CompTIA CompTIA Certifications CV0-003 Questions & Answers

• Question 411:

  When designing a three-node. load-balanced application, a systems administrator must ensure each node runs on a different physical server for HA purposes. Which of the following does the systems administrator need to configure?

  A. Round-robin methods

  B. Live migration

  C. Anti-affinity rule

  D. Priority queues

  Correct Answer: C

  Explanation: The correct answer is C. Anti-affinity rule.

  An anti-affinity rule is a configuration option that prevents two or more virtual machines (VMs) from running on the same physical host. This can improve the availability and fault tolerance of the VMs, as it reduces the risk of losing multiple

  VMs due to a single host failure. An anti-affinity rule can also improve the performance and load balancing of the VMs, as it distributes the workload across different hosts and avoids resource contention . A round-robin method is a load

  balancing algorithm that distributes incoming requests to a pool of servers in a circular order. A round-robin method does not consider the availability, capacity, or location of the servers, and may assign requests to servers that are

  overloaded, offline, or far away. A round-robin method does not ensure that each node runs on a different physical server.

  A live migration is a process that allows moving a running VM from one physical host to another without interrupting its operation. A live migration can improve the availability and performance of the VMs, as it enables dynamic load balancing,

  maintenance, and disaster recovery. However, a live migration does not prevent two or more VMs from running on the same physical host in the first place. A priority queue is a data structure that stores elements based on their priority values.

  A priority queue allows inserting and removing elements in order of their priority, such that the element with the highest priority is always at the front of the queue. A priority queue can be used to implement scheduling algorithms for processes

  or tasks, but it does not affect where they run on physical servers.

• Question 412:

  During a security incident on an laaS platform, which of the following actions will a systems administrator most likely take as part of the containment procedure?

  A. Connect to an instance for triage.

  B. Add a deny rule to the network ACL.

  C. Mirror the traffic to perform a traffic capture.

  D. Perform a memory acquisition.

  Correct Answer: B

  Explanation: A network access control list (ACL) is a set of rules that controls the inbound and outbound traffic for a network interface or a subnet. A deny rule can be used to block or filter the traffic from a specific source or destination, such as an IP address, a port number, or a protocol. By adding a deny rule to the network ACL, a systems administrator can prevent the communication between the compromised instance and the attacker, or between the compromised instance and other instances or servers. This can help to contain the security incident and limit the potential damage or data loss. A deny rule can also be used to isolate the compromised instance for further investigation or remediation. References: CompTIA Cloud+ CV0-003 Study Guide, Chapter 5: Maintaining a Cloud Environment, page 222-223; What is a network access control list (ACL)?.

• Question 413:

  An environment has a dual-stack infrastructure in an active-active configuration in two separate data centers. Which of the following best describes replication between the two sites?

  A. Data is moved constantly from the hot site to the warm site.

  B. Data is replicated every 15 minutes from one site to the other.

  C. Data is moved from one site to the other once per day.

  D. Data is synchronized in real time across the sites.

  E. Data is moved twice a day from Site A to Site B, and then from Site B to Site A.

  Correct Answer: D

  Explanation: A dual-stack infrastructure is a network that supports both IPv4 and IPv6 protocols. An active-active configuration is a high-availability cluster that distributes workloads across two or more nodes that are running the same service simultaneously. Replication between the two sites means that data is copied from one site to another to ensure consistency and redundancy. Data synchronization is the process of ensuring that data is identical across multiple locations. Therefore, data synchronization in real time means that data is replicated as soon as it changes on either site, without any delay or lag. References: Active-Active vs. Active-Passive High-Availability Clustering, Dual-stack IPv6 architectures for AWS and hybrid networks ?Part 2, Understanding Dual Stacking of IPv4 and IPv6 Unicast Addresses

• Question 414:

  A cloud solutions architect has an environment that must only be accessed during work hours. Which of the following processes should be automated to best reduce cost?

  A. Scaling of the environment after work hours

  B. Implementing access control after work hours

  C. Shutting down the environment after work hours

  D. Blocking external access to the environment after work hours

  Correct Answer: C

  Shutting down the environment after work hours is the best process to automate to reduce cost, as it will stop incurring charges for the cloud resources that are not needed outside of work hours. Scaling, implementing access control, or blocking external access may still incur some costs for the cloud resources that are running or reserved, even if they are not fully utilized. Shutting down the environment can be automated using scripts, schedules, or triggers that can turn off or deallocate the cloud resources based on time or usage criteria12.

• Question 415:

  A systems administrator is implementing a new version of a company's primary human- resources application. An upgrade will be performed on the production server, as there is no development environment. The administrator needs to have a plan in case something goes wrong with the upgrade. Which of the following will work best to ensure a quick rollback in case an issue arises?

  A. An application-level backup

  B. A production snapshot

  C. A full backup

  D. A differential backup

  Correct Answer: B

  A production snapshot is a point-in-time copy of the state and data of a production server or instance. It can be used to restore the server or instance to the exact state it was in when the snapshot was taken, in case of a failure, error, or corruption. A production snapshot can help to ensure a quick rollback in case an issue arises during an application upgrade, as it can revert the changes made by the upgrade and restore the previous version of the application. A production snapshot can also preserve the configuration and settings of the server or instance, as well as the application data and dependencies. A production snapshot is different from a backup, which is a copy of the data only, and may not include the state or configuration of the server or instance. References: CompTIA Cloud+ CV0-003 Study Guide, Chapter 2: Deploying a Cloud Environment, page 75- 76; Snapshots vs Backups: Key Differences and Similarities.

