hardMultiple SelectObjective-mapped
CV0-004 Practice Question: Which THREE of the following are valid methods to…
Which THREE of the following are valid methods to manage identity and access in a multi-cloud environment?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a federation using SAML 2.0 between the corporate identity provider and each cloud.
Options B, C, and E are correct. B: Federation via SAML 2.0 enables single sign-on (SSO) across multiple clouds, centralizing identity management. C: Assigning resource tags and using attribute-based access control (ABAC) allows granular, policy-driven access across clouds based on resource attributes. E: A cloud access security broker (CASB) provides visibility and enforces access policies consistently across multiple cloud environments. Option A is incorrect because a site-to-site VPN secures network connectivity, not identity and access. Option D is incorrect because a single shared API key is not identity-based and poses a security risk by not providing individual accountability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set up a site-to-site VPN between the on-premises network and each cloud.
Why it's wrong here
VPNs provide network connectivity, not identity management.
- ✓
Implement a federation using SAML 2.0 between the corporate identity provider and each cloud.
Why this is correct
Federation allows SSO and centralized identity management.
- ✓
Assign resource tags and use them in attribute-based access control (ABAC) policies.
Why this is correct
ABAC allows dynamic access decisions based on tags.
- ✗
Use a single shared API key for all clouds to simplify automation.
Why it's wrong here
Shared keys are insecure and not a suitable identity method.
- ✓
Deploy a cloud access security broker (CASB) to enforce access policies across clouds.
Why this is correct
CASB provides visibility and control over cloud usage.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
One of 977 original CV0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.