CV0-004 Security — 10 Questions

Question 1

A company requires multi-factor authentication (MFA) for all users accessing the cloud management console. Which IAM policy element should be used to enforce this?

Accepted Answer

Condition. The Condition element in an IAM policy specifies the circumstances under which the policy statement is in effect. To enforce MFA, you use a condition key such as aws:MultiFactorAuthPresent set to true, ensuring the policy only allows actions when MFA has been satisfied. This is the standard mechanism for MFA enforcement in AWS IAM policies.

Answer

Action

Answer

Effect

Answer

Resource

Question 2

A cloud administrator is configuring network security for a multi-tier application. Which TWO statements about security groups and network ACLs are correct?

Accepted Answer

Network ACLs are stateless and require explicit allow rules for both inbound and outbound traffic.. Network ACLs are stateless, meaning they do not automatically allow return traffic; you must explicitly define allow rules for both inbound and outbound traffic. Option E is correct because security groups are stateful and support only allow rules; you cannot create a deny rule within a security group, and any traffic not explicitly allowed is implicitly denied.

Answer

Network ACLs evaluate rules before security groups.

Answer

Security groups can be used to deny traffic from specific IP addresses.

Answer

Security groups are stateless.

Question 3

A company is migrating a legacy application to a Kubernetes cluster in the cloud. The application requires a database password to be accessible at runtime. Which approach aligns with cloud security best practices for secrets management?

Accepted Answer

Use a secrets management solution like HashiCorp Vault with a sidecar container to inject the password. Using a dedicated secrets management solution like HashiCorp Vault with a sidecar container aligns with cloud security best practices because it provides centralized secret storage, dynamic secret generation, audit logging, and fine-grained access control. The sidecar injects the secret at runtime without persisting it in the pod spec or etcd, reducing the attack surface and enabling secret rotation without redeploying the application.

Answer

Store the password as a Kubernetes Secret and mount it as a volume

Answer

Hardcode the password in the application code

Answer

Inject the password as an environment variable in the pod spec

Question 4

A cloud customer needs to ensure that data stored in an object storage bucket is encrypted at rest. The customer wants to manage the encryption keys themselves. Which encryption option should they choose?

Accepted Answer

Server-side encryption with customer-provided keys. Server-side encryption with customer-provided keys allows the customer to manage their own encryption keys while the cloud provider handles the encryption and decryption process. The customer provides the encryption key as part of the upload request, and the provider uses it to encrypt the object at rest, then discards the key after the operation. This meets the requirement of managing the keys themselves while ensuring data is encrypted at rest on the server side.

Answer

Server-side encryption with provider-managed keys

Answer

Server-side encryption with key management service

Answer

Client-side encryption

Question 5

A security engineer is implementing DDoS protection for a public-facing web application hosted in AWS. Which TWO services should be used together to provide comprehensive DDoS mitigation? (Choose two.)

Accepted Answer

AWS WAF. AWS Shield Advanced provides enhanced DDoS protection for EC2, ELB, CloudFront, etc. AWS WAF can be used to mitigate application-layer attacks like HTTP flood. Shield Standard is free but less comprehensive. Route 53 is DNS and does not directly mitigate DDoS. GuardDuty is threat detection.

Answer

Amazon Route 53

Answer

AWS Shield Standard

Answer

Amazon GuardDuty

Question 6

A cloud administrator is configuring encryption for data at rest in a cloud storage service. The administrator wants to use a key that is generated and managed by the cloud provider but stored in the customer's account. Which key management option is being described?

Accepted Answer

Customer-managed keys (CMK). Customer-managed keys (CMK) in cloud storage describe a model where the cloud provider generates and manages the key material, but the key is stored in the customer's account (e.g., AWS KMS, Azure Key Vault) and the customer controls its lifecycle and permissions. This gives the customer control over key rotation and access policies while the provider handles the cryptographic operations. It matches the scenario of a provider-generated key stored in the customer's account.

Answer

Customer-supplied keys (SSE-C)

Answer

No encryption

Answer

Cloud provider-managed keys (SSE-S3)

Question 7

A cloud security analyst is reviewing a compliance report and sees that the organization needs to ensure encryption keys are rotated periodically. Which of the following would best satisfy this requirement?

Accepted Answer

Using customer-managed keys with a defined rotation policy. Using customer-managed keys (CMKs) with a defined rotation policy allows the organization to control key rotation, satisfying the compliance requirement. AWS KMS supports automatic rotation of CMKs, which rotates the backing key annually while retaining the old key material for decryption. This meets periodic rotation requirements and provides auditability.

Answer

Disabling key rotation to prevent key loss

Answer

Storing keys in the application configuration file

Answer

Using provider-managed keys with automatic rotation

Question 8

A cloud engineer is tasked with securing network traffic in a VPC. Which TWO of the following are stateful security mechanisms? (Choose two.)

Accepted Answer

DDoS protection services. Security groups are stateful, automatically allowing return traffic. DDoS protection services are stateful as they track and analyze traffic flows to detect anomalies. Network ACLs are stateless. WAF is typically stateless, processing each request independently. Route tables are stateless, simply directing traffic without tracking connections.

Answer

Web Application Firewall (WAF)

Answer

Network ACLs

Answer

Route tables

Question 9

A cloud administrator notices that a security group rule allowing SSH (port 22) from any IP address (0.0.0.0/0) was created for a Linux server. The server is used for administrative purposes only. Which security best practice should be applied to reduce the attack surface?

Accepted Answer

Restrict the source IP address to the company's public IP range. Restricting the source IP address to the company's public IP range (option D) directly reduces the attack surface by limiting SSH access to only trusted administrative networks. This is the most effective security best practice because it prevents unauthorized external hosts from even attempting to connect to port 22, regardless of authentication method or port obscurity. In cloud environments like AWS, security group rules are stateful and evaluated before any packet reaches the instance, making source IP restriction a fundamental layer of defense.

Answer

Disable password authentication and use SSH keys only

Answer

Change the SSH port to a non-standard port

Answer

Add a deny rule for SSH in the network ACL

Question 10

A cloud engineer is configuring encryption for data stored in an S3 bucket. The company requires that encryption keys be managed by the organization, not the cloud provider. Which encryption option should be used?

Accepted Answer

SSE-C. SSE-C (Server-Side Encryption with Customer-Provided Keys) allows the organization to manage their own encryption keys while AWS handles the encryption and decryption process. The customer provides the encryption key in each request, and AWS discards the key after the operation, ensuring the cloud provider never stores the key. This meets the requirement that keys be managed by the organization, not the cloud provider.

Answer

SSE-KMS

Answer

SSE-S3

Answer

Client-side encryption