CompTIA CompTIA Certifications CV0-003 Questions & Answers

• Question 371:

  A systems administrator needs to connect the companys network to a public cloud services provider. Which of the following will BEST ensure encryption in transit for data transfers?

  A. Identity federation

  B. A VPN tunnel

  C. A proxy solution

  D. A web application firewall

  Correct Answer: B

  Explanation: The answer is A. SAML. SAML (Security Assertion Markup Language) is a standard for exchanging authentication and authorization data between different parties, such as a user and a service provider. In a federated cluster,

  SAML can be used to enable single sign-on (SSO) for users across multiple clusters or cloud providers. SAML relies on the exchange of XML-based assertions that contain information about the user's identity, attributes, and entitlements. If

  the users' API access tokens have become invalid, it could be because the SAML assertions have expired, been revoked, or corrupted. The administrator should check the SAML configuration and logs to determine the cause of this issue.

  Some possible sources of information about SAML and federated clusters are:

  Authenticating | Kubernetes: This page provides an overview of authenticating users in Kubernetes, including using SAML for federated identity. Authenticating to the Kubernetes API server - Google Cloud: This page explains how to

  authenticate to the Kubernetes API server on Google Cloud, including using SAML for federated identity with Google Cloud Identity Platform. Error 403 User not authorized when trying to access Azure Databricks API through Active Directory

  - Stack Overflow: This page discusses a similar issue of users getting an error when trying to access Azure Databricks API using SAML and Active Directory.

• Question 372:

  A cloud administrator who is troubleshooting DNS issues discovers zone transfers are not occurring between the primary and secondary name servers due to an error in the serial numbers. Which of the following records should the administrator query for the serial number?

  A. PTR

  B. TXT

  C. SOA

  D. SRV

  Correct Answer: C

  Explanation: SOA stands for Start of Authority, and it is a type of DNS record that contains information about a DNS zone, such as the name of the primary name server, the email address of the zone administrator, the serial number of the zone, and other parameters. The serial number is used to indicate when a zone has been updated, and it is incremented by the primary name server whenever a change is made to the zone data. The secondary name servers use the serial number to determine if they need to request a zone transfer from the primary name server to synchronize their data. References: [CompTIA Cloud+ Study Guide], page 207.

• Question 373:

  A systems administrator is working within a private cloud environment. Over time. random 4K read/write speeds on all VMS in the environment slow down until the VMS are completely unusable, with disk speeds of less than 1MBps. The

  administrator has gathered the information below:

  There is no correlation between the slowdown and VM/hypervisor resource utilization.

  The network is rated to 40Gbps and utilization is between 1--5%.

  The hypervisors use hundreds of NFSv3 mounts to the same storage appliance, one per VM.

  The VMS on each hypervisor become unresponsive after two weeks of uptime.

  The unresponsiveness is resolved by moving slow VMS onto a rebooted hypervisor.

  Which of the following solutions will MOST likely resolve this issue?

  A. Increase caching on the storage appliance.

  B. Configure jumbo frames on the hypervisors and storage.

  C. Increase CPU/RAM resources on affected VMS.

  D. Reduce the number of NFSv3 mounts to one.

  Correct Answer: D

  Explanation: The correct answer is D. Reduce the number of NFSv3 mounts to one.

  NFSv3 is a network file system protocol that allows clients to access files stored on a remote server. NFSv3 uses TCP or UDP as the transport layer protocol, and typically runs on port 20491. One of the known issues with NFSv3 mounts is that they can cause performance degradation and unresponsiveness on the client side if there are too many mounts or if there are network connectivity problems. This is because NFSv3 does not handle connection failures or timeouts gracefully, and may keep retrying to access the server indefinitely, blocking other processes or threads. This can result in slow disk speeds, high CPU usage, and system hangs23. Therefore, one of the possible solutions to this issue is to reduce the number of NFSv3 mounts to one per hypervisor, instead of one per VM. This way, the hypervisor can manage the access to the shared storage appliance more efficiently, and avoid creating too many TCP connections or UDP packets that may overload the network or the server. Reducing the number of NFSv3 mounts can also simplify the configuration and troubleshooting of the network file system. Increasing caching on the storage appliance may improve the read performance of the NFSv3 mounts, but it will not solve the underlying issue of connection failures or timeouts. Caching may also introduce data inconsistency or corruption issues if the cache is not synchronized with the server. Configuring jumbo frames on the hypervisors and storage may improve the network throughput and efficiency of the NFSv3 mounts, but it will not solve the underlying issue of connection failures or timeouts. Jumbo frames are larger than standard Ethernet frames, and require that all devices on the network path support them. Jumbo frames may also introduce fragmentation or compatibility issues if they are not configured properly. Increasing CPU/RAM resources on affected VMs may improve their performance in general, but it will not solve the underlying issue of connection failures or timeouts. Increasing CPU/RAM resources may also be costly and wasteful if they are not needed for other purposes.

