CV0-004 Security — 40 Questions

Question 1

A company requires multi-factor authentication (MFA) for all users accessing the cloud management console. Which IAM policy element should be used to enforce this?

Accepted Answer

Condition. The Condition element in an IAM policy specifies the circumstances under which the policy statement is in effect. To enforce MFA, you use a condition key such as aws:MultiFactorAuthPresent set to true, ensuring the policy only allows actions when MFA has been satisfied. This is the standard mechanism for MFA enforcement in AWS IAM policies.

Answer

Action

Answer

Effect

Answer

Resource

Question 2

A cloud administrator is configuring network security for a multi-tier application. Which TWO statements about security groups and network ACLs are correct?

Accepted Answer

Network ACLs are stateless and require explicit allow rules for both inbound and outbound traffic.. Network ACLs are stateless, meaning they do not automatically allow return traffic; you must explicitly define allow rules for both inbound and outbound traffic. Option E is correct because security groups are stateful and support only allow rules; you cannot create a deny rule within a security group, and any traffic not explicitly allowed is implicitly denied.

Answer

Network ACLs evaluate rules before security groups.

Answer

Security groups can be used to deny traffic from specific IP addresses.

Answer

Security groups are stateless.

Question 3

A company is migrating a legacy application to a Kubernetes cluster in the cloud. The application requires a database password to be accessible at runtime. Which approach aligns with cloud security best practices for secrets management?

Accepted Answer

Use a secrets management solution like HashiCorp Vault with a sidecar container to inject the password. Using a dedicated secrets management solution like HashiCorp Vault with a sidecar container aligns with cloud security best practices because it provides centralized secret storage, dynamic secret generation, audit logging, and fine-grained access control. The sidecar injects the secret at runtime without persisting it in the pod spec or etcd, reducing the attack surface and enabling secret rotation without redeploying the application.

Answer

Store the password as a Kubernetes Secret and mount it as a volume

Answer

Hardcode the password in the application code

Answer

Inject the password as an environment variable in the pod spec

Question 4

A cloud customer needs to ensure that data stored in an object storage bucket is encrypted at rest. The customer wants to manage the encryption keys themselves. Which encryption option should they choose?

Accepted Answer

Server-side encryption with customer-provided keys. Server-side encryption with customer-provided keys allows the customer to manage their own encryption keys while the cloud provider handles the encryption and decryption process. The customer provides the encryption key as part of the upload request, and the provider uses it to encrypt the object at rest, then discards the key after the operation. This meets the requirement of managing the keys themselves while ensuring data is encrypted at rest on the server side.

Answer

Server-side encryption with provider-managed keys

Answer

Server-side encryption with key management service

Answer

Client-side encryption

Question 5

A security engineer is implementing DDoS protection for a public-facing web application hosted in AWS. Which TWO services should be used together to provide comprehensive DDoS mitigation? (Choose two.)

Accepted Answer

AWS WAF. AWS Shield Advanced provides enhanced DDoS protection for EC2, ELB, CloudFront, etc. AWS WAF can be used to mitigate application-layer attacks like HTTP flood. Shield Standard is free but less comprehensive. Route 53 is DNS and does not directly mitigate DDoS. GuardDuty is threat detection.

Answer

Amazon Route 53

Answer

AWS Shield Standard

Answer

Amazon GuardDuty

Question 6

A cloud administrator is configuring encryption for data at rest in a cloud storage service. The administrator wants to use a key that is generated and managed by the cloud provider but stored in the customer's account. Which key management option is being described?

Accepted Answer

Customer-managed keys (CMK). Customer-managed keys (CMK) in cloud storage describe a model where the cloud provider generates and manages the key material, but the key is stored in the customer's account (e.g., AWS KMS, Azure Key Vault) and the customer controls its lifecycle and permissions. This gives the customer control over key rotation and access policies while the provider handles the cryptographic operations. It matches the scenario of a provider-generated key stored in the customer's account.

Answer

Customer-supplied keys (SSE-C)

Answer

No encryption

Answer

Cloud provider-managed keys (SSE-S3)

Question 7

A cloud security analyst is reviewing a compliance report and sees that the organization needs to ensure encryption keys are rotated periodically. Which of the following would best satisfy this requirement?

