CV0-004 Security Practice Test 6 — 15 Questions

Question 1

A cloud administrator is configuring a CASB (Cloud Access Security Broker) for SaaS applications. Which TWO capabilities should the administrator expect from the CASB? (Choose two.)

Accepted Answer

Discover and control shadow IT usage. CASBs provide visibility into shadow IT, enforce data loss prevention policies, and control access to SaaS applications.

Answer

Manage on-premises server patches

Answer

Provide local DNS resolution

Answer

Replace the cloud provider's infrastructure

Question 2

In the shared responsibility model, which of the following is the cloud customer responsible for?

Accepted Answer

Operating system patching on virtual machines. The shared responsibility model states that customers are responsible for OS patching, application code, IAM, data encryption, and network security groups.

Answer

Network infrastructure under the hypervisor

Answer

Hypervisor security

Answer

Physical hardware maintenance

Question 3

A security engineer is configuring an AWS IAM policy for a new application. The policy must allow the application to read objects from a specific S3 bucket. Which IAM policy element determines whether the action is allowed or denied?

Accepted Answer

Effect. The Effect element in an IAM policy specifies whether the policy allows or denies the requested action.

Answer

Action

Answer

Resource

Answer

Condition

Question 4

A cloud administrator is designing network security for a three-tier application. The web tier must be accessible from the internet, but the application and database tiers should only be reachable from the web tier. Which security group configuration should be used?

Accepted Answer

Use separate security groups: web allows HTTP/HTTPS from 0.0.0.0/0; app allows traffic from web security group; db allows traffic from app security group. It uses separate security groups for each tier, implementing the principle of least privilege. The web tier security group allows HTTP/HTTPS from 0.0.0.0/0 for internet access, while the app tier security group references the web tier security group as its source, ensuring only traffic from the web tier can reach the application tier. Similarly, the database tier security group references the app tier security group, restricting access exclusively to the application tier. This configuration enforces strict east-west traffic control and prevents direct internet access to the internal tiers.

Answer

Assign the same security group to all tiers and use a single inbound rule

Answer

Place all tiers in the same subnet and use a network ACL to permit all traffic

Answer

Configure a network ACL for each subnet with allow rules for the required traffic

Question 5

A company running a critical web application wants to protect against SQL injection and cross-site scripting attacks. The application is behind a load balancer. Which type of service should be deployed to provide this protection?

Accepted Answer

Web application firewall (WAF). A web application firewall (WAF) is designed to protect web applications from common web exploits like SQL injection and cross-site scripting. It can be integrated with load balancers to inspect HTTP/HTTPS traffic and filter malicious requests based on customizable rules. This makes it the correct choice for the described threat scenario.

Answer

Network firewall

Answer

DDoS protection service

Answer

Intrusion detection system

Question 6

Which encryption standard is most commonly used for data at rest in cloud storage services?

Accepted Answer

AES-256. AES-256 is the industry standard for encrypting data at rest in cloud environments.

Answer

Blowfish

Answer

DES

Answer

RSA

Question 7

A cloud architect needs to ensure that all data transmitted between an on-premises data center and a cloud VPC is encrypted. Which solution should be implemented?

Accepted Answer

VPN Gateway. A VPN connection encrypts traffic in transit using IPsec tunnels.

Answer

Security group

Answer

Cloud KMS

Answer

Direct Connect

Question 8

An organization's compliance policy requires that all access to cloud resources be logged and that logs be immutable. Which service should be used to meet these requirements?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made to AWS resources, providing a detailed audit log of who made the request, from which IP address, and when. CloudTrail logs can be stored in an S3 bucket with S3 Object Lock enabled, which enforces a write-once-read-many (WORM) model to make logs immutable, meeting the compliance requirement for both logging and immutability.

Answer

AWS CloudWatch Logs

Answer

AWS Trusted Advisor

Answer

AWS Config

Question 9

A company uses Azure and wants to enforce multi-factor authentication (MFA) for all administrative users. The solution must be centrally managed and apply to all Azure subscriptions. Which approach should be used?

Accepted Answer

Create a Conditional Access policy in Azure AD requiring MFA for all cloud apps. Conditional Access policies in Azure AD are centrally managed and can enforce MFA for all cloud apps across all Azure subscriptions by targeting the 'Microsoft Azure Management' cloud app. This approach applies to all administrative users regardless of subscription, as Azure AD is the identity provider for Azure resources.

Answer

Configure MFA on each individual Azure subscription

Answer

Assign MFA to each user individually in Azure AD

Answer

Use Azure Policy to require MFA for admin roles

Question 10

Which of the following is a key benefit of using a Cloud Access Security Broker (CASB)?

Accepted Answer

Discovers and controls use of unauthorized cloud applications. CASBs provide visibility and control over SaaS applications, including shadow IT discovery.

Answer

Automates resource provisioning

Answer

Provides DDoS protection

Answer

Manages encryption keys for on-premises data

Question 11

A cloud engineer is deploying a containerized application on Kubernetes. The security team requires that containers run with reduced privileges and that certain capabilities are dropped. Which Kubernetes feature should be used to enforce these requirements?

Accepted Answer

Pod Security Standards. Pod Security Standards (or Pod Security Policies) define security contexts and can restrict container capabilities.

Answer

Network policies

Answer

ConfigMap

Answer

Horizontal Pod Autoscaler

Question 12

An organization uses multiple cloud providers and wants to centralize secrets management. Which solution would best meet this requirement?

Accepted Answer

HashiCorp Vault. HashiCorp Vault is a multi-cloud secrets management solution that can store and rotate secrets across different providers.

Answer

Azure Key Vault

Answer

AWS Secrets Manager

Answer

Google Cloud Secret Manager

Question 13

During a security audit, it is discovered that a cloud storage bucket contains sensitive data that should have been encrypted at rest. The bucket was created with default settings. Which step must be taken to encrypt the data that is already stored?

Accepted Answer

Copy the objects to a new bucket that has default encryption enabled, then delete the original bucket. Enabling default encryption only affects new objects. Existing objects must be re-encrypted by copying them, which applies the new encryption settings.

Answer

Encrypt the objects using client-side encryption before upload

Answer

Use a server-side encryption with customer-provided keys (SSE-C) on each existing object

Answer

Enable default encryption on the bucket; all existing objects will be automatically encrypted

Question 14

A cloud security team is implementing the principle of least privilege for IAM roles. Which TWO actions are consistent with this principle?

Accepted Answer

Regularly review and revoke unused permissions. Least privilege means granting only the permissions necessary for a task and periodically reviewing access.

Answer

Grant full administrative access to all users to simplify management

Answer

Use wildcard (*) permissions to allow all actions on a resource

Answer

Assign root user access to all developers

Question 15

A company is deploying a web application on GCP and needs to protect against OWASP Top 10 threats and DDoS attacks. Which THREE services should be combined to provide comprehensive protection?

Accepted Answer

Cloud Load Balancing. Cloud Load Balancing (A) is correct because it distributes incoming traffic across multiple backend instances, providing inherent DDoS resilience by absorbing and scaling with attack traffic. It also integrates directly with Cloud Armor to enforce OWASP Top 10 web application firewall (WAF) rules, such as SQL injection and XSS protections, at the edge before traffic reaches the application.

Answer

Cloud NAT

Answer

Cloud VPN