CV0-004 Security Practice Test 9 — 15 Questions

Question 1

A security engineer is designing a data classification policy for a cloud environment. The policy must identify sensitive data, apply appropriate controls, and monitor access. Which THREE of the following should be included in the policy? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Encryption at rest for classified data. Data classification includes identifying where data resides, encrypting it, and monitoring access. DLP tools help enforce policies. Security groups are network controls, not data classification. CASB is for SaaS, but not necessarily part of a classification policy.

Answer

Cloud Access Security Broker (CASB) for all data

Answer

Network security groups to isolate data

Question 2

A cloud engineer is configuring a web application that must comply with PCI DSS. The application runs on virtual machines in a public cloud. Which of the following security responsibilities falls under the customer's scope according to the shared responsibility model?

Accepted Answer

Patching the guest operating system of the virtual machines. In the shared responsibility model, the customer is responsible for patching the guest OS, while the cloud provider manages the physical infrastructure and hypervisor.

Answer

Replacing failed physical drives in the storage array

Answer

Configuring the physical network firewall

Answer

Applying hypervisor patches

Question 3

A security administrator is deploying a web application firewall (WAF) to protect a public-facing web application. The application experiences a high volume of traffic from a specific geographic region that is not part of the target customer base. Which WAF feature would best reduce the attack surface without impacting legitimate users?

Accepted Answer

Geo-blocking. Geo-blocking allows the administrator to block traffic from specific regions, reducing the attack surface by eliminating traffic from non-target areas.

Answer

IP whitelisting

Answer

Rate limiting

Answer

OWASP rule set

Question 4

A cloud architect is designing identity and access management (IAM) for a multi-cloud environment. The architect wants to enforce least privilege and support federation with an on-premises Active Directory. Which TWO of the following should be implemented? (Select TWO).

Accepted Answer

Using service accounts for application authentication. Federation with SAML allows SSO from on-prem AD, and service accounts provide non-human identities for applications, both supporting least privilege by granting only necessary permissions.

Answer

Storing shared credentials in application code

Answer

Assigning full administrator roles to all users

Answer

Disabling multi-factor authentication (MFA)

Question 5

A cloud administrator manages a Microsoft Azure subscription. The security team requires that all virtual machines in a resource group be protected by a host-based firewall that filters traffic by port and protocol, independent of any network security group rules. The administrator needs a solution that can be applied directly to the operating system of each VM. Which solution should the administrator implement?

Accepted Answer

Install and configure a host-based firewall such as Windows Defender Firewall or iptables on each VM.. The requirement is for a host-based firewall that filters traffic by port and protocol directly on each VM's operating system. Only a firewall installed inside the guest OS, such as Windows Defender Firewall or iptables, meets this need. Azure-native services like Firewall, NSGs, and DDoS Protection operate at the network layer and cannot enforce OS-level filtering.

Answer

Enable Azure DDoS Protection Standard on the virtual network.

Answer

Configure Azure Firewall in the virtual network.

Answer

Apply a network security group (NSG) to each VM's network interface.

Question 6

A cloud security engineer is responsible for an AWS environment that stores regulated data in Amazon S3 buckets. An audit finding states that data at rest in S3 is not encrypted with a customer-managed key, and the organization must retain control over key rotation and access policies. The engineer must implement encryption that satisfies the audit while minimizing changes to existing applications. Which approach should the engineer take?

Accepted Answer

Configure SSE-KMS with a customer-managed AWS KMS key and set the bucket default encryption to use that key.. SSE-KMS with a customer-managed key gives the organization control over key policies, rotation, and usage auditing while allowing S3 to handle encryption transparently. Setting it as the bucket default means applications do not need modification to encrypt new objects. Other options either leave key control with AWS or require significant application changes.

Answer

Enable SSE-C by providing encryption keys in each S3 API request.

Answer

Enable S3 default encryption using SSE-S3 (AES-256) on all buckets.

Answer

Implement client-side encryption in each application before uploading objects to S3.

Question 7

A cloud administrator manages an AWS environment where developers require temporary, least-privilege access to specific S3 buckets. The administrator wants to avoid creating long-term IAM user credentials and needs the ability to audit who assumed which role and when. Which AWS service should be used to issue short-lived credentials for these developers?

