CV0-004 Security Practice Test 7 — 15 Questions

Question 1

A company is migrating its on-premises applications to a public cloud. The security team wants to ensure that the cloud provider is responsible for physical security of data centers, while the company remains responsible for securing guest operating systems. Which concept does this describe?

Accepted Answer

Shared responsibility model. The shared responsibility model delineates security obligations between the cloud provider (physical infrastructure, hypervisor) and the customer (OS, applications, IAM).

Answer

Least privilege principle

Answer

Zero Trust architecture

Answer

Defense in depth

Question 2

A cloud administrator needs to grant a developer read-only access to a specific storage bucket in AWS. Which IAM component should the administrator modify?

Accepted Answer

IAM policy. IAM policies are JSON documents that define permissions for AWS resources like S3 buckets.

Answer

Security group

Answer

AWS WAF

Answer

Network ACL

Question 3

A company uses Azure RBAC to manage access to resources. A user is assigned a Contributor role at the subscription scope. Which of the following is true regarding the scope of this role?

Accepted Answer

The user will have Contributor permissions on all resources within the subscription.. RBAC roles in Azure are inherited from higher scopes to lower scopes (management group → subscription → resource group → resource).

Answer

The user will have Contributor permissions only on resources created after the assignment.

Answer

The user will have Contributor permissions on the subscription itself but not its resources.

Answer

The user will have Contributor permissions only on resource groups within the subscription.

Question 4

A security engineer is configuring a network security group (NSG) in Azure to allow inbound HTTPS traffic to a web server. The engineer creates an inbound rule allowing TCP port 443 from the Internet. What must be done to ensure the web server can respond to clients?

Accepted Answer

No additional rule is needed because the NSG is stateful.. NSGs are stateful; allowing inbound traffic automatically allows the corresponding outbound response traffic.

Answer

Create an outbound rule allowing all traffic to the Internet.

Answer

Create an inbound rule allowing TCP port 443 from the web server.

Answer

Create an outbound rule allowing TCP port 443 to the Internet.

Question 5

A cloud architect is designing a DDoS protection strategy for a web application hosted on AWS. The application uses an Application Load Balancer (ALB). Which service provides automatic, always-on DDoS protection at no additional cost?

Accepted Answer

AWS Shield Standard. AWS Shield Standard provides automatic protection against common DDoS attacks for all AWS customers at no additional cost.

Answer

AWS WAF

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Question 6

A company stores sensitive customer data in an S3 bucket and must encrypt the data at rest using a key managed by the company (not AWS). Which encryption option should the company use?

Accepted Answer

SSE-C. SSE-C allows customers to provide their own encryption keys; AWS performs encryption/decryption but does not store the keys.

Answer

Client-side encryption

Answer

SSE-KMS

Answer

SSE-S3

Question 7

Which of the following is a benefit of using a Cloud Access Security Broker (CASB) for SaaS applications?

Accepted Answer

It gives visibility and control over Shadow IT and data protection.. CASBs provide visibility into SaaS usage and enforce security policies, such as data loss prevention (DLP) and access control.

Answer

It encrypts data at rest in cloud storage.

Answer

It provides a virtual private network (VPN) for remote access.

Answer

It replaces the need for a web application firewall.

Question 8

A company's compliance team must provide evidence that their cloud environment meets PCI DSS requirements. Which AWS service can aggregate security findings and automate compliance checks?

Accepted Answer

AWS Security Hub. AWS Security Hub provides a comprehensive view of security alerts and compliance status across AWS accounts, including automated checks against standards like PCI DSS.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 9

A DevOps team deploys a containerized application on Amazon EKS. The security team wants to ensure that containers do not run as root and that read-only root filesystems are enforced. Which Kubernetes mechanism should be used?

Accepted Answer

Pod Security Standards. Pod Security Standards (formerly PSP) define security contexts, including runAsNonRoot and readOnlyRootFilesystem, to enforce these policies.

Answer

Kubernetes RBAC

Answer

Network Policies

Answer

Secrets management

Question 10

A security administrator needs to store database credentials and API keys securely in AWS. The credentials must be automatically rotated every 90 days. Which service should the administrator use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed to store secrets and provides built-in rotation capabilities.

Answer

AWS Systems Manager Parameter Store

Answer

AWS KMS

Answer

AWS Certificate Manager

Question 11

A cloud administrator is implementing network security for a VPC. The administrator needs to create a stateless firewall that filters traffic based on source and destination IP, port, and protocol. Which TWO of the following are characteristics of this type of firewall? (Select TWO.)

Accepted Answer

Rules are evaluated in order, starting with the lowest rule number.. Network ACLs are stateless, meaning they do not track connection state and require explicit rules for both inbound and outbound traffic. They evaluate rules in order by rule number.

Answer

It is stateful and tracks connection state.

Answer

It operates at the application layer (Layer 7).

Answer

It automatically allows response traffic for allowed inbound connections.

Question 12

A company is implementing multi-factor authentication (MFA) for cloud console access. Which TWO of the following are valid MFA methods? (Select TWO.)

Accepted Answer

A password and a hardware TOTP token. A hardware TOTP token generates a time-based one-time password (RFC 6238) that changes every 30 or 60 seconds, providing a second factor independent of the user's password. Combining this with a password satisfies the MFA requirement of using two different authentication factors (something you know and something you have).

Answer

Two different passwords

Answer

A password and a security question

Answer

A username and password

Question 13

A security engineer is designing a data classification policy for a cloud environment. The policy must identify sensitive data, apply appropriate controls, and monitor access. Which THREE of the following should be included in the policy? (Select THREE.)

Accepted Answer

Encryption at rest for classified data. Data classification includes identifying where data resides, encrypting it, and monitoring access. DLP tools help enforce policies. Security groups are network controls, not data classification. CASB is for SaaS, but not necessarily part of a classification policy.

Answer

Cloud Access Security Broker (CASB) for all data

Answer

Network security groups to isolate data

Question 14

A cloud architect is designing a secrets management solution for a microservices application. The solution must avoid hardcoding secrets in code and support automatic rotation. Which THREE of the following are best practices? (Select THREE.)

Accepted Answer

Use a dedicated secrets management service like AWS Secrets Manager.. Best practices include using a dedicated vault, injecting secrets at runtime, and enabling rotation. Storing secrets in environment variables is not recommended. Using IAM roles avoids storing credentials.

Answer

Use long-lived static keys for simplicity.

Answer

Store secrets in environment variables for ease of access.

Question 15

A company is deploying a web application in a cloud environment and needs to protect against SQL injection and cross-site scripting (XSS) attacks. Additionally, the company wants to block traffic from specific geographic regions. Which TWO services should be used? (Select TWO.)

Accepted Answer

Web Application Firewall (WAF). WAF can inspect HTTP requests for SQL injection and XSS, and also provide geo-blocking. DDoS protection is for volumetric attacks, not application-layer threats. Network ACLs and Security Groups do not inspect application payloads.

Answer

Network Access Control List (NACL)

Answer

DDoS protection service

Answer

Security Group