hardMultiple ChoiceObjective-mapped
CV0-004 Practice Question: A cloud operations team is investigating a…
A cloud operations team is investigating a security breach where an unauthorized user accessed a storage bucket containing sensitive data. The logs show that the access occurred using valid access keys from an IP address outside the company's network. The administrator checks the IAM policies and finds that the keys belong to a service account that has read access to the bucket. Which of the following actions would be MOST effective in preventing a recurrence?
⚠ Common exam trap
A common mix-up: candidates choose Option C (IP-based policy) because they think it blocks external access, but they overlook that service accounts are not bound to a specific IP and can be used from any location, making IP restrictions ineffective for key-based access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rotate the compromised keys and implement multi-factor authentication on the account.
Rotating the compromised keys immediately invalidates the stolen credentials, while implementing multi-factor authentication (MFA) on the service account adds an additional layer of security. Even though service accounts typically don't support interactive MFA, using IAM conditions to require MFA for API calls or using workload identity federation can enforce MFA-like controls. This directly addresses the root cause—compromised static keys—and prevents reuse of the stolen access keys.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Remove the bucket and restore from backup to a new bucket.
Why it's wrong here
This does not address the root cause of compromised credentials.
- ✗
Delete the service account and create a new one with the same permissions.
Why it's wrong here
The old keys could still be used until deletion, and new account could be compromised again.
- ✗
Change the bucket policy to deny access from outside the company's IP range.
Why it's wrong here
This does not revoke the stolen keys immediately; the attacker could still access.
- ✓
Rotate the compromised keys and implement multi-factor authentication on the account.
Why this is correct
Key rotation invalidates stolen keys, and MFA adds protection.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CV0-004 question from scratch — 977 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.