Security Controls CV0-004 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A government agency stores classified data in a cloud environment. They require that encryption keys be