CV0-004 Security Practice Test 10 — 15 Questions

Question 1

A cloud engineer is deploying a containerized workload to a Kubernetes cluster running in a public cloud. The security team requires that the application pods never use long-lived static credentials to access the cloud provider's object storage service. The cluster already runs an OpenID Connect (OIDC) identity provider that the cloud provider trusts. Which approach should the engineer implement to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure an IAM role with a trust policy scoped to the cluster's OIDC provider and annotate the Kubernetes service account so pods receive short-lived tokens.. Federating the Kubernetes service account with the cloud IAM role through the cluster's OIDC provider lets pods obtain short-lived, automatically rotated credentials scoped to a single workload. Because no secret key material is ever stored in the cluster, the requirement that pods never use long-lived static credentials is met, and least privilege is enforced per service account rather than shared cluster-wide.

Answer

Enable basic authentication on the Kubernetes API server and issue each pod a static service account token stored in a durable Secret.

Answer

Deploy a sidecar container that holds a username and password for the object storage service and proxies all requests from the application container.

Answer

Store the object storage access key and secret key in a Kubernetes Secret and mount it into the pod as environment variables.

Question 2

A financial services company stores regulated data in Amazon S3 buckets. A security architect must ensure that objects are encrypted at rest using keys that the company controls, can be rotated on a schedule, and can be audited independently of AWS-managed keys. The keys must not leave AWS hardware security modules in plaintext. Which encryption option should the architect choose?

Accepted Answer

SSE-KMS with a customer managed key in AWS KMS. SSE-KMS with a customer managed key gives the company ownership of the key policy, scheduled rotation, and an audit trail via CloudTrail and KMS logs, while the key material remains protected inside AWS KMS HSMs. This matches the control, rotation, and auditability requirements.

Answer

SSE-S3 with bucket default encryption

Answer

SSE-C with customer-provided keys

Answer

Client-side encryption before uploading to S3

Question 3

A financial services firm stores regulated customer records in an object storage bucket in a public cloud. A compliance auditor requires that every object be encrypted with a customer-managed key so the firm can revoke access instantly and prove key custody, while still allowing the provider to perform envelope encryption for performance. Which configuration meets these requirements?

Accepted Answer

Configure the bucket to use a customer-managed key stored in the cloud key management service, with automatic key rotation and an audit trail of key usage.. Customer-managed keys held in the cloud key management service satisfy custody and revocation requirements because the organization controls the key lifecycle and can disable the key to cut off decryption instantly. The provider still performs envelope encryption by generating per-object data keys wrapped by the customer-managed key, which keeps performance high and maintains an auditable record of every cryptographic operation.

Answer

Enable provider-managed default encryption on the bucket using keys the cloud provider generates and rotates automatically.

Answer

Encrypt each object client-side with an application-held symmetric key before uploading, and store the ciphertext in the bucket.

Answer

Apply a bucket policy that denies unencrypted uploads and rely on transport layer security to protect objects at rest.

Question 4

A cloud security team is implementing a key management strategy for workloads spread across AWS and Azure. The team wants a single system of record for cryptographic keys, with the ability to import existing keys from on-premises HSMs, enforce automatic annual rotation, and produce immutable audit logs of every key use. Which approach best satisfies these requirements?

Accepted Answer

Implement a centralized external key manager with cloud-native integrations, using BYOK import, policy-driven rotation, and tamper-evident logging.. Centralizing key custody in an external manager that integrates with both AWS KMS and Azure Key Vault meets the single-system-of-record goal while preserving BYOK import, policy-driven rotation, and tamper-evident audit trails. Provider-native replication or object storage cannot deliver unified control, and per-region HSM silos reintroduce fragmentation. The centralized approach also keeps key material under organizational control across clouds.

Answer

Deploy a dedicated FIPS 140-2 Level 3 HSM cluster in each cloud region and use the provider's native key management to front the cluster.

Answer

Use AWS KMS with a multi-Region customer managed key and replicate key metadata to Azure Key Vault.

Answer

Store all keys in an encrypted S3 bucket with Object Lock and grant both clouds access through cross-account IAM roles.

Question 5

A cloud operations team runs a containerized payroll application on Amazon EKS. Compliance requires that the application pod retrieve database credentials at runtime without embedding them in the container image, and that the credentials be rotated automatically every 30 days. Which approach BEST meets these requirements?

Accepted Answer

Store the credentials in AWS Secrets Manager and use the AWS Secrets Manager and Config Provider for Secrets Store CSI Driver to inject them into the pod.. The requirement is runtime retrieval of database credentials plus automatic 30-day rotation without embedding secrets in the image. A secrets manager with native rotation integrated into the pod through the Secrets Store CSI Driver delivers both, mounting values as files and refreshing them on schedule. Base64 secrets, environment variables, and IAM role credentials each miss either the rotation or the runtime-injection aspect of the scenario.

