Exam CV0-003 topic 1 question 358 discussion

Explanation: If the storage appliance is exposed to the public internet via a NATed public IP, and an administrator notices strange files and a spike in network traffic, the most likely cause is that the default password was never changed. Attackers scan public IPs for appliances with default credentials. Many virtual storage appliances ship with weak or known default credentials, making them easy targets. Once compromised, the appliance could be used for data exfiltration, cryptojacking, or hosting malicious files, explaining the spike in network traffic.

C. Keyword is "just deployed" no other deployments are essentially in this public cloud environment as well we can assume. We do not know what could be doing the NAT as well. Most likely this is a DDoS attack occurring and infiltration because of the weird files. We can assume no firewall was protecting this asset against these attacks.

The storage appliance having a NAT to a public IP only indicates the appliance private IP is translated to a public IP for external access. Going with C.

If it is nat, it is already behind a firewall. Going with default password

C. The storage appliance has no firewall.