Accepted Answer

Using customer-managed keys with a defined rotation policy. Using customer-managed keys (CMKs) with a defined rotation policy allows the organization to control key rotation, satisfying the compliance requirement. AWS KMS supports automatic rotation of CMKs, which rotates the backing key annually while retaining the old key material for decryption. This meets periodic rotation requirements and provides auditability.

Answer

Disabling key rotation to prevent key loss

Answer

Storing keys in the application configuration file

Answer

Using provider-managed keys with automatic rotation

Question 8

A cloud engineer is tasked with securing network traffic in a VPC. Which TWO of the following are stateful security mechanisms? (Choose two.)

Accepted Answer

DDoS protection services. Security groups are stateful, automatically allowing return traffic. DDoS protection services are stateful as they track and analyze traffic flows to detect anomalies. Network ACLs are stateless. WAF is typically stateless, processing each request independently. Route tables are stateless, simply directing traffic without tracking connections.

Answer

Web Application Firewall (WAF)

Answer

Network ACLs

Answer

Route tables

Question 9

A cloud administrator notices that a security group rule allowing SSH (port 22) from any IP address (0.0.0.0/0) was created for a Linux server. The server is used for administrative purposes only. Which security best practice should be applied to reduce the attack surface?

Accepted Answer

Restrict the source IP address to the company's public IP range. Restricting the source IP address to the company's public IP range (option D) directly reduces the attack surface by limiting SSH access to only trusted administrative networks. This is the most effective security best practice because it prevents unauthorized external hosts from even attempting to connect to port 22, regardless of authentication method or port obscurity. In cloud environments like AWS, security group rules are stateful and evaluated before any packet reaches the instance, making source IP restriction a fundamental layer of defense.

Answer

Disable password authentication and use SSH keys only

Answer

Change the SSH port to a non-standard port

Answer

Add a deny rule for SSH in the network ACL

Question 10

A cloud engineer is configuring encryption for data stored in an S3 bucket. The company requires that encryption keys be managed by the organization, not the cloud provider. Which encryption option should be used?

Accepted Answer

SSE-C. SSE-C (Server-Side Encryption with Customer-Provided Keys) allows the organization to manage their own encryption keys while AWS handles the encryption and decryption process. The customer provides the encryption key in each request, and AWS discards the key after the operation, ensuring the cloud provider never stores the key. This meets the requirement that keys be managed by the organization, not the cloud provider.

Answer

SSE-KMS

Answer

SSE-S3

Answer

Client-side encryption

Question 11

A company is migrating a financial application to the cloud and must comply with PCI DSS. Which of the following cloud compliance programs is most relevant to demonstrate compliance?

Accepted Answer

PCI DSS Level 1. PCI DSS Level 1 is the highest level of compliance for organizations handling credit card data. Cloud providers offer PCI DSS attestations to support customer compliance.

Answer

ISO 27001

Answer

SOC 2 Type II

Answer

HIPAA BAA

Question 12

A cloud engineer is deploying a new application and needs to securely store database credentials. The credentials must be automatically rotated every 90 days. Which service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is purpose-built for storing and automatically rotating secrets such as database credentials. It natively integrates with Amazon RDS, Redshift, and DocumentDB to rotate credentials every 90 days or on a custom schedule using Lambda rotation functions. This meets the requirement for secure storage and automatic rotation without custom code.

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Answer

AWS Identity and Access Management (IAM)

Question 13

A cloud architect is designing network security for a VPC. The architect needs to implement both stateful and stateless firewalls. Which TWO of the following correctly describe these firewall types?

Accepted Answer

Security groups are stateful; they automatically allow return traffic for allowed inbound connections.. Option B is correct because security groups are stateful firewalls: when an inbound connection is permitted, the return traffic is automatically allowed regardless of outbound rules, since the connection state is tracked. Option D is correct because network ACLs are stateless and support both allow and deny rules, which are evaluated in numbered order from lowest to highest until a match is found. Option A is incorrect because it reverses the behavior: network ACLs are stateless, not stateful, and do not automatically allow return traffic. Option C is a true statement about security groups but does not describe a firewall type as the question asks, and it is not marked correct. Option E is incorrect because security groups cannot deny traffic; they only support allow rules, whereas only network ACLs can explicitly deny.

Answer

Network ACLs are stateful; they track connection state and allow return traffic automatically.

Answer

Security groups support allow rules only; deny rules are not supported.

