CV0-004 Practice Test 9 — 10 Questions

Question 1

A company uses Azure RBAC to manage access to resources. A user is assigned a Contributor role at the subscription scope. Which of the following is true regarding the scope of this role?

Accepted Answer

The user will have Contributor permissions on all resources within the subscription.. RBAC roles in Azure are inherited from higher scopes to lower scopes (management group → subscription → resource group → resource).

Answer

The user will have Contributor permissions only on resources created after the assignment.

Answer

The user will have Contributor permissions on the subscription itself but not its resources.

Answer

The user will have Contributor permissions only on resource groups within the subscription.

Question 2

A cloud administrator needs to grant a developer read-only access to a specific storage bucket in AWS. Which IAM component should the administrator modify?

Accepted Answer

IAM policy. To grant a developer read-only access to a specific S3 bucket, the administrator must modify an IAM policy. IAM policies are JSON documents that define permissions (Allow/Deny) for actions on AWS resources, and they can be attached to IAM users, groups, or roles. By creating a policy that allows s3:GetObject, s3:ListBucket, etc., on the specific bucket ARN, the administrator can grant least-privilege read-only access.

Answer

Security group

Answer

AWS WAF

Answer

Network ACL

Question 3

Which cloud service model provides the customer with the ability to deploy and manage custom applications without managing the underlying operating system or runtime environment?

Accepted Answer

PaaS. PaaS provides a managed platform where customers deploy their code while the provider manages the OS, runtime, and infrastructure.

Answer

SaaS

Answer

IaaS

Answer

FaaS

Question 4

A company uses AWS and needs to enforce that all S3 buckets are encrypted at rest with customer-managed keys stored in AWS KMS. Which IAM policy condition would ensure this?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The 'aws:RequestTag' condition (or similar) can enforce that resources are created with specific tags, but to enforce encryption key usage, the condition 's3:x-amz-server-side-encryption-aws-kms-key-id' is used.

Answer

s3:x-amz-server-side-encryption with value AES256

Answer

aws:SourceVpce

Answer

s3:versioning

Question 5

A company uses AWS CloudFormation to manage its infrastructure. After updating a stack, a developer notices that the actual infrastructure differs from the expected template. Which CloudFormation feature should be used to identify these differences?

Accepted Answer

Drift detection. Drift detection allows you to detect whether a stack's actual configuration differs from its expected template configuration.

Answer

Stack sets

Answer

Change sets

Answer

Rollback triggers

Question 6

Which TWO of the following are best practices for securing access to a cloud management console?

Accepted Answer

Restrict access based on IP address ranges. Restricting access based on IP address ranges (B) is a best practice because it limits the attack surface by allowing only trusted network sources to reach the management console. This is often implemented via security group rules, network ACLs, or cloud provider-specific features like AWS Security Groups or Azure NSGs, reducing exposure to brute-force and unauthorized access attempts.

Answer

Use complex passwords and rotate them every 30 days

Answer

Use the root account for daily administration

Answer

Enable guest access for external auditors

Question 7

An organization is moving sensitive data to the cloud and must ensure it is encrypted while stored on disk. Which type of encryption should be implemented?

Accepted Answer

Encryption at rest. Encryption at rest protects data stored on disk, typically using AES-256.

Answer

Encryption in transit

Answer

Hashing

Answer

Tokenization

Question 8

A company is migrating to AWS and needs to meet PCI DSS compliance. Which THREE of the following should be implemented? (Choose three.)

Accepted Answer

Encrypting cardholder data at rest and in transit. PCI DSS requires encryption of cardholder data, regular security testing (like vulnerability scanning), and audit logging. Using default VPC settings may not be secure. Single-factor authentication is insufficient.

Answer

Using single-factor authentication for all administrative access

Answer

Using default VPC settings without changes

Question 9

A cloud architect is designing a multi-tenant SaaS application on AWS. Which of the following security responsibilities is the CUSTOMER responsible for under the shared responsibility model?

Accepted Answer

Configuring security groups. Under the shared responsibility model, the customer is responsible for data encryption, OS patching, and IAM configuration, while the provider secures the physical infrastructure.

Answer

Global network infrastructure

Answer

Patching the hypervisor

Answer

Physical security of data centers

Question 10

A company uses CloudFormation to manage infrastructure across multiple AWS accounts. They want to deploy a common set of resources (e.g., VPC, IAM roles) to all accounts in their organization. Which CloudFormation feature should they use?

Accepted Answer

Stack sets. CloudFormation StackSets allow you to deploy a single template across multiple AWS accounts and regions in one operation, using either self-managed permissions or AWS Organizations integration. This is the designed feature for organization-wide resource deployment like VPCs and IAM roles. StackSets handle the orchestration, rollback, and drift detection across all target accounts.

Answer

Change sets

Answer

Nested stacks

Answer

Drift detection