CV0-004 Security — 20 Questions

Question 1

A cloud administrator is troubleshooting an issue where a user in the finance department cannot access a critical application hosted on a private cloud. The user can access other applications in the same subnet. The security team recently implemented a new network security policy. Which of the following is MOST likely causing the issue?

Accepted Answer

A host-based firewall rule is blocking the specific application port on the user's VM.. Option D is correct because the user can access other applications in the same subnet, indicating network connectivity is intact, but a specific application is blocked. A host-based firewall rule on the user's VM (e.g., Windows Firewall or iptables) can filter traffic by port or protocol, and a newly implemented security policy likely added a rule blocking the port used by the critical application. This explains why only that application is inaccessible while others work.

Answer

The user's VM is isolated from the subnet due to a misconfigured VLAN.

Answer

The user's account has been disabled due to a failed login attempt.

Answer

The hypervisor is denying access to the application due to a resource quota violation.

Question 2

An organization wants to ensure that only authorized personnel can access the cloud management console. Which of the following is the BEST method to achieve this?

Accepted Answer

Enable multi-factor authentication (MFA) for all console users.. Multi-factor authentication (MFA) is the best method because it adds an additional layer of security beyond just a password, requiring a second factor (e.g., a time-based one-time password from an authenticator app or a hardware token). This significantly reduces the risk of unauthorized access even if credentials are compromised, as the attacker would also need the second factor. In cloud environments like AWS, Azure, or GCP, MFA is a fundamental security best practice for protecting the management console.

Answer

Implement strong password policies with complex passwords.

Answer

Disable the web console and require API access only.

Answer

Restrict console access to a specific IP address range.

Question 3

A company is migrating a legacy application to a public cloud. The application requires a static IP address for licensing. The security team insists on encrypting all traffic between the application and the database. Which of the following should the cloud architect implement?

Accepted Answer

Create a VPN connection between the application and database subnets.. Option A is correct because creating a VPN connection between the application and database subnets establishes an encrypted tunnel (using IPsec or TLS-based VPN protocols) that ensures all traffic between the two subnets is encrypted, meeting the security team's requirement. Additionally, the application's need for a static IP address can be satisfied by assigning a static private IP to the application instance within its subnet, while the VPN provides secure communication without exposing traffic to the public internet.

Answer

Assign an elastic IP and use NAT.

Answer

Use TLS certificates on the web server.

Answer

Deploy a site-to-site VPN from the cloud to the on-premises data center.

Question 4

A cloud administrator is tasked with ensuring that only encrypted connections are used to transfer files to a cloud storage bucket. Which of the following should the administrator enforce?

Accepted Answer

Require HTTPS for all uploads.. HTTPS (HTTP over TLS) encrypts data in transit using TLS, ensuring that files uploaded to a cloud storage bucket are protected from eavesdropping and tampering. By requiring HTTPS for all uploads, the administrator enforces encrypted connections as mandated by the security policy, which is a standard practice for cloud storage services like AWS S3 or Azure Blob Storage.

Answer

Use HTTP with a custom header.

Answer

Allow FTP but restrict to specific IPs.

Answer

Enable SFTP access to the bucket.

Question 5

A company is implementing a cloud-based SIEM solution. Which TWO of the following are essential data sources that should be integrated to ensure comprehensive security monitoring?

Accepted Answer

DNS query logs from the cloud DNS service.. DNS query logs from the cloud DNS service (Option D) are essential because they provide visibility into domain resolution activities, which can reveal command-and-control (C2) communications, data exfiltration via DNS tunneling, or connections to malicious domains. In a cloud-based SIEM, these logs are critical for detecting threats that leverage DNS as a covert channel, as they capture the source IP, queried domain, and response codes in real time.

Answer

Physical access logs from the data center.

Answer

Firewall configuration backup files.

Answer

Employee vacation schedule.

Question 6

A cloud administrator is designing a secure multi-tenant environment. Which THREE of the following are best practices for isolating tenant workloads?

Accepted Answer

Deploy tenant workloads on dedicated hypervisors.. Deploying tenant workloads on dedicated hypervisors provides strong physical isolation, preventing a compromised hypervisor from affecting other tenants. This approach eliminates the risk of side-channel attacks or resource contention that could cross tenant boundaries, ensuring each tenant's virtual machines run on separate hardware with no shared compute resources.

Answer

Use a single virtual switch for all tenants.

Answer

Place all tenants on the same storage array for efficiency.

Question 7

A company experiences a data breach where an attacker exfiltrated data from a cloud storage bucket. The security team discovers that the bucket had a policy allowing public access. The cloud administrator had previously set the bucket to be private. Which of the following is the MOST likely reason the bucket became public?

