CV0-004 Practice Test 23 — 15 Questions

Question 1

An organization wants to audit all API calls made in their AWS account. Which AWS service should be enabled to capture these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity for governance, compliance, and auditing.

Answer

Amazon CloudWatch

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 2

Which of the following compliance frameworks is specifically designed for handling healthcare information in the United States?

Accepted Answer

HIPAA. HIPAA (Health Insurance Portability and Accountability Act) sets standards for protecting sensitive patient data. PCI DSS is for payment card data, SOC 2 is for service organizations, ISO 27001 is for information security management.

Answer

SOC 2 Type II

Answer

ISO 27001

Answer

PCI DSS

Question 3

A company uses AWS CloudFormation to manage its infrastructure. After updating a stack, a developer notices that the actual infrastructure differs from the expected template. Which CloudFormation feature should be used to identify these differences?

Accepted Answer

Drift detection. Drift detection allows you to detect whether a stack's actual configuration differs from its expected template configuration.

Answer

Stack sets

Answer

Change sets

Answer

Rollback triggers

Question 4

An organization is subject to PCI DSS compliance and must demonstrate that it is meeting security requirements. Which cloud service can aggregate compliance findings and provide a dashboard?

Accepted Answer

AWS Security Hub. AWS Security Hub aggregates security findings from multiple AWS services and provides a compliance dashboard.

Answer

AWS CloudTrail

Answer

AWS Shield

Answer

AWS Config

Question 5

A cloud engineer is configuring a web application that must comply with PCI DSS. The application runs on virtual machines in a public cloud. Which of the following security responsibilities falls under the customer's scope according to the shared responsibility model?

Accepted Answer

Patching the guest operating system of the virtual machines. In the shared responsibility model, the customer is responsible for patching the guest OS, while the cloud provider manages the physical infrastructure and hypervisor.

Answer

Replacing failed physical drives in the storage array

Answer

Configuring the physical network firewall

Answer

Applying hypervisor patches

Question 6

A security engineer is implementing DDoS protection for a public-facing web application hosted in AWS. Which TWO services should be used together to provide comprehensive DDoS mitigation? (Choose two.)

Accepted Answer

AWS WAF. AWS Shield Advanced provides enhanced DDoS protection for EC2, ELB, CloudFront, etc. AWS WAF can be used to mitigate application-layer attacks like HTTP flood. Shield Standard is free but less comprehensive. Route 53 is DNS and does not directly mitigate DDoS. GuardDuty is threat detection.

Answer

Amazon Route 53

Answer

AWS Shield Standard

Answer

Amazon GuardDuty

Question 7

A company uses Azure AD for identity federation with an on-premises Active Directory. They want to enable single sign-on (SSO) for cloud applications using an open standard. Which protocol should they use?

Accepted Answer

SAML 2.0. SAML (Security Assertion Markup Language) and OIDC (OpenID Connect) are open standards for federation. SAML is commonly used for SSO with Azure AD. OAuth is for authorization, not authentication. LDAP is a directory protocol. Kerberos is for on-premises.

Answer

OAuth 2.0

Answer

LDAP

Answer

Kerberos

Question 8

A cloud architect is designing a DDoS protection strategy for a web application hosted on AWS. The application uses an Application Load Balancer (ALB). Which service provides automatic, always-on DDoS protection at no additional cost?

Accepted Answer

AWS Shield Standard. AWS Shield Standard provides automatic protection against common DDoS attacks for all AWS customers at no additional cost.

Answer

AWS WAF

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Question 9

A security administrator is deploying a web application firewall (WAF) to protect a public-facing web application. The application experiences a high volume of traffic from a specific geographic region that is not part of the target customer base. Which WAF feature would best reduce the attack surface without impacting legitimate users?

Accepted Answer

Geo-blocking. Geo-blocking allows the administrator to block traffic from specific regions, reducing the attack surface by eliminating traffic from non-target areas.

Answer

IP whitelisting

Answer

Rate limiting

Answer

OWASP rule set

Question 10

A cloud administrator needs to ensure that a set of AWS EC2 instances can only be accessed via SSH from the corporate office IP range 203.0.113.0/24. Which configuration should the administrator implement?

Accepted Answer

Create a security group with an inbound rule allowing TCP port 22 from 203.0.113.0/24. A security group acts as a stateful virtual firewall for EC2 instances. By specifying the source IP range 203.0.113.0/24 on the inbound SSH rule, only traffic from that range is allowed. Security groups are stateful, so return traffic is automatically permitted.

Answer

Deploy a VPN and require all SSH traffic to go through it

Answer

Configure a network ACL with an inbound allow rule for TCP port 22 from 203.0.113.0/24

Answer

Use AWS WAF to block SSH traffic except from 203.0.113.0/24

Question 11

An organization is implementing a CI/CD pipeline for a critical application. The team wants to deploy a new version to a small subset of users initially to validate performance and functionality before rolling out to the entire user base. Which deployment strategy best fits this requirement?

Accepted Answer

Canary deployment. Canary deployment releases the new version to a small percentage of users, monitors its performance, and gradually increases traffic if successful.

Answer

Rolling deployment

Answer

Blue/green deployment

Answer

Immutable deployment

Question 12

A company is implementing a secrets management solution. The security team wants to ensure that secrets are protected and rotated regularly. Which THREE of the following are best practices for secrets management?

Accepted Answer

Audit access to secrets to detect unauthorized usage.. Best practices include using a dedicated vault, rotating secrets, avoiding hard-coded secrets, and auditing access.

Answer

Hard-code secrets in application source code for simplicity.

Answer

Store secrets in environment variables for easy access by applications.

Question 13

An organization is moving sensitive data to the cloud and must ensure it is encrypted while stored on disk. Which type of encryption should be implemented?

Accepted Answer

Encryption at rest. Encryption at rest protects data stored on disk, typically using AES-256.

Answer

Encryption in transit

Answer

Hashing

Answer

Tokenization

Question 14

A company uses a SaaS application for customer relationship management (CRM). The security team wants to monitor user activities and enforce data loss prevention (DLP) policies. Which type of security tool should be deployed?

Accepted Answer

Cloud Access Security Broker (CASB). A Cloud Access Security Broker (CASB) provides visibility into SaaS usage, monitors user activities, and can enforce DLP policies across cloud applications.

Answer

Intrusion Detection System (IDS)

Answer

Security Information and Event Management (SIEM)

Answer

Web Application Firewall (WAF)

Question 15

A company is migrating to AWS and needs to meet PCI DSS compliance. Which THREE of the following should be implemented? (Choose three.)

Accepted Answer

Encrypting cardholder data at rest and in transit. PCI DSS requires encryption of cardholder data, regular security testing (like vulnerability scanning), and audit logging. Using default VPC settings may not be secure. Single-factor authentication is insufficient.

Answer

Using single-factor authentication for all administrative access

Answer

Using default VPC settings without changes