CV0-004 Security Practice Test 2 — 15 Questions

Question 1

A cloud security team is implementing encryption for data at rest using customer-managed keys in a cloud KMS. Which THREE practices should be followed?

Accepted Answer

Use IAM policies to restrict who can use and manage the keys.. IAM policies are essential for enforcing the principle of least privilege in cloud KMS. By restricting who can use (encrypt/decrypt) and manage (rotate/disable/destroy) customer-managed keys, the security team ensures that only authorized principals can access the key material. This prevents unauthorized users or services from compromising data at rest, which is a core requirement for compliance frameworks like PCI DSS or HIPAA.

Answer

Store the key material in plaintext in the application code.

Answer

Use a default cloud provider key to simplify management.

Question 2

A company is adopting a shared responsibility model for a PaaS cloud deployment. Which THREE responsibilities belong to the customer?

Accepted Answer

Data classification and encryption. In a PaaS shared responsibility model, the customer is responsible for data classification and encryption of data at rest and in transit. The cloud provider manages the underlying infrastructure, but the customer must classify data according to sensitivity and apply encryption mechanisms, such as using TLS 1.2/1.3 for data in transit and AES-256 for data at rest, as the provider cannot access or classify customer data.

Answer

Management of the runtime environment

Answer

Physical security of data centers

Question 3

A cloud customer is deploying a virtual machine (VM) in a public IaaS environment. According to the shared responsibility model, which of the following security tasks is the customer responsible for?

Accepted Answer

Patching the guest operating system. Under the shared responsibility model, the customer is responsible for securing the operating system, applications, and data within the VM. The cloud provider secures the physical host and hypervisor.

Answer

Securing the hypervisor

Answer

Physical security of the data center

Answer

Network infrastructure integrity

Question 4

A cloud administrator needs to ensure that a set of AWS EC2 instances can only be accessed via SSH from the corporate office IP range 203.0.113.0/24. Which configuration should the administrator implement?

Accepted Answer

Create a security group with an inbound rule allowing TCP port 22 from 203.0.113.0/24. A security group acts as a stateful virtual firewall for EC2 instances. By specifying the source IP range 203.0.113.0/24 on the inbound SSH rule, only traffic from that range is allowed. Security groups are stateful, so return traffic is automatically permitted.

Answer

Deploy a VPN and require all SSH traffic to go through it

Answer

Configure a network ACL with an inbound allow rule for TCP port 22 from 203.0.113.0/24

Answer

Use AWS WAF to block SSH traffic except from 203.0.113.0/24

Question 5

A company is migrating a legacy application to a Kubernetes cluster in the cloud. The application requires a database password to be accessible at runtime. Which approach aligns with cloud security best practices for secrets management?

Accepted Answer

Use a secrets management solution like HashiCorp Vault with a sidecar container to inject the password. Storing secrets in a dedicated secrets manager like HashiCorp Vault or AWS Secrets Manager is recommended. Kubernetes Secrets should be avoided if possible, and secrets should never be hardcoded or stored in environment variables directly.

Answer

Store the password as a Kubernetes Secret and mount it as a volume

Answer

Hardcode the password in the application code

Answer

Inject the password as an environment variable in the pod spec

Question 6

A security auditor is reviewing the IAM configuration for a cloud account. The auditor finds that a user has permissions to create and delete resources in all services. Which principle of security is being violated?

Accepted Answer

Least privilege. The principle of least privilege dictates that users should only have the minimum permissions necessary to perform their job functions. Granting full access to all services violates this principle.

Answer

Need to know

Answer

Defense in depth

Answer

Separation of duties

Question 7

An organization is subject to PCI DSS compliance and must ensure that all data transmitted between its cloud application and users is encrypted. Which encryption method should be enforced?

Accepted Answer

TLS 1.2 or higher. TLS (Transport Layer Security) is the standard protocol for encrypting data in transit over networks, such as between a web browser and a server. PCI DSS requires strong encryption for cardholder data in transit.

Answer

AES-256

Answer

SHA-256

Answer

IPsec VPN

Question 8

A company uses AWS and wants to centralize security monitoring across multiple accounts. Which service should they use to aggregate security findings and check compliance against standards like CIS AWS Foundations?

