CV0-004 Security Practice Test 8 — 15 Questions

Question 1

A cloud engineer is deploying a containerized application on Kubernetes. The security team requires that containers run with reduced privileges and that certain capabilities are dropped. Which Kubernetes feature should be used to enforce these requirements?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Pod Security Standards. Pod Security Standards (PSS) define three levels (Privileged, Baseline, Restricted) that enforce security controls, including running containers with reduced privileges and dropping capabilities. The Restricted policy specifically requires dropping all capabilities and running as non-root, among other restrictions. Therefore, PSS is the correct feature to enforce these requirements.

Answer

Network policies

Answer

ConfigMap

Answer

Horizontal Pod Autoscaler

Question 2

An organization uses multiple cloud providers and wants to centralize secrets management. Which solution would best meet this requirement?

Accepted Answer

HashiCorp Vault. HashiCorp Vault is a multi-cloud secrets management solution that can store and rotate secrets across different providers.

Answer

Azure Key Vault

Answer

AWS Secrets Manager

Answer

Google Cloud Secret Manager

Question 3

A cloud security team is implementing the principle of least privilege for IAM roles. Which TWO actions are consistent with this principle?

Accepted Answer

Regularly review and revoke unused permissions. Option B is correct because regularly reviewing and revoking unused permissions enforces least privilege over time, eliminating accumulated or stale entitlements that could be exploited. Option C is correct because creating custom roles scoped to only the specific permissions each job function requires directly embodies least privilege, granting no more access than necessary. Option A is wrong because granting full administrative access to all users violates least privilege by massively over-provisioning rights. Option D is wrong because wildcard (*) permissions allow all actions on a resource, which is the opposite of narrowly scoped access. Option E is wrong because assigning root user access to all developers grants the most privileged account to many people, directly contradicting least privilege.

Answer

Grant full administrative access to all users to simplify management

Answer

Use wildcard (*) permissions to allow all actions on a resource

Answer

Assign root user access to all developers

Question 4

A company is deploying a web application on GCP and needs to protect against OWASP Top 10 threats and DDoS attacks. Which THREE services should be combined to provide comprehensive protection?

Accepted Answer

Cloud Load Balancing. Cloud Load Balancing (A) is correct because it distributes incoming traffic across multiple backend instances, providing inherent DDoS resilience by absorbing and scaling with attack traffic. It also integrates directly with Cloud Armor to enforce OWASP Top 10 web application firewall (WAF) rules, such as SQL injection and XSS protections, at the edge before traffic reaches the application.

Answer

Cloud NAT

Answer

Cloud VPN

Question 5

A cloud administrator is configuring network ACLs (NACLs) for a VPC subnet. The subnet hosts a web server that must accept HTTP (port 80) and HTTPS (port 443) from the internet, and the server needs to respond to clients. Which TWO rules are required?

Accepted Answer

Outbound rule: allow TCP ports 1024-65535 to 0.0.0.0/0. Option E is correct because the web server must accept inbound HTTP and HTTPS traffic from the internet, so the NACL needs an inbound rule permitting TCP ports 80 and 443 from 0.0.0.0/0. Option D is correct because NACLs are stateless, meaning return traffic is not automatically allowed; the server's responses to clients use ephemeral source ports in the 1024-65535 range, so an outbound rule allowing TCP ports 1024-65535 to 0.0.0.0/0 is required for the responses to reach clients. Option A is not required because ICMP is not needed for HTTP/HTTPS web service and is unrelated to the stated requirement. Option B is wrong because outbound traffic from the server does not originate from ports 80/443; those are the listening ports, while responses use ephemeral ports. Option C is wrong because inbound client requests target destination ports 80/443, not the ephemeral range, so allowing 1024-65535 inbound would not satisfy the requirement.

Answer

Inbound rule: allow all ICMP from 0.0.0.0/0

Answer

Outbound rule: allow TCP port 80 and 443 to 0.0.0.0/0

Answer

Inbound rule: allow TCP ports 1024-65535 from 0.0.0.0/0

Question 6

A company is migrating its on-premises applications to a public cloud. The security team wants to ensure that the cloud provider is responsible for physical security of data centers, while the company remains responsible for securing guest operating systems. Which concept does this describe?

Accepted Answer

Shared responsibility model. The shared responsibility model defines the division of security responsibilities between the cloud provider and the customer. The provider is responsible for security 'of' the cloud (e.g., physical data centers), while the customer is responsible for security 'in' the cloud (e.g., guest OS, applications). This matches the scenario where the provider handles physical security and the company secures guest operating systems.

