CompTIA CV0-004 Practice Test 55
Question 540
The infrastructure architect at a regional health provider investigates this condition: a cloud file share suddenly shows many rapid file rewrites and encrypted extensions under one user identity. Which explanation best accounts for it?
- Stolen login tokens or credentials may be abused even when the legitimate user never approved new access.
- Legal holds override normal disposal schedules for records within their scope.
- Server-side request forgery can reach instance metadata if egress and metadata protections are weak.
- Ransomware can spread through valid file permissions, so anomalous access and protected history matter.
Explanation
Correct Answer
D:The evidence of success is: Alerting detects synthetic mass changes and a prior clean file version is recoverable.
Incorrect Answers
A:That approach would help when a remote worker receives a fake cloud sign-in page and shortly afterward a new device signs in with their account. Check the difference through: Review file audit events, user access, versioning and immutable recovery points.
B:The alternative is aimed at a different condition: A deletion policy automatically removes contract records after one year even though some are subject to a legal hold. Ransomware can spread through valid file permissions, so anomalous access and protected history matter.
C:The proposed measure serves a related cloud task, but the present symptom calls for a more specific response. Ransomware can spread through valid file permissions, so anomalous access and protected history matter. Check the difference through: Review file audit events, user access, versioning and immutable recovery points.
Question 541
At a global distribution company, an engineer needs to close a case where a cloud file share suddenly shows many rapid file rewrites and encrypted extensions under one user identity. What test is most decisive?
- Alerting detects synthetic mass changes and a prior clean file version is recoverable.
- The app can read permitted calendar data while write/admin calls are rejected.
- Suspicious instance creation is stopped and its initiating identity is identified from audit logs.
- The suspicious session is revoked and a replay from the untrusted device is blocked.
Explanation
Correct Answer
A:Alerting detects synthetic mass changes and a prior clean file version is recoverable. This proves the service behavior rather than just showing a changed configuration. Ransomware can spread through valid file permissions, so anomalous access and protected history matter.
Incorrect Answers
B:That approach would help when a mobile application requests full account administration just to read a user's calendar. The required acceptance result is: Alerting detects synthetic mass changes and a prior clean file version is recoverable.
C:Ransomware can spread through valid file permissions, so anomalous access and protected history matter.
D:The suspicious session is revoked and a replay from the untrusted device is blocked. The relevant cloud response here is: Alerting detects synthetic mass changes and a prior clean file version is recoverable.
Question 542
At a regional health provider, this issue is reported: a cloud file share suddenly shows many rapid file rewrites and encrypted extensions under one user identity. What should be examined before applying a fix?
- Correlate message artifacts, sign-in device, token activity and MFA events.
- Review file audit events, user access, versioning and immutable recovery points.
- Review provisioning events, resource tags, GPU utilization and payment anomalies.
- Inspect running services, account rights, firewall defaults and benchmark applicability.
Explanation
Correct Answer
B:Review file audit events, user access, versioning and immutable recovery points. This distinguishes the relevant dependency before changing cloud resources. Ransomware can spread through valid file permissions, so anomalous access and protected history matter.
Incorrect Answers
A:That approach would help when a remote worker receives a fake cloud sign-in page and shortly afterward a new device signs in with their account. Review file audit events, user access, versioning and immutable recovery points.
C:Review provisioning events, resource tags, GPU utilization and payment anomalies. The relevant cloud response here is: Review file audit events, user access, versioning and immutable recovery points.
D:Inspect running services, account rights, firewall defaults and benchmark applicability. The relevant cloud response here is: Review file audit events, user access, versioning and immutable recovery points.
Question 543
At a global distribution company, an operational review finds that a remote worker receives a fake cloud sign-in page and shortly afterward a new device signs in with their account. What is the best next step?
- Investigate mass modification signals, restrict the compromised identity and protect recoverable versions.
- Move credentials into a controlled secret store, rotate the leaked value and inventory consumers.
- Investigate phishing indicators, revoke suspicious sessions and strengthen phishing-resistant authentication.
- Investigate unexpected compute provisioning as possible account misuse and isolate the credentials.
Explanation
Correct Answer
C:Stolen login tokens or credentials may be abused even when the legitimate user never approved new access. The change should be verified, not just applied: The suspicious session is revoked and a replay from the untrusted device is blocked.
