CV0-004 Security Practice Question
A cloud security team is reviewing audit logs and notices that a service account has been used to launch several high-risk API calls that are not part of its normal behavior. Which security control should be implemented to detect such anomalies in real time?
⚠ Common exam trap
CV0-004 often tests the distinction between detective controls that merely log (audit logging) and those that actively analyze behavior (anomaly detection) — candidates pick logging because it sounds like 'detection.'
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement an anomaly detection service
Anomaly detection services (such as Amazon GuardDuty, Azure Defender, or Google Cloud Security Command Center) use machine learning and behavioral baselines to identify unusual API activity from service accounts in near real time. Since the question specifies detecting deviations from normal behavior, a behavioral analytics control is required rather than passive logging or static policy enforcement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable API audit logging
Why it's wrong here
API audit logging records calls after the fact, which is why the team is already reviewing those logs; it provides no real-time detection or alerting on deviation from baseline behaviour. Audit logging is the correct control when the requirement is retrospective investigation, compliance evidence or forensic reconstruction.
- ✓
Implement an anomaly detection service
Why this is correct
Anomaly detection establishes behavioural baselines for service accounts and flags deviations, such as unusual high-risk API calls, in real time. This satisfies the requirement to detect abnormal activity as it occurs rather than relying on static rules or periodic review.
- ✗
Use a static IAM policy
Why it's wrong here
A static IAM policy grants or denies permissions deterministically; it cannot learn a service account's normal call pattern or raise alerts when behaviour diverges. Static policies suit enforcing least privilege at design time, whereas detecting anomalous high-risk API calls in real time requires behavioural analytics.
- ✗
Configure a network ACL
Why it's wrong here
A network ACL filters traffic by IP, port and protocol at subnet boundaries; it cannot inspect API call content or user identity, so it cannot flag a service account issuing unusual high-risk API calls. ACLs suit segmenting workloads or restricting ingress, not behavioural anomaly detection.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CV0-004 question from scratch — 834 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.