CompTIA CV0-003 - CompTIA Cloud+ Certification Exam

Hardening is the best option to help the cloud provider secure the environment and limit consumers’ activity on its IaaS platform. Hardening is a process of reducing the attack surface and vulnerabilities of a system or device by applying security configurations, patches, updates, policies, rules, etc. Hardening can prevent consumers from installing unauthorized or unsupported software on their cloud servers, such as hypervisors.

This is the best solution to achieve the objective of reducing current RTO (Recovery Time Objective) from 12 hours to one hour, and RPO (Recovery Point Objective) from one day to eight hours, at the lowest cost possible, for a website that uses mostly static files and a small relational database. RTO is a metric that measures how quickly a system or service can be restored after a disruption or disaster. RPO is a metric that measures how much data can be lost or how far back in time a recovery point can be without causing significant impact or damage. To reduce RTO and RPO, the administrator should implement a website replica in the cloud with auto-scaling using the smallest possible footprint. A website replica is a copy or backup of a website that can be used for recovery or failover purposes. Auto-scaling is a feature that allows cloud resources or systems to adjust their capacity and performance according to demand or workload. Using auto-scaling with the smallest possible footprint can minimize costs by using only the necessary resources and scaling up or down as needed. The administrator should also use DNS (Domain Name System) to shift the load from on premises to the cloud. DNS is a service that translates domain names into IP addresses and vice versa. Using DNS, the administrator can redirect traffic from the on-premises website to the cloud replica in case of a disruption or disaster, and vice versa when recovery is complete.

LTS (Long Term Support) is the update branch that the administrator should choose to ensure the system receives updates that are maintained for at least four years. An update branch is a category or group of updates that have different characteristics or features, such as frequency, stability, duration, etc. An update branch can help customers to choose the type of updates that suit their needs and preferences. LTS is an update branch that provides updates that are stable, reliable, and secure, and are supported for a long period of time, usually four years or more. LTS can help customers who value stability and security over new features or functions, and who do not want to change or upgrade their systems frequently.

A call tree is what will help the administrator find the details of the relevant team members for escalation after a disaster situation has occurred and the entire team needs to be informed about the situation. A call tree is a document or diagram that shows the hierarchy or sequence of communication or notification among team members in case of an emergency or incident, such as a disaster situation. A call tree can help to find the details of the relevant team members for escalation by providing information such as:

Name: This indicates who is involved in the communication or notification process, such as team members, managers, stakeholders, etc.

Role: This indicates what is their function or responsibility in the communication or notification process, such as initiator, receiver, sender, etc.

Contact: This indicates how they can be reached or contacted in the communication or notification process, such as phone number, email address, etc.

Creating a VPN tunnel is the first action that the engineer should perform to prepare for server migrations and establish connectivity between clouds. A VPN (Virtual Private Network) tunnel is a secure and encrypted connection that allows data to be transferred between two networks or locations over the public internet. Creating a VPN tunnel can enable communication and interoperability between different cloud environments, as well as protect data from interception or modification during migration.

Affinity is what must be set up to ensure two VMs remain together on the same host. Affinity is a feature that allows customers to specify preferences or requirements for placing VMs on certain hosts or clusters within a cloud environment. Affinity can help to improve performance, availability, compatibility, or security of VMs by ensuring they are located on optimal hosts or clusters. Affinity can also help to keep two VMs together on the same host by creating an affinity rule that binds them together.

Moving the digital certificate to the load balancer and configuring the communication between the load balancer and the VMs to use HTTP are two actions that will decrease the CPU utilization of the VMs that are running behind a network load balancer with two VMs, each with its own digital certificate configured. Moving the digital certificate to the load balancer will offload the SSL/TLS encryption and decryption tasks from the VMs to the load balancer, which can reduce the CPU overhead and improve performance. Configuring the communication between the load balancer and the VMs to use HTTP will eliminate the need for encryption and decryption between them, which can also reduce CPU consumption. However, this may introduce security risks if sensitive data is transmitted over HTTP.

User quotas are what will help control the amount of space that is being used by a file server in the cloud that has a limited amount of disk space due to financial considerations. User quotas are the limits or restrictions that are imposed on the amount of space that each user can use or consume on a file server or storage device. User quotas can help to control the amount of space that is being used by:

Preventing or reducing wastage or overuse of space by users who may store unnecessary or redundant files or data on the file server or storage device.

Ensuring fair and equal distribution or allocation of space among users who may have different needs or demands for space on the file server or storage device.

Monitoring and managing the usage or consumption of space by users who may need to be notified or alerted when they reach or exceed their quota on the file server or storage device.

A default and common credentialed scan is what the administrator should use to verify the word “qwerty” has not been used as a password on any of the administrative web consoles in a network. A credentialed scan is a type of vulnerability scan that uses valid credentials or accounts to access and scan target systems or devices. A credentialed scan can provide more accurate and detailed results than a non-credentialed scan, as it can perform more actions and tests on target systems or devices. A default and common credentialed scan is a type of credentialed scan that uses default or common credentials or accounts, such as admin/admin, root/root, etc., to access and scan target systems or devices. A default and common credentialed scan can help to identify weak or insecure passwords on administrative web consoles, such as “qwerty”, and recommend stronger passwords.