CV0-004 Security Practice Test 4 — 15 Questions

Question 1

A cloud engineer is tasked with securing network traffic in a VPC. Which TWO of the following are stateful security mechanisms? (Choose two.)

Accepted Answer

DDoS protection services. Security groups are stateful, automatically allowing return traffic. DDoS protection services are stateful as they track and analyze traffic flows to detect anomalies. Network ACLs are stateless. WAF is typically stateless, processing each request independently. Route tables are stateless, simply directing traffic without tracking connections.

Answer

Web Application Firewall (WAF)

Answer

Network ACLs

Answer

Route tables

Question 2

A cloud architect is designing a multi-tenant SaaS application on AWS. Which of the following security responsibilities is the CUSTOMER responsible for under the shared responsibility model?

Accepted Answer

Configuring security groups. Under the shared responsibility model, the customer is responsible for data encryption, OS patching, and IAM configuration, while the provider secures the physical infrastructure.

Answer

Global network infrastructure

Answer

Patching the hypervisor

Answer

Physical security of data centers

Question 3

A security engineer is reviewing IAM policies and notices a policy that allows all actions on all resources for a user. Which principle of security is being violated?

Accepted Answer

Least privilege. The principle of least privilege states that users should be granted only the permissions necessary to perform their job functions.

Answer

Separation of duties

Answer

Need to know

Answer

Defense in depth

Question 4

A company has deployed a containerized application on a Kubernetes cluster. The security team wants to ensure that containers cannot run as the root user and that the container's root filesystem is read-only. Which Kubernetes security mechanism should be used?

Accepted Answer

Pod Security Standards. Pod Security Standards (PSS) provide predefined security profiles (privileged, baseline, restricted) that enforce policies like running as non-root and read-only root filesystem.

Answer

Network policies

Answer

Seccomp profiles

Answer

Resource quotas

Question 5

An organization uses Azure and wants to ensure that only authenticated users from its on-premises Active Directory can access cloud resources. The company has Azure AD Connect set up and wants to enable single sign-on (SSO) for cloud applications. Which federation standard should be used?

Accepted Answer

SAML. SAML (Security Assertion Markup Language) is the correct federation standard because it enables browser-based single sign-on (SSO) by exchanging authentication and authorization assertions between an identity provider (on-premises Active Directory via Azure AD Connect) and a service provider (cloud applications). SAML 2.0 is specifically designed for federated identity scenarios where users authenticate on-premises and gain access to cloud resources without re-entering credentials.

Answer

Kerberos

Answer

OAuth 2.0

Answer

OpenID Connect

Question 6

A cloud administrator notices that a security group rule allowing SSH (port 22) from any IP address (0.0.0.0/0) was created for a Linux server. The server is used for administrative purposes only. Which security best practice should be applied to reduce the attack surface?

Accepted Answer

Restrict the source IP address to the company's public IP range. Restricting the source IP address to the company's public IP range (option D) directly reduces the attack surface by limiting SSH access to only trusted administrative networks. This is the most effective security best practice because it prevents unauthorized external hosts from even attempting to connect to port 22, regardless of authentication method or port obscurity. In cloud environments like AWS, security group rules are stateful and evaluated before any packet reaches the instance, making source IP restriction a fundamental layer of defense.

Answer

Disable password authentication and use SSH keys only

Answer

Change the SSH port to a non-standard port

Answer

Add a deny rule for SSH in the network ACL

Question 7

A cloud engineer is configuring encryption for data stored in an S3 bucket. The company requires that encryption keys be managed by the organization, not the cloud provider. Which encryption option should be used?

Accepted Answer

SSE-C. SSE-C (Server-Side Encryption with Customer-Provided Keys) allows the organization to manage their own encryption keys while AWS handles the encryption and decryption process. The customer provides the encryption key in each request, and AWS discards the key after the operation, ensuring the cloud provider never stores the key. This meets the requirement that keys be managed by the organization, not the cloud provider.

Answer

SSE-KMS

Answer

SSE-S3

Answer

Client-side encryption

Question 8

A company uses a SaaS application for customer relationship management (CRM). The security team wants to monitor user activities and enforce data loss prevention (DLP) policies. Which type of security tool should be deployed?