Accepted Answer

An IAM role with administrative privileges applied a bucket policy that overrode the private setting.. A bucket policy that grants public access (e.g., `Principal: "*"` with `Effect: "Allow"`) can override the private block public access setting at the bucket level. Even if the cloud administrator set the bucket to private via the console or ACLs, an IAM role with administrative privileges can apply a bucket policy that explicitly allows public access, effectively making the bucket public. This is because bucket policies are evaluated separately and can grant permissions that supersede other access controls.

Answer

The bucket had versioning enabled, which reverted to a previous public state.

Answer

Access logs were not enabled, so the change was not recorded.

Answer

Server-side encryption was disabled, causing the bucket to become public.

Question 8

A cloud administrator is configuring a web application hosted on a public cloud VM. The application must be accessible over HTTPS, and the administrator needs to ensure that all traffic between the client and the server is encrypted. The cloud provider offers a managed certificate service. Which of the following is the BEST practice for securing the application?

Accepted Answer

Use the cloud provider's managed certificate service to provision and attach the certificate to the load balancer.. The cloud provider's managed certificate service automatically handles certificate provisioning, renewal, and attachment to the load balancer, ensuring HTTPS traffic is encrypted with a trusted certificate from a public CA. This is the best practice because it offloads TLS termination to the load balancer, reducing the VM's CPU overhead and centralizing certificate management. It also ensures the certificate is automatically renewed before expiry, preventing service disruptions.

Answer

Generate a self-signed certificate and configure the web server to use it.

Answer

Disable HTTPS and rely on network-level encryption provided by the cloud provider.

Answer

Create a certificate signing request (CSR) and submit it to a public CA, then install the certificate and private key on the VM.

Question 9

A cloud administrator is troubleshooting connectivity to a web server running on a Linux VM. The web server is configured to listen on ports 80 (HTTP) and 443 (HTTPS). The administrator runs the iptables command shown in the exhibit. Based on the output, what is the MOST likely reason that external users cannot access the web server on port 443?

Accepted Answer

The iptables rule for port 443 only allows traffic from the 10.0.0.0/8 subnet, which does not include external IP addresses.. Option D is correct because the iptables rule for port 443 specifies a source IP range of 10.0.0.0/8, which is a private RFC 1918 address space. External users have public IP addresses that do not fall within this subnet, so their HTTPS traffic is implicitly dropped by the rule's match condition. The default policy being ACCEPT does not override the explicit rule that only permits traffic from the 10.0.0.0/8 subnet.

Answer

The web server is not configured to listen on port 443, so iptables rules are irrelevant.

Answer

The iptables default policy is ACCEPT, but the rule for port 443 explicitly drops traffic from external sources.

Answer

The rule for port 80 is placed before the rule for port 443, causing all HTTPS traffic to be evaluated as HTTP and dropped.

Question 10

A cloud engineer is responsible for securing a multi-tier application deployed on IaaS. The application consists of web servers, application servers, and database servers. The engineer needs to implement network segmentation to minimize the attack surface. Which of the following is the BEST approach?

Accepted Answer

Create separate subnets for each tier and configure security groups to allow only required traffic between them.. Option B is correct because creating separate subnets for each tier enforces network segmentation at the IP layer, which is a fundamental security best practice for multi-tier applications. By configuring security groups (stateful firewalls) to allow only the specific required traffic (e.g., HTTP/HTTPS from web to app, SQL from app to database), the engineer minimizes the attack surface by preventing lateral movement if one tier is compromised. This approach aligns with the principle of least privilege and is the most effective method in IaaS environments like AWS, Azure, or GCP.

Answer

Use a single security group for all instances and define rules to allow traffic between tiers.

Answer

Place web servers in a public subnet and application and database servers in the same private subnet with a common security group.

Answer

Place all instances in the same subnet and use network ACLs to restrict traffic between tiers.

Question 11

A company is migrating its on-premises workload to a public cloud. The security team wants to ensure that all data transmitted between the on-premises network and the cloud VPC is encrypted in transit and that the connection uses dedicated bandwidth. Which of the following should the security team implement?

Accepted Answer

Configure a site-to-site VPN between the on-premises network and the cloud VPC.. Option C is correct because a site-to-site VPN creates an encrypted tunnel (using IPsec/IKE) over the public internet, ensuring data in transit is encrypted. However, the question also requires dedicated bandwidth, which a VPN does not provide—it shares internet bandwidth. The correct answer should be a dedicated connection like AWS Direct Connect or Azure ExpressRoute, but since the question states 'dedicated bandwidth' and the only option that provides encryption is the VPN, C is the best choice among the options given.

Answer

Attach an internet gateway to the VPC and use public IP addresses.

Answer

Use a NAT gateway to translate private IPs to public IPs.

