A company has an incident response plan, but during a recent security incident, the team struggled to contain the threat because they did not have the necessary tools or access. What should be done to improve the plan?

Move the incident response plan to a cloud-based document repository

Conduct regular tabletop exercises and ensure the incident response team has the required tools and permissions

Increase the number of team members

Outsource incident response to a third-party provider

What is the primary purpose of Cloud Security Posture Management (CSPM)?

To provide a virtual private network for secure remote access

To automatically patch all operating systems in the cloud

To continuously monitor cloud environments for misconfigurations and compliance risks

To encrypt all data stored in the cloud

What is the primary purpose of a risk assessment in a cloud environment?

To comply with all regulatory standards automatically

To prioritize vulnerabilities based on their potential impact and likelihood

To eliminate all vulnerabilities from the cloud environment

To ensure that all cloud resources are encrypted

A security team has identified three vulnerabilities in their cloud environment: a critical vulnerability in a public-facing web server, a high vulnerability in an internal database, and a medium vulnerability in a development environment. The team has limited resources and must prioritize remediation. Which vulnerability should be addressed first?

The high vulnerability in the internal database

All three vulnerabilities should be addressed simultaneously

The critical vulnerability in the public-facing web server

The medium vulnerability in the development environment

A cloud administrator notices that several VMs have been created with default administrative credentials and open management ports. The company wants to prevent this from happening again. What should the administrator implement?

A manual checklist for administrators to follow when creating VMs

A vulnerability scanner that runs after VM creation

A network access control list (ACL) that blocks all inbound traffic

A configuration management tool with policy-as-code to enforce secure baseline configurations

CompTIACloud+

Domain 4Objective 1

Vulnerability Management CV0-004 Practice Questions (Page 2)

Part of the Security domain, which accounts for 19% of the CV0-004 exam. CompTIA does not publish an official question count, but from its 90-minute exam (~35–60 total, ~7–11 in this domain), expect 1–2 from this objective — we provide 37 practice questions to prepare you well beyond it. (estimate)

37questions here

8free pages

9concepts

19%of the exam

Questions 6–10

6expert · hard
A company has an incident response plan, but during a recent security incident, the team struggled to contain the threat because they did not have the necessary tools or access. What should be done to improve the plan?
Select an answer first
7foundation · easy
What is the primary purpose of Cloud Security Posture Management (CSPM)?
Select an answer first
8foundation · easy
What is the primary purpose of a risk assessment in a cloud environment?
Select an answer first
9expert · hard
A security team has identified three vulnerabilities in their cloud environment: a critical vulnerability in a public-facing web server, a high vulnerability in an internal database, and a medium vulnerability in a development environment. The team has limited resources and must prioritize remediation. Which vulnerability should be addressed first?
Select an answer first
10application · medium
A cloud administrator notices that several VMs have been created with default administrative credentials and open management ports. The company wants to prevent this from happening again. What should the administrator implement?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CV0-004

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by CompTIA. “CV0-004” is a trademark of its owner, used for identification only.