Answer

Create an IAM role for the service account and let the application call the database with IAM authentication credentials that never expire.

Answer

Mount the credentials as a Kubernetes Secret created from a base64-encoded manifest stored in the Git repository.

Answer

Inject the credentials as environment variables through the pod spec, referencing values held in an encrypted Amazon S3 bucket.

Question 6

A cloud security team is hardening a Linux virtual machine that hosts a public-facing API in a public cloud. The team wants to reduce the attack surface at the operating system layer and detect unauthorized file changes. Which TWO measures should the team implement? (Choose two.)

Accepted Answer

Remove or disable unnecessary services, packages, and listening ports that the API does not require.. Reducing the attack surface means removing unnecessary services, packages, and listening ports so fewer exploitable components remain on the host. Detecting unauthorized changes requires a host-based intrusion detection system that monitors file integrity and alerts on tampering. Together these cover both the reduction and detection goals, while the remaining options either expand privileges, weaken layered filtering, or expose trust material insecurely.

Answer

Store the virtual machine's SSH host keys in a publicly readable object storage bucket for easy distribution to clients.

Answer

Grant the API service account full administrative privileges on the virtual machine to simplify troubleshooting and deployment.

Answer

Disable the local firewall and rely solely on the cloud provider's security group rules for all traffic filtering.

Question 7

A cloud operations team is reviewing the shared responsibility model for a SaaS customer relationship management application. The team wants to document which security tasks remain the customer's responsibility. Which task is the customer responsible for under the shared responsibility model?

Accepted Answer

Managing user identities, access permissions, and authentication policies within the SaaS application.. Under the shared responsibility model, the provider secures the cloud infrastructure while the customer secures what they put in the cloud. For SaaS, that means the customer owns data classification, user identity, access management, and authentication configuration. Physical security, hypervisor patching, and hardware firmware all fall to the provider because they sit below the customer's reach.

Answer

Patching the hypervisor that hosts the SaaS application's virtual machines.

Answer

Maintaining the physical security controls at the data center hosting the SaaS platform.

Answer

Applying firmware updates to the storage arrays that back the SaaS application's database.

Question 8

A cloud administrator is deploying a new containerized workload on Google Kubernetes Engine in Google Cloud. The security team requires that the containers run with a non-root user, have a read-only root filesystem where possible, and are prevented from gaining additional Linux capabilities. Which GKE feature should the administrator enable to enforce these restrictions at the pod level?

Accepted Answer

Pod Security Admission with the restricted profile. Pod Security Admission with the restricted profile enforces the exact pod-level controls requested: non-root execution, disallowing privilege escalation, dropping Linux capabilities, and requiring stricter seccomp and filesystem settings. Enabling it on the namespace applies the policy consistently across the workload.

Answer

Shielded GKE Nodes

Answer

Binary Authorization

Answer

Network Policy in GKE

Question 9

A company stores sensitive customer data in an Amazon S3 bucket. A security audit reveals that the data is encrypted at rest using SSE-S3. The company now requires that they manage and control the encryption keys themselves, including the ability to rotate and revoke them. Which S3 encryption option should be used?

Accepted Answer

SSE-KMS with customer managed keys. SSE-KMS with customer managed keys gives the organization ownership and control of the KMS keys used to encrypt S3 objects. This allows key rotation, policy management, and revocation, which aligns with the audit requirement. Other S3 encryption options either lack customer key control or place management outside the S3 server-side encryption model.

Answer

Client-side encryption

Answer

SSE-S3

Answer

SSE-KMS with AWS managed keys

Question 10

A financial services firm stores regulated customer records in an Amazon S3 bucket. Auditors require that every object be encrypted at rest with a customer-managed key, that key usage be logged, and that the firm be able to revoke access to the data by disabling the key. Which configuration meets these requirements?

Accepted Answer

Configure default bucket encryption with SSE-KMS using a customer-managed AWS KMS key and enable CloudTrail data events for the bucket.. The scenario demands a customer-managed key that the firm can disable to revoke access, plus logging of key usage. SSE-KMS with a customer-managed AWS KMS key satisfies the key control because disabling the key blocks decryption, and CloudTrail captures KMS cryptographic operations as well as S3 data events. AWS-managed keys, SSE-S3, and SSE-C all lack the customer-controlled revocation and audit characteristics required.

Answer

Configure default bucket encryption with SSE-S3 and enable S3 server access logging on the bucket.

