CV0-004 Security Practice Test 3 — 15 Questions

Question 1

A cloud architect must design encryption key management for a multi-region application on AWS. The application stores regulated data in Amazon S3 and Amazon RDS across three Regions. The compliance team requires that keys are stored in FIPS 140-2 Level 3 validated hardware, that key material is automatically rotated annually, and that the architect can prove keys were never exported. Which key type should the architect use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS KMS multi-Region customer managed key replicated to each Region with rotation enabled.. Multi-Region AWS KMS customer managed keys are generated and used inside FIPS 140-2 Level 3 validated HSMs, support automatic annual rotation, and replicate to multiple Regions so the same key serves S3 and RDS. Because the key material is non-exportable, the architect can provide the required attestation while simplifying cross-Region encryption operations.

Answer

S3 SSE-C with customer-provided keys stored in AWS Secrets Manager and rotated by Lambda.

Answer

AWS KMS symmetric customer managed key with automatic annual rotation enabled.

Answer

AWS CloudHSM cluster in each Region with a custom key store referenced by KMS.

Question 2

A cloud administrator is responsible for a set of Linux virtual machines in a public cloud. The administrator needs to enable secure remote administration without exposing SSH to the internet and without managing long-lived SSH key pairs on each host. Which approach best meets these requirements?

Accepted Answer

Use AWS Systems Manager Session Manager to establish shell access without opening inbound ports or distributing SSH keys.. AWS Systems Manager Session Manager provides shell access through the SSM agent and IAM, so no inbound SSH port needs to be open and no per-host SSH key pairs are required. Access is auditable via session logging. A bastion host, site-to-site VPN, or password authentication either still exposes SSH, still requires key management, or weakens security, so Session Manager is the correct fit.

Answer

Deploy a bastion host with a public IP and distribute SSH key pairs to all administrators.

Answer

Configure a site-to-site VPN between the corporate network and the cloud VPC, then use SSH over the private network.

Answer

Enable SSH password authentication on all instances and enforce a strong password policy.

Question 3

A cloud security engineer manages an Azure subscription where several production virtual machines run Windows Server. An audit requires that all administrative connections to these VMs be logged with the source IP address, user identity, and session duration for compliance reporting. The engineer wants to enable just-in-time VM access through Microsoft Defender for Cloud. Which component must be deployed on each VM to support this requirement?

Accepted Answer

Microsoft Defender for Servers Plan 2. Just-in-time VM access is delivered through Microsoft Defender for Servers Plan 2, which configures NSGs to block management ports until an approved request opens them for a limited time and source. Its logs capture requester identity, source IP, and session window, matching the audit requirement.

Answer

Azure Bastion

Answer

Network Watcher

Answer

Azure Monitor Agent

Question 4

A cloud security team needs to block known malicious IP addresses from reaching a public-facing web application hosted on a load balancer. The team wants the block list to be applied at the edge before traffic reaches the application servers. Which AWS service should be used to meet this requirement?

Accepted Answer

AWS WAF. AWS WAF is the appropriate service because it filters HTTP(S) requests at the edge and supports IP set match conditions to block traffic from specified addresses. Placing the block list on WAF ensures malicious traffic is stopped before it reaches the load balancer or application servers, which directly addresses the requirement.

Answer

AWS Shield Advanced

Answer

AWS Network ACL

Answer

Amazon GuardDuty

Question 5

A healthcare company stores patient records in an Amazon S3 bucket. Compliance requires that all objects be encrypted at rest with keys the company controls and can rotate independently of AWS. The security team must also be able to audit key usage and immediately revoke access to the key without deleting the data. Which S3 encryption configuration meets these requirements?

Accepted Answer

SSE-KMS with a customer managed key in AWS KMS. SSE-KMS with a customer managed key is the only option that provides customer-controlled key lifecycle, independent rotation, CloudTrail-based audit of key usage, and immediate revocation by disabling the key. The other options either use AWS-managed keys, lack auditing, or move encryption responsibility to the client, none of which satisfy the full set of healthcare compliance requirements.

Answer

SSE-C using keys stored in AWS Secrets Manager

Answer

SSE-S3 with bucket versioning enabled

Answer

Client-side encryption with an AWS-owned key

Question 6

A cloud administrator manages a Kubernetes cluster on AWS EKS. The security team requires that all pod-to-pod traffic within the cluster be encrypted in transit without modifying application code. The administrator enables encryption by deploying a service mesh, but the team also wants to enforce mutual TLS (mTLS) between pods. Which solution should the administrator implement to meet the mTLS requirement?

Accepted Answer

Deploy Istio with its default configuration, which automatically enables mTLS between all sidecar-injected pods.. Istio's service mesh architecture uses sidecar proxies to transparently intercept all pod traffic and enforce mTLS without application changes. Its default installation includes a certificate authority that issues and rotates workload certificates. By enabling strict mTLS, the administrator ensures that all pod-to-pod communication is encrypted and mutually authenticated, meeting the security team's requirement.

Answer

Use AWS App Mesh with a virtual node configuration that enforces TLS termination at the ingress gateway.

Answer

Configure Kubernetes Network Policies to allow only encrypted traffic between pods using IPsec.

Answer

Enable AWS Certificate Manager (ACM) private CA and configure the EKS control plane to issue certificates to each pod.

Question 7

A healthcare company runs workloads in Microsoft Azure and must comply with HIPAA. The security team wants to detect anomalous sign-ins and suspicious resource activity across the subscription, and to receive automated alerts when risky behavior is identified. Which Azure service should the team use to meet these detection and alerting requirements?

