CV0-004 Security — Timed 10 Questions

Question 1

A cloud administrator is configuring encryption for data at rest in a cloud storage service. The administrator wants to use a key that is generated and managed by the cloud provider but stored in the customer's account. Which key management option is being described?

10 minute time limit — choose an answer to begin.

Accepted Answer

Customer-managed keys (CMK). Customer-managed keys (CMK) are generated by the cloud provider's key management service but stored and managed (via policies, rotation) within the customer's account. This gives the customer control over key usage and access, unlike cloud provider-managed keys (SSE-S3) which are fully managed by the provider.

Answer

Customer-supplied keys (SSE-C)

Answer

No encryption

Answer

Cloud provider-managed keys (SSE-S3)

Question 2

A company is deploying a web application in a cloud environment and needs to protect against SQL injection and cross-site scripting (XSS) attacks. Additionally, the company wants to block traffic from specific geographic regions. Which TWO services should be used? (Select TWO.)

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) can inspect HTTP/HTTPS traffic to block SQL injection and cross-site scripting (XSS) attacks. Many WAF implementations also include a geo-blocking feature that allows blocking traffic from specific geographic regions. Therefore, a single WAF service can satisfy all requirements. Geo-blocking is a feature of WAF, not a separate service, so option B is redundant. Network ACLs, DDoS protection, and Security Groups do not provide application-layer inspection or geo-blocking.

Answer

Geo-blocking feature in WAF

Answer

Network Access Control List (NACL)

Answer

DDoS protection service

Answer

Security Group

Question 3

A cloud engineer is configuring a web application on AWS and needs to ensure that only HTTP and HTTPS traffic from the internet is allowed to reach the EC2 instances. Which AWS service should be used to control inbound traffic at the instance level?

Accepted Answer

Security Group. Security groups are stateful virtual firewalls that control inbound and outbound traffic at the instance level. Network ACLs operate at the subnet level and are stateless.

Answer

AWS Shield

Answer

AWS WAF

Answer

Network ACL

Question 4

A company is migrating to a public cloud and wants to understand security responsibilities. According to the shared responsibility model, which of the following is the customer responsible for in an IaaS deployment?

Accepted Answer

Patching the guest operating system. In IaaS, the customer is responsible for securing the operating system, applications, and data, including patching the guest OS.

Answer

Network infrastructure security

Answer

Physical security of data centers

Answer

Hypervisor security

Question 5

A security administrator needs to enforce least privilege for a Kubernetes cluster in a cloud environment. Which approach should be used to restrict permissions for pods that need to access the cloud provider's API?

Accepted Answer

Use a service account with a role that has only the required permissions. Using a service account with a role that has minimal permissions and attaching it to the pod ensures least privilege for pod-to-cloud API access.

Answer

Assign the pod a static cloud IAM user credential

Answer

Disable cloud API access for all pods

Answer

Grant the pod cluster-admin privileges in Kubernetes

Question 6

An organization is moving sensitive data to the cloud and must ensure it is encrypted while stored on disk. Which type of encryption should be implemented?

Accepted Answer

Encryption at rest. Encryption at rest protects data stored on disk, typically using AES-256.

Answer

Encryption in transit

Answer

Hashing

Answer

Tokenization

Question 7

A cloud administrator needs to provide external partners with access to a cloud application using their existing corporate credentials. Which federation protocol should be used?

Accepted Answer

SAML. SAML is a standard federation protocol that enables single sign-on using existing identity providers.

Answer

RADIUS

Answer

Kerberos

Answer

LDAP

Question 8

A company is using a SaaS application and wants to gain visibility into user activity and enforce data loss prevention policies. Which technology should be deployed?

Accepted Answer

Cloud Access Security Broker (CASB). A Cloud Access Security Broker (CASB) provides visibility, compliance, and data security controls for SaaS applications.

Answer

Intrusion Detection System (IDS)

Answer

Web Application Firewall (WAF)

Answer

Network Access Control (NAC)

Question 9

During a security audit, a cloud engineer discovers that a container image used in production has a known critical vulnerability in a base layer. Which practice should be implemented to prevent this in the future?

Accepted Answer

Perform container image scanning during CI/CD. Regular container image scanning in the CI/CD pipeline detects vulnerabilities before deployment.

Answer

Enable Kubernetes pod security policies

Answer

Use only official images from Docker Hub

Answer

Implement network segmentation

Question 10

An organization needs to store database credentials and API keys securely in the cloud, with automatic rotation every 90 days. Which service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager manages secrets lifecycle, including automatic rotation.

Answer

AWS CloudHSM

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store