Correct Answer: A

On firewall 3, change the DENY 0.0.0.0 entry to rule 3 not rule 1.

Correct Answer: B

Tagging is what the administrator should implement first to assist with reporting the cost for each business unit for applications in a public cloud environment. Tagging is a technique that allows customers to assign metadata or labels to their cloud resources, such as applications, instances, volumes, etc., based on their attributes or criteria. Tagging can help customers to organize, manage, monitor, and report their cloud resources and costs by business unit, project, owner, environment, etc.

Reference: https://www.linkedin.com/pulse/cloud-showback-critical-piece-enterprise-governance-how-gowda-/

Correct Answer: D

Mandatory access control (MAC) is a type of access control model that enforces strict security policies based on predefined rules and labels. MAC assigns security labels to subjects (users or processes) and objects (files or resources) and allows access only if the subject has the appropriate clearance and need-to-know for the object. MAC can mitigate the risk of users who have access to an instance modifying the system configurations, as it can prevent unauthorized or accidental changes to critical files or settings by restricting access based on predefined rules and labels. References: CompTIA Cloud+ Certification Exam Objectives, page 14, section 2.7

Correct Answer: B

A cloud access security broker (CASB) is a type of security solution that acts as a gateway between cloud service users and cloud service providers. A CASB can help a company get multiple compliance and security certifications for its public cloud environment, as it can provide visibility, control, and protection for cloud data and applications. A CASB can also help the company handle the extra workload and overcome the limited knowledge of the current infrastructure, as it can automate and simplify the enforcement of security policies and compliance requirements across multiple cloud services. References: CompTIA Cloud+ Certification Exam Objectives, page 14, section 2.7

Correct Answer: C

DDoS protection is what the administrator should configure to mitigate a network-based flooding attack that caused an outage in a cloud environment. A network- based flooding attack is a type of attack that sends a large amount of network

traffic or requests to a target system or service, such as a server, website, application, etc., with the intention of overwhelming or exhausting its resources or capacity. A network-based flooding attack can cause an outage in a cloud

environment by disrupting or degrading the availability or performance of the target system or service, as well as affecting other systems or services that share the same network or infrastructure. DDoS protection is a tool or service that

detects and prevents network-based flooding attacks, also known as Distributed Denial of Service (DDoS) attacks. DDoS protection can mitigate a network- based flooding attack by providing features such as:

Filtering: DDoS protection can filter network traffic or requests based on various criteria, such as source, destination, protocol, content, etc., and block or allow them accordingly.

Diverting: DDoS protection can divert network traffic or requests away from the target system or service to another location or device, such as a scrubbing center, proxy, firewall, etc., where they can be analyzed and processed. Scaling:

DDoS protection can scale network resources or capacity dynamically and automatically to handle the increased demand or load caused by the network- based flooding attack.

Correct Answer: C

Implementing an application whitelisting policy is the best way to prevent users from running malware on several IaaS compute instances. Application whitelisting is a security technique that allows only authorized or trusted applications to run on a system or device, and blocks or restricts all other applications. Application whitelisting can prevent users from running malware or unwanted software on their cloud instances, as well as reduce the attack surface and vulnerabilities of the system.

Correct Answer: B

These are the network ports that are required from a security perspective to copy a large set of files between the private and public cloud through a VPN tunnel. A VPN (Virtual Private Network) tunnel is a secure and encrypted connection that allows data to be transferred between two networks or locations over the public internet. To copy files between the private and public cloud, the following ports are needed: Port 22: This is the port used by SSH (Secure Shell) protocol, which is a method of remotely accessing and managing cloud resources or systems using a command- line interface. SSH can also be used to securely transfer files using SCP (Secure Copy Protocol) or SFTP (SSH File Transfer Protocol). Port 443: This is the port used by HTTPS (Hypertext Transfer Protocol Secure), which is a protocol that encrypts and secures web traffic. HTTPS can also be used to transfer files using web browsers or tools such as curl or wget. Port 445: This is the port used by SMB (Server Message Block) protocol, which is a protocol that allows file sharing and access over a network. SMB can also be used to transfer files using tools such as robocopy or rsync.

Correct Answer: CF

These are the protocols that should be used to share the disks between the nodes of a database cluster to access the same LUN (Logical Unit Number). A LUN is an identifier that represents a logical unit of storage, such as a disk, partition,

volume, etc., that can be accessed by a host system or device. To share the disks between the nodes of a cluster, the following protocols can be used:

iSCSI (Internet Small Computer System Interface): This is a protocol that allows SCSI commands to be sent over IP networks. iSCSI can enable block-level storage access over a network, which means that the host system or device can

access the storage as if it were a local disk.

FC (Fibre Channel): This is a protocol that provides high-speed and low-latency data transfer over optical fiber cables. FC can also enable block-level storage access over a network, which means that the host system or device can access

the storage as if it were a local disk.

Reference: https://www.vembu.com/blog/shared-storage-cluster-shared-volumes-configuration/

Correct Answer: D

Containers are the best approach to design a new machine-learning platform that needs to be portable between public and private clouds and should be kept as small as possible. Containers are isolated environments that can run applications and their dependencies without interfering with other processes or systems. Containers are lightweight, portable, and scalable, which makes them ideal for machine-learning applications. Containers can be moved easily between public and private clouds without requiring any changes or modifications. Containers can also reduce the size and complexity of applications by using only the necessary components and libraries.

Reference: https://www.ibm.com/in-en/cloud/learn/containerization

Correct Answer: B

The best way to resolve the issue where the autoscaling configuration is creating a new VM every five minutes after deploying a new CI/CD tool to automate new releases of the web application and configuring a script to be executed by the VMs during bootstrapping is to debug the script and redeploy it. Debugging the script means finding and fixing any errors or bugs in the code or logic of the script that may cause unexpected or undesired behavior, such as triggering the autoscaling condition or failing to complete the bootstrapping process. Redeploying the script means updating or replacing the existing script with the corrected or improved version of the script. Reference: [CompTIA Cloud+ Certification Exam Objectives], Domain 4.0 Troubleshooting, Objective 4.5 Given a scenario, troubleshoot automation/orchestration issues.