Accepted Answer

Microsoft Defender for Cloud. Microsoft Defender for Cloud aggregates security signals across Azure and connected identity sources, detecting anomalous sign-ins and suspicious resource activity while raising prioritized alerts. That combination of detection and automated alerting matches the healthcare company's compliance monitoring goal.

Answer

Azure Policy

Answer

Azure Advisor

Answer

Azure Service Health

Question 8

A cloud operations team is hardening an AWS environment. They want to detect unauthorized changes to IAM policies and resource configurations, and to receive near-real-time notifications when such changes occur. Which TWO steps should the team take to meet these requirements? (Choose two.)

Accepted Answer

Create an Amazon EventBridge rule that matches CloudTrail events and routes them to an SNS topic. CloudTrail supplies the authoritative record of management API activity, including IAM policy edits and configuration changes. EventBridge then matches those specific events and routes them to SNS for near-real-time notification, giving the team both detection and alerting in one pipeline.

Answer

Deploy AWS Shield Advanced on all accounts

Answer

Enable AWS Config with managed rules to evaluate resource compliance

Answer

Turn on Amazon GuardDuty in all regions

Question 9

A cloud engineer is configuring a virtual private cloud peering connection between two VPCs owned by different business units in the same cloud provider. Security policy requires that traffic between the VPCs be inspected by a centralized next-generation firewall appliance and that the connection not expose either VPC to the public internet. Which design should the engineer implement?

Accepted Answer

Create a VPC peering connection and route inter-VPC traffic through a gateway load balancer that forwards to the firewall appliance.. A gateway load balancer inserts the firewall appliance transparently into the traffic path using GENEVE encapsulation, so inter-VPC flows are inspected while remaining on the provider's private backbone. Direct transit gateway routing skips inspection, a VPN adds unnecessary encryption, and internet gateway routing exposes traffic publicly. The gateway load balancer model centralizes security inspection without re-addressing workloads.

Answer

Create a transit gateway attachment and allow the two VPCs to route directly to each other without inspection.

Answer

Establish a site-to-site VPN between the two VPCs and terminate it on the firewall appliance.

Answer

Attach an internet gateway to both VPCs and route inter-VPC traffic through the firewall's public interface.

Question 10

A cloud administrator is configuring a web application that uses a MySQL database on Amazon RDS. The security policy mandates that all connections to the database be encrypted in transit. The administrator has already enabled SSL/TLS on the RDS instance. Which additional step must be taken to enforce encryption for all client connections?

Accepted Answer

Modify the RDS parameter group to set require_secure_transport to 1.. The require_secure_transport parameter in MySQL forces all client connections to use SSL/TLS. By setting it to 1 in the RDS parameter group and rebooting the instance, the administrator ensures that any connection attempt without encryption is rejected. This is the standard method to enforce encryption in transit for MySQL on RDS.

Answer

Configure the RDS security group to allow only port 3306 with SSL.

Answer

Create a read replica with encryption enabled and redirect all traffic to it.

Answer

Enable IAM database authentication for the RDS instance.

Question 11

A cloud engineer is configuring a web application on AWS and needs to ensure that only HTTP and HTTPS traffic from the internet is allowed to reach the EC2 instances. Which AWS service should be used to control inbound traffic at the instance level?

Accepted Answer

Security Group. Security groups are stateful virtual firewalls that control inbound and outbound traffic at the instance level. Network ACLs operate at the subnet level and are stateless.

Answer

AWS Shield

Answer

AWS WAF

Answer

Network ACL

Question 12

A company is migrating to a public cloud and wants to understand security responsibilities. According to the shared responsibility model, which of the following is the customer responsible for in an IaaS deployment?

Accepted Answer

Patching the guest operating system. In an IaaS deployment, the customer is responsible for patching the guest operating system (A). Under the shared responsibility model, the cloud provider manages the physical security, network infrastructure, and hypervisor, while the customer is responsible for the security of everything they deploy on the infrastructure, including the guest OS, applications, and data. Patching the guest OS is a customer task because the customer has control over the OS and its configuration.

Answer

Network infrastructure security

Answer

Physical security of data centers

Answer

Hypervisor security

Question 13

A security administrator needs to enforce least privilege for a Kubernetes cluster in a cloud environment. Which approach should be used to restrict permissions for pods that need to access the cloud provider's API?

Accepted Answer

Use a service account with a role that has only the required permissions. In Kubernetes, pods assume a Kubernetes service account, and cloud providers support mapping that service account to a cloud IAM role via workload identity (for example, IRSA on EKS or Workload Identity on GKE/AKS). This lets the pod obtain short-lived credentials scoped to only the permissions in the role, enforcing least privilege without embedding static credentials.

Answer

Assign the pod a static cloud IAM user credential

Answer

Disable cloud API access for all pods

Answer

Grant the pod cluster-admin privileges in Kubernetes

Question 14

An organization is moving sensitive data to the cloud and must ensure it is encrypted while stored on disk. Which type of encryption should be implemented?

Accepted Answer

Encryption at rest. Encryption at rest protects data stored on disk, typically using AES-256.

Answer

Encryption in transit

Answer

Hashing

Answer

Tokenization

Question 15

A cloud administrator needs to provide external partners with access to a cloud application using their existing corporate credentials. Which federation protocol should be used?

Accepted Answer

SAML. SAML (Security Assertion Markup Language) is the standard federation protocol for web-based single sign-on, allowing external partners to authenticate with their own corporate identity provider and access a cloud application via trust relationships. It exchanges XML-based assertions between an identity provider and a service provider. This matches the requirement of using existing corporate credentials for external access.

Answer

RADIUS

Answer

Kerberos

Answer

LDAP