CV0-004 Practice Test 48 — 15 Questions

Question 1

A security engineer is configuring an AWS IAM policy for a new application. The policy must allow the application to read objects from a specific S3 bucket. Which IAM policy element determines whether the action is allowed or denied?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Effect. The Effect element in an IAM policy specifies whether the policy allows or denies the requested action.

Answer

Action

Answer

Resource

Answer

Condition

Question 2

A cloud engineer is deploying a containerized application on Kubernetes. The security team requires that containers run with reduced privileges and that certain capabilities are dropped. Which Kubernetes feature should be used to enforce these requirements?

Accepted Answer

Pod Security Standards. Pod Security Standards (or Pod Security Policies) define security contexts and can restrict container capabilities.

Answer

Network policies

Answer

ConfigMap

Answer

Horizontal Pod Autoscaler

Question 3

A cloud security team is implementing the principle of least privilege for IAM roles. Which TWO actions are consistent with this principle?

Accepted Answer

Regularly review and revoke unused permissions. Least privilege means granting only the permissions necessary for a task and periodically reviewing access.

Answer

Grant full administrative access to all users to simplify management

Answer

Use wildcard (*) permissions to allow all actions on a resource

Answer

Assign root user access to all developers

Question 4

A cloud administrator is configuring network ACLs (NACLs) for a VPC subnet. The subnet hosts a web server that must accept HTTP (port 80) and HTTPS (port 443) from the internet, and the server needs to respond to clients. Which TWO rules are required?

Accepted Answer

Outbound rule: allow TCP ports 1024-65535 to 0.0.0.0/0. NACLs are stateless, so both inbound and outbound rules must be explicitly allowed. Inbound allows HTTP/HTTPS, outbound allows ephemeral ports for return traffic.

Answer

Inbound rule: allow all ICMP from 0.0.0.0/0

Answer

Outbound rule: allow TCP port 80 and 443 to 0.0.0.0/0

Answer

Inbound rule: allow TCP ports 1024-65535 from 0.0.0.0/0

Question 5

A company stores sensitive customer data in an S3 bucket and must encrypt the data at rest using a key managed by the company (not AWS). Which encryption option should the company use?

Accepted Answer

SSE-C. SSE-C allows customers to provide their own encryption keys; AWS performs encryption/decryption but does not store the keys.

Answer

Client-side encryption

Answer

SSE-KMS

Answer

SSE-S3

Question 6

A cloud security analyst is investigating a potential container security incident. The analyst notices that a container is sending outbound traffic to a known malicious IP address. The container was deployed from an image that passed a vulnerability scan. Which TWO of the following should the analyst implement to detect and prevent such behavior in the future? (Select TWO).

Accepted Answer

Enable runtime security monitoring for anomalous container behavior. Runtime security tools monitor container behavior for anomalies like outbound connections to malicious IPs, and scanning base image layers helps catch vulnerabilities that might allow such behavior.

Answer

Use a static IP address for all containers

Answer

Disable outbound network access for all containers

Answer

Store container secrets in environment variables

Question 7

A healthcare organization must store patient imaging data that is accessed infrequently but must be retained for 7 years. They need the lowest-cost storage option while ensuring data can be retrieved within 12 hours if needed. Which storage class should they use?

Accepted Answer

Archive storage (Glacier / Azure Archive). Archive storage like Amazon S3 Glacier Deep Archive or Azure Archive is the lowest cost for long-term retention, with retrieval times ranging from minutes to 12 hours.

Answer

Object storage standard tier

Answer

Block storage with snapshots

Answer

File storage (EFS / Azure Files)

Question 8

A cloud architect is designing a multi-tier application that must meet a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 hour. Which disaster recovery strategy is MOST cost-effective while meeting these requirements?

Accepted Answer

Warm standby with database replication. Warm standby with database replication is the most cost-effective strategy that meets an RTO of 15 minutes and an RPO of 1 hour. It maintains a scaled-down but fully functional copy of the production environment in another region, with synchronous or asynchronous database replication ensuring data loss is within the 1-hour RPO. Failover can be automated to achieve the 15-minute RTO without the expense of running full production capacity in the standby region.

Answer

Backup and restore from object storage

Answer

Pilot light with database replication

Answer

Active-active across two regions

Question 9

A healthcare organization uses a cloud-based virtual private cloud (VPC) to host a web application that processes protected health information (PHI). The application consists of a public-facing load balancer, a web server tier in a public subnet, and a database tier in a private subnet. The database runs on a managed relational database service with encryption at rest enabled using a cloud provider-managed key. The security auditor requires that the database encryption key must be controlled by the organization and rotated every 90 days. Additionally, the database must only be accessible from the web server tier. The database is currently accessible from the entire VPC CIDR block. What should the cloud administrator do to meet these requirements?

