CompTIA CompTIA Certifications CV0-004 Questions & Answers

• Question 271:

  An on-premises data center is located in an earthquake-prone location. The workload consists of real-time, online transaction processing. Which of the following data protection strategies should be used to back up on-premises data to the cloud while also being cost effective?

  A. Remote replication for failover

  B. A copy that is RAID 1 protected on spinning drives in an on-premises private cloud

  C. A full backup to on-site tape libraries in a private cloud

  D. Air-gapped protection to provide cyber resiliency

  Correct Answer: A

  Remote replication for failover is the data protection strategy that should be used to back up on-premises data to the cloud for an earthquake-prone location. It provides real-time or near-real-time copying of data to a remote location, which can be quickly activated in case the primary site fails.References: Disaster recovery strategies, including remote replication for failover, are part of the cloud-based data protection methods covered in the CompTIA Cloud+ certification.

• Question 272:

  A newly configured VM fails to run application updates despite having internet access. The updates download automatically from a third-party network. Given the following output:

  

  Which of the following troubleshooting steps would be best to take?

  A. Checking DNS configurations

  B. Reconfiguring routing protocols

  C. Testing the IP address configuration

  D. Running a trace to the router

  Correct Answer: A

  The best troubleshooting step to take given the output is to check DNS configurations. The failure to resolve the "na.updateserver.net" domain suggests a DNS resolution issue, which could be due to incorrect DNS settings, a failure in the DNS service, or an issue with the DNS server itself.References: Troubleshooting DNS issues is a crucial skill in cloud management, as DNS plays a fundamental role in network connectivity and access to resources. It is covered under Cloud Concepts in the CompTIA Cloud+ curriculum.

• Question 273:

  A cloud administrator recently created three servers in the cloud. The goal was to create ACLs so the servers could not communicate with each other. The servers were configured with the following IP addresses:

  

  After implementing the ACLs, the administrator confirmed that some servers are still able to reach the other servers. Which of the following should the administrator change to prevent the servers from being on the same network?

  A. The IP address of Server 1 to 172.16.12.36

  B. The IP address of Server 1 to 172.16.12.2

  C. The IP address of Server 2 to 172.16.12.18

  D. The IP address of Server 2 to 172.16.14.14

  Correct Answer: B

  To prevent the servers from being on the same network and communicating with each other, the administrator should change the IP address of Server 1 to 172.16.12.2. This IP address is outside the subnet defined by the subnet mask 255.255.255.240, which would place Server 1 on a different subnet, preventing direct communication without routing. References: CompTIA Cloud+ Study Guide (V0-004) by Todd Montgomery and Stephen Olson

• Question 274:

  A systems administrator needs to configure backups for the company's on-premises VM cluster. The storage used for backups will be constrained on free space until the company can implement cloud backups. Which of the following backup types will save the most space, assuming the frequency of backups is kept the same?

  A. Snapshot

  B. Ful

  C. Differential

  D. Incremental

  Correct Answer: D

  An incremental backup strategy saves space because it only backs up data that has changed since the last backup. Compared to full and differential backups, incremental backups are smaller and save more space, which is essential when

  storage is constrained.

  References: CompTIA Cloud+ Guide to Cloud Computing (ISBN: 978-1-64274-282-2)

• Question 275:

  SIMULATION

  The QA team is testing a newly implemented clinical trial management (CTM) SaaS application that uses a business intelligence application for reporting. The UAT users were instructed to use HTTP and HTTPS.

  Refer to the application dataflow:

  1.

  1A -The end user accesses the application through a web browser to enter and view clinical data.

  2.

  2A -The CTM application server reads/writes data to/from the database server.

  3.

  1B -The end user accesses the application through a web browser to run reports on clinical data.

  4.

  2B -The CTM application server makes a SOAP call on a non-privileged port to the BI application server.

  5.

  3B -The BI application server gets the data from the database server and presents it to the CTM application server.

  When UAT users try to access the application using https://ctm.app.com or http://ctm.app.com, they get a message stating: "Browser cannot display the webpage." The QA team has raised a ticket to troubleshoot the issue.

  INSTRUCTIONS

  You are a cloud engineer who is tasked with reviewing the firewall rules as well as virtual network settings.

  You should ensure the firewall rules are allowing only the traffic based on the dataflow.

  You have already verified the external DNS resolution and NAT are working.

  Verify and appropriately configure the VLAN assignments and ACLs. Drag and drop the appropriate VLANs to each tier from the VLAN Tags table. Click on each Firewall to change ACLs as needed.

