CV0-004 Security Practice Test 2 — 15 Questions

Question 1

A company uses Azure and wants to centrally audit all management operations across subscriptions. Which service should be used to collect and analyze these logs?

Accepted Answer

Azure Monitor. Azure Monitor is the correct service because it provides a centralized platform for collecting, analyzing, and acting on telemetry data from Azure resources, including management operations across subscriptions. Specifically, the Azure Activity Log within Azure Monitor captures all control-plane events (e.g., resource creation, deletion, policy changes) at the subscription level, enabling auditing and alerting. This directly meets the requirement for centrally auditing management operations across multiple subscriptions.

Answer

GCP Cloud Audit Logs

Answer

AWS CloudTrail

Answer

Azure Security Center

Question 2

A company is migrating to GCP and needs to ensure data encryption in transit for all external communications. Which THREE measures should be implemented? (Choose three.)

Accepted Answer

Configure load balancer to redirect HTTP to HTTPS. TLS 1.2+ ensures strong encryption in transit. Certificate management ensures valid certificates. Enforcing HTTPS via load balancer policies redirects HTTP traffic.

Answer

Disable TLS for internal VPC traffic

Answer

Enable AES-256 encryption at rest

Question 3

A cloud architect needs to ensure that all data transmitted between an on-premises data center and a cloud VPC is encrypted. Which solution should be implemented?

Accepted Answer

VPN Gateway. A VPN Gateway encrypts traffic in transit between an on-premises data center and a cloud VPC by establishing an IPsec tunnel over the public internet. This directly satisfies the requirement that all transmitted data be encrypted end-to-end between the two environments. IPsec provides confidentiality, integrity, and authentication for every packet crossing the tunnel.

Answer

Security group

Answer

Cloud KMS

Answer

Direct Connect

Question 4

An organization's compliance policy requires that all access to cloud resources be logged and that logs be immutable. Which service should be used to meet these requirements?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS resources, providing a detailed audit log of who made the request, from which IP address, and when. CloudTrail logs can be stored in an S3 bucket with S3 Object Lock enabled, which enforces a write-once-read-many (WORM) model to make logs immutable, meeting the compliance requirement for both logging and immutability.

Answer

AWS CloudWatch Logs

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 5

During a security audit, it is discovered that a cloud storage bucket contains sensitive data that should have been encrypted at rest. The bucket was created with default settings. Which step must be taken to encrypt the data that is already stored?

Accepted Answer

Copy the objects to a new bucket that has default encryption enabled, then delete the original bucket. Enabling default encryption only affects new objects. Existing objects must be re-encrypted by copying them, which applies the new encryption settings.

Answer

Encrypt the objects using client-side encryption before upload

Answer

Use a server-side encryption with customer-provided keys (SSE-C) on each existing object

Answer

Enable default encryption on the bucket; all existing objects will be automatically encrypted

Question 6

A cloud administrator is implementing network security for a VPC. The administrator needs to create a stateless firewall that filters traffic based on source and destination IP, port, and protocol. Which TWO of the following are characteristics of this type of firewall? (Select TWO.)

Accepted Answer

Rules are evaluated in order, starting with the lowest rule number.. Network ACLs are stateless, meaning they do not track connection state and require explicit rules for both inbound and outbound traffic. They evaluate rules in order by rule number.

Answer

It is stateful and tracks connection state.

Answer

It operates at the application layer (Layer 7).

Answer

It automatically allows response traffic for allowed inbound connections.

Question 7

A company is implementing multi-factor authentication (MFA) for cloud console access. Which TWO of the following are valid MFA methods? (Select TWO.)

Accepted Answer

A password and a hardware TOTP token. A hardware TOTP token generates a time-based one-time password (RFC 6238) that changes every 30 or 60 seconds, providing a second factor independent of the user's password. Combining this with a password satisfies the MFA requirement of using two different authentication factors (something you know and something you have).

Answer

Two different passwords

Answer

A password and a security question

Answer

A username and password

Question 8

A cloud architect is designing a secrets management solution for a microservices application. The solution must avoid hardcoding secrets in code and support automatic rotation. Which THREE of the following are best practices? (Select THREE.)

Accepted Answer

Use a dedicated secrets management service like AWS Secrets Manager.. Option A is correct because a dedicated secrets management service such as AWS Secrets Manager centralizes storage, enforces encryption at rest with KMS, and provides fine-grained IAM access control, eliminating hardcoded secrets in code. Option B is correct because injecting secrets at runtime via volume mounts (e.g., Kubernetes CSI Secrets Store driver or tmpfs-backed volumes) keeps secrets out of the image and source code and delivers them only when the container starts. Option D is correct because enabling automatic rotation (e.g., Secrets Manager rotation via Lambda) limits the blast radius of a leaked credential and satisfies the requirement for automatic rotation. Option C is incorrect because long-lived static keys increase exposure risk and directly contradict the rotation requirement. Option E is incorrect because environment variables are easily exposed via process listings, crash dumps, logs, and child processes, making them a weaker practice than runtime volume injection.

Answer

Use long-lived static keys for simplicity.

Answer

Store secrets in environment variables for ease of access.

Question 9

A company is deploying a web application in a cloud environment and needs to protect against SQL injection and cross-site scripting (XSS) attacks. Additionally, the company wants to block traffic from specific geographic regions. Which TWO services should be used? (Select TWO.)

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) can inspect HTTP/HTTPS traffic to block SQL injection and cross-site scripting (XSS) attacks. Many WAF implementations also include a geo-blocking feature that allows blocking traffic from specific geographic regions. Therefore, a single WAF service can satisfy all requirements. Geo-blocking is a feature of WAF, not a separate service, so option B is redundant. Network ACLs, DDoS protection, and Security Groups do not provide application-layer inspection or geo-blocking.

