hardMultiple Choice
CV0-004 Practice Question: A security analyst is investigating a potential…
A security analyst is investigating a potential data exfiltration from a cloud environment. The analyst finds that an instance IAM role was assumed by a compromised user, and the role has permissions to read from a sensitive database. What is the BEST way to prevent this type of attack in the future?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enforce MFA for all users and require MFA when assuming the role.
The best because enforcing MFA for all users and requiring MFA when assuming roles ensures that even if a user's credentials are compromised, the attacker cannot assume the IAM role without also having access to the user's MFA device. This directly addresses the scenario. Option B is not the best because adding a resource-based policy to deny access from the role would break legitimate access and does not prevent the compromised user from assuming the role. Option C is not the best because rotating the role's access keys every 30 days does not prevent an attacker from using the role's temporary credentials if they have already assumed the role; also, IAM roles do not have access keys; they issue temporary credentials. Option D is not the best because removing the IAM role and using a service account would not solve the underlying issue and could introduce other security risks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enforce MFA for all users and require MFA when assuming the role.
Why this is correct
Requiring MFA at role assumption adds a second authentication factor, so a compromised user's stolen credentials alone cannot assume the instance IAM role. This directly blocks the credential-based privilege escalation path that granted database read access, satisfying the prevention requirement.
- ✗
Add a resource-based policy to the database to deny access from the role.
Why it's wrong here
A resource-based deny blocks that role's current access but leaves the assumed-role path intact, so a compromised principal can still assume it. Resource policies suit cross-account grants; preventing role assumption abuse requires restricting the role's trust policy and permissions.
- ✗
Rotate the IAM role's access keys every 30 days.
Why it's wrong here
Rotating access keys does not apply to instance roles, which issue temporary credentials automatically, and the compromised user's assumed session persists regardless. Key rotation suits long-lived IAM user credentials; restricting the role's trust policy and permissions addresses assumption abuse.
- ✗
Remove the IAM role and use a service account instead.
Why it's wrong here
Replacing the role with a service account reintroduces long-lived credentials, which are the exposure being eliminated. Service accounts suit legacy workloads lacking identity federation; instance roles with tightly scoped permissions and trust conditions are the intended mechanism for cloud workloads.
Go deeper
Related to this question
About these practice questions
One of 834 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.