CV0-004 Security Practice Test 3 — 15 Questions

Question 1

A cloud administrator is configuring an Azure environment for a healthcare application that must comply with HIPAA. Which TWO configurations are required to meet HIPAA security and privacy rules? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement audit logging for access to ePHI. Audit logging for access to ePHI is required by HIPAA to track who accessed, modified, or deleted protected health information. In Azure, this is implemented through Azure Monitor and Log Analytics, which capture detailed audit trails for storage accounts, databases, and applications. Without audit logs, the organization cannot demonstrate compliance with the HIPAA Security Rule's requirement for activity monitoring and accountability.

Answer

Configure network security groups to allow only HTTPS traffic

Answer

Enable multi-factor authentication for all administrative accounts

Answer

Configure automatic patching for all virtual machines

Question 2

A company is deploying a cloud-native application that uses containers orchestrated by Kubernetes. The security team wants to enforce the principle of least privilege at the Kubernetes level. Which THREE measures should be implemented? (Choose three.)

Accepted Answer

Apply Pod Security Standards (e.g., restricted policy). Pod Security Standards (PSS) define security contexts for pods, with the 'restricted' policy enforcing the principle of least privilege by disallowing privileged containers, host network access, and other high-risk capabilities. This directly prevents pods from running with unnecessary permissions, aligning with the security team's goal at the pod level.

Answer

Implement network policies to restrict pod-to-pod communication

Answer

Use namespaces to separate environments

Question 3

According to the shared responsibility model, which of the following is the cloud provider responsible for?

Accepted Answer

Physical infrastructure security. The cloud provider is responsible for the physical infrastructure, hypervisor, and global network, while the customer is responsible for OS patching, IAM, data encryption, etc.

Answer

Operating system patching

Answer

Application code security

Answer

Identity and access management configuration

Question 4

A company has a requirement to enforce least privilege for its cloud resources. The cloud engineer is configuring IAM policies. Which of the following best describes least privilege?

Accepted Answer

Granting only the permissions necessary to perform specific tasks. Least privilege means granting only the permissions required to perform a job function, minimizing potential damage from compromised accounts.

Answer

Granting permissions based on the user's job title rather than specific needs

Answer

Granting permissions only to senior managers

Answer

Granting full administrator access to all users to simplify management

Question 5

An organization uses AWS and wants to control inbound traffic to its EC2 instances. They need a solution that automatically allows response traffic for any permitted inbound request. Which of the following should they use?

Accepted Answer

Security groups. Security groups are stateful, meaning if you allow inbound traffic, the response is automatically allowed regardless of outbound rules. Network ACLs are stateless and require explicit rules for both directions.

Answer

DDoS protection

Answer

Web Application Firewall

Answer

Network ACLs

Question 6

Which of the following compliance frameworks is specifically designed for handling healthcare information in the United States?

Accepted Answer

HIPAA. HIPAA (Health Insurance Portability and Accountability Act) sets standards for protecting sensitive patient data. PCI DSS is for payment card data, SOC 2 is for service organizations, ISO 27001 is for information security management.

Answer

SOC 2 Type II

Answer

ISO 27001

Answer

PCI DSS

Question 7

A DevOps team is deploying containerized applications on Kubernetes. They want to ensure containers do not run with root privileges and that host filesystem access is restricted. Which Kubernetes feature should they use?

Accepted Answer

Pod Security Standards. Pod Security Standards (PSS) define security levels (privileged, baseline, restricted) to enforce security policies on pods, such as disallowing root access and restricting host filesystem access.

Answer

Service accounts

Answer

ConfigMaps

Answer

Network policies

Question 8

An organization uses multiple SaaS applications and wants to enforce data loss prevention policies and gain visibility into user activity. Which technology should they implement?

Accepted Answer

Cloud Access Security Broker (CASB). A Cloud Access Security Broker (CASB) provides visibility, compliance, data security, and threat protection for SaaS applications. WAF protects web applications, VPN provides remote access, and SIEM aggregates logs.

Answer

Security information and event management (SIEM)

Answer

Web Application Firewall (WAF)

Answer

Virtual private network (VPN)

Question 9

A cloud security team is implementing a secrets management solution for applications running on AWS. They need to automatically rotate database credentials every 30 days and avoid hardcoding secrets. Which service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager allows automatic rotation of secrets (e.g., database credentials) and integration with AWS services. Parameter Store can store secrets but does not natively support automatic rotation. KMS is for encryption keys. IAM roles are for AWS service permissions.

Answer

AWS Identity and Access Management (IAM) roles

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 10

Which of the following is a benefit of using a Web Application Firewall (WAF)?

Accepted Answer

Filtering malicious HTTP/HTTPS traffic to a web application. WAFs protect web applications from common attacks like SQL injection, cross-site scripting, and other OWASP Top 10 threats by filtering and monitoring HTTP/HTTPS traffic.

Answer

Encrypting data at rest in a database

Answer

Protecting against DDoS attacks at the network layer

Answer

Managing user identities and access

Question 11

A cloud administrator needs to audit all API calls made in a GCP project for compliance purposes. Which service should be enabled to log these actions?

Accepted Answer

GCP Cloud Audit Logs. Cloud Audit Logs in GCP record administrative activities and data access. CloudTrail is AWS-specific, Azure Monitor is for Azure, and Security Command Center is a security dashboard.

Answer

Azure Monitor

Answer

GCP Security Command Center

Answer

AWS CloudTrail

Question 12

A company uses Azure AD for identity federation with an on-premises Active Directory. They want to enable single sign-on (SSO) for cloud applications using an open standard. Which protocol should they use?

Accepted Answer

SAML 2.0. SAML (Security Assertion Markup Language) and OIDC (OpenID Connect) are open standards for federation. SAML is commonly used for SSO with Azure AD. OAuth is for authorization, not authentication. LDAP is a directory protocol. Kerberos is for on-premises.

Answer

OAuth 2.0

Answer

LDAP

Answer

Kerberos

Question 13

A cloud security analyst is reviewing a compliance report and sees that the organization needs to ensure encryption keys are rotated periodically. Which of the following would best satisfy this requirement?

Accepted Answer

Using customer-managed keys with a defined rotation policy. Customer-managed keys allow the customer to set rotation policies. Provider-managed keys are automatically rotated but the customer cannot control the schedule. Storing keys in the application configuration file violates security best practices. Disabling rotation does not meet the requirement.

Answer

Disabling key rotation to prevent key loss

Answer

Storing keys in the application configuration file

Answer

Using provider-managed keys with automatic rotation

Question 14

A cloud architect is designing a container security strategy. Which TWO of the following should be implemented to secure containers? (Choose two.)

Accepted Answer

Runtime security monitoring for anomalous behavior. Image scanning detects vulnerabilities in container images, and runtime security monitors containers for anomalous behavior. Network ACLs are not container-specific. Using the latest base image reduces vulnerabilities. Disabling security controls is wrong.

Answer

Disabling all security contexts in Kubernetes

Answer

Using the latest base images without scanning

Answer

Implementing network ACLs at the hypervisor level

Question 15

A company is migrating to AWS and needs to meet PCI DSS compliance. Which THREE of the following should be implemented? (Choose three.)

Accepted Answer

Encrypting cardholder data at rest and in transit. PCI DSS requires encryption of cardholder data, regular security testing (like vulnerability scanning), and audit logging. Using default VPC settings may not be secure. Single-factor authentication is insufficient.

Answer

Using single-factor authentication for all administrative access

Answer

Using default VPC settings without changes