CV0-004 Security Practice Test 5 — 15 Questions

Question 1

A company is implementing a secrets management solution. The security team wants to ensure that secrets are protected and rotated regularly. Which THREE of the following are best practices for secrets management?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Audit access to secrets to detect unauthorized usage.. Best practices include using a dedicated vault, rotating secrets, avoiding hard-coded secrets, and auditing access.

Answer

Hard-code secrets in application source code for simplicity.

Answer

Store secrets in environment variables for easy access by applications.

Question 2

Which of the following is the cloud provider's responsibility under the shared responsibility model?

Accepted Answer

Securing the physical data center. The cloud provider is responsible for physical infrastructure, hypervisor, and global network. Customer manages OS, apps, IAM, data, and network security groups.

Answer

Encrypting data stored in cloud resources

Answer

Configuring identity and access management policies

Answer

Patching guest operating systems

Question 3

A security administrator is configuring a web application firewall (WAF) to protect against SQL injection attacks. Which WAF feature should be enabled?

Accepted Answer

OWASP rule set. OWASP rules include protections against SQL injection, XSS, and other common web vulnerabilities.

Answer

Geo-blocking

Answer

Rate limiting

Answer

DDoS protection

Question 4

A company uses AWS and needs to enforce that all S3 buckets are encrypted at rest with customer-managed keys stored in AWS KMS. Which IAM policy condition would ensure this?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The 'aws:RequestTag' condition (or similar) can enforce that resources are created with specific tags, but to enforce encryption key usage, the condition 's3:x-amz-server-side-encryption-aws-kms-key-id' is used.

Answer

s3:x-amz-server-side-encryption with value AES256

Answer

aws:SourceVpce

Answer

s3:versioning

Question 5

An organization wants to ensure that only authenticated users from their corporate Active Directory can access cloud resources. Which federation protocol is most commonly used for this purpose?

Accepted Answer

SAML. SAML is widely used for federation between corporate identity providers (e.g., Active Directory) and cloud services.

Answer

LDAP

Answer

OAuth 2.0

Answer

RADIUS

Question 6

A cloud architect is designing a security group for a web server in AWS. The server must receive HTTPS traffic from the internet. What is the most secure inbound rule?

Accepted Answer

Allow HTTPS from 0.0.0.0/0. Security groups are stateful; specifying source IP range 0.0.0.0/0 for HTTPS is typical for public web servers.

Answer

Allow HTTPS from the VPC CIDR only

Answer

Allow HTTPS from 10.0.0.0/8

Answer

Allow all traffic from 0.0.0.0/0

Question 7

Which of the following is a stateless network access control that requires explicit allow rules for both inbound and outbound traffic?

Accepted Answer

Network ACL. Network ACLs (NACLs) are stateless; security groups are stateful.

Answer

Security group

Answer

DDoS protection

Answer

Web application firewall

Question 8

A DevOps team deploys a containerized application to a Kubernetes cluster. They need to ensure that containers cannot run with privileged access. Which Kubernetes security mechanism should be applied?

Accepted Answer

Pod Security Standards. Pod Security Standards define policies like 'restricted' that prevent privileged containers.

Answer

Network policies

Answer

ConfigMaps

Answer

Service accounts

Question 9

A company needs to meet PCI DSS compliance requirements for storing credit card data in the cloud. Which compliance certification should they verify their cloud provider has?

Accepted Answer

PCI DSS Level 1. PCI DSS Level 1 is the highest level for handling cardholder data.

Answer

ISO 27001

Answer

SOC 2 Type II

Answer

HIPAA BAA

Question 10

Which of the following is a best practice for managing secrets in cloud applications?

Accepted Answer

Use a cloud secrets manager with automatic rotation. Secrets should be stored in a dedicated secrets manager and rotated regularly, never hard-coded.

Answer

Embed secrets in application code

Answer

Store secrets in environment variables

Answer

Share secrets via email

Question 11

A cloud administrator notices that an AWS IAM user has more permissions than necessary. Which principle should be applied to correct this?

Accepted Answer

Least privilege. Least privilege means granting only the permissions required to perform a job function.

Answer

Separation of duties

Answer

Defense in depth

Answer

Zero trust

Question 12

A company uses Azure and wants to centrally audit all management operations across subscriptions. Which service should be used to collect and analyze these logs?

Accepted Answer

Azure Monitor. Azure Monitor is the correct service because it provides a centralized platform for collecting, analyzing, and acting on telemetry data from Azure resources, including management operations across subscriptions. Specifically, the Azure Activity Log within Azure Monitor captures all control-plane events (e.g., resource creation, deletion, policy changes) at the subscription level, enabling auditing and alerting. This directly meets the requirement for centrally auditing management operations across multiple subscriptions.

Answer

GCP Cloud Audit Logs

Answer

AWS CloudTrail

Answer

Azure Security Center

Question 13

A security team needs to enforce multi-factor authentication (MFA) for all users accessing the cloud management console. Which IAM feature should be configured?

Accepted Answer

Condition in IAM policy requiring MFA. A condition in an identity policy can require the presence of multi-factor authentication, enforcing MFA for access to the cloud management console. This is a standard mechanism to mandate MFA at the policy level, ensuring users must authenticate with a second factor before accessing the console.

Answer

IAM role

Answer

Resource-based policy

Answer

Password policy

Question 14

A cloud security engineer is hardening a Kubernetes cluster. Which TWO measures should be implemented to improve container security? (Choose two.)

Accepted Answer

Implement runtime security monitoring. A is correct because runtime security monitoring (e.g., using Falco, Sysdig, or Aqua Security) detects and alerts on anomalous behavior within running containers, such as unexpected system calls, privilege escalations, or file system changes. This is a critical layer of defense that complements image scanning by catching threats that bypass static checks, such as zero-day exploits or compromised containers. Without runtime monitoring, malicious activity inside a container can go undetected until significant damage occurs.

Answer

Store secrets in ConfigMaps

Answer

Disable audit logging to reduce overhead

Answer

Use default service accounts for all pods

Question 15

A company is migrating to GCP and needs to ensure data encryption in transit for all external communications. Which THREE measures should be implemented? (Choose three.)

Accepted Answer

Configure load balancer to redirect HTTP to HTTPS. TLS 1.2+ ensures strong encryption in transit. Certificate management ensures valid certificates. Enforcing HTTPS via load balancer policies redirects HTTP traffic.

Answer

Disable TLS for internal VPC traffic

Answer

Enable AES-256 encryption at rest