CV0-004 Practice Test 24 — 15 Questions

Question 1

During a security audit, an organization discovers their cloud-based database is accessible from any public IP address due to a firewall rule allowing 0.0.0.0/0 on port 3306 (MySQL). The database must remain accessible to remote developers working from home. What is the most effective remediation?

Accepted Answer

Change the firewall rule to allow only specific known developer IP ranges.. Option C is correct because restricting to specific trusted IP ranges reduces exposure while maintaining remote access.

Answer

Remove the firewall rule entirely and rely on database IAM authentication.

Answer

Enable encryption in transit using TLS and keep the rule as is.

Answer

Move the database to a private subnet without a NAT gateway.

Question 2

A cloud security analyst finds the above JSON policy attached to an S3 bucket containing confidential customer data. What change must be made to comply with the principle of least privilege?

Accepted Answer

Restrict the Principal to a specific AWS account or user.. Option D is correct because a wildcard Principal allows anonymous access; restricting to a specific principal ensures only authorized entities can access the data.

Answer

Change the Effect to 'Deny'.

Answer

Change the Action to 's3:PutObject'.

Answer

Remove the Resource field.

Question 3

The above condition is included in an IAM policy. What does this condition restrict?

Accepted Answer

Access to only requests from the IP range 192.168.1.0/24.. Option A is correct because the aws:SourceIp condition key limits the source IP addresses to the specified range.

Answer

Access through a VPN connection.

Answer

Access to only private IP addresses.

Answer

Access from a specific VPC.

Question 4

Which TWO of the following are effective methods to protect data in transit within a cloud environment? Select two.

Accepted Answer

VPN overlay networks. Options A and B are correct because TLS and VPN encrypt data during transmission. The other options are for data at rest or data masking.

Answer

Object-level ACLs

Answer

Server-side encryption with AES-256

Answer

Data masking

Question 5

Which TWO of the following are common vulnerabilities in cloud environments that can lead to unauthorized access? Select two.

Accepted Answer

Lack of encryption for data in transit. Options A and D are correct because misconfigured security groups and lack of encryption in transit are common vulnerabilities. B, C, and E are security best practices.

Answer

Enabling automatic patching

Answer

Using multi-factor authentication

Answer

Properly scoped IAM roles

Question 6

Which THREE of the following are essential components of a cloud incident response plan? Select three.

Accepted Answer

Root cause analysis. Options A, B, and D are correct because communication, root cause analysis, and containment are critical to incident response. Cost optimization and backup schedule are operational concerns.

Answer

Data backup schedule

Answer

Cost optimization strategies

Question 7

During a security assessment, a cloud auditor discovers that a virtual machine has a publicly accessible SSH port (22) open to the entire internet (0.0.0.0/0). The VM is a bastion host intended for administration. What should be done to reduce risk?

Accepted Answer

Remove the network security group rule allowing SSH from 0.0.0.0/0 and add a rule allowing only the corporate VPN's public IP range.. Option C is correct because a bastion host should only be accessible from trusted IPs, typically the corporate VPN or a specific IP range. Option A is wrong because security groups are the proper tool. Option B is wrong because closing SSH externally would block administration. Option D is wrong because disabling password auth alone does not limit access.

Answer

Remove the security group rule for SSH and rely on the operating system firewall.

Answer

Disable SSH and use a serial console for administration.

Answer

Enable SSH key authentication and disable password login.

Question 8

Which TWO of the following are best practices for securing a cloud object storage bucket?

Accepted Answer

Enable bucket versioning.. Options A and D are correct. Enabling versioning helps protect against accidental deletion or overwrite, and bucket policies can restrict access to specific principals. Option B is wrong because public access is generally not recommended. Option C is wrong because lifecycle policies are for management, not security. Option E is wrong because encryption is important but does not enforce access control.

Answer

Set the bucket ACL to public-read-write for ease of access.

Answer

Configure a lifecycle policy to delete objects after 30 days.

Answer

Encrypt all objects using server-side encryption.

Question 9

Which THREE of the following are valid methods to manage identity and access in a multi-cloud environment?