Incorrect Answers
A:That approach would help when a cloud file share suddenly shows many rapid file rewrites and encrypted extensions under one user identity. In this case, stolen login tokens or credentials may be abused even when the legitimate user never approved new access.
B:Stolen login tokens or credentials may be abused even when the legitimate user never approved new access. The alternative is aimed at a different condition: Application credentials are copied across many VM config files and nobody knows which instances use the leaked secret.
D:Cloud resource abuse can appear as unusual billing, API calls and compute demand rather than an application error. The relevant cloud response here is: Investigate phishing indicators, revoke suspicious sessions and strengthen phishing-resistant authentication.
Question 544
An operator asks why the issue arises: a remote worker receives a fake cloud sign-in page and shortly afterward a new device signs in with their account. Which explanation is strongest?
- Zero Trust denies implicit trust based solely on network location and applies conditional access decisions.
- Ransomware can spread through valid file permissions, so anomalous access and protected history matter.
- Server-side request forgery can reach instance metadata if egress and metadata protections are weak.
- Stolen login tokens or credentials may be abused even when the legitimate user never approved new access.
Explanation
Correct Answer
D:The evidence of success is: The suspicious session is revoked and a replay from the untrusted device is blocked.
Incorrect Answers
A:That approach would help when a cloud intranet trusts any request from the office IP range even when the calling device is unmanaged. Check the difference through: Correlate message artifacts, sign-in device, token activity and MFA events.
B:The alternative is aimed at a different condition: A cloud file share suddenly shows many rapid file rewrites and encrypted extensions under one user identity. It does not directly resolve the described failure. Stolen login tokens or credentials may be abused even when the legitimate user never approved new access. Check the difference through: Correlate message artifacts, sign-in device, token activity and MFA events.
C:The proposed measure serves a related cloud task, but the present symptom calls for a more specific response. Stolen login tokens or credentials may be abused even when the legitimate user never approved new access. Check the difference through: Correlate message artifacts, sign-in device, token activity and MFA events.
Question 545
After correcting the following problem, what result would best confirm success? A remote worker receives a fake cloud sign-in page and shortly afterward a new device signs in with their account.
- The suspicious session is revoked and a replay from the untrusted device is blocked.
- A locality audit confirms no protected record or backup crosses the restricted boundary.
- Alerting detects synthetic mass changes and a prior clean file version is recoverable.
- A controlled metadata probe fails from the app without breaking approved outbound calls.
Explanation
Correct Answer
A:The suspicious session is revoked and a replay from the untrusted device is blocked. This proves the service behavior rather than just showing a changed configuration. Stolen login tokens or credentials may be abused even when the legitimate user never approved new access.
Incorrect Answers
B:That approach would help when a company stores citizen information in an approved region but its backups replicate automatically to a prohibited country. The required acceptance result is: The suspicious session is revoked and a replay from the untrusted device is blocked.
C:Stolen login tokens or credentials may be abused even when the legitimate user never approved new access. The alternative is aimed at a different condition: A cloud file share suddenly shows many rapid file rewrites and encrypted extensions under one user identity.
D:Stolen login tokens or credentials may be abused even when the legitimate user never approved new access. The proposed measure serves a related cloud task, but the present symptom calls for a more specific response.
Question 546
The platform team investigates: a remote worker receives a fake cloud sign-in page and shortly afterward a new device signs in with their account. Which diagnostic inspection would isolate the immediate dependency?
- Review provisioning events, resource tags, GPU utilization and payment anomalies.
- Correlate message artifacts, sign-in device, token activity and MFA events.
- Inspect labels, destination conditions, false positives and enforcement evidence.
- Inspect outbound request logs, metadata token requirements and application URL validation.
Explanation
Correct Answer
B:Correlate message artifacts, sign-in device, token activity and MFA events. This distinguishes the relevant dependency before changing cloud resources. Stolen login tokens or credentials may be abused even when the legitimate user never approved new access.
Incorrect Answers
A:That approach would help when an unused project suddenly provisions GPU instances through an unfamiliar API principal at night. Correlate message artifacts, sign-in device, token activity and MFA events.
C:Inspect labels, destination conditions, false positives and enforcement evidence. The relevant cloud response here is: Correlate message artifacts, sign-in device, token activity and MFA events.
D:Inspect outbound request logs, metadata token requirements and application URL validation. The relevant cloud response here is: Correlate message artifacts, sign-in device, token activity and MFA events.
