mediumMultiple Choice
CV0-004 Practice Question: A security team wants to implement host-based…
A security team wants to implement host-based intrusion detection on their virtual machines in a public cloud. Which approach provides the most effective detection while minimizing performance impact?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a cloud-native security service that deploys an agent to monitor system logs and file integrity.
Cloud-native security services that deploy agents on each VM provide host-based intrusion detection by monitoring system logs and file integrity, which is the most effective method for host-level threats. Options A, B, and C are incorrect: A (antivirus) focuses on malware, not intrusion detection; B and C are network-based, not host-based, and may not capture host-level events.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Install an antivirus agent on each VM.
Why it's wrong here
Antivirus agents match signatures and scan files; they do not monitor system calls, process ancestry or file integrity, so fileless and living-off-the-land intrusions evade them. It is tempting because agents are host-resident, and would be correct for malware detection and remediation rather than behavioural intrusion detection.
- ✗
Enable network traffic logging at the hypervisor level.
Why it's wrong here
Hypervisor-level traffic logging is network-based detection, capturing east-west flows but never inspecting guest process behaviour, file integrity or syscall activity, so host compromise goes unseen. It is tempting because hypervisor taps avoid in-guest agents, and would be correct for network intrusion detection or traffic forensics across tenants.
- ✗
Enable VPC flow logs and analyze them.
Why it's wrong here
VPC flow logs record connection metadata only, with no payload or guest-level telemetry, so they cannot detect host intrusion. It is tempting because flow logs are agentless and cheap, and would be correct for network anomaly detection, traffic baselining or connectivity troubleshooting rather than host-based detection.
- ✓
Use a cloud-native security service that deploys an agent to monitor system logs and file integrity.
Why this is correct
A cloud-native agent monitors system logs and file integrity directly on each VM, satisfying the host-based detection requirement. Agent-based collection captures OS-level events that network inspection cannot see, while lightweight log and integrity checks limit CPU and memory overhead compared with full packet capture or continuous file scanning.
Go deeper
Related to this question
About these practice questions
This CV0-004 question is part of Courseiva's 834-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.