A vulnerability scan reveals a critical remote code execution vulnerability in a web application running on a cloud VM. The application is business-critical and cannot be taken offline. What is the most appropriate remediation strategy?

Restore the VM from a backup taken before the vulnerability was introduced

Immediately shut down the VM to prevent exploitation

Apply a virtual patch using a web application firewall (WAF) rule

Apply the vendor patch during the next maintenance window

A security analyst is reviewing the cloud environment and notices that a virtual machine has a public IP address and is directly accessible from the internet. The VM is only supposed to be accessed by internal users. What is the most likely vulnerability?

The VM is not patched with the latest security updates

The VM is not protected by a firewall

The VM is exposed to the internet, increasing the attack surface

The VM is using weak encryption protocols

A security team wants to assess the vulnerability of a containerized application running in a cloud environment. Which tool is most appropriate for this task?

A container image scanner that checks for known vulnerabilities in the image layers

A configuration management tool that checks the container's runtime settings

A web application scanner that tests the application's HTTP endpoints

A network vulnerability scanner that scans the container's IP address

A security team has identified several vulnerabilities in their cloud environment. They need to prioritize remediation efforts. Which factor should be the primary consideration when prioritizing?

The ease of exploitation by an attacker

The number of systems affected by the vulnerability

The potential impact on business operations and data sensitivity

A company has a critical vulnerability in a legacy application that cannot be patched because the vendor no longer provides updates. The application is essential for business operations. What is the most appropriate remediation strategy?

Implement compensating controls such as network segmentation and strict access controls

Decommission the application immediately

Apply a vendor patch that is not officially supported

Ignore the vulnerability because the application is legacy

CompTIACloud+

Domain 4Objective 1

Vulnerability Management CV0-004 Practice Questions (Page 1)

Part of the Security domain, which accounts for 19% of the CV0-004 exam. CompTIA does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

9concepts

19%of the exam

Questions 1–5

1application · medium
A vulnerability scan reveals a critical remote code execution vulnerability in a web application running on a cloud VM. The application is business-critical and cannot be taken offline. What is the most appropriate remediation strategy?
Select an answer first
2application · medium
A security analyst is reviewing the cloud environment and notices that a virtual machine has a public IP address and is directly accessible from the internet. The VM is only supposed to be accessed by internal users. What is the most likely vulnerability?
Select an answer first
3application · medium
A security team wants to assess the vulnerability of a containerized application running in a cloud environment. Which tool is most appropriate for this task?
Select an answer first
4application · medium
A security team has identified several vulnerabilities in their cloud environment. They need to prioritize remediation efforts. Which factor should be the primary consideration when prioritizing?
Select an answer first
5expert · hard
A company has a critical vulnerability in a legacy application that cannot be patched because the vendor no longer provides updates. The application is essential for business operations. What is the most appropriate remediation strategy?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CV0-004

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CV0-004” is a trademark of its owner, used for identification only.