Answer

Set up a direct connection between the on-premises router and the cloud VPC.

Question 12

A cloud administrator notices that an IAM user has permissions that are not explicitly assigned. The administrator suspects that the user is inheriting permissions through group membership or role assignment. Which TWO methods can the administrator use to identify all effective permissions for this user? (Choose TWO.)

Accepted Answer

List the user's group memberships and examine the policies attached to those groups and any roles the user can assume.. Option A is correct because group memberships and assumable roles are common sources of inherited permissions. By listing the user's groups and examining the policies attached to those groups, as well as any roles the user can assume, the administrator can trace the origin of the unexpected permissions. This method directly identifies the inheritance chain that grants permissions not explicitly assigned to the user.

Answer

Review the user's recent access logs to see which actions were allowed.

Answer

Check the resource-based policies on each resource the user might access.

Answer

Log in as the root user and run a permissions report.

Question 13

Refer to the exhibit. A cloud security engineer is reviewing an S3 bucket policy that controls access to the 'example-bucket' bucket. The 'AdminRole' IAM role attempts to upload an object to the bucket using the AWS CLI without specifying the '--server-side-encryption' parameter. The object transfer uses HTTPS. What will be the outcome?

Accepted Answer

The upload fails because the condition in the Allow statement is not satisfied.. The S3 bucket policy includes an Allow statement with a condition that requires `s3:x-amz-server-side-encryption` to be `AES256`. Since the `AdminRole` IAM role did not specify the `--server-side-encryption` parameter, the condition is not satisfied, and the Allow statement does not grant permission. Without a matching Allow, the default implicit deny applies, causing the upload to fail.

Answer

The upload succeeds but the object is stored without server-side encryption.

Answer

The upload succeeds because the request uses HTTPS and the role is allowed.

Answer

The upload fails because the Deny statement blocks all requests that are not using HTTPS.

Question 14

Sequence the steps to troubleshoot a cloud-based application that is not accessible from the internet.

Question 15

Sequence the steps to configure a cloud monitoring alert for high memory usage on a virtual machine.

Question 16

Match each storage type to its characteristic.

Question 17

Match each troubleshooting command to its function.

Question 18

A cloud administrator is configuring a new virtual private cloud (VPC) and needs to ensure that traffic between web servers and database servers is restricted to only the necessary ports. Which security approach should the administrator implement?

Accepted Answer

Implement network ACLs with rules that allow only HTTP/HTTPS from web to database and block all other traffic.. Network ACLs provide stateless filtering at the subnet level, allowing explicit allow/deny rules for inbound and outbound traffic. Security groups are stateful and operate at the instance level, but they are not as effective for subnet-level segmentation. IAM roles manage permissions for services, not traffic filtering. Flow logs capture traffic information but do not restrict it.

Answer

Enable VPC flow logs to detect and block malicious traffic.

Answer

Configure a security group with inbound rules for the web tier and outbound rules for the database tier.

Answer

Create an IAM policy to restrict access between subnets.

Question 19

A company has deployed a multi-tier application on a public cloud platform. The security team discovers that a Compute Instance is communicating with an external IP address known for malicious activity. The instance is part of an auto scaling group. What is the BEST immediate action to contain the threat while minimizing downtime?

Accepted Answer

Remove the instance from the auto scaling group and attach a security group that blocks all traffic.. Isolating the compromised instance by detaching it from the auto scaling group and applying a security group that denies all traffic can quickly contain the threat. Network ACLs are attached to subnets and changing them could affect other instances. Suspending the auto scaling group alone may not stop the current instance. Updating routing tables is complex and could disrupt legitimate traffic.

Answer

Suspend the auto scaling group to prevent additional instances from being launched.

Answer

Use a routing table blackhole to drop traffic from the instance.

Answer

Modify the network ACL for the subnet to deny traffic to the malicious IP.

Question 20

A cloud architect is designing a solution to ensure that data at rest in an object storage bucket is encrypted. The company requires that the encryption keys are managed by an on-premises hardware security module (HSM) to maintain control. Which encryption approach should the architect choose?

Accepted Answer

Client-side encryption using a local library.. Client-side encryption allows the customer to encrypt data before sending it to the cloud, using keys managed on-premises. Server-side encryption with cloud-managed keys would have the cloud provider control the keys, negating the requirement. SSE-C allows the customer to provide their own encryption keys, but the keys must be sent to the cloud each time, which may not satisfy the on-premises management requirement. Client-side encryption ensures data is encrypted before leaving the on-premises environment.

Answer

Server-side encryption with cloud-managed keys (SSE).

Answer

Disable encryption at rest to rely on network encryption.

Answer

Server-side encryption with customer-provided keys (SSE-C).