CV0-004 Practice Test 24 — 15 Questions

Question 1

A cloud security team is implementing a secrets management solution for applications running on AWS. They need to automatically rotate database credentials every 30 days and avoid hardcoding secrets. Which service should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager allows automatic rotation of secrets (e.g., database credentials) and integration with AWS services. Parameter Store can store secrets but does not natively support automatic rotation. KMS is for encryption keys. IAM roles are for AWS service permissions.

Answer

AWS Identity and Access Management (IAM) roles

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 2

A cloud administrator is implementing network security for a VPC. The administrator needs to create a stateless firewall that filters traffic based on source and destination IP, port, and protocol. Which TWO of the following are characteristics of this type of firewall? (Select TWO.)

Accepted Answer

Rules are evaluated in order, starting with the lowest rule number.. Network ACLs are stateless, meaning they do not track connection state and require explicit rules for both inbound and outbound traffic. They evaluate rules in order by rule number.

Answer

It is stateful and tracks connection state.

Answer

It operates at the application layer (Layer 7).

Answer

It automatically allows response traffic for allowed inbound connections.

Question 3

A DevOps team wants to deploy a Kubernetes application using a package manager that simplifies the deployment process by bundling all Kubernetes resources into a single package. Which tool should the team use?

Accepted Answer

Helm. Helm is the package manager for Kubernetes that uses charts to define, install, and upgrade even the most complex Kubernetes applications.

Answer

Kustomize

Answer

Ansible

Answer

Terraform

Question 4

A security team is implementing encryption for a cloud-based database. The compliance requirements mandate that encryption keys be managed by the customer and rotated every 90 days. Which THREE of the following should the team use? (Select THREE).

Accepted Answer

Integrate with the cloud KMS using customer-managed keys. Encryption at rest with AES-256, a cloud KMS with customer-managed keys, and automated key rotation meet the requirements. TLS secures data in transit but is not about key management.

Answer

Store the encryption key in a configuration file

Answer

Use TLS 1.2+ for data in transit

Question 5

A cloud architect is designing a multi-tier application. The application tier needs to access a database, but the database should not be reachable from the internet. Which network security control should be used?

Accepted Answer

Place the database in a private subnet and use a security group to allow traffic only from the application tier. Placing the database in a private subnet with no direct internet route ensures it is not reachable from the internet. Security groups can then allow inbound traffic only from the application tier's security group.

Answer

Encrypt the database connection using TLS

Answer

Use a VPN to connect the application tier to the database

Answer

Place the database in a public subnet with restrictive security groups

Question 6

A security administrator needs to store database credentials and API keys securely in AWS. The credentials must be automatically rotated every 90 days. Which service should the administrator use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed to store secrets and provides built-in rotation capabilities.

Answer

AWS Systems Manager Parameter Store

Answer

AWS KMS

Answer

AWS Certificate Manager

Question 7

A security administrator is configuring a Web Application Firewall (WAF) to protect a public-facing web application. The application experiences a high volume of traffic from certain geographic regions that are not serving customers. Which WAF feature should be used to block this traffic?

Accepted Answer

Geo-blocking. Geo-blocking allows the WAF to block or allow traffic based on geographic location, reducing unwanted traffic and potential attacks.

Answer

Rate limiting

Answer

OWASP rule set

Answer

IP reputation lists

Question 8

A company uses Azure RBAC to manage access to resources. A user is assigned a Contributor role at the subscription scope. Which of the following is true regarding the scope of this role?

Accepted Answer

The user will have Contributor permissions on all resources within the subscription.. RBAC roles in Azure are inherited from higher scopes to lower scopes (management group → subscription → resource group → resource).

Answer

The user will have Contributor permissions only on resources created after the assignment.

Answer

The user will have Contributor permissions on the subscription itself but not its resources.

Answer

The user will have Contributor permissions only on resource groups within the subscription.

Question 9

A company uses Google Cloud Platform (GCP) and wants to enforce that all service accounts used by applications have only the permissions necessary to perform their tasks. Which IAM concept should the administrator apply?

Accepted Answer

Least privilege. The principle of least privilege dictates granting only the required permissions. In GCP, this is achieved by assigning predefined roles that are narrowly scoped to specific services, and by using conditions to further restrict access.

Answer

Separation of duties

Answer

Privileged access management (PAM)

Answer

Role-based access control (RBAC)

Question 10

A cloud engineer is configuring a web application on AWS and needs to ensure that only HTTP and HTTPS traffic from the internet is allowed to reach the EC2 instances. Which AWS service should be used to control inbound traffic at the instance level?

Accepted Answer

Security Group. Security groups are stateful virtual firewalls that control inbound and outbound traffic at the instance level. Network ACLs operate at the subnet level and are stateless.

Answer

AWS Shield

Answer

AWS WAF

Answer

Network ACL

Question 11

A cloud engineer is planning a database migration from an on-premises Oracle database to Amazon RDS for PostgreSQL. The migration must minimize downtime and preserve ongoing changes. Which TWO services should the engineer consider using together? (Choose two.)

Accepted Answer

AWS Database Migration Service (DMS). AWS DMS can migrate data and replicate ongoing changes using CDC, while the Schema Conversion Tool can convert the Oracle schema to PostgreSQL.

Answer

AWS DataSync

Answer

AWS Snowball

Answer

Amazon S3 Transfer Acceleration

Question 12

A company is adopting a CI/CD pipeline using Jenkins to deploy a web application. The pipeline must include steps to compile code, run unit tests, package the application, deploy to a test environment, and then deploy to production. Which pipeline stage should be configured immediately after the build stage?

Accepted Answer

Test. In a typical CI/CD pipeline, after build (compile) comes test (e.g., unit tests) to validate the code before proceeding to deploy.

Answer

Verify

Answer

Deploy to production

Answer

Source

Question 13

A cloud architect is designing a multi-tenant SaaS application on AWS. Which of the following security responsibilities is the CUSTOMER responsible for under the shared responsibility model?

Accepted Answer

Configuring security groups. Under the shared responsibility model, the customer is responsible for data encryption, OS patching, and IAM configuration, while the provider secures the physical infrastructure.

Answer

Global network infrastructure

Answer

Patching the hypervisor

Answer

Physical security of data centers

Question 14

A DevOps team deploys a containerized application on Amazon EKS. The security team wants to ensure that containers do not run as root and that read-only root filesystems are enforced. Which Kubernetes mechanism should be used?

Accepted Answer

Pod Security Standards. Pod Security Standards (formerly PSP) define security contexts, including runAsNonRoot and readOnlyRootFilesystem, to enforce these policies.

Answer

Kubernetes RBAC

Answer

Network Policies

Answer

Secrets management

Question 15

A security engineer is designing a data classification policy for a cloud environment. The policy must identify sensitive data, apply appropriate controls, and monitor access. Which THREE of the following should be included in the policy? (Select THREE.)

Accepted Answer

Encryption at rest for classified data. Data classification includes identifying where data resides, encrypting it, and monitoring access. DLP tools help enforce policies. Security groups are network controls, not data classification. CASB is for SaaS, but not necessarily part of a classification policy.

Answer

Cloud Access Security Broker (CASB) for all data

Answer

Network security groups to isolate data