Question 547
During an approved service change at a global distribution company, a developer changes a shared cloud deployment module on the main branch without peer review and disrupts two services. Which action is the most targeted?
- Separate logical changes into reviewable commits while keeping each buildable.
- Track immutable commit identity and revert or redeploy a verified known-good revision.
- Use a protected feature branch and pull request with required review checks.
- Resolve the conflict against both requirements and test the merged result.
Explanation
Correct Answer
C:A reviewed pull request separates proposed changes from the protected release branch. The change should be verified, not just applied: An unauthorized direct push fails while approved reviewed changes can merge.
Incorrect Answers
A:That approach would help when a developer mixes credential changes, database schema edits and unrelated formatting in one massive commit. In this case, a reviewed pull request separates proposed changes from the protected release branch.
B:Source history enables reproducible rollback only when deployed artifacts map to exact reviewed commits. The relevant cloud response here is: Use a protected feature branch and pull request with required review checks.
D:Version-control conflict resolution requires preserving intended semantics, not just choosing whichever text builds. The relevant cloud response here is: Use a protected feature branch and pull request with required review checks.
Question 548
During architecture review, a developer changes a shared cloud deployment module on the main branch without peer review and disrupts two services. Which statement best explains why the corrective approach works?
- Source history enables reproducible rollback only when deployed artifacts map to exact reviewed commits.
- Version-control conflict resolution requires preserving intended semantics, not just choosing whichever text builds.
- Focused commits make review, diagnosis and rollback safer than bundling unrelated changes.
- A reviewed pull request separates proposed changes from the protected release branch.
Explanation
Correct Answer
D:The evidence of success is: An unauthorized direct push fails while approved reviewed changes can merge.
Incorrect Answers
A:That approach would help when a recent merge raises API error rates and engineers cannot tell which deployment commit produced it. Check the difference through: Inspect branch protection, review history and successful checks.
B:The alternative is aimed at a different condition: Two engineering teams change the same IaC line and a merge overwrites one team's resource security setting. It does not directly resolve the described failure. A reviewed pull request separates proposed changes from the protected release branch. Check the difference through: Inspect branch protection, review history and successful checks.
C:The proposed measure serves a related cloud task, but the present symptom calls for a more specific response. A reviewed pull request separates proposed changes from the protected release branch. Check the difference through: Inspect branch protection, review history and successful checks.
Question 549
A service owner asks for a measurable acceptance test: a developer changes a shared cloud deployment module on the main branch without peer review and disrupts two services. Which result should the team obtain?
- An unauthorized direct push fails while approved reviewed changes can merge.
- Reviewers can identify each change's purpose and revert a defect without losing independent fixes.
- The merged configuration passes policy checks and retains both approved security requirements.
- The service returns to its prior behavior and release logs identify the matching commit.
Explanation
Correct Answer
A:An unauthorized direct push fails while approved reviewed changes can merge. This proves the service behavior rather than just showing a changed configuration. A reviewed pull request separates proposed changes from the protected release branch.
Incorrect Answers
B:That approach would help when a developer mixes credential changes, database schema edits and unrelated formatting in one massive commit. The required acceptance result is: An unauthorized direct push fails while approved reviewed changes can merge.
C:A reviewed pull request separates proposed changes from the protected release branch.
D:The service returns to its prior behavior and release logs identify the matching commit. The relevant cloud response here is: An unauthorized direct push fails while approved reviewed changes can merge.
Question 550
Before changing production at a regional health provider, a developer changes a shared cloud deployment module on the main branch without peer review and disrupts two services. Which evidence should the engineer check first?
- Review git tags, deployment manifests and build provenance.
- Inspect branch protection, review history and successful checks.
- Compare common ancestor, both diffs and integration test results.
- Inspect changed files, dependency order and commit message clarity.
Explanation
Correct Answer
B:Inspect branch protection, review history and successful checks. This distinguishes the relevant dependency before changing cloud resources. A reviewed pull request separates proposed changes from the protected release branch.
Incorrect Answers
A:That approach would help when a recent merge raises API error rates and engineers cannot tell which deployment commit produced it. In this case, a reviewed pull request separates proposed changes from the protected release branch.
C:Compare common ancestor, both diffs and integration test results. The relevant cloud response here is: Inspect branch protection, review history and successful checks.
D:Inspect changed files, dependency order and commit message clarity. The relevant cloud response here is: Inspect branch protection, review history and successful checks.