CV0-004 Security Practice Test 5 — 15 Questions

Question 1

A security team discovers that a container image used in production contains a known vulnerability in one of its base image layers. Which action should be taken to remediate this issue?

Accepted Answer

Rebuild the container image using an updated base image. When a vulnerability is found in a base image layer, the correct remediation is to rebuild the container image using an updated base image that includes the patched version of the affected component. Containers are immutable, so patching a running container does not persist and does not fix the image. Rebuilding ensures the new image is free of the vulnerability and can be redeployed across the environment.

Answer

Delete the container and recreate it from the same image

Answer

Apply a security patch to the running container

Answer

Enable runtime security monitoring to detect exploitation attempts

Question 2

A cloud architect is designing a multi-tier application. The application tier needs to access a database, but the database should not be reachable from the internet. Which network security control should be used?

Accepted Answer

Place the database in a private subnet and use a security group to allow traffic only from the application tier. Placing the database in a private subnet with no direct internet route ensures it is not reachable from the internet. Security groups can then allow inbound traffic only from the application tier's security group.

Answer

Encrypt the database connection using TLS

Answer

Use a VPN to connect the application tier to the database

Answer

Place the database in a public subnet with restrictive security groups

Question 3

A company uses Google Cloud Platform (GCP) and wants to enforce that all service accounts used by applications have only the permissions necessary to perform their tasks. Which IAM concept should the administrator apply?

Accepted Answer

Least privilege. The principle of least privilege dictates granting only the required permissions. In GCP, this is achieved by assigning predefined roles that are narrowly scoped to specific services, and by using conditions to further restrict access.

Answer

Separation of duties

Answer

Privileged access management (PAM)

Answer

Role-based access control (RBAC)

Question 4

A cloud administrator is configuring an Azure environment for a healthcare application that must comply with HIPAA. Which TWO configurations are required to meet HIPAA security and privacy rules? (Choose two.)

Accepted Answer

Implement audit logging for access to ePHI. Audit logging for access to ePHI is required by HIPAA to track who accessed, modified, or deleted protected health information. In Azure, this is implemented through Azure Monitor and Log Analytics, which capture detailed audit trails for storage accounts, databases, and applications. Without audit logs, the organization cannot demonstrate compliance with the HIPAA Security Rule's requirement for activity monitoring and accountability.

Answer

Configure network security groups to allow only HTTPS traffic

Answer

Enable multi-factor authentication for all administrative accounts

Answer

Configure automatic patching for all virtual machines

Question 5

A company is deploying a cloud-native application that uses containers orchestrated by Kubernetes. The security team wants to enforce the principle of least privilege at the Kubernetes level. Which THREE measures should be implemented? (Choose three.)

Accepted Answer

Apply Pod Security Standards (e.g., restricted policy). Pod Security Standards (PSS) define security contexts for pods, with the 'restricted' policy enforcing the principle of least privilege by disallowing privileged containers, host network access, and other high-risk capabilities. This directly prevents pods from running with unnecessary permissions, aligning with the security team's goal at the pod level.

Answer

Implement network policies to restrict pod-to-pod communication

Answer

Use namespaces to separate environments

Question 6

According to the shared responsibility model, which of the following is the cloud provider responsible for?

Accepted Answer

Physical infrastructure security. Under the shared responsibility model, the cloud provider is always responsible for the security OF the cloud — the physical facilities, hardware, network fabric, and hypervisor layer that underpin the service. Physical infrastructure security (data center access controls, hardware disposal, environmental controls) is entirely the provider's domain and cannot be delegated to the customer. Customers are responsible for security IN the cloud, which covers their data, configurations, and workloads.

Answer

Operating system patching

Answer

Application code security

Answer

Identity and access management configuration

Question 7

A company has a requirement to enforce least privilege for its cloud resources. The cloud engineer is configuring IAM policies. Which of the following best describes least privilege?

Accepted Answer

Granting only the permissions necessary to perform specific tasks. Least privilege means granting each user or service only the minimum permissions required to perform their specific job functions, and nothing more. This limits the blast radius of compromised credentials and reduces accidental or malicious damage. In cloud IAM, this is implemented through fine-grained policies scoped to specific resources and actions.

Answer

Granting permissions based on the user's job title rather than specific needs

Answer

Granting permissions only to senior managers

Answer

Granting full administrator access to all users to simplify management

Question 8

An organization uses AWS and wants to control inbound traffic to its EC2 instances. They need a solution that automatically allows response traffic for any permitted inbound request. Which of the following should they use?

