CV0-004 Security — Timed 15 Questions

Question 1

A cloud administrator is configuring encryption for data at rest in a cloud storage service. The administrator wants to use a key that is generated and managed by the cloud provider but stored in the customer's account. Which key management option is being described?

15 minute time limit — choose an answer to begin.

Accepted Answer

Customer-managed keys (CMK). Customer-managed keys (CMK) are generated by the cloud provider's key management service but stored and managed (via policies, rotation) within the customer's account. This gives the customer control over key usage and access, unlike cloud provider-managed keys (SSE-S3) which are fully managed by the provider.

Answer

Customer-supplied keys (SSE-C)

Answer

No encryption

Answer

Cloud provider-managed keys (SSE-S3)

Question 2

A company is deploying a web application in a cloud environment and needs to protect against SQL injection and cross-site scripting (XSS) attacks. Additionally, the company wants to block traffic from specific geographic regions. Which TWO services should be used? (Select TWO.)

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) can inspect HTTP/HTTPS traffic to block SQL injection and cross-site scripting (XSS) attacks. Many WAF implementations also include a geo-blocking feature that allows blocking traffic from specific geographic regions. Therefore, a single WAF service can satisfy all requirements. Geo-blocking is a feature of WAF, not a separate service, so option B is redundant. Network ACLs, DDoS protection, and Security Groups do not provide application-layer inspection or geo-blocking.

Answer

Geo-blocking feature in WAF

Answer

Network Access Control List (NACL)

Answer

DDoS protection service

Answer

Security Group

Question 3

A cloud engineer is configuring a web application on AWS and needs to ensure that only HTTP and HTTPS traffic from the internet is allowed to reach the EC2 instances. Which AWS service should be used to control inbound traffic at the instance level?

Accepted Answer

Security Group. Security groups are stateful virtual firewalls that control inbound and outbound traffic at the instance level. Network ACLs operate at the subnet level and are stateless.

Answer

AWS Shield

Answer

AWS WAF

Answer

Network ACL

Question 4

A company is migrating to a public cloud and wants to understand security responsibilities. According to the shared responsibility model, which of the following is the customer responsible for in an IaaS deployment?

Accepted Answer

Patching the guest operating system. In IaaS, the customer is responsible for securing the operating system, applications, and data, including patching the guest OS.

Answer

Network infrastructure security

Answer

Physical security of data centers

Answer

Hypervisor security

Question 5

A security administrator needs to enforce least privilege for a Kubernetes cluster in a cloud environment. Which approach should be used to restrict permissions for pods that need to access the cloud provider's API?

Accepted Answer

Use a service account with a role that has only the required permissions. Using a service account with a role that has minimal permissions and attaching it to the pod ensures least privilege for pod-to-cloud API access.

Answer

Assign the pod a static cloud IAM user credential

Answer

Disable cloud API access for all pods

Answer

Grant the pod cluster-admin privileges in Kubernetes

Question 6

An organization is moving sensitive data to the cloud and must ensure it is encrypted while stored on disk. Which type of encryption should be implemented?

Accepted Answer

Encryption at rest. Encryption at rest protects data stored on disk, typically using AES-256.

Answer

Encryption in transit

Answer

Hashing

Answer

Tokenization

Question 7

A cloud administrator needs to provide external partners with access to a cloud application using their existing corporate credentials. Which federation protocol should be used?

Accepted Answer

SAML. SAML is a standard federation protocol that enables single sign-on using existing identity providers.

Answer

RADIUS

Answer

Kerberos

Answer

LDAP

Question 8

A company is using a SaaS application and wants to gain visibility into user activity and enforce data loss prevention policies. Which technology should be deployed?

Accepted Answer

Cloud Access Security Broker (CASB). A Cloud Access Security Broker (CASB) provides visibility, compliance, and data security controls for SaaS applications.

Answer

Intrusion Detection System (IDS)

Answer

Web Application Firewall (WAF)

Answer

Network Access Control (NAC)

Question 9

During a security audit, a cloud engineer discovers that a container image used in production has a known critical vulnerability in a base layer. Which practice should be implemented to prevent this in the future?

Accepted Answer

Perform container image scanning during CI/CD. Regular container image scanning in the CI/CD pipeline detects vulnerabilities before deployment.

Answer

Enable Kubernetes pod security policies

Answer

Use only official images from Docker Hub

Answer

Implement network segmentation

Question 10

An organization needs to store database credentials and API keys securely in the cloud, with automatic rotation every 90 days. Which service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager manages secrets lifecycle, including automatic rotation.

Answer

AWS CloudHSM

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 11

A cloud architect is designing a network to protect a web application from common attacks such as SQL injection and cross-site scripting. Which cloud service should be used?

Accepted Answer

Web Application Firewall (WAF). A Web Application Firewall (WAF) inspects HTTP traffic and blocks web exploits like SQL injection and XSS.

Answer

DDoS Protection

Answer

Network ACL

Answer

Security Group

Question 12

A company requires multi-factor authentication (MFA) for all users accessing the cloud management console. Which IAM policy element should be used to enforce this?

Accepted Answer

Condition. A Condition element in an IAM policy can require MFA by checking the aws:MultiFactorAuthPresent key.

Answer

Action

Answer

Effect

Answer

Resource

Question 13

A cloud security team is reviewing audit logs and notices that a service account has been used to launch several high-risk API calls that are not part of its normal behavior. Which security control should be implemented to detect such anomalies in real time?

Accepted Answer

Implement an anomaly detection service. Anomaly detection tools use machine learning and behavioral analytics to identify unusual API activity in real time, providing early warning of potential security threats.

Answer

Enable API audit logging

Answer

Use a static IAM policy

Answer

Configure a network ACL

Question 14

An organization is subject to PCI DSS compliance and must demonstrate that it is meeting security requirements. Which cloud service can aggregate compliance findings and provide a dashboard?

Accepted Answer

AWS Security Hub. AWS Security Hub aggregates security findings from multiple AWS services and provides a compliance dashboard.

Answer

AWS CloudTrail

Answer

AWS Shield

Answer

AWS Config

Question 15

A cloud administrator is configuring network security for a multi-tier application. Which TWO statements about security groups and network ACLs are correct?

Accepted Answer

Network ACLs are stateless and require explicit allow rules for both inbound and outbound traffic.. Network ACLs are stateless, meaning they do not automatically allow return traffic; you must explicitly define allow rules for both inbound and outbound traffic. Option E is correct because security groups are stateful and support only allow rules; you cannot create a deny rule within a security group, and any traffic not explicitly allowed is implicitly denied.

Answer

Network ACLs evaluate rules before security groups.

Answer

Security groups can be used to deny traffic from specific IP addresses.

Answer

Security groups are stateless.