  If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

  

  

  

  A. Check the answer in explanation.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  On firewall 3, change the DENY 0.0.0.0 entry to rule 3 not rule 1.

• Question 276:

  SIMULATION

  A company has decided to scale its e-commerce application from its corporate datacenter to a commercial cloud provider to meet an anticipated increase in demand during an upcoming holiday.

  The majority of the application load takes place on the application server under normal conditions. For this reason, the company decides to deploy additional application servers into a commercial cloud provider using the on-premises

  orchestration engine that installs and configures common software and network configurations.

  The remote computing environment is connected to the on-premises datacenter via a site-to-site IPSec tunnel. The external DNS provider has been configured to use weighted round-robin routing to load balance connections from the Internet.

  During testing, the company discovers that only 20% of connections completed successfully.

  INSTRUCTIONS

  Review the network architecture and supporting documents and fulfill these requirements:

  Part 1:

  1.

  Analyze the configuration of the following components: DNS, Firewall 1, Firewall 2, Router 1, Router 2, VPN and Orchestrator Server.

  2.

  Identify the problematic device(s).

  Part 2:

  1.

  Identify the correct options to provide adequate configuration for hybrid cloud architecture.

  2.

  If at any time you would like to bring back the initial state of the simulation, please click the Reset All button.

  Part 1:

  Cloud Hybrid Network Diagram

  

  

  

  

  Part 2:

  Only select a maximum of TWO options from the multiple choice question

  A. Update the PSK (Pre-shared key) in Router 2.

  B. Update the A record on the DNS from 2.2.2.2 to 1.1.1.1.

  C. Promote deny All to allow All in Firewall 1 and Firewall 2.

  D. Change the Address Space on Router 2.

  E. Change internal IP Address of Router 1.

  F. Reverse the Weight property in the two CNAME records on the DNS.

  G. Add the Application Server at on-premises to the Load Balancer.

  Correct Answer: AD

  Part 1: Router 2

  The problematic device is Router 2, which has an incorrect configuration for the IPSec tunnel. The IPSec tunnel is a secure connection between the on-premises datacenter and the cloud provider, which allows the traffic to flow between the

  two networks. The IPSec tunnel requires both endpoints to have matching parameters, such as the IP addresses, the pre-shared key (PSK), the encryption and authentication algorithms, and the security associations (SAs) .

  According to the network diagram and the configuration files, Router 2 has a different PSK and a different address space than Router 1. Router 2 has a PSK of "1234567890", while Router 1 has a PSK of "0987654321". Router 2 has an

  address space of 10.0.0.0/8, while Router 1 has an address space of 192.168.0.0/16. These mismatches prevent the IPSec tunnel from establishing and encrypting the traffic between the two networks. The other devices do not have any

  obvious errors in their configuration. The DNS provider has two CNAME records that point to the application servers in the cloud provider, with different weights to balance the load. The firewall rules allow the traffic from and to the application

  servers on port 80 and port 443, as well as the traffic from and to the VPN server on port 500 and port 4500. The orchestration server has a script that installs and configures the application servers in the cloud provider, using the DHCP server

  to assign IP addresses.

  Part 2:

  The correct options to provide adequate configuration for hybrid cloud architecture are:

  Update the PSK (Pre-shared key) in Router 2.

  Change the Address Space on Router 2.

  These options will fix the IPSec tunnel configuration and allow the traffic to flow between the on-premises datacenter and the cloud provider. The PSK should match the one on Router 1, which is "0987654321". The address space should also

  match the one on Router 1, which is 192.168.0.0/16.

• Question 277:

  SIMULATION

  A company hosts various containerized applications for business uses. A client reports that one of its routine business applications fails to load the web-based login prompt hosted in the company cloud.

  Click on each device and resource. Review the configurations, logs, and characteristics of each node in the architecture to diagnose the issue. Then, make the necessary changes to the WAF configuration to remediate the issue.

  

  

  A. See the below for solution.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  From the image, it's noticeable that some finance application rules are set to "Block" traffic. If the client's issue is with a finance-related application not loading the login prompt, these rules could be the cause.

  The rule with ID 1005, labeled "Finance application 1", is configured to allow access to "webapp1" for finance-related paths. However, rule 1006, labeled "Finance application 2", is set to block access to "webapp1" for login-related paths. To

  remediate the issue based on the WAF configuration you have provided, you would want to:

  Ensure that the correct paths to the finance application are allowed through the WAF.

