CV0-004 Security Practice Test 7 — 15 Questions

Question 1

An organization wants to ensure that only authenticated users from their corporate Active Directory can access cloud resources. Which federation protocol is most commonly used for this purpose?

Accepted Answer

SAML. SAML (Security Assertion Markup Language) is the standard federation protocol used to enable single sign-on (SSO) between an identity provider (like Active Directory Federation Services) and a service provider (cloud resources). It exchanges authentication and authorization data in XML assertions, allowing users authenticated against corporate AD to access cloud applications without separate credentials. SAML is specifically designed for web-based federated identity scenarios, making it the most common choice for enterprise cloud SSO.

Answer

LDAP

Answer

OAuth 2.0

Answer

RADIUS

Question 2

Which of the following is a stateless network access control that requires explicit allow rules for both inbound and outbound traffic?

Accepted Answer

Network ACL. Network ACLs (NACLs) are stateless; security groups are stateful.

Answer

Security group

Answer

DDoS protection

Answer

Web application firewall

Question 3

A DevOps team deploys a containerized application to a Kubernetes cluster. They need to ensure that containers cannot run with privileged access. Which Kubernetes security mechanism should be applied?

Accepted Answer

Pod Security Standards. Pod Security Standards (PSS) define three profiles — Privileged, Baseline, and Restricted — that control whether pods can run with privileged access, host networking, hostPath volumes, and similar elevated capabilities. Enforcing the Restricted or Baseline profile via Pod Security Admission prevents containers from running privileged. This is the native Kubernetes mechanism for restricting pod-level privileges.

Answer

Network policies

Answer

ConfigMaps

Answer

Service accounts

Question 4

Which of the following is a best practice for managing secrets in cloud applications?

Accepted Answer

Use a cloud secrets manager with automatic rotation. Using a cloud secrets manager with automatic rotation is the best practice because it centralizes secret storage, encrypts secrets at rest and in transit, and automates rotation to reduce the risk of credential leakage. Services like AWS Secrets Manager, Azure Key Vault, and Google Secret Manager provide fine-grained access control and audit logging, ensuring secrets are not exposed in code or configuration files.

Answer

Embed secrets in application code

Answer

Store secrets in environment variables

Answer

Share secrets via email

Question 5

A cloud administrator notices that an AWS IAM user has more permissions than necessary. Which principle should be applied to correct this?

Accepted Answer

Least privilege. Least privilege means granting an identity only the permissions required to perform its task, and nothing more. When an IAM user has excessive permissions, the correct remediation is to scope the attached policies down to the minimum necessary, which is the definition of least privilege. The other principles address different security concerns and do not directly describe trimming excess permissions.

Answer

Separation of duties

Answer

Defense in depth

Answer

Zero trust

Question 6

A security team needs to enforce multi-factor authentication (MFA) for all users accessing the cloud management console. Which IAM feature should be configured?

Accepted Answer

Condition in IAM policy requiring MFA. A condition in an identity policy can require the presence of multi-factor authentication, enforcing MFA for access to the cloud management console. This is a standard mechanism to mandate MFA at the policy level, ensuring users must authenticate with a second factor before accessing the console.

Answer

IAM role

Answer

Resource-based policy

Answer

Password policy

Question 7

A cloud security engineer is hardening a Kubernetes cluster. Which TWO measures should be implemented to improve container security? (Choose two.)

Accepted Answer

Implement runtime security monitoring. A is correct because runtime security monitoring (e.g., using Falco, Sysdig, or Aqua Security) detects and alerts on anomalous behavior within running containers, such as unexpected system calls, privilege escalations, or file system changes. This is a critical layer of defense that complements image scanning by catching threats that bypass static checks, such as zero-day exploits or compromised containers. Without runtime monitoring, malicious activity inside a container can go undetected until significant damage occurs.

Answer

Store secrets in ConfigMaps

Answer

Disable audit logging to reduce overhead

Answer

Use default service accounts for all pods

Question 8

A cloud administrator is configuring a CASB (Cloud Access Security Broker) for SaaS applications. Which TWO capabilities should the administrator expect from the CASB? (Choose two.)

Accepted Answer

Discover and control shadow IT usage. Option A is correct because a core CASB function is discovery of shadow IT — the CASB uses API connectors, log analysis, and traffic inspection to identify unsanctioned SaaS usage and then apply control (block, coach, or allow) policies. Option C is correct because CASBs enforce data loss prevention policies on cloud traffic and data at rest, inspecting content for sensitive patterns (PII, PCI, credentials) and applying actions such as block, quarantine, or encryption via API or inline proxies. Options B, D, and E are incorrect: patch management of on-premises servers is a configuration management/endpoint tool function, local DNS resolution is provided by DNS servers (e.g., BIND, Windows DNS) rather than a CASB, and a CASB never replaces the cloud provider's infrastructure — it sits alongside SaaS/IaaS to provide visibility, compliance, threat protection, and data security.

