hardMultiple ChoiceObjective-mapped
CV0-004 Practice Question: Uses a private cloud and wants to implement…
An organization uses a private cloud and wants to implement multifactor authentication (MFA) for administrative access to the hypervisor. However, due to legacy system constraints, the hypervisor does not support MFA directly. What is the BEST alternative to achieve MFA for administrative logins?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy a jump host (bastion host) with MFA, and restrict hypervisor access to only that host.
A jump host (bastion host) can be placed in a separate network segment that requires MFA for access. Administrators log into the jump host first and then connect to the hypervisor from it. Direct SSH keys still rely on single-factor authentication. A VPN without MFA is insufficient. Using a certificate alone is also single factor.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure SSH key-based authentication for all hypervisor logins.
Why it's wrong here
SSH keys are considered something you have, but without a second factor, it's still single-factor authentication.
- ✗
Implement a certificate-based authentication scheme for the hypervisor.
Why it's wrong here
Certificates alone are a single factor; MFA requires at least two different factors.
- ✗
Set up a VPN that requires MFA and allow only VPN traffic to reach the hypervisor.
Why it's wrong here
VPN with MFA protects the network connection, but once connected, the hypervisor login itself lacks MFA.
- ✓
Deploy a jump host (bastion host) with MFA, and restrict hypervisor access to only that host.
Why this is correct
This layers MFA at the entry point, and the hypervisor access is limited to a secured intermediary.
Go deeper
Related to this question
About these practice questions
This CV0-004 question is part of Courseiva's 977-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.