• Question 416:

  A cloud security engineer needs to design an IDS/IPS solution for a web application in a single virtual private network. The engineer is considering implementing IPS protection for traffic coming from the internet. Which of the following should the engineer consider to meet this requirement?

  A. Configuring a web proxy server

  B. Implementing load balancing using SSI- in front of web applications

  C. Implementing IDS/IPS agents on each instance running in that virtual private network

  D. Implementing dynamic routing

  Correct Answer: C

  An Intrusion Detection System (IDS) is a software or hardware system that monitors network traffic for malicious activity and alerts the administrator of any potential threats. An Intrusion Prevention System (IPS) is a software or hardware system that not only detects but also blocks or mitigates the malicious activity. Both IDS and IPS are essential for securing a web application in a cloud environment1. A web proxy server is a server that acts as an intermediary between the

  client and the web server. It can provide caching, filtering, and authentication services, but it does not offer IDS/IPS functionality. Therefore, option A is incorrect. Load balancing using SSI (Server Side Includes) is a technique that distributes

  the workload among multiple web servers by inserting dynamic content into web pages. It can improve the performance and availability of a web application, but it does not provide IDS/IPS protection. Therefore, option B is incorrect.

  Implementing IDS/IPS agents on each instance running in that virtual private network is a valid solution for providing IPS protection for traffic coming from the internet. The agents can monitor and inspect the network traffic on each instance

  and block or report any suspicious activity to a central management console. This can prevent attacks from reaching the web application or spreading to other instances in the same network.

  Therefore, option C is correct.

  Implementing dynamic routing is a technique that allows routers to select the best path for forwarding packets based on network conditions. It can enhance the reliability and efficiency of a network, but it does not offer IDS/IPS functionality.

  Therefore, option D is incorrect.

• Question 417:

  A VDI administrator is enhancing the existing environment with a feature to allow users to connect devices to virtual workstations. Which of the following types of devices are most likely to be allowed in the upgrade? (Select two).

  A. Display monitors

  B. USB devices

  C. SATA devices

  D. PCIe devices

  E. PCI devices

  F. Printers

  Correct Answer: BF

  Explanation: B. USB devices and F. Printers are most likely to be allowed in the upgrade. USB devices are common peripherals that users may want to connect to their virtual workstations, such as flash drives, keyboards, mice, webcams, etc. Printers are also useful devices that users may need to print documents from their virtual desktops. VDI software can support USB redirection and printer redirection to enable these devices to work with virtual workstations12. Display monitors, SATA devices, PCIe devices, and PCI devices are less likely to be allowed in the upgrade, as they are either part of the physical hardware of the end device or the server, or they require direct access to the host system. VDI software typically does not support these types of devices, as they are not compatible with the virtualization layer or the remote display protocol34.

  1: What is VDI? | Virtual Desktop Infrastructure | VMware 2: What Is Virtual Desktop Infrastructure (VDI)? | Microsoft Azure 3: What Is Virtual Desktop Infrastructure (VDI)? - Cisco 4: Best Virtual Desktop Infrastructure (VDI) Software in 2023 | G2

• Question 418:

  A cloud solutions architect is working on a private cloud environment in which storage consumption is increasing daily, resulting in high costs. Which of the following can the architect use to provide more space without adding more capacity? (Select two).

  A. Tiering

  B. Deduplication

  C. RAID provisioning

  D. Compression

  E. Flash optimization

  F. NVMe

  Correct Answer: BD

  Explanation: B. Deduplication and D. Compression are the two options that the architect can use to provide more space without adding more capacity. Deduplication is the process of eliminating duplicate copies of data that are stored in different locations, thus reducing the storage consumption and costs1. Compression is the process of reducing the size of data by applying algorithms that remove redundant or unnecessary information, thus saving storage space and bandwidth2. Both deduplication and compression can improve the efficiency and performance of cloud storage solutions12.

• Question 419:

  An organization's executives would like to allow access to devices that meet the corporate security compliance levels. Which of the following criteria are most important for the organization to consider? (Select two).

  A. Serial number

  B. Firmware

  C. Antivirus version and definition

  D. OS patch level

  E. CPU architecture

  F. Manufacturer

  Correct Answer: CD

  Explanation: Antivirus version and definition and OS patch level are important criteria for the organization to consider when allowing access to devices that meet the corporate security compliance levels. These criteria can help ensure that the devices are protected from malware and vulnerabilities that could compromise the security of the organization's data and systems. Serial number, firmware, CPU architecture, and manufacturer are not directly related to security compliance levels, although they may be relevant for other purposes such as inventory management or compatibility. References: CompTIA Cloud+ CV0-003 Exam Objectives, Objective 4.2: Given a scenario, apply security configurations and compliance controls1 ; CompTIA Quick Start Guide to Tackling Cloud Security Concerns2

• Question 420:

  A company has a large environment with multiple VPCs across three regions in a public cloud. The company is concerned about connectivity within the regions. Which of the following should the cloud administrator implement?

  A. Peering

  B. A firewall

  C. Network access control

  D. A load balancer

  Correct Answer: A

  Peering is a networking technique that allows direct and private connection between two or more cloud networks without using the public Internet. Peering can help the cloud administrator improve the connectivity within the regions by reducing the latency, increasing the bandwidth, and enhancing the security of the data transfer. Peering can be implemented between VPCs within the same region or across different regions, depending on the CSP's offerings and the customer's requirements. Peering can also help reduce the network costs by avoiding the use of the Internet gateways or VPNs. References: CompTIA Cloud+ CV0-003 Certification Study Guide, Chapter 3, Objective 3.1: Given a scenario, implement cloud networking solutions.