Answer

Manage on-premises server patches

Answer

Provide local DNS resolution

Answer

Replace the cloud provider's infrastructure

Question 9

In the shared responsibility model, which of the following is the cloud customer responsible for?

Accepted Answer

Operating system patching on virtual machines. In the shared responsibility model, the cloud customer is responsible for security 'in' the cloud, which includes the operating system, applications, and data. For IaaS, the customer manages the guest OS, including patching, while the cloud provider manages the hypervisor, network infrastructure, and physical hardware. Therefore, operating system patching on virtual machines is the customer's responsibility.

Answer

Network infrastructure under the hypervisor

Answer

Hypervisor security

Answer

Physical hardware maintenance

Question 10

A security engineer is configuring an AWS IAM policy for a new application. The policy must allow the application to read objects from a specific S3 bucket. Which IAM policy element determines whether the action is allowed or denied?

Accepted Answer

Effect. The Effect element in an IAM policy specifies whether the statement allows or denies access. It is a required element that can be set to 'Allow' or 'Deny'. In this case, to allow the application to read objects, the Effect must be 'Allow'. Therefore, the Effect element determines whether the action is allowed or denied.

Answer

Action

Answer

Resource

Answer

Condition

Question 11

A cloud administrator is designing network security for a three-tier application. The web tier must be accessible from the internet, but the application and database tiers should only be reachable from the web tier. Which security group configuration should be used?

Accepted Answer

Use separate security groups: web allows HTTP/HTTPS from 0.0.0.0/0; app allows traffic from web security group; db allows traffic from app security group. It uses separate security groups for each tier, implementing the principle of least privilege. The web tier security group allows HTTP/HTTPS from 0.0.0.0/0 for internet access, while the app tier security group references the web tier security group as its source, ensuring only traffic from the web tier can reach the application tier. Similarly, the database tier security group references the app tier security group, restricting access exclusively to the application tier. This configuration enforces strict east-west traffic control and prevents direct internet access to the internal tiers.

Answer

Assign the same security group to all tiers and use a single inbound rule

Answer

Place all tiers in the same subnet and use a network ACL to permit all traffic

Answer

Configure a network ACL for each subnet with allow rules for the required traffic

Question 12

A company running a critical web application wants to protect against SQL injection and cross-site scripting attacks. The application is behind a load balancer. Which type of service should be deployed to provide this protection?

Accepted Answer

Web application firewall (WAF). A web application firewall (WAF) is designed to protect web applications from common web exploits like SQL injection and cross-site scripting. It can be integrated with load balancers to inspect HTTP/HTTPS traffic and filter malicious requests based on customizable rules. This makes it the correct choice for the described threat scenario.

Answer

Network firewall

Answer

DDoS protection service

Answer

Intrusion detection system

Question 13

Which encryption standard is most commonly used for data at rest in cloud storage services?

Accepted Answer

AES-256. AES-256 is the de facto standard for data-at-rest encryption in cloud storage services such as Amazon S3, Azure Blob Storage, and Google Cloud Storage. It provides strong symmetric encryption with a 256-bit key, is FIPS 140-2/3 validated, and is widely supported by hardware acceleration. Cloud providers default to AES-256 (or AES-128 in some cases) for server-side encryption.

Answer

Blowfish

Answer

DES

Answer

RSA

Question 14

A company uses Azure and wants to enforce multi-factor authentication (MFA) for all administrative users. The solution must be centrally managed and apply to all Azure subscriptions. Which approach should be used?

Accepted Answer

Create a Conditional Access policy in Azure AD requiring MFA for all cloud apps. Conditional Access policies in Microsoft Entra ID are centrally managed and can enforce MFA for all cloud apps across all Azure subscriptions by targeting the 'Microsoft Azure Management' cloud app. This approach applies to all administrative users regardless of subscription, as Microsoft Entra ID is the identity provider for Azure resources.

Answer

Configure MFA on each individual Azure subscription

Answer

Assign MFA to each user individually in Azure AD

Answer

Use Azure Policy to require MFA for admin roles

Question 15

Which of the following is a key benefit of using a Cloud Access Security Broker (CASB)?

Accepted Answer

Discovers and controls use of unauthorized cloud applications. CASBs provide visibility and control over SaaS applications, including shadow IT discovery.

Answer

Automates resource provisioning

Answer

Provides DDoS protection

Answer

Manages encryption keys for on-premises data