Answer

Least privilege principle

Answer

Zero Trust architecture

Answer

Defense in depth

Question 7

A cloud administrator needs to grant a developer read-only access to a specific storage bucket in AWS. Which IAM component should the administrator modify?

Accepted Answer

IAM policy. To grant a developer read-only access to a specific S3 bucket, the administrator must modify an IAM policy. IAM policies are JSON documents that define permissions (Allow/Deny) for actions on AWS resources, and they can be attached to IAM users, groups, or roles. By creating a policy that allows s3:GetObject, s3:ListBucket, etc., on the specific bucket ARN, the administrator can grant least-privilege read-only access.

Answer

Security group

Answer

AWS WAF

Answer

Network ACL

Question 8

A company uses Azure RBAC to manage access to resources. A user is assigned a Contributor role at the subscription scope. Which of the following is true regarding the scope of this role?

Accepted Answer

The user will have Contributor permissions on all resources within the subscription.. RBAC roles in Azure are inherited from higher scopes to lower scopes (management group → subscription → resource group → resource).

Answer

The user will have Contributor permissions only on resources created after the assignment.

Answer

The user will have Contributor permissions on the subscription itself but not its resources.

Answer

The user will have Contributor permissions only on resource groups within the subscription.

Question 9

A security engineer is configuring a network security group (NSG) in Azure to allow inbound HTTPS traffic to a web server. The engineer creates an inbound rule allowing TCP port 443 from the Internet. What must be done to ensure the web server can respond to clients?

Accepted Answer

No additional rule is needed because the NSG is stateful.. NSGs are stateful; allowing inbound traffic automatically allows the corresponding outbound response traffic.

Answer

Create an outbound rule allowing all traffic to the Internet.

Answer

Create an inbound rule allowing TCP port 443 from the web server.

Answer

Create an outbound rule allowing TCP port 443 to the Internet.

Question 10

A cloud architect is designing a DDoS protection strategy for a web application hosted on AWS. The application uses an Application Load Balancer (ALB). Which service provides automatic, always-on DDoS protection at no additional cost?

Accepted Answer

AWS Shield Standard. AWS Shield Standard provides automatic protection against common DDoS attacks for all AWS customers at no additional cost.

Answer

AWS WAF

Answer

AWS Network Firewall

Answer

AWS Shield Advanced

Question 11

A company stores sensitive customer data in an S3 bucket and must encrypt the data at rest using a key managed by the company (not AWS). Which encryption option should the company use?

Accepted Answer

SSE-C. SSE-C (Server-Side Encryption with Customer-Provided Keys) allows the company to provide their own encryption key with each request, and AWS uses that key to encrypt the object at rest but does not store the key. This meets the requirement that the key is managed by the company, not AWS.

Answer

Client-side encryption

Answer

SSE-KMS

Answer

SSE-S3

Question 12

Which of the following is a benefit of using a Cloud Access Security Broker (CASB) for SaaS applications?

Accepted Answer

It gives visibility and control over Shadow IT and data protection.. CASBs provide visibility into SaaS usage and enforce security policies, such as data loss prevention (DLP) and access control.

Answer

It encrypts data at rest in cloud storage.

Answer

It provides a virtual private network (VPN) for remote access.

Answer

It replaces the need for a web application firewall.

Question 13

A company's compliance team must provide evidence that their cloud environment meets PCI DSS requirements. Which AWS service can aggregate security findings and automate compliance checks?

Accepted Answer

AWS Security Hub. AWS Security Hub aggregates security findings from multiple AWS services and third-party tools, and it can run automated compliance checks against standards like PCI DSS. It provides a central dashboard for security posture. AWS Config records resource configurations but does not aggregate findings or automate compliance checks in the same way. Amazon Inspector is for vulnerability assessment, and CloudTrail logs API activity.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS CloudTrail

Question 14

A DevOps team deploys a containerized application on Amazon EKS. The security team wants to ensure that containers do not run as root and that read-only root filesystems are enforced. Which Kubernetes mechanism should be used?

Accepted Answer

Pod Security Standards. Pod Security Standards (formerly PSP) define security contexts, including runAsNonRoot and readOnlyRootFilesystem, to enforce these policies.

Answer

Kubernetes RBAC

Answer

Network Policies

Answer

Secrets management

Question 15

A security administrator needs to store database credentials and API keys securely in AWS. The credentials must be automatically rotated every 90 days. Which service should the administrator use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed to store secrets and provides built-in rotation capabilities.

Answer

AWS Systems Manager Parameter Store

Answer

AWS KMS

Answer

AWS Certificate Manager