CV0-004 Security Practice Test 2 — 15 Questions

Question 1

Match each storage type to its characteristic.

Question 2

Match each troubleshooting command to its function.

Question 3

A cloud administrator is configuring a new virtual private cloud (VPC) and needs to ensure that traffic between web servers and database servers is restricted to only the necessary ports. Which security approach should the administrator implement?

Accepted Answer

Implement network ACLs with rules that allow only HTTP/HTTPS from web to database and block all other traffic.. Network ACLs provide stateless filtering at the subnet level, allowing explicit allow/deny rules for inbound and outbound traffic. Security groups are stateful and operate at the instance level, but they are not as effective for subnet-level segmentation. IAM roles manage permissions for services, not traffic filtering. Flow logs capture traffic information but do not restrict it.

Answer

Enable VPC flow logs to detect and block malicious traffic.

Answer

Configure a security group with inbound rules for the web tier and outbound rules for the database tier.

Answer

Create an IAM policy to restrict access between subnets.

Question 4

A company has deployed a multi-tier application on a public cloud platform. The security team discovers that a Compute Instance is communicating with an external IP address known for malicious activity. The instance is part of an auto scaling group. What is the BEST immediate action to contain the threat while minimizing downtime?

Accepted Answer

Remove the instance from the auto scaling group and attach a security group that blocks all traffic.. Isolating the compromised instance by detaching it from the auto scaling group and applying a security group that denies all traffic can quickly contain the threat. Network ACLs are attached to subnets and changing them could affect other instances. Suspending the auto scaling group alone may not stop the current instance. Updating routing tables is complex and could disrupt legitimate traffic.

Answer

Suspend the auto scaling group to prevent additional instances from being launched.

Answer

Use a routing table blackhole to drop traffic from the instance.

Answer

Modify the network ACL for the subnet to deny traffic to the malicious IP.

Question 5

A cloud architect is designing a solution to ensure that data at rest in an object storage bucket is encrypted. The company requires that the encryption keys are managed by an on-premises hardware security module (HSM) to maintain control. Which encryption approach should the architect choose?

Accepted Answer

Client-side encryption using a local library.. Client-side encryption allows the customer to encrypt data before sending it to the cloud, using keys managed on-premises. Server-side encryption with cloud-managed keys would have the cloud provider control the keys, negating the requirement. SSE-C allows the customer to provide their own encryption keys, but the keys must be sent to the cloud each time, which may not satisfy the on-premises management requirement. Client-side encryption ensures data is encrypted before leaving the on-premises environment.

Answer

Server-side encryption with cloud-managed keys (SSE).

Answer

Disable encryption at rest to rely on network encryption.

Answer

Server-side encryption with customer-provided keys (SSE-C).

Question 6

A company's cloud environment uses a shared responsibility model. The security team notices that a data breach occurred due to misconfigured storage buckets in the public cloud. Which party is primarily responsible for this misconfiguration according to the shared responsibility model?

Accepted Answer

The customer. Under the shared responsibility model, the customer is responsible for configuring their cloud resources securely, including storage bucket permissions. The cloud provider is responsible for the security of the cloud (infrastructure) but not for customer misconfigurations. The third-party vendor and cloud auditor are not directly responsible for the misconfiguration.

Answer

The cloud service provider

Answer

The cloud auditor

Answer

A third-party security vendor

Question 7

An organization uses a private cloud and wants to implement multifactor authentication (MFA) for administrative access to the hypervisor. However, due to legacy system constraints, the hypervisor does not support MFA directly. What is the BEST alternative to achieve MFA for administrative logins?

Accepted Answer

Deploy a jump host (bastion host) with MFA, and restrict hypervisor access to only that host.. A jump host (bastion host) can be placed in a separate network segment that requires MFA for access. Administrators log into the jump host first and then connect to the hypervisor from it. Direct SSH keys still rely on single-factor authentication. A VPN without MFA is insufficient. Using a certificate alone is also single factor.

Answer

Configure SSH key-based authentication for all hypervisor logins.

Answer

Implement a certificate-based authentication scheme for the hypervisor.

Answer

Set up a VPN that requires MFA and allow only VPN traffic to reach the hypervisor.

Question 8

A cloud administrator is tasked with ensuring that all API requests to the cloud management plane are encrypted. Which protocol should be enforced to meet this requirement?