Accepted Answer

AWS Security Token Service (STS). The requirement is for temporary credentials that expire automatically and can be audited. AWS STS provides exactly that through mechanisms like AssumeRole, which returns short-lived credentials associated with an IAM role. CloudTrail records the AssumeRole call, giving the administrator visibility into who assumed which role and when. Other options either provide long-term credentials or do not issue credentials at all.

Answer

AWS Key Management Service (KMS) data keys

Answer

AWS Organizations service control policies (SCPs)

Answer

AWS Identity and Access Management (IAM) access keys

Question 8

A cloud administrator manages a fleet of Amazon EC2 instances hosting a stateless web tier. The security team requires that any administrative SSH access is logged to a tamper-evident, centralized location, and that the private keys never leave a hardware device. Which approach should the administrator implement?

Accepted Answer

Use AWS Systems Manager Session Manager with an EC2 instance profile and log sessions to Amazon CloudWatch Logs and S3.. Session Manager uses the Systems Manager agent and IAM instance profiles to broker shell access, so no inbound SSH port or private key distribution is required. Session logging to CloudWatch Logs and S3 with retention controls provides the tamper-evident, centralized audit trail. Together these meet both the key custody and logging requirements without exposing credentials.

Answer

Store SSH private keys in AWS Secrets Manager and retrieve them at instance boot via user data.

Answer

Deploy a bastion host with SSH certificate authority and forward all session logs to a syslog server.

Answer

Configure EC2 key pairs and rotate them every 30 days using AWS Lambda and EventBridge.

Question 9

A cloud engineer manages a Kubernetes cluster on Google Kubernetes Engine (GKE). An application team reports that a compromised container in the 'payments' namespace attempted to read secrets belonging to the 'analytics' namespace, but the request was denied. The engineer wants to enforce a policy that restricts pod-to-pod traffic so that only pods labeled 'app=frontend' can reach pods labeled 'app=api' on TCP port 8080, while denying all other ingress to the api pods. Which mechanism should the engineer implement?

Accepted Answer

A Kubernetes NetworkPolicy applied in the api namespace selecting pods with label app=api, with an ingress rule allowing only pods labeled app=frontend on TCP 8080.. Kubernetes NetworkPolicy is the correct tool because it provides label-selector-based ingress control at the pod level. Selecting pods labeled app=api and allowing ingress only from app=frontend on TCP 8080 implements the required least-privilege traffic rule. Node-level VPC firewalls, Services, and mTLS alone cannot express or enforce this pod-label restriction, so the NetworkPolicy is the only option that meets the stated requirement.

Answer

A Kubernetes Service of type ClusterIP exposing the api pods, combined with a PodDisruptionBudget to limit access.

Answer

A GKE firewall rule (VPC firewall) that allows ingress to the node pool on TCP 8080 from the frontend node pool's IP range only.

Answer

An Istio sidecar with mTLS STRICT mode enabled in the payments and analytics namespaces.

Question 10

A security team runs workloads in Microsoft Azure and must ensure that all data stored in Azure SQL Database and Azure Storage accounts is encrypted with customer-managed keys (CMK) rather than platform-managed keys. The compliance officer requires that the organization be able to revoke access to the data by disabling the key, and that key rotation be controlled internally. Which Azure service should the team configure to meet these requirements?

Accepted Answer

Azure Key Vault, storing the RSA keys and granting the SQL and Storage resources access via managed identities.. Azure Key Vault is the service that stores customer-managed RSA keys and integrates with Azure SQL Database and Azure Storage to encrypt data at rest with keys the organization controls. By granting the PaaS resources access through managed identities, the team can rotate or disable the key to revoke access. Disk Encryption, Information Protection labels, and Confidential Computing address other layers and cannot satisfy the CMK and revocation requirements.

Answer

Azure Information Protection labels applied to the database and storage resources to classify the data.

Answer

Azure Confidential Computing with SGX-enabled virtual machines hosting the SQL and storage workloads.

Answer

Azure Disk Encryption with BitLocker and DM-Crypt extensions applied to the underlying VM disks.

Question 11

A cloud engineer is configuring an Azure Storage account that holds regulated customer data. The compliance team requires that data is encrypted at rest with customer-managed keys stored in Azure Key Vault, and that key usage is auditable. Which configuration should the engineer apply?