Answer

Geo-blocking feature in WAF

Answer

Network Access Control List (NACL)

Answer

DDoS protection service

Answer

Security Group

Question 10

A security team is implementing encryption for a cloud-based database. The compliance requirements mandate that encryption keys be managed by the customer and rotated every 90 days. Which THREE of the following should the team use? (Select THREE).

Accepted Answer

Integrate with the cloud KMS using customer-managed keys. Encryption at rest with AES-256, a cloud KMS with customer-managed keys, and automated key rotation meet the requirements. TLS secures data in transit but is not about key management.

Answer

Store the encryption key in a configuration file

Answer

Use TLS 1.2+ for data in transit

Question 11

A cloud security analyst is investigating a potential container security incident. The analyst notices that a container is sending outbound traffic to a known malicious IP address. The container was deployed from an image that passed a vulnerability scan. Which TWO of the following should the analyst implement to detect and prevent such behavior in the future? (Select TWO).

Accepted Answer

Enable runtime security monitoring for anomalous container behavior. Option C is correct because runtime security monitoring tools (e.g., Falco, Sysdig, or cloud-native runtime protection) detect anomalous container behavior such as unexpected outbound connections to malicious IPs, which image scanning alone cannot catch since the image passed its scan. Option E is correct because scanning container image layers during CI/CD (e.g., with Trivy, Clair, or Anchore) catches known vulnerabilities in base images and dependencies before deployment, reducing the attack surface that could lead to malicious outbound traffic. Option A is not appropriate because static IP addresses do not detect or prevent malicious outbound traffic and can actually hinder container orchestration and scaling. Option B is overly broad and would break legitimate application functionality, since containers often require outbound access for APIs, updates, and dependencies; egress filtering should be selective, not globally disabled. Option D is a security anti-pattern, as storing secrets in environment variables exposes them to leakage via process listings, logs, and container inspection, and it does nothing to detect or prevent malicious outbound traffic.

Answer

Use a static IP address for all containers

Answer

Disable outbound network access for all containers

Answer

Store container secrets in environment variables

Question 12

A security engineer is configuring encryption for data at rest in an Azure environment. The organization requires that all virtual machine disks be encrypted with customer-managed keys stored in Azure Key Vault, and that the keys be automatically rotated every 90 days. Which Azure feature should the engineer implement?

Accepted Answer

Azure Disk Encryption with customer-managed keys and Key Vault rotation policy. The requirement is for customer-managed keys in Azure Key Vault with automatic rotation every 90 days. Azure Disk Encryption integrates with Key Vault, and Key Vault's rotation policy can automatically generate new key versions on a defined schedule. When the key rotates, ADE seamlessly re-wraps the disk encryption key, maintaining encryption without downtime. This combination provides the needed control and automation.

Answer

Azure Disk Encryption with Key Vault and key auto-rotation

Answer

Azure Disk Encryption (ADE) with BitLocker

Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C)

Question 13

A financial services company runs a containerized payment API on Google Kubernetes Engine. Auditors require that only images signed by the company's internal signing authority can be deployed, and that unsigned images are rejected at admission time. Which GKE feature should the administrator configure?

Accepted Answer

Binary Authorization with a attestor that verifies signatures from the internal Certificate Authority Service.. Binary Authorization is the GKE control that enforces image provenance at admission. Attestors created with Certificate Authority Service verify that images were signed by the company's internal authority, and the cluster's admission controller rejects any pod whose image lacks a valid attestation. Vulnerability scanning, sandboxing, and service mesh encryption address different risks and cannot block unsigned images.

Answer

Anthos Service Mesh with mutual TLS between all payment API workloads.

Answer

Artifact Registry vulnerability scanning with automatic rebuilds on critical findings.

Answer

GKE Sandbox with gVisor runtime isolation for all payment API pods.

Question 14

A cloud administrator is responsible for securing a containerized application deployed on a Kubernetes cluster in the cloud. The administrator needs to ensure that containers run with the least privilege and cannot access the host's file system or network. Which Kubernetes feature should be used to enforce these restrictions?

Accepted Answer

Pod Security Admission. Pod Security Admission is the current Kubernetes mechanism to enforce Pod Security Standards, which include restricted profiles that prevent host access and require non-root containers. By labeling a namespace with the restricted policy, the administrator ensures all pods meet strict security requirements. This is the correct feature to enforce least privilege and host isolation.

Answer

Pod Security Policies (PSP)

Answer

Role-Based Access Control (RBAC)

Answer

Network Policies

Question 15

A cloud security team manages workloads in Microsoft Azure. An auditor requires that all administrative actions performed in the subscription be recorded, retained for 365 days, and searchable for at least 90 days without additional tooling. The team wants the lowest-cost native solution that meets the requirement. Which action should the administrator take?

Accepted Answer

Configure Azure Monitor activity log export to a Log Analytics workspace with 365-day retention and 90-day interactive retention.. The activity log captures subscription-level administrative operations, and exporting it to a Log Analytics workspace delivers native query capability plus configurable total and interactive retention. This natively satisfies both the one-year retention and the 90-day searchable requirement without additional third-party tools or custom pipelines.

Answer

Deploy Azure Monitor alerts on administrative operations and store the alert history for one year.

Answer

Enable Microsoft Defender for Cloud continuous export to an event hub for downstream processing.

Answer

Enable Azure Diagnostic Settings to stream the activity log to an Azure Storage account using an immutable blob policy.