Accepted Answer

Re-encrypt the database using a customer-managed key in the cloud provider's key management service, and update the database security group to only allow traffic from the web server security group.. It addresses both requirements: re-encrypting the database with a customer-managed key in the cloud provider's KMS allows the organization to control and rotate the key every 90 days, and updating the database security group to only allow traffic from the web server security group restricts access to only the web server tier. Option A is incorrect because exporting and re-importing the database is unnecessary and disabling encryption is not recommended; re-encrypting in place is the proper approach. Option B is incorrect because provider-managed keys do not give the organization control or the ability to rotate the key as required. Option D is incorrect because encrypting the web server's storage does not address database encryption or access control requirements.

Answer

Export the database, disable encryption, and import into a new database with a customer-managed key.

Answer

Enable encryption with a provider-managed key and restrict database access using a network ACL.

Answer

Encrypt the web server's storage with a customer-managed key and keep the database encryption as is.

Question 10

Refer to the exhibit. The auto scaling group is fluctuating between 2 and 3 instances every few minutes. What is the most likely cause?

Accepted Answer

The scaling policies are based on metrics that are too sensitive.. The auto scaling group fluctuating between 2 and 3 instances every few minutes indicates a scaling policy that is too sensitive, likely based on a metric such as CPU utilization or request count per target that oscillates rapidly. When the metric crosses the scale-out threshold, a new instance launches, causing the metric to drop below the scale-in threshold, which then terminates an instance, creating a cycle. This is a classic symptom of thrashing due to overly aggressive or poorly configured scaling policies.

Answer

The instances are taking too long to become healthy.

Answer

The launch configuration has incorrect user data.

Answer

The load balancer is not properly distributing traffic.

Question 11

A company is experiencing latency issues when accessing a cloud-based application. The cloud administrator runs a traceroute and notices high latency at the ISP's edge router. Which of the following is the MOST likely cause?

Accepted Answer

An internet service provider (ISP) issue is degrading the WAN connection. High latency at the ISP's edge router indicates that the bottleneck is occurring on the WAN link between the company's network and the cloud provider, which is under the ISP's control. This is a classic symptom of an ISP issue, such as congestion, routing problems, or a degraded physical link, directly impacting the WAN connection. The traceroute output localizes the latency to the ISP's infrastructure, not to the company's internal network or the cloud application's resources.

Answer

A misconfigured firewall rule is dropping packets

Answer

The load balancer is sending traffic to unhealthy instances

Answer

The virtual machine hosting the application is under-provisioned

Question 12

A cloud administrator notices that an Auto Scaling group is launching and terminating instances too frequently, causing instability. What should the administrator adjust to reduce this flapping behavior?

Accepted Answer

Increase the cooldown period. Increasing the cooldown period gives instances time to stabilize before additional scaling actions, reducing flapping.

Answer

Disable the cooldown period

Answer

Decrease the cooldown period

Answer

Increase the scale-out threshold

Question 13

A cloud administrator notices that an IAM role in a public cloud environment has permissions to perform all actions on all resources. The principle of least privilege should be applied. What is the best first step to reduce the security risk?

Accepted Answer

Review the role's attached policies and identify unused or unnecessary permissions.. The best first step is to review the role's attached policies and identify unused or unnecessary permissions (Option C). This aligns with the principle of least privilege by allowing the administrator to understand which permissions are actually needed before making changes, minimizing the risk of disrupting legitimate access. Deleting the role immediately (Option A) could cause service disruptions. Creating a new role and asking users to switch (Option B) is time-consuming and may not address the root issue. Modifying the trust policy (Option D) restricts who can assume the role but does not reduce the permissions granted.

Answer

Delete the role and create a new one with minimal permissions immediately.

Answer

Create a new role with fewer permissions and ask users to switch roles.

Answer

Modify the role's trust policy to restrict which users can assume it.

Question 14

A company is migrating an on-premises Oracle database to Amazon RDS for MySQL. The migration must have minimal downtime and must handle ongoing changes during migration. The schema needs to be converted to MySQL-compatible format. Which combination of AWS services should the team use?

Accepted Answer

AWS DMS with AWS Schema Conversion Tool (SCT). AWS DMS can perform ongoing replication using CDC, and SCT converts schemas between different database engines.

Answer

AWS SCT alone

Answer

AWS DataSync

Answer

AWS DMS alone

Question 15

A cloud administrator is designing an auto-scaling policy for a web application that experiences predictable traffic spikes during business hours. The administrator wants to ensure that the application scales out before the start of business hours to avoid performance degradation. Which scaling policy type should be used?

Accepted Answer

Scheduled scaling. Scheduled scaling allows scaling actions at specific times (e.g., before business hours).

Answer

Manual scaling

Answer

Dynamic scaling

Answer

Predictive scaling