Accepted Answer

Security groups. AWS security groups are stateful virtual firewalls that automatically allow return traffic for any permitted inbound request, regardless of outbound rules. This stateful behavior means that if an inbound request is allowed, the response is automatically permitted, satisfying the requirement. Network ACLs, by contrast, are stateless and require explicit rules for both directions.

Answer

DDoS protection

Answer

Web Application Firewall

Answer

Network ACLs

Question 9

Which of the following compliance frameworks is specifically designed for handling healthcare information in the United States?

Accepted Answer

HIPAA. HIPAA (Health Insurance Portability and Accountability Act) sets standards for protecting sensitive patient data. PCI DSS is for payment card data, SOC 2 is for service organizations, ISO 27001 is for information security management.

Answer

SOC 2 Type II

Answer

ISO 27001

Answer

PCI DSS

Question 10

A DevOps team is deploying containerized applications on Kubernetes. They want to ensure containers do not run with root privileges and that host filesystem access is restricted. Which Kubernetes feature should they use?

Accepted Answer

Pod Security Standards. Pod Security Standards (PSS) define three profiles — Privileged, Baseline, and Restricted — that control whether pods can run as root, use host namespaces, access the host filesystem, or use privileged capabilities. Enforcing the Restricted profile via Pod Security Admission (PSA) directly prevents root execution and restricts hostPath/host filesystem access. This is the native Kubernetes mechanism for pod-level security hardening.

Answer

Service accounts

Answer

ConfigMaps

Answer

Network policies

Question 11

An organization uses multiple SaaS applications and wants to enforce data loss prevention policies and gain visibility into user activity. Which technology should they implement?

Accepted Answer

Cloud Access Security Broker (CASB). A Cloud Access Security Broker (CASB) sits between users and SaaS applications to enforce DLP policies, provide visibility into shadow IT, and monitor user activity across multiple cloud services. CASB is specifically designed for the SaaS visibility and control use case described, offering API-based and proxy-based modes. It can inspect data in transit and at rest in sanctioned SaaS apps, apply DLP rules, and generate audit trails.

Answer

Security information and event management (SIEM)

Answer

Web Application Firewall (WAF)

Answer

Virtual private network (VPN)

Question 12

A cloud security team is implementing a secrets management solution for applications running on AWS. They need to automatically rotate database credentials every 30 days and avoid hardcoding secrets. Which service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager allows automatic rotation of secrets (e.g., database credentials) and integration with AWS services. Parameter Store can store secrets but does not natively support automatic rotation. KMS is for encryption keys. IAM roles are for AWS service permissions.

Answer

AWS Identity and Access Management (IAM) roles

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 13

Which of the following is a benefit of using a Web Application Firewall (WAF)?

Accepted Answer

Filtering malicious HTTP/HTTPS traffic to a web application. WAFs protect web applications from common attacks like SQL injection, cross-site scripting, and other OWASP Top 10 threats by filtering and monitoring HTTP/HTTPS traffic.

Answer

Encrypting data at rest in a database

Answer

Protecting against DDoS attacks at the network layer

Answer

Managing user identities and access

Question 14

A cloud administrator needs to audit all API calls made in a GCP project for compliance purposes. Which service should be enabled to log these actions?

Accepted Answer

GCP Cloud Audit Logs. GCP Cloud Audit Logs is the correct service because it records all API calls and administrative actions in a GCP project, including Admin Activity, Data Access, System Event, and Policy Denied logs. Enabling and exporting these logs to a SIEM or log bucket satisfies the compliance audit requirement for API call visibility.

Answer

Azure Monitor

Answer

GCP Security Command Center

Answer

AWS CloudTrail

Question 15

A company uses Azure AD for identity federation with an on-premises Active Directory. They want to enable single sign-on (SSO) for cloud applications using an open standard. Which protocol should they use?

Accepted Answer

SAML 2.0. SAML (Security Assertion Markup Language) and OIDC (OpenID Connect) are open standards for federation. SAML is commonly used for SSO with Microsoft Entra ID. OAuth is for authorization, not authentication. LDAP is a directory protocol. Kerberos is for on-premises.

Answer

OAuth 2.0

Answer

LDAP

Answer

Kerberos