CV0-004 Security — 40 Questions

Question 1

A cloud administrator is configuring encryption for data at rest in a cloud storage service. The administrator wants to use a key that is generated and managed by the cloud provider but stored in the customer's account. Which key management option is being described?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Customer-managed keys (CMK). Customer-managed keys (CMK) are generated by the cloud provider's key management service but stored and managed (via policies, rotation) within the customer's account. This gives the customer control over key usage and access, unlike cloud provider-managed keys (SSE-S3) which are fully managed by the provider.

Answer

Customer-supplied keys (SSE-C)

Answer

No encryption

Answer

Cloud provider-managed keys (SSE-S3)

Question 2

A company is deploying a web application in a cloud environment and needs to protect against SQL injection and cross-site scripting (XSS) attacks. Additionally, the company wants to block traffic from specific geographic regions. Which TWO services should be used? (Select TWO.)

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) can inspect HTTP/HTTPS traffic to block SQL injection and cross-site scripting (XSS) attacks. Many WAF implementations also include a geo-blocking feature that allows blocking traffic from specific geographic regions. Therefore, a single WAF service can satisfy all requirements. Geo-blocking is a feature of WAF, not a separate service, so option B is redundant. Network ACLs, DDoS protection, and Security Groups do not provide application-layer inspection or geo-blocking.

Answer

Geo-blocking feature in WAF

Answer

Network Access Control List (NACL)

Answer

DDoS protection service

Answer

Security Group

Question 3

A cloud engineer is configuring a web application on AWS and needs to ensure that only HTTP and HTTPS traffic from the internet is allowed to reach the EC2 instances. Which AWS service should be used to control inbound traffic at the instance level?

Accepted Answer

Security Group. Security groups are stateful virtual firewalls that control inbound and outbound traffic at the instance level. Network ACLs operate at the subnet level and are stateless.

Answer

AWS Shield

Answer

AWS WAF

Answer

Network ACL

Question 4

A company is migrating to a public cloud and wants to understand security responsibilities. According to the shared responsibility model, which of the following is the customer responsible for in an IaaS deployment?

Accepted Answer

Patching the guest operating system. In IaaS, the customer is responsible for securing the operating system, applications, and data, including patching the guest OS.

Answer

Network infrastructure security

Answer

Physical security of data centers

Answer

Hypervisor security

Question 5

A security administrator needs to enforce least privilege for a Kubernetes cluster in a cloud environment. Which approach should be used to restrict permissions for pods that need to access the cloud provider's API?

Accepted Answer

Use a service account with a role that has only the required permissions. Using a service account with a role that has minimal permissions and attaching it to the pod ensures least privilege for pod-to-cloud API access.

Answer

Assign the pod a static cloud IAM user credential

Answer

Disable cloud API access for all pods

Answer

Grant the pod cluster-admin privileges in Kubernetes

Question 6

An organization is moving sensitive data to the cloud and must ensure it is encrypted while stored on disk. Which type of encryption should be implemented?

Accepted Answer

Encryption at rest. Encryption at rest protects data stored on disk, typically using AES-256.

Answer

Encryption in transit

Answer

Hashing

Answer

Tokenization

Question 7

A cloud administrator needs to provide external partners with access to a cloud application using their existing corporate credentials. Which federation protocol should be used?

Accepted Answer

SAML. SAML is a standard federation protocol that enables single sign-on using existing identity providers.

Answer

RADIUS

Answer

Kerberos

Answer

LDAP

Question 8

A company is using a SaaS application and wants to gain visibility into user activity and enforce data loss prevention policies. Which technology should be deployed?

Accepted Answer

Cloud Access Security Broker (CASB). A Cloud Access Security Broker (CASB) provides visibility, compliance, and data security controls for SaaS applications.

Answer

Intrusion Detection System (IDS)

Answer

Web Application Firewall (WAF)

Answer

Network Access Control (NAC)

Question 9

During a security audit, a cloud engineer discovers that a container image used in production has a known critical vulnerability in a base layer. Which practice should be implemented to prevent this in the future?

Accepted Answer

Perform container image scanning during CI/CD. Regular container image scanning in the CI/CD pipeline detects vulnerabilities before deployment.

Answer

Enable Kubernetes pod security policies

Answer

Use only official images from Docker Hub

Answer

Implement network segmentation

Question 10

An organization needs to store database credentials and API keys securely in the cloud, with automatic rotation every 90 days. Which service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager manages secrets lifecycle, including automatic rotation.

Answer

AWS CloudHSM

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 11

A cloud architect is designing a network to protect a web application from common attacks such as SQL injection and cross-site scripting. Which cloud service should be used?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) inspects HTTP traffic and blocks web exploits like SQL injection and XSS.

Answer

DDoS Protection

Answer

Network ACL

Answer

Security Group

Question 12

A company requires multi-factor authentication (MFA) for all users accessing the cloud management console. Which IAM policy element should be used to enforce this?

Accepted Answer

Condition. A Condition element in an IAM policy can require MFA by checking the aws:MultiFactorAuthPresent key.

Answer

Action

Answer

Effect

Answer

Resource

Question 13

A cloud security team is reviewing audit logs and notices that a service account has been used to launch several high-risk API calls that are not part of its normal behavior. Which security control should be implemented to detect such anomalies in real time?

Accepted Answer

Implement an anomaly detection service. Anomaly detection tools use machine learning and behavioral analytics to identify unusual API activity in real time, providing early warning of potential security threats.

Answer

Enable API audit logging

Answer

Use a static IAM policy

Answer

Configure a network ACL

Question 14

An organization is subject to PCI DSS compliance and must demonstrate that it is meeting security requirements. Which cloud service can aggregate compliance findings and provide a dashboard?

Accepted Answer

AWS Security Hub. AWS Security Hub aggregates security findings from multiple AWS services and provides a compliance dashboard.

Answer

AWS CloudTrail

Answer

AWS Shield

Answer

AWS Config

Question 15

A cloud administrator is configuring network security for a multi-tier application. Which TWO statements about security groups and network ACLs are correct?

Accepted Answer

Network ACLs are stateless and require explicit allow rules for both inbound and outbound traffic.. Network ACLs are stateless, meaning they do not automatically allow return traffic; you must explicitly define allow rules for both inbound and outbound traffic. Option E is correct because security groups are stateful and support only allow rules; you cannot create a deny rule within a security group, and any traffic not explicitly allowed is implicitly denied.

Answer

Network ACLs evaluate rules before security groups.

Answer

Security groups can be used to deny traffic from specific IP addresses.

Answer

Security groups are stateless.

Question 16

A cloud security team is implementing encryption for data at rest using customer-managed keys in a cloud KMS. Which THREE practices should be followed?

Accepted Answer

Use IAM policies to restrict who can use and manage the keys.. IAM policies are essential for enforcing the principle of least privilege in cloud KMS. By restricting who can use (encrypt/decrypt) and manage (rotate/disable/destroy) customer-managed keys, the security team ensures that only authorized principals can access the key material. This prevents unauthorized users or services from compromising data at rest, which is a core requirement for compliance frameworks like PCI DSS or HIPAA.

Answer

Store the key material in plaintext in the application code.

Answer

Use a default cloud provider key to simplify management.

Question 17

A company is adopting a shared responsibility model for a PaaS cloud deployment. Which THREE responsibilities belong to the customer?

Accepted Answer

Data classification and encryption. In a PaaS shared responsibility model, the customer is responsible for data classification and encryption of data at rest and in transit. The cloud provider manages the underlying infrastructure, but the customer must classify data according to sensitivity and apply encryption mechanisms, such as using TLS 1.2/1.3 for data in transit and AES-256 for data at rest, as the provider cannot access or classify customer data.

Answer

Management of the runtime environment

Answer

Physical security of data centers

Question 18

A cloud customer is deploying a virtual machine (VM) in a public IaaS environment. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Patching the guest operating system. Under the shared responsibility model, the customer is responsible for securing the operating system, applications, and data within the VM. The cloud provider secures the physical host and hypervisor.

Answer

Securing the hypervisor

Answer

Physical security of the data center

Answer

Network infrastructure integrity

Question 19

A cloud administrator needs to ensure that a set of AWS EC2 instances can only be accessed via SSH from the corporate office IP range 203.0.113.0/24. Which configuration should the administrator implement?

Accepted Answer

Create a security group with an inbound rule allowing TCP port 22 from 203.0.113.0/24. A security group acts as a stateful virtual firewall for EC2 instances. By specifying the source IP range 203.0.113.0/24 on the inbound SSH rule, only traffic from that range is allowed. Security groups are stateful, so return traffic is automatically permitted.

Answer

Deploy a VPN and require all SSH traffic to go through it

Answer

Configure a network ACL with an inbound allow rule for TCP port 22 from 203.0.113.0/24

Answer

Use AWS WAF to block SSH traffic except from 203.0.113.0/24

Question 20

A company is migrating a legacy application to a Kubernetes cluster in the cloud. The application requires a database password to be accessible at runtime. Which approach aligns with cloud security best practices for secrets management?

Accepted Answer

Use a secrets management solution like HashiCorp Vault with a sidecar container to inject the password. Storing secrets in a dedicated secrets manager like HashiCorp Vault or AWS Secrets Manager is recommended. Kubernetes Secrets should be avoided if possible, and secrets should never be hardcoded or stored in environment variables directly.

Answer

Store the password as a Kubernetes Secret and mount it as a volume

Answer

Hardcode the password in the application code

Answer

Inject the password as an environment variable in the pod spec