  Modify any rules that are incorrectly blocking access to the application. If the client's problem is specifically with the login prompt, then rule 1006 seems the most likely culprit. Changing the action from "Block" to "Allow" for rule 1006 could

  potentially resolve the client's issue. The rule should be carefully reviewed and updatedto ensure legitimate traffic is not being blocked while still protecting against unauthorized access.

• Question 278:

  SIMULATION

  You are a cloud engineer working for a cloud service provider that is responsible for an IaaS offering.

  Your customer, who creates VMs and manages virtual storage, has noticed I/O bandwidth issues and low IOPS (under 9000).

  Your manager wants you to verify the proper storage configuration as dictated by your service level agreement (SLA).

  The SLA specifies:

  1.

  Each SFP on the hypervisor host must be set to the maximum link speed allowed by the SAN array. . All SAN array disk groups must be configured in a RAID 5.

  2.

  The SAN array must be fully configured for redundant fabric paths. . IOPS should not fall below 14000 INSTRUCTIONS Click on each service processor to review the displayed information. Then click on the drop-down menus to change the settings of each device as necessary to conform to the SLA requirements.

  

  

  A. See the explanation for complete solution.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  Based on the SLA requirements and the information provided in the diagram:

  For the Hypervisor:

  Slot A fiber channel card:

  Port 1 link speed should be set to 16 Gbps since it's connected to Fabric switch A which supports 16 Gbps.

  Port 2 link speed should be set to 8 Gbps because it's connected to Fabric switch B which supports up to 8 Gbps.

  Slot B fiber channel card:

  Port 1 link speed should be set to 16 Gbps since it's connected to Fabric switch A which supports 16 Gbps.

  Port 2 link speed should be set to 8 Gbps because it's connected to Fabric switch B which supports up to 8 Gbps.

  

• Question 279:

  SIMULATION

  A company hosts various containerized applications for business uses. A client reports that one of its routine business applications fails to load the web-based login prompt hosted in the company cloud.

  

  INSTRUCTIONS Click on each device and resource. Review the configurations, logs, and characteristics of each node in the architecture to diagnose the issue. Then, make the necessary changes to the WAF configuration to remediate the issue. Web app 1

  

  Web app 2

  

  Web app 3

  

  Web app 4

  

  Client app

  

  

  A. Check the for the complete Solution.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  The issue is with Web app 1 (Finance application).

  From the WAF logs, we can see that requests to

  https://webapp1.comptia.org/FIN/login.htmlare being blocked (Rule ID 1006). The rule is configured to block access to the finance application's login page. This corresponds to the reported issue of the web-based login prompt not loading. To

  remediate the issue, the WAF configuration for Rule ID 1006 should be changed from "Block" to "Allow". This will enable the web-based login prompt to load for the client. Additionally, the client app configuration indicates that the client laptop

  (IP 192.168.10.142) is trying to access the service, and the WAF logs show that requests from this IP are being blocked due to the current rule set. Changing the action for Rule ID 1006 will also ensure that legitimate attempts to access the

  login page from this IP are not blocked.

  Steps for remediation:

  Go to the WAF configuration.

  Find Rule ID 1006 for the Finance application 1.

  Change the action from "Block" to "Allow".

  Save the changes.

  References:

  Web application firewall (WAF) configurations typically include rules that define which traffic should be allowed or blocked. Blocking legitimate traffic to login pages can prevent users from accessing the application, which seems to be the case

  here.

  Client application configurations and WAF logs provide valuable insights into the source of the traffic and the rules that are affecting it. It's important to ensure that the rules align with the intended access policies for the application.

• Question 280:

  SIMULATION

  An e-commerce company is migrating from an on-premises private cloud environment to a public cloud IaaS environment. You are tasked with right-sizing the environment to save costs after the migration. The company's requirements are to provide a 20% overhead above the average resource consumption, rounded up.

  INSTRUCTIONS

  Review the specifications and graphs showing resource usage for the web and database servers. Determine the average resource usage and select the correct specifications from the available drop-down options.

  

  A. Check the for the complete Solution.

  B. PlaceHolder

  C. PlaceHolder

  D. PlaceHolder

  Correct Answer: A

  For the Web Server: CPU: 2 vCPUs RAM: 2GB Disk Speed: 10MBps For the Database Server: CPU: 6 vCPUs RAM: 128GB Disk Speed: 110MBps These selections are based on maintaining a 20% overhead above the average resource consumption and rounding up to the next available option in the dropdowns provided.