud bursting

Availability zones

Multicloud tenancy

Availability zones provide the best availability for critical applications in the event of a disaster. They are distinct locations within a cloud region that are engineered to be isolated from failures in other availability zones, thus providing redundancy and failover capabilities, which is essential for maintaining high availability of critical applications.References: The concept of availability zones and their importance in disaster recovery and high availability is covered under the domain of Management and Technical Operations in the CompTIA Cloud+ objectives.

NO.49 A cloud architect is preparing environments to develop a new application that will process sensitive dat a. The project team consists of one internal developer, two external consultants, and three testers. Which of the following is the most important security control for the cloud architect to consider implementing?

Setting up private development, public development, and testing environments

Segregating environments for internal and external teams

Configuring DDoS protection to mitigate the risk of downtime

Using IAM and ACL in order to bolster DLP

In a project handling sensitive data with a mix of internal and external team members, implementing Identity and Access Management (IAM) and Access Control Lists (ACL) is crucial for Data Loss Prevention (DLP). These controls ensure that only authorized individuals have access to specific resources, and actions are governed according to the principle of least privilege, minimizing the risk of data leakage or unauthorized access.

NO.50 A cross-site request forgery vulnerability exploited a web application that was hosted in a public laaS network. A security engineer determined that deploying a WAF in blocking mode at a CDN would prevent the application from being exploited again. However, a week after implementing the WAF, the application was exploited again. Which of the following should the security engineer do to make the WAF control effective?

Configure the DDoS protection on the CDN.

Install endpoint protection software on the VMs

Add an ACL to the VM subnet.

Deploy an IDS on the laaS network.

NO.51 The change control board received a request to approve a configuration change 10 deploy in the cloud production environment. Which of the following should have already been competed?

Penetration test

End-to-end security testing

Cost benefit analysis

User acceptance testing

Before a configuration change is deployed in the cloud production environment, it is crucial to conduct User Acceptance Testing (UAT). UAT involves testing the system by the end-users or clients to ensure it can handle required tasks in real-world scenarios, according to specifications. This testing is the final stage before the change is approved for production, ensuring that all functionalities meet user requirements and the system is ready for deployment.
Reference: The CompTIA Cloud+ certification highlights the significance of various testing phases, including UAT, as part of the cloud deployment process to validate the system’s readiness and functionality for end-users.

NO.52 An organization’s security policy states that software applications should not exchange sensitive data in cleartext.
The security analyst is concerned about a software application that uses Base64 to encode credit card data.
Which of the following would be the best algorithm to replace Base64?

RC4

AES

SHA-3

3DES

Loading …

Verified CV0-004 exam dumps Q&As with Correct 230 Questions and Answers: https://www.latestcram.com/CV0-004-exam-cram-questions.html

Free Cram & Latest Exams Dumps

Get 2025 Updated Free CompTIA CV0-004 Exam Questions & Answer [Q32-Q52]

leave a comment Cancel reply

Recent Posts

Archives

Categories