CV0-004 Security Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. A cloud administrator runs the above command on a Linux virtual machine. What is the effect of the current firewall rules?

Accepted Answer

All incoming traffic is allowed except RDP, which is dropped.. The rules show ACCEPT for SSH (22), HTTP (80), and HTTPS (443), and DROP for RDP (3389). Since the default policy on the INPUT chain is ACCEPT, all other traffic is allowed, which is not secure. The administrator should set the default policy to DROP and only allow necessary ports.

Answer

All outgoing traffic is controlled by these rules.

Answer

The firewall is blocking all traffic by default.

Answer

Only SSH, HTTP, and HTTPS are allowed; all other traffic is dropped.

Question 2

Refer to the exhibit. This log message is from a cloud security scanner. Which principle did the scanner likely detect?

Accepted Answer

Least privilege. The message indicates that user credentials were stored in user data (such as instance metadata) and are accessible to all users with read access to that metadata. This violates the principle of least privilege because credentials should not be widely accessible.

Answer

Separation of duties

Answer

Defense in depth

Answer

Fail securely

Question 3

A cloud administrator notices that an IAM role in a public cloud environment has permissions to perform all actions on all resources. The principle of least privilege should be applied. What is the best first step to reduce the security risk?

Accepted Answer

Review the role's attached policies and identify unused or unnecessary permissions.. Option A is correct because reviewing current permissions identifies specific unnecessary privileges before making changes, minimizing disruption. Other options are too drastic or do not address the root cause.

Answer

Delete the role and create a new one with minimal permissions immediately.

Answer

Create a new role with fewer permissions and ask users to switch roles.

Answer

Modify the role's trust policy to restrict which users can assume it.

Question 4

A company uses a cloud provider's key management service to encrypt data at rest. The security team wants to ensure that encryption keys are automatically rotated every 90 days to meet compliance requirements. Which feature should be enabled?

Accepted Answer

Key automatic rotation. Option B is correct because automatic rotation replaces key material periodically without manual intervention, meeting compliance needs.

Answer

Key import scheduling

Answer

Key revocation

Answer

Key policy enforcement

Question 5

During a security audit, an organization discovers their cloud-based database is accessible from any public IP address due to a firewall rule allowing 0.0.0.0/0 on port 3306 (MySQL). The database must remain accessible to remote developers working from home. What is the most effective remediation?

Accepted Answer

Change the firewall rule to allow only specific known developer IP ranges.. Option C is correct because restricting to specific trusted IP ranges reduces exposure while maintaining remote access.

Answer

Remove the firewall rule entirely and rely on database IAM authentication.

Answer

Enable encryption in transit using TLS and keep the rule as is.

Answer

Move the database to a private subnet without a NAT gateway.

Question 6

A cloud security analyst finds the above JSON policy attached to an S3 bucket containing confidential customer data. What change must be made to comply with the principle of least privilege?

Accepted Answer

Restrict the Principal to a specific AWS account or user.. Option D is correct because a wildcard Principal allows anonymous access; restricting to a specific principal ensures only authorized entities can access the data.

Answer

Change the Effect to 'Deny'.

Answer

Change the Action to 's3:PutObject'.

Answer

Remove the Resource field.

Question 7

The above condition is included in an IAM policy. What does this condition restrict?

Accepted Answer

Access to only requests from the IP range 192.168.1.0/24.. Option A is correct because the aws:SourceIp condition key limits the source IP addresses to the specified range.

Answer

Access through a VPN connection.

Answer

Access to only private IP addresses.

Answer

Access from a specific VPC.

Question 8

A user attempted to copy an encrypted snapshot to a different region and received the above error. What is the most likely cause?

Accepted Answer

The snapshot was created in a different region using a regional KMS key that is not present in the destination region.. Option B is correct because the error indicates the KMS key is not present in the destination region, which occurs when a regional key is used.

Answer

The snapshot size exceeds the regional limit.

Answer

The user does not have permission to create snapshots in the destination region.

Answer

The KMS key used to encrypt the snapshot has been deleted.

Question 9

A cloud architect is designing a multi-tier application. To ensure secure communication between the web tier and the application tier within the same VPC, which approach should be used?

Accepted Answer

Use internal IP addresses with network ACLs allowing all traffic from the web tier subnet.. Option C is correct because using internal IPs with network ACLs provides network segmentation and control within the VPC.

Answer

Use a VPN between tiers.

Answer

Use public IP addresses with security groups.

Answer

Use a transit gateway with encryption.

Question 10

Which of the following is the best practice for securely storing secrets such as database passwords in a cloud environment?

Accepted Answer

Use a dedicated secrets management service.. Option D is correct because dedicated secrets management services provide secure storage, rotation, and access control.

Answer

Hard-code the secrets in the application code.

Answer

Store secrets in a configuration file in the repository.

Answer

Encrypt secrets and store them in a shared storage.

Question 11

A company uses a cloud provider's identity federation to allow employees to sign in using their corporate Active Directory credentials. After a merger, employees from the acquired company need access. What must be modified to enable federated access for the new users without disrupting existing access?

Accepted Answer

Update the trust policy to include the new Active Directory domain.. Option A is correct because updating the trust policy to include the new domain allows federation from both domains under the same identity provider.

Answer

Create a separate federation agreement for the new domain.

Answer

Manually create cloud IAM users for each employee.

Answer

Create a new identity provider in the cloud.

Question 12

A security team wants to implement host-based intrusion detection on their virtual machines in a public cloud. Which approach provides the most effective detection while minimizing performance impact?

Accepted Answer

Use a cloud-native security service that deploys an agent to monitor system logs and file integrity.. Option B is correct because cloud-native security services with agents are optimized for host-based detection with minimal overhead.

Answer

Install an antivirus agent on each VM.

Answer

Enable network traffic logging at the hypervisor level.

Answer

Enable VPC flow logs and analyze them.

Question 13

A company stores sensitive data in a cloud object storage. They want to ensure that data is automatically deleted after a retention period of 7 years to comply with legal requirements. Which feature should be used?

Accepted Answer

Lifecycle policy with expiration.. Option C is correct because lifecycle policies can automatically expire objects after a specified number of days.

Answer

Versioning with delete markers.

Answer

Object lock with retention mode.

Answer

AWS Config rules.

Question 14

During a penetration test, a cloud security engineer discovers that a storage bucket is publicly accessible because of a misconfigured block public access setting. The bucket contains encrypted data. Which of the following is the primary risk?

Accepted Answer

Unauthorized users can list and download objects, but encryption at rest protects content if the key is also not accessible.. Option D is correct because unauthorized users can list and download encrypted objects, even if the data is encrypted at rest. The primary risk is data exfiltration if the encryption key is compromised or the data is not properly encrypted.

Answer

The bucket name is exposed to enumeration.

Answer

Data is unreadable because it is encrypted.

Answer

The encryption key is exposed.

Question 15

Which TWO of the following are effective methods to protect data in transit within a cloud environment? Select two.

Accepted Answer

VPN overlay networks. Options A and B are correct because TLS and VPN encrypt data during transmission. The other options are for data at rest or data masking.

Answer

Object-level ACLs

Answer

Server-side encryption with AES-256

Answer

Data masking

CV0-004 Security Practice Test 3 — 15 Questions

Exhibit

CV0-004 Security Practice Test 3 — 15 Questions

Exhibit