Answer

Both security groups and network ACLs can be used to allow or deny traffic based on source IP and port.

Question 14

A cloud architect is designing a security group for a web server in AWS. The server must receive HTTPS traffic from the internet. What is the most secure inbound rule?

Accepted Answer

Allow HTTPS from 0.0.0.0/0. It allows only HTTPS (TCP port 443) from any internet source (0.0.0.0/0), which is the minimum necessary exposure for a public web server. This satisfies the requirement to receive HTTPS traffic from the internet while restricting all other ports and protocols. Security groups are stateful, so return traffic is automatically allowed, and the rule is as secure as possible given the public-facing requirement.

Answer

Allow HTTPS from the VPC CIDR only

Answer

Allow HTTPS from 10.0.0.0/8

Answer

Allow all traffic from 0.0.0.0/0

Question 15

A company needs to meet PCI DSS compliance requirements for storing credit card data in the cloud. Which compliance certification should they verify their cloud provider has?

Accepted Answer

PCI DSS Level 1. PCI DSS Level 1 is the highest level of PCI DSS validation and is the certification a cloud provider must hold to demonstrate it can store, process, and transmit cardholder data in compliance with PCI DSS requirements. Verifying a provider's PCI DSS Level 1 attestation (Report on Compliance or Attestation of Compliance) confirms they meet the stringent controls for handling credit card data. This is the specific certification tied to payment card data storage, unlike general security frameworks.

Answer

ISO 27001

Answer

SOC 2 Type II

Answer

HIPAA BAA

Question 16

A company uses Azure and wants to centrally audit all management operations across subscriptions. Which service should be used to collect and analyze these logs?

Accepted Answer

Azure Monitor. Azure Monitor is the correct service because it provides a centralized platform for collecting, analyzing, and acting on telemetry data from Azure resources, including management operations across subscriptions. Specifically, the Azure Activity Log within Azure Monitor captures all control-plane events (e.g., resource creation, deletion, policy changes) at the subscription level, enabling auditing and alerting. This directly meets the requirement for centrally auditing management operations across multiple subscriptions.

Answer

GCP Cloud Audit Logs

Answer

AWS CloudTrail

Answer

Azure Security Center

Question 17

A company is migrating to GCP and needs to ensure data encryption in transit for all external communications. Which THREE measures should be implemented? (Choose three.)

Accepted Answer

Configure load balancer to redirect HTTP to HTTPS. TLS 1.2+ ensures strong encryption in transit. Certificate management ensures valid certificates. Enforcing HTTPS via load balancer policies redirects HTTP traffic.

Answer

Disable TLS for internal VPC traffic

Answer

Enable AES-256 encryption at rest

Question 18

A cloud architect needs to ensure that all data transmitted between an on-premises data center and a cloud VPC is encrypted. Which solution should be implemented?

Accepted Answer

VPN Gateway. A VPN Gateway encrypts traffic in transit between an on-premises data center and a cloud VPC by establishing an IPsec tunnel over the public internet. This directly satisfies the requirement that all transmitted data be encrypted end-to-end between the two environments. IPsec provides confidentiality, integrity, and authentication for every packet crossing the tunnel.

Answer

Security group

Answer

Cloud KMS

Answer

Direct Connect

Question 19

An organization's compliance policy requires that all access to cloud resources be logged and that logs be immutable. Which service should be used to meet these requirements?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS resources, providing a detailed audit log of who made the request, from which IP address, and when. CloudTrail logs can be stored in an S3 bucket with S3 Object Lock enabled, which enforces a write-once-read-many (WORM) model to make logs immutable, meeting the compliance requirement for both logging and immutability.

Answer

AWS CloudWatch Logs

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 20

During a security audit, it is discovered that a cloud storage bucket contains sensitive data that should have been encrypted at rest. The bucket was created with default settings. Which step must be taken to encrypt the data that is already stored?

Accepted Answer

Copy the objects to a new bucket that has default encryption enabled, then delete the original bucket. Enabling default encryption only affects new objects. Existing objects must be re-encrypted by copying them, which applies the new encryption settings.

Answer

Encrypt the objects using client-side encryption before upload

Answer

Use a server-side encryption with customer-provided keys (SSE-C) on each existing object

Answer

Enable default encryption on the bucket; all existing objects will be automatically encrypted