CV0-004 Practice Test 16 — 15 Questions

Question 1

An organization is subject to PCI DSS compliance and must ensure that all data transmitted between its cloud application and users is encrypted. Which encryption method should be enforced?

Accepted Answer

TLS 1.2 or higher. TLS (Transport Layer Security) is the standard protocol for encrypting data in transit over networks, such as between a web browser and a server. PCI DSS requires strong encryption for cardholder data in transit.

Answer

AES-256

Answer

SHA-256

Answer

IPsec VPN

Question 2

An organization needs to store database credentials and API keys securely in the cloud, with automatic rotation every 90 days. Which service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager manages secrets lifecycle, including automatic rotation.

Answer

AWS CloudHSM

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 3

A cloud administrator notices that an AWS IAM user has more permissions than necessary. Which principle should be applied to correct this?

Accepted Answer

Least privilege. Least privilege means granting only the permissions required to perform a job function.

Answer

Separation of duties

Answer

Defense in depth

Answer

Zero trust

Question 4

A company's cloud environment uses Azure Active Directory for identity management. They want to allow employees to sign in using their existing on-premises Active Directory credentials without synchronizing passwords to the cloud. Which federation protocol should they use?

Accepted Answer

SAML 2.0. Federation allows identity federation without password synchronization. AD FS can be configured to use SAML 2.0 or OIDC to authenticate against on-premises AD and issue tokens to access cloud resources.

Answer

LDAP

Answer

Kerberos

Answer

OAuth 2.0

Question 5

A company has a requirement to enforce least privilege for its cloud resources. The cloud engineer is configuring IAM policies. Which of the following best describes least privilege?

Accepted Answer

Granting only the permissions necessary to perform specific tasks. Least privilege means granting only the permissions required to perform a job function, minimizing potential damage from compromised accounts.

Answer

Granting permissions based on the user's job title rather than specific needs

Answer

Granting permissions only to senior managers

Answer

Granting full administrator access to all users to simplify management

Question 6

A company is using a SaaS application and wants to gain visibility into user activity and enforce data loss prevention policies. Which technology should be deployed?

Accepted Answer

Cloud Access Security Broker (CASB). A Cloud Access Security Broker (CASB) provides visibility, compliance, and data security controls for SaaS applications.

Answer

Intrusion Detection System (IDS)

Answer

Web Application Firewall (WAF)

Answer

Network Access Control (NAC)

Question 7

A security team discovers that a container image used in production contains a known vulnerability in one of its base image layers. Which action should be taken to remediate this issue?

Accepted Answer

Rebuild the container image using an updated base image. The vulnerability is in the base image, so rebuilding the image using an updated base image that includes the security fix is the correct remediation. Additionally, scanning images in a CI/CD pipeline can catch vulnerabilities before deployment.

Answer

Delete the container and recreate it from the same image

Answer

Apply a security patch to the running container

Answer

Enable runtime security monitoring to detect exploitation attempts

Question 8

A cloud engineer is deploying a new application and needs to securely store database credentials. The credentials must be automatically rotated every 90 days. Which service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager allows secure storage and automatic rotation of secrets such as database credentials, with configurable rotation intervals.

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Answer

AWS Identity and Access Management (IAM)

Question 9

A company needs to meet PCI DSS compliance requirements for storing credit card data in the cloud. Which compliance certification should they verify their cloud provider has?

Accepted Answer

PCI DSS Level 1. PCI DSS Level 1 is the highest level for handling cardholder data.

Answer

ISO 27001

Answer

SOC 2 Type II

Answer

HIPAA BAA

Question 10

A security administrator is configuring a web application firewall (WAF) to protect against SQL injection attacks. Which WAF feature should be enabled?

Accepted Answer

OWASP rule set. OWASP rules include protections against SQL injection, XSS, and other common web vulnerabilities.

Answer

Geo-blocking

Answer

Rate limiting

Answer

DDoS protection

Question 11

A company uses AWS and wants to centralize security monitoring across multiple accounts. Which service should they use to aggregate security findings and check compliance against standards like CIS AWS Foundations?

Accepted Answer

AWS Security Hub. AWS Security Hub aggregates security alerts from various AWS services and third-party tools, and provides compliance checks against standards like CIS, PCI DSS, and AWS Foundational Security Best Practices.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Config

Question 12

A company requires multi-factor authentication (MFA) for all users accessing the cloud management console. Which IAM policy element should be used to enforce this?

Accepted Answer

Condition. A Condition element in an IAM policy can require MFA by checking the aws:MultiFactorAuthPresent key.

Answer

Action

Answer

Effect

Answer

Resource

Question 13

A cloud administrator needs to provide external partners with access to a cloud application using their existing corporate credentials. Which federation protocol should be used?

Accepted Answer

SAML. SAML is a standard federation protocol that enables single sign-on using existing identity providers.

Answer

RADIUS

Answer

Kerberos

Answer

LDAP

Question 14

A cloud architect is designing a network to protect a web application from common attacks such as SQL injection and cross-site scripting. Which cloud service should be used?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) inspects HTTP traffic and blocks web exploits like SQL injection and XSS.

Answer

DDoS Protection

Answer

Network ACL

Answer

Security Group

Question 15

According to the shared responsibility model, which of the following is the cloud provider responsible for?

Accepted Answer

Physical infrastructure security. The cloud provider is responsible for the physical infrastructure, hypervisor, and global network, while the customer is responsible for OS patching, IAM, data encryption, etc.

Answer

Operating system patching

Answer

Application code security

Answer

Identity and access management configuration