Accepted Answer

Configure a customer-managed key in Azure Key Vault and assign it as the encryption key for the storage account.. Azure Storage encryption supports customer-managed keys by referencing a key stored in Azure Key Vault or Managed HSM. Setting the account's encryption key source to that key gives the customer control over rotation and revocation, while Key Vault logging records every key operation. Microsoft-managed keys and disk encryption do not provide the same customer control or auditability for storage account data.

Answer

Set the storage account encryption key source to Microsoft-managed keys and enable soft delete.

Answer

Enable infrastructure encryption and store keys in a managed HSM.

Answer

Enable Azure Disk Encryption on the storage account and store the KEK in Key Vault.

Question 12

A cloud operations team manages a multi-account AWS environment. Auditors require that every API call made in all accounts be logged to a central location, that logs be immutable for 90 days, and that the logs capture the identity of the caller, the source IP, and the request time. The team wants minimal custom development. Which combination should the team implement?

Accepted Answer

AWS CloudTrail organization trail delivering to a central S3 bucket with S3 Object Lock in compliance mode and a bucket policy denying deletes.. A CloudTrail organization trail is the AWS-native way to capture API activity across all accounts in AWS Organizations into one central S3 bucket. CloudTrail events include caller identity, source IP, and event time. Applying S3 Object Lock in compliance mode plus a bucket policy that denies deletion provides the required 90-day immutability. The other services handle configuration, application logs, or findings, none of which produce the required centralized, immutable API audit trail.

Answer

Amazon CloudWatch Logs with subscription filters forwarding application logs to a central account.

Answer

AWS Config recording all resource configurations in each account and aggregating them into a central aggregator account.

Answer

AWS Security Hub aggregating findings from GuardDuty and Inspector into a central administrator account.

Question 13

A financial services company runs a multi-tenant SaaS application on AWS. Each tenant has dedicated Amazon RDS for MySQL databases. The security team must ensure that data at rest is encrypted with keys that are unique per tenant and that the company can independently audit key usage. Which approach should be used?

Accepted Answer

Use a separate customer managed key (CMK) in AWS KMS for each tenant's RDS instance. Using a separate AWS KMS customer managed key for each tenant's RDS instance provides unique encryption keys per tenant, enabling strong isolation and independent auditability. CloudTrail logs each key's usage, so the security team can track which key encrypted which database and when. This meets both the security and compliance requirements without application-level complexity.

Answer

Use a single customer managed key (CMK) in AWS KMS for all RDS instances

Answer

Use client-side encryption with a per-tenant key stored in the application

Answer

Use AWS managed keys (aws/rds) for each RDS instance

Question 14

A cloud security architect is designing a data protection strategy for a multi-tenant SaaS application hosted in a public cloud. The application stores tenant data in object storage and a managed relational database. Regulators require that each tenant's data be cryptographically isolated so that a key compromise for one tenant cannot expose another tenant's data, and that the organization be able to prove key usage is auditable. Which TWO measures should the architect implement? (Choose two.)

Accepted Answer

Use a separate customer-managed key per tenant in a managed key management service, with key usage logged to an audit trail.. Per-tenant customer-managed keys in a managed KMS provide cryptographic isolation, and envelope encryption with tenant-specific master keys ensures data keys are wrapped uniquely per tenant. Both approaches rely on KMS audit logging to prove key usage. Shared provider-managed keys, row-level filtering, and a single organization-wide key fail to create per-tenant cryptographic boundaries or auditable key-usage records.

Answer

Enable provider-managed encryption at rest on the object storage and database, relying on the provider's default keys.

Answer

Store all tenant data in a single database schema and rely on application-level row filtering for isolation.

Answer

Encrypt backups with a single organization-wide key and rotate it annually to limit exposure.

Question 15

A financial services company runs a containerized payment application on Google Kubernetes Engine (GKE). A compliance auditor requires that all container images deployed to the cluster be cryptographically verified for integrity and provenance before admission. The security team wants to enforce this at the cluster level without modifying each application's deployment pipeline. Which GKE feature should they implement?

Accepted Answer

Binary Authorization. Binary Authorization is the GKE feature purpose-built to enforce that only images signed by trusted attestors can be deployed. Because enforcement occurs through the cluster admission controller, the policy applies centrally without requiring changes to each pipeline. The other options address network perimeters, image metadata scanning, or node hardening, none of which cryptographically verify image provenance at admission time.

Answer

VPC Service Controls

Answer

Container Analysis

Answer

Shielded GKE Nodes