mediumMultiple Choice
CV0-004 Practice Question: A mid-sized company is migrating its on-premises…
A mid-sized company is migrating its on-premises applications to a public cloud. The security team has implemented a cloud access security broker (CASB) to monitor and enforce policies for sensitive data. The company uses a multi-cloud environment with both AWS and Azure. After deployment, the security team receives alerts that a developer accidentally exposed a set of credentials in a public GitHub repository. The credentials were associated with a service account that has read-write access to an AWS S3 bucket containing customer PII (personally identifiable information). The team immediately revokes the credentials and rotates the access keys. The security team wants to prevent such incidents in the future and ensure that any exposed credentials are promptly detected without relying solely on manual GitHub scans. The company also wants to maintain a least-privilege model for all cloud resources. Given this scenario, which of the following actions should the security team take FIRST to reduce the risk of credential exposure and improve detection?
⚠ Common exam trap
CompTIA often tests the distinction between periodic and continuous detection mechanisms, where candidates may choose a periodic scanning tool (Option A) because it seems simpler, but the question explicitly requires prompt detection without relying solely on manual scans, making real-time CASB integration the correct first action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the CASB to integrate with the GitHub API to continuously scan for exposed secrets and automatically trigger alerts.
A CASB is designed to integrate with cloud services like GitHub via APIs to provide continuous monitoring and policy enforcement. By configuring the CASB to scan GitHub repositories in real-time, the security team can detect exposed credentials immediately upon commit, rather than relying on periodic scans or manual reviews. This aligns with the requirement for prompt detection without manual intervention and leverages the existing CASB investment for multi-cloud environments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Implement a periodic secret scanning tool that runs every 24 hours and reports any found credentials to the security team.
Why it's wrong here
A 24-hour scan leaves a window in which exposed credentials remain valid, and periodic scanning does not address the over-privileged service account holding read-write S3 access. It is tempting because scheduled secret scanning is a genuine detection control, but the stem requires prompt detection and least privilege, which continuous scanning and scoped permissions deliver.
- ✓
Configure the CASB to integrate with the GitHub API to continuously scan for exposed secrets and automatically trigger alerts.
Why this is correct
Integrating the CASB with the GitHub API gives continuous, automated secret scanning across repositories, replacing manual checks and satisfying the stem's detection requirement. Alerts fire immediately when credentials appear, enabling prompt revocation before the exposed service account's read-write S3 access can be abused.
- ✗
Disable all public repositories and require all code to be stored in private repositories with strict branch protection rules.
Why it's wrong here
Private repositories with branch protection restrict where code lives but do not detect credentials already committed or pushed elsewhere, and they do not enforce least privilege on the AWS service account. It is tempting because it reduces accidental public exposure, which is a valid hardening step, yet the stem demands prompt automated detection of exposed secrets.
- ✗
Require all developers to use a password manager to store secrets and set up a process to manually review GitHub commits.
Why it's wrong here
Password managers store secrets for humans but cannot prevent a developer pasting credentials into a commit, and manual commit review is neither prompt nor automated. It is tempting because secret management and review are sound practices, yet the stem explicitly rejects reliance on manual GitHub scans and demands automated detection plus least privilege.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CV0-004 question is part of Courseiva's 834-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.