Accepted Answer

AWS Security Hub. AWS Security Hub aggregates security alerts from various AWS services and third-party tools, and provides compliance checks against standards like CIS, PCI DSS, and AWS Foundational Security Best Practices.

Answer

AWS CloudTrail

Answer

Amazon GuardDuty

Answer

AWS Config

Question 9

A cloud administrator needs to protect a web application from common attacks such as SQL injection and cross-site scripting (XSS). Which cloud service should be implemented?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) is specifically designed to filter and monitor HTTP traffic, blocking common web exploits like SQL injection and XSS. Cloud providers offer WAF services (e.g., AWS WAF, Azure WAF, Cloud Armor).

Answer

DDoS protection service

Answer

Network ACL

Answer

Security group

Question 10

A company's cloud environment uses Azure Active Directory for identity management. They want to allow employees to sign in using their existing on-premises Active Directory credentials without synchronizing passwords to the cloud. Which federation protocol should they use?

Accepted Answer

SAML 2.0. Federation allows identity federation without password synchronization. AD FS can be configured to use SAML 2.0 or OIDC to authenticate against on-premises AD and issue tokens to access cloud resources.

Answer

LDAP

Answer

Kerberos

Answer

OAuth 2.0

Question 11

A security team discovers that a container image used in production contains a known vulnerability in one of its base image layers. Which action should be taken to remediate this issue?

Accepted Answer

Rebuild the container image using an updated base image. The vulnerability is in the base image, so rebuilding the image using an updated base image that includes the security fix is the correct remediation. Additionally, scanning images in a CI/CD pipeline can catch vulnerabilities before deployment.

Answer

Delete the container and recreate it from the same image

Answer

Apply a security patch to the running container

Answer

Enable runtime security monitoring to detect exploitation attempts

Question 12

A cloud architect is designing a multi-tier application. The application tier needs to access a database, but the database should not be reachable from the internet. Which network security control should be used?

Accepted Answer

Place the database in a private subnet and use a security group to allow traffic only from the application tier. Placing the database in a private subnet with no direct internet route ensures it is not reachable from the internet. Security groups can then allow inbound traffic only from the application tier's security group.

Answer

Encrypt the database connection using TLS

Answer

Use a VPN to connect the application tier to the database

Answer

Place the database in a public subnet with restrictive security groups

Question 13

A cloud customer needs to ensure that data stored in an object storage bucket is encrypted at rest. The customer wants to manage the encryption keys themselves. Which encryption option should they choose?

Accepted Answer

Server-side encryption with customer-provided keys. Server-side encryption with customer-provided keys allows the customer to manage their own encryption keys while the cloud provider handles the encryption and decryption process. The customer provides the encryption key as part of the upload request, and the provider uses it to encrypt the object at rest, then discards the key after the operation. This meets the requirement of managing the keys themselves while ensuring data is encrypted at rest on the server side.

Answer

Server-side encryption with provider-managed keys

Answer

Server-side encryption with key management service

Answer

Client-side encryption

Question 14

A company uses Google Cloud Platform (GCP) and wants to enforce that all service accounts used by applications have only the permissions necessary to perform their tasks. Which IAM concept should the administrator apply?

Accepted Answer

Least privilege. The principle of least privilege dictates granting only the required permissions. In GCP, this is achieved by assigning predefined roles that are narrowly scoped to specific services, and by using conditions to further restrict access.

Answer

Separation of duties

Answer

Privileged access management (PAM)

Answer

Role-based access control (RBAC)

Question 15

A security engineer is implementing DDoS protection for a public-facing web application hosted in AWS. Which TWO services should be used together to provide comprehensive DDoS mitigation? (Choose two.)

Accepted Answer

AWS WAF. AWS Shield Advanced provides enhanced DDoS protection for EC2, ELB, CloudFront, etc. AWS WAF can be used to mitigate application-layer attacks like HTTP flood. Shield Standard is free but less comprehensive. Route 53 is DNS and does not directly mitigate DDoS. GuardDuty is threat detection.

Answer

Amazon Route 53

Answer

AWS Shield Standard

Answer

Amazon GuardDuty