Accepted Answer

Implement a federation using SAML 2.0 between the corporate identity provider and each cloud.. Options A, B, and D are correct. A single sign-on (SSO) with federation allows centralized access control, cloud access security brokers (CASB) enforce policies across clouds, and resource tags combined with access policies can automate access. Option C is wrong because shared keys are not identity-based. Option E is wrong because VPNs are for network, not identity.

Answer

Set up a site-to-site VPN between the on-premises network and each cloud.

Answer

Use a single shared API key for all clouds to simplify automation.

Question 10

Which TWO steps should be performed to ensure that a new cloud user has only the minimum required permissions to perform their job? (Choose two.)

Accepted Answer

Provide permissions based on the user's specific job functions.. The principle of least privilege involves granting only necessary permissions and periodically reviewing them. Using a broad policy is the opposite. Removing the user is not appropriate. Creating a group is good for management but not directly for least privilege.

Answer

Assign the user to a group with broad administrator access for flexibility.

Answer

Remove the user's account immediately after granting access.

Answer

Create a custom role that includes all possible permissions.

Question 11

A cloud architect is designing a multi-tier application. To ensure secure communication between the web tier and the application tier within the same VPC, which approach should be used?

Accepted Answer

Use internal IP addresses with network ACLs allowing all traffic from the web tier subnet.. Option C is correct because using internal IPs with network ACLs provides network segmentation and control within the VPC.

Answer

Use a VPN between tiers.

Answer

Use public IP addresses with security groups.

Answer

Use a transit gateway with encryption.

Question 12

A cloud architect is designing a multi-tier application in a public cloud that must comply with PCI DSS. The web tier must be accessible from the internet, but the application tier should not have any public IP addresses. Which architecture meets these requirements?

Accepted Answer

Place the web tier in a public subnet behind an internet-facing load balancer, and the app tier in a private subnet with a NAT gateway for outbound traffic.. Option A is correct because placing the web tier in a public subnet with a load balancer and the app tier in a private subnet with no public IPs fulfills the requirement. Option B is wrong because a direct VPC peering does not restrict public access. Option C is wrong because a VPN adds unnecessary complexity. Option D is wrong because the app tier should not have public IPs.

Answer

Assign public IP addresses to both tiers and use security group rules to restrict traffic.

Answer

Deploy both tiers in private subnets and use a VPC peering connection to the corporate data center.

Answer

Use a site-to-site VPN between the cloud VPC and an on-premises network for all traffic.

Question 13

A cloud engineer runs the commands shown in the exhibit. Based on the output, which security issue is present?

Accepted Answer

The firewall rule allows SSH access from any source IP.. Option B is correct because the firewall rule allow-ssh allows SSH (tcp:22) from all IP addresses (0.0.0.0/0), which is a security risk. Option A is wrong because the bastion host is separate. Option C is wrong because there is only one rule shown. Option D is wrong because the instances are running normally.

Answer

The bastion host is not used for SSH access.

Answer

The web servers are not running.

Answer

There are too many firewall rules allowing SSH.

Question 14

Refer to the exhibit. What is the effect of this bucket policy?

Accepted Answer

It allows anyone to read objects in example-bucket only if they come from the specified IP range.. The policy allows s3:GetObject to any principal (*) but only if the request originates from the IP range 203.0.113.0/24. This is a common way to restrict access to a specific network. It does not deny other IPs explicitly; it just doesn't allow them. It does not require authentication; the principal is *.

Answer

It requires users to authenticate with AWS IAM before accessing the bucket.

Answer

It allows only the specified IP range to write objects.

Answer

It denies all access to the bucket except from the specified IP range.

Question 15

Which of the following is the best practice for securely storing secrets such as database passwords in a cloud environment?

Accepted Answer

Use a dedicated secrets management service.. Option D is correct because dedicated secrets management services provide secure storage, rotation, and access control.

Answer

Hard-code the secrets in the application code.

Answer

Store secrets in a configuration file in the repository.

Answer

Encrypt secrets and store them in a shared storage.