• Question 374:

  A company is concerned it will run out of VLANs on its private cloud platform in the next couple months, and the product currently offered to customers requires the company to allocate three dedicated, segmented tiers. Which of the following can the company implement to continue adding new customers and to maintain the required level of isolation from other tenants?

  A. GRE

  B. SR-IOV

  C. VXLAN

  D. IPSec

  Correct Answer: C

  One possible solution for the company to continue adding new customers and to maintain the required level of isolation from other tenants is to implement VXLAN. VXLAN is a network virtualization technology that can extend VLAN by adding a 24-bit segment ID, which allows up to 16 million unique virtual segments. VXLAN can encapsulate layer 2 Ethernet frames within layer 3 IP packets, and tunnel them across the underlying network. VXLAN can provide logical isolation and security for different tenants, as well as scalability and flexibility for large cloud computing environments1.

• Question 375:

  A company is using laaS services from two different providers: one for its primary site, and the other for a secondary site. The primary site is completely inaccessible, and the management team has decided to run through the BCP procedures. Which of the following will provide the complete asset information?

  A. DR replication document

  B. DR playbook

  C. DR policies and procedures document

  D. DR network diagram

  Correct Answer: B

  Explanation: According to the CompTIA Cloud+ CV0-003 Certification Study Guide1, the answer is B. DR playbook. A DR playbook is a document that contains the detailed steps and procedures to recover from a disaster scenario. It includes the asset information, such as the cloud resources, configurations, and dependencies, that are needed to restore the normal operations of the business. A DR replication document is a document that describes how the data and applications are replicated between the primary and secondary sites. A DR policies and procedures document is a document that defines the roles and responsibilities of the staff, the communication channels, and the objectives and scope of the DR plan. A DR network diagram is a visual representation of the network topology and connectivity between the primary and secondary sites.

• Question 376:

  A systems administrator is attempting to gather information about services and resource utilization on VMS in a cloud environment. Which of the following will BEST accomplish this objective?

  A. Syslog

  B. SNMP

  C. CMDB

  D. Service management

  E. Performance monitoring

  Correct Answer: E

  Performance monitoring is the process of collecting and analyzing metrics related to the performance and availability of resources in a cloud environment1. Performance monitoring can help a systems administrator to gather information about

  services and resource utilization on VMs in a cloud environment by providing the following benefits2:

  Identify and troubleshoot performance issues and bottlenecks before they affect the end users or business operations.

  Optimize the resource allocation and configuration to meet the performance requirements and SLAs of the services.

  Plan for future capacity and scalability needs based on the historical trends and patterns of resource utilization.

  Compare the performance and costs of different cloud service providers, regions, and SKUs.

  Some of the tools and services that can help with performance monitoring in a cloud environment are3:

  Azure Monitor: A comprehensive service that provides a unified view of the health, performance, and availability of your Azure resources, applications, and services. Azure Monitor collects metrics, logs, and traces from various sources and

  provides analysis, visualization, alerting, and automation capabilities. Azure Advisor: A personalized service that provides recommendations to optimize your Azure resources for performance, security, cost, reliability, and operational

  excellence. Azure Advisor analyzes your resource configuration and usage data and suggests best practices to improve your cloud environment. Azure Application Insights: A service that monitors the performance and usage of your web

  applications and services. Application Insights collects telemetry data such as requests, dependencies, exceptions, page views, custom events, and metrics from your application code and provides powerful analytics, diagnostics, and alerting

  features.

  Azure Log Analytics: A service that collects and analyzes data from various sources such as Azure Monitor, Azure services, VMs, containers, applications, and other cloud or on-premises systems. Log Analytics enables you to query,

  visualize, and correlate log data using the Kusto Query Language (KQL) and create custom dashboards and reports.

  Syslog is a standard protocol for sending log messages from network devices to a central server. Syslog can help with logging and auditing activities in a cloud environment, but it does not provide performance monitoring capabilities.

  Therefore, option A is incorrect. SNMP (Simple Network Management Protocol) is a protocol for collecting and organizing information about managed devices on a network. SNMP can help with network management and monitoring in a cloud

  environment, but it does not provide comprehensive performance monitoring for VMs and services. Therefore, option B is incorrect. CMDB (Configuration Management Database) is a database that stores information about the configuration

  items (CIs) in an IT environment. CMDB can help with configuration management and change management in a cloud environment, but it does not provide performance monitoring capabilities. Therefore, option C is incorrect. Service

  management is a set of processes and practices that aim to deliver value to customers by providing quality services that meet their needs and expectations. Service management can help with service design, delivery, support, and

  improvement in a cloud environment, but it does not provide performance monitoring capabilities. Therefore, option D is incorrect.