Accepted Answer

TLS. TLS (Transport Layer Security) encrypts data in transit and is the standard protocol for securing API communications. SSH is for remote shell access, SSL (deprecated) is similar but newer is TLS, and IPsec is used for VPN tunnels.

Answer

IPsec

Answer

SSL

Answer

SSH

Question 9

A company's compliance policy requires that all virtual machine (VM) instances must have security patches applied within 30 days of release. The cloud environment automatically deploys VMs from a golden image. Which strategy would BEST ensure compliance without manual intervention?

Accepted Answer

Update the golden image with the latest patches and redeploy all VMs from it.. Regularly updating the golden image and using it to create new VMs ensures that all new instances are patched within the required timeframe. Automated patch scanning per instance is reactive and may not enforce the golden image. Using a configuration management tool to apply patches after VM creation can work but may cause a delay; updating the golden image is proactive and ensures consistency. A patch management server is good but not as comprehensive as updating the baseline.

Answer

Use a configuration management tool like Ansible to apply patches on boot.

Answer

Schedule a nightly job to scan each VM for missing patches and apply them.

Answer

Install a patch management server and configure VMs to update from it on startup.

Question 10

During a security audit, it is discovered that a cloud application can be accessed using a shared service account that has elevated privileges. The audit recommends implementing a just-in-time (JIT) access model. What is the primary benefit of JIT access in this scenario?

Accepted Answer

Reduces the attack surface by minimizing persistent privileged access.. JIT access grants temporary elevated privileges only when needed, reducing the risk of standing privileged access. It enables real-time approval workflows. It does not directly manage identities nor automate audits of third-party access; those are secondary benefits.

Answer

Automates auditing of third-party access.

Answer

Allows for easier management of user identities.

Answer

Eliminates the need for user authentication.

Question 11

A company wants to protect data in transit between its on-premises data center and a public cloud environment. Which technology should be used to create a secure encrypted tunnel over the internet?

Accepted Answer

VPN. A VPN (Virtual Private Network) creates an encrypted tunnel over the internet. TLS is used for web traffic, not for site-to-site tunnels. SSH is for remote admin, and a firewall is for filtering, not encrypting tunnels.

Answer

SSH

Answer

Firewall

Answer

TLS

Question 12

Which TWO actions should a cloud administrator take to protect against data exfiltration from a cloud storage bucket? (Choose two.)

Accepted Answer

Implement server-side encryption with SSE-S3.. Enabling object versioning allows recovery if data is deleted or overwritten but does not prevent exfiltration. Requiring MFA for delete operations prevents unauthorized deletion but not reading. Restricting public access and encrypting data at rest are effective controls against exfiltration. Audit logging is detective, not preventive.

Answer

Enable object versioning on the bucket.

Answer

Configure bucket access logs for monitoring.

Answer

Enable MFA delete on the bucket.

Question 13

Which THREE elements are required for a complete key lifecycle management strategy in a cloud environment? (Choose three.)

Accepted Answer

Secure key generation. Secure key generation is the foundational first step in a key lifecycle management strategy. In a cloud environment, keys must be generated using a FIPS 140-2 validated hardware security module (HSM) or a cloud provider's equivalent (e.g., AWS CloudHSM, Azure Key Vault Premium) to ensure cryptographic strength and prevent exposure of the private key material during creation.

Answer

Key backup and recovery

Answer

Key access control

Question 14

Which TWO steps should be performed to ensure that a new cloud user has only the minimum required permissions to perform their job? (Choose two.)

Accepted Answer

Provide permissions based on the user's specific job functions.. The principle of least privilege involves granting only necessary permissions and periodically reviewing them. Using a broad policy is the opposite. Removing the user is not appropriate. Creating a group is good for management but not directly for least privilege.

Answer

Assign the user to a group with broad administrator access for flexibility.

Answer

Remove the user's account immediately after granting access.

Answer

Create a custom role that includes all possible permissions.

Question 15

Refer to the exhibit. What is the effect of this bucket policy?

Accepted Answer

It allows anyone to read objects in example-bucket only if they come from the specified IP range.. The policy allows s3:GetObject to any principal (*) but only if the request originates from the IP range 203.0.113.0/24. This is a common way to restrict access to a specific network. It does not deny other IPs explicitly; it just doesn't allow them. It does not require authentication; the principal is *.

Answer

It requires users to authenticate with AWS IAM before accessing the bucket.

Answer

It allows only the specified IP range to write objects.

Answer

It denies all access to the bucket except from the specified IP range.