Accepted Answer

Cloud Access Security Broker (CASB). A Cloud Access Security Broker (CASB) provides visibility into SaaS usage, monitors user activities, and can enforce DLP policies across cloud applications.

Answer

Intrusion Detection System (IDS)

Answer

Security Information and Event Management (SIEM)

Answer

Web Application Firewall (WAF)

Question 9

A security administrator is configuring a Web Application Firewall (WAF) to protect a public-facing web application. The application experiences a high volume of traffic from certain geographic regions that are not serving customers. Which WAF feature should be used to block this traffic?

Accepted Answer

Geo-blocking. Geo-blocking allows the WAF to block or allow traffic based on geographic location, reducing unwanted traffic and potential attacks.

Answer

Rate limiting

Answer

OWASP rule set

Answer

IP reputation lists

Question 10

A company is migrating a financial application to the cloud and must comply with PCI DSS. Which of the following cloud compliance programs is most relevant to demonstrate compliance?

Accepted Answer

PCI DSS Level 1. PCI DSS Level 1 is the highest level of compliance for organizations handling credit card data. Cloud providers offer PCI DSS attestations to support customer compliance.

Answer

ISO 27001

Answer

SOC 2 Type II

Answer

HIPAA BAA

Question 11

A cloud engineer is deploying a new application and needs to securely store database credentials. The credentials must be automatically rotated every 90 days. Which service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager allows secure storage and automatic rotation of secrets such as database credentials, with configurable rotation intervals.

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Answer

AWS Identity and Access Management (IAM)

Question 12

An organization wants to audit all API calls made in their AWS account. Which AWS service should be enabled to capture these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records API activity for governance, compliance, and auditing.

Answer

Amazon CloudWatch

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 13

A security analyst is reviewing logs and finds that an unauthorized user accessed a storage blob in a cloud environment. The analyst needs to determine which permissions allowed the access. Which cloud feature provides a detailed view of effective permissions for a user?

Accepted Answer

Role-Based Access Control (RBAC) with effective permissions analysis. Role-Based Access Control (RBAC) systems often provide an 'effective permissions' or 'check access' feature that allows an administrator to evaluate the cumulative permissions assigned to a specific user, group, or service principal for a given resource scope. This feature calculates the net effect of all role assignments, including inherited permissions from higher-level scopes such as management groups, subscriptions, and resource groups, enabling the analyst to pinpoint exactly which role granted the unauthorized access.

Answer

Privileged Identity Management (PIM)

Answer

Blueprints/Service Catalog

Answer

Policy Enforcement

Question 14

A company uses Google Cloud Platform and wants to enforce that all Compute Engine instances use a specific Customer-Managed Encryption Key (CMEK) for disk encryption. Which GCP service should be used to enforce this policy?

Accepted Answer

Organization Policies. Organization Policies (formerly known as 'Constraints') allow administrators to define and enforce guardrails for Google Cloud resources at the hierarchy level. The specific constraint `compute.requireCsekEncryption` (or the newer CMEK-based equivalent) can be applied to a folder or project to mandate that all Compute Engine disks use a Customer-Managed Encryption Key, rejecting any instance creation or disk attachment that does not comply.

Answer

IAM Conditions

Answer

Cloud Security Command Center

Answer

Cloud Key Management Service

Question 15

A cloud architect is designing network security for a VPC. The architect needs to implement both stateful and stateless firewalls. Which TWO of the following correctly describe these firewall types?

Accepted Answer

Security groups are stateful; they automatically allow return traffic for allowed inbound connections.. Security groups are stateful firewalls that automatically allow return traffic for allowed inbound connections. Network ACLs are stateless firewalls that support both allow and deny rules evaluated in priority order. Option C, while true, describes a property of security groups (allow rules only) but is not a direct description of the firewall type (stateful vs. stateless) as asked by the question. Therefore, only options B and D are correct.

Answer

Network ACLs are stateful; they track connection state and allow return traffic automatically.

Answer

Security groups support allow rules only; deny rules are not supported.

Answer

Both security groups and network ACLs can be used to allow or deny traffic based on source IP and port.