• Question 377:

  The Chief Information Officer of a financial services company wants to ensure stringent security measures are maintained while migrating customer financial information from a private cloud to the public cloud. The cloud engineer must deploy automated validation and verification checks to prevent unauthorized disclosure of financial information. Which of the following should be configured during the migration?

  A. ACL

  B. VPN

  C. P2V

  D. VDI

  Correct Answer: B

  Explanation: One possible answer is:

  B. VPN

  A VPN (Virtual Private Network) is a technology that creates a secure and encrypted connection between a remote device and a private network over the internet. A VPN can help prevent unauthorized disclosure of financial information during

  the migration from a private cloud to the public cloud, as it can protect the data in transit from interception, tampering, or leakage. A VPN can also help maintain compliance with data privacy regulations, such as GDPR or PCI DSS, by

  ensuring that the data is only accessible by authorized parties12.

  ACL (Access Control List) is a method of controlling access to resources based on user or group permissions. ACL can help enforce security policies and restrict access to sensitive data, but it does not encrypt or protect the data in transit3.

  P2V (Physical to Virtual) is a process of converting a physical machine into a virtual machine. P2V can help migrate workloads from on-premises servers to cloud servers, but it does not ensure the security of the data during the migration4.

  VDI (Virtual Desktop Infrastructure) is a technology that provides users with virtual desktops hosted on a centralized server. VDI can help improve the performance, availability, and manageability of desktop environments, but it does not

  address the security of the data during the migration5.

• Question 378:

  A cloud engineer is migrating a customer's web servers from a hypervisor platform to a CSP environment. The engineer needs to decouple the infrastructure and components during the migration to reduce the single points of failure. Which of the following storage options should the cloud engineer migrate the content to in order to improve availability?

  A. Block

  B. File

  C. Object

  D. iSCSI E. NFS

  Correct Answer: C

  Object storage is a storage option that stores data as discrete units called objects, which are identified by a unique identifier and can have metadata attached to them. Object storage can help the cloud engineer migrate the content to improve availability by decoupling the data from the underlying infrastructure and components. Object storage can also provide high scalability, durability, and redundancy for the data, as well as support for multiple protocols and access methods. Object storage can be accessed through APIs, web interfaces, or gateways that can emulate file or block storage. Object storage is suitable for storing unstructured or static data, such as web content, images, videos, or documents. References: CompTIA Cloud+ CV0-003 Certification Study Guide, Chapter 4, Objective 4.1: Given a scenario, implement cloud storage solutions.

• Question 379:

  A systems administrator is reviewing the logs from a company's IDS and notices a large amount of outgoing traffic from a particular server. The administrator then runs a scan on the server, which detects malware that cannot be removed. Which of the following should the administrator do first?

  A. Determine the root cause.

  B. Disconnect the server from the network.

  C. Perform a more intrusive scan.

  D. Restore the server from a backup.

  Correct Answer: B

  Explanation: The first step in any incident response procedure is to contain the incident and prevent it from spreading or causing more damage. In this scenario, the systems administrator is reviewing the logs from a company's IDS and notices a large amount of outgoing traffic from a particular server. The administrator then runs a scan on the server, which detects malware that cannot be removed. This indicates that the server is compromised and may be sending malicious or sensitive data to an external source. Therefore, the best thing to do first is to disconnect the server from the network, which will isolate it from the rest of the system and stop the data exfiltration. Determining the root cause, performing a more intrusive scan, and restoring the server from a backup are all important steps, but they should be done after the server is disconnected from the network. References: CompTIA Cloud+ CV0-003 Certification Study Guide, Chapter 10, Incident Response Procedures, page 1771.

• Question 380:

  A systems administrator audits a cloud application and discovers one of the key regulatory requirements has not been addressed. The requirement states that if a physical breach occurs and hard drives are stolen, the contents of the drives should not be readable. Which of the following should be used to address the requirement?

  A. Obfuscation

  B. Encryption

  C. EDR

  D. HIPS

  Correct Answer: B

  Explanation: Encryption is the process of transforming data into an unreadable format using a secret key or algorithm. Encryption can be used to protect data at rest or in transit from unauthorized access or theft. If a physical breach occurs

  and hard drives are stolen, encryption can prevent the contents of the drives from being readable by anyone who does not have the decryption key or algorithm.

  References: [CompTIA Cloud+ Study Guide], page 236.