Pass CV0-003 Exam Guide

The best answer is D. Metrics and time-series data measuring key performance indicators.

Metrics and time-series data are numerical values that represent the state and behavior of a system over time. They can measure key performance indicators (KPIs) such as availability, latency, throughput, error rate, and resource utilization. Metrics and time-series data can help a cloud administrator to monitor, analyze, and troubleshoot the performance characteristics of an application .

Metrics and time-series data are most likely to be used in a reporting dashboard, because they can provide a clear and concise overview of the application’s performance. A reporting dashboard is a graphical user interface that displays the most important information about a system or a process in a single view. A reporting dashboard can help a cloud administrator to:

Visualize the trends and patterns of the metrics and time-series data using charts, graphs, tables, or gauges .

Compare the actual performance of the application with the expected or desired performance based on the defined service level objectives (SLOs) or service level agreements (SLAs) .

Identify and diagnose any performance issues or anomalies that may affect the reliability of the application .

Communicate and report the performance status and results to the stakeholders or customers.

The other options are not as likely to be used in a reporting dashboard, because they are either too detailed, too outdated, or too irrelevant for measuring the performance characteristics of the application. For example:

Data from files containing error messages from the application (A) may help to identify and debug some specific errors or exceptions that occur in the application. However, they are not sufficient to measure the overall performance or reliability of the application. They are also too verbose and unstructured to be displayed in a reporting dashboard.

Results from the last performance and workload testing (B) may help to evaluate and optimize the performance of the application under different scenarios and conditions. However, they are not representative of the current or real-time performance of the application in production. They are also too static and outdated to be displayed in a reporting dashboard.

Detail log data from syslog files of the application © may help to record and track the events and activities that happen in the application. However, they are not designed to measure the key performance indicators or metrics of the application. They are also too complex and voluminous to be displayed in a reporting dashboard.

Telnet and FTP are two services that should be disabled on a cloud server because they are insecure and vulnerable to attacks. Telnet and FTP use plain text to transmit data over the network, which means that anyone who can intercept the traffic can read or modify the data, including usernames, passwords, commands, files, etc. This can lead to data breaches, unauthorized access, or malicious actions on the server1.

Instead of Telnet and FTP, more secure alternatives should be used, such as SSH (Secure Shell) and SFTP (Secure File Transfer Protocol). SSH and SFTP use encryption to protect the data in transit and provide authentication and integrity checks for the communication. SSH and SFTP can prevent eavesdropping, tampering, or spoofing of the data and ensure the confidentiality and privacy of the server2.

The other options are not services that should be disabled on a cloud server:

Option C: Remote login. Remote login is a service that allows users to access a remote server from another location using a network connection. Remote login can be useful for managing, configuring, or troubleshooting a cloud server without having to physically access it. Remote login can be secured by using encryption, authentication, authorization, and logging mechanisms3.

Option D: DNS (Domain Name System). DNS is a service that translates human-friendly domain names into IP addresses that can be used to communicate over the Internet. DNS is essential for resolving the names of the cloud resources and services that are hosted on the cloud platform. DNS can be secured by using DNSSEC (DNS Security Extensions), which add digital signatures to DNS records to verify their authenticity and integrity.

Option E: DHCP (Dynamic Host Configuration Protocol). DHCP is a service that assigns IP addresses and other network configuration parameters to devices on a network. DHCP can simplify the management of IP addresses and avoid conflicts or errors in the network. DHCP can be secured by using DHCP snooping, which filters out unauthorized DHCP messages and prevents rogue DHCP servers from assigning IP addresses.

Option F: LDAP (Lightweight Directory Access Protocol). LDAP is a service that stores and organizes information about users, devices, and resources on a network. LDAP can provide identity management and access control for the cloud environment. LDAP can be secured by using LDAPS (LDAP over SSL/TLS), which encrypts the LDAP traffic and provides authentication and integrity checks.

Changing the subnet mask to use a 255.255.255.128 range would allow for the potential server addition. The current subnet mask of 255.255.255.240 (/28) only allows for 14 usable host addresses in the 172.16.0.0 network, which is not enough to accommodate the existing eight servers and the possible 16 new servers. Changing the subnet mask to 255.255.255.128 (/25) would increase the number of usable host addresses to 126 in the same network, which is sufficient to handle the server expansion. Changing the IP address range to use a 10.0.0.0 address, changing the server template to add network interfaces, or changing the server scaling configuration to increase the maximum limit would not solve the issue of the limited host addresses in the same network range. References: CompTIA Cloud+ CV0-003 Certification Study Guide, Chapter 3, Objective 3.1: Given a scenario, implement cloud networking solutions.

The correct answer is C and D.

C. Fix the file permissions with read-only access to the owner of the file.

D. Open port 22 access for the computer’s public IP address.

The authorized_keys file on the server should have read-only access for the owner of the file, and no access for anyone else. This ensures that only the owner can read the public keys that are authorized to log in, and no one can modify or delete them. The file permissions can be fixed with the command chmod 400 ~/.ssh/authorized_keys on the server. This is a recommended security practice for SSH key-based authentication123.

The computer that wants to log in to the server using SSH key-based authentication needs to have access to port 22 on the server, which is the default port for SSH service. This can be done by opening port 22 access for the computer’s public IP address on the server’s firewall or security group settings. This allows the computer to initiate an SSH connection to the server and authenticate with its private key. Opening port 21, which is used for FTP service, is not relevant or secure for SSH key-based authentication1.