Answer

Configure default bucket encryption with SSE-KMS using an AWS-managed key and enable KMS key rotation every year.

Answer

Enable S3 Object Lock in compliance mode and require SSE-C headers on every PUT request.

Question 11

An administrator is configuring access to a cloud management console for a large team. The organization wants to require a second authentication factor for all users and centralize the identity source so that disabling an account in the corporate directory immediately removes cloud access. Which approach should the administrator implement?

Accepted Answer

Federate the cloud provider with the corporate directory using SAML or OIDC and enforce multi-factor authentication at the identity provider.. Identity federation with the corporate directory through SAML or OIDC establishes one authoritative identity source, so deactivating a directory account instantly prevents new cloud sessions. Enforcing multi-factor authentication at the identity provider applies the second factor consistently to every federated sign-in, meeting both the centralization and the stronger-authentication goals without maintaining duplicate cloud identities.

Answer

Issue each user a long-lived cloud API access key and require them to use it when signing in to the management console.

Answer

Share a single privileged cloud account among the team and rotate its password on a weekly schedule.

Answer

Create separate local cloud accounts for each user and enforce a strong password complexity policy on each one.

Question 12

A cloud engineer is deploying a containerized application on Amazon EKS. The application pods need to access an Amazon RDS database. The security team wants to avoid storing database credentials in the container image or environment variables and prefers short-lived credentials. Which mechanism should be used?

Accepted Answer

AWS Secrets Manager with IAM roles for service accounts (IRSA). IAM roles for service accounts (IRSA) enables EKS pods to assume an IAM role and receive temporary credentials. The pod can then access AWS Secrets Manager to retrieve the database secret dynamically, eliminating hardcoded credentials. This approach provides short-lived credentials and adheres to the security team's preference for avoiding static secrets in the container environment.

Answer

Kubernetes Secrets mounted as environment variables

Answer

AWS Systems Manager Parameter Store with SecureString parameters

Answer

Amazon RDS IAM database authentication with a static master password

Question 13

A financial services firm runs containerized workloads on a managed Kubernetes service. Auditors require that no container can run as root, that privilege escalation is blocked, and that the policy is enforced at admission time without modifying existing deployment manifests. Which control best meets these requirements?

Accepted Answer

Configure a Pod Security Admission policy with the restricted profile applied to the target namespace.. Pod Security Admission enforces pod security standards when a pod is admitted, so the restricted profile prevents root execution and privilege escalation before the container starts. It applies at the namespace level, requiring no changes to deployment manifests. Logging, network policy, and runtime termination either observe or react rather than block, so they cannot satisfy a preventive admission-time mandate.

Answer

Deploy a runtime security agent that kills containers detected running with root privileges.

Answer

Enable the Kubernetes audit log and forward events to a SIEM for alerting on privileged containers.

Answer

Apply a network policy that denies egress traffic from containers running in the target namespace.

Question 14

A cloud operations team is hardening a Microsoft Azure subscription that hosts production virtual machines. The security lead wants to ensure that only approved operating system images can be deployed and that any drift from the baseline configuration is automatically detected. Which TWO Azure services should be implemented to meet these goals? (Choose two.)

Accepted Answer

Azure Policy with a custom definition restricting allowed image publishers and offers. Azure Policy with a custom image restriction definition enforces that only approved OS images can be deployed, directly satisfying the image control requirement. Azure Automation State Configuration continuously evaluates VMs against a DSC baseline and reports drift, satisfying the drift detection requirement. Together they provide both preventive and detective controls for the production subscription.

Answer

Azure Policy with the built-in 'Allowed virtual machine size SKUs' initiative

Answer

Azure Advisor security recommendations

Answer

Microsoft Defender for Cloud regulatory compliance dashboard

Question 15

A cloud security team is hardening a Microsoft Azure subscription that hosts production virtual machines. The team must ensure that administrative access to the VMs requires multi-factor authentication and that privileged role assignments are reviewed on a recurring basis. (Choose two.)

Accepted Answer

Enable Microsoft Entra multifactor authentication and enforce it through a Conditional Access policy scoped to the Azure portal and VM management.. The two requirements are MFA for administrative access and recurring review of privileged role assignments. Conditional Access enforces MFA for the portal and VM management paths, while Privileged Identity Management access reviews provide scheduled attestation of privileged roles and can revoke access automatically. The other choices either weaken privilege boundaries, address network reachability, or focus on patching rather than identity controls.

Answer

Assign the Owner role at the subscription scope to all administrators so they can manage access reviews themselves.

Answer

Create a custom Azure Policy that audits virtual machines lacking the latest OS patches.

Answer

Enable just-in-time VM access in Microsoft Defender for Cloud and rely on it as the sole authentication control.