hardMultiple ChoiceObjective-mapped
CV0-004 Practice Question: A security analyst is investigating a potential…
A security analyst is investigating a potential data exfiltration from a cloud environment. The analyst finds that an instance IAM role was assumed by a compromised user, and the role has permissions to read from a sensitive database. What is the BEST way to prevent this type of attack in the future?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enforce MFA for all users and require MFA when assuming the role.
The best because enforcing MFA for all users and requiring MFA when assuming roles ensures that even if a user's credentials are compromised, the attacker cannot assume the IAM role without also having access to the user's MFA device. This directly addresses the scenario. Option B is not the best because adding a resource-based policy to deny access from the role would break legitimate access and does not prevent the compromised user from assuming the role. Option C is not the best because rotating the role's access keys every 30 days does not prevent an attacker from using the role's temporary credentials if they have already assumed the role; also, IAM roles do not have access keys; they issue temporary credentials. Option D is not the best because removing the IAM role and using a service account would not solve the underlying issue and could introduce other security risks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enforce MFA for all users and require MFA when assuming the role.
Why this is correct
MFA adds a second factor, making it much harder for attackers to use stolen credentials.
- ✗
Add a resource-based policy to the database to deny access from the role.
Why it's wrong here
This would block the role entirely, not just compromised users.
- ✗
Rotate the IAM role's access keys every 30 days.
Why it's wrong here
Key rotation reduces exposure window but does not prevent a compromised user from assuming the role.
- ✗
Remove the IAM role and use a service account instead.
Why it's wrong here
Service accounts are less secure than roles with MFA policies.
Go deeper
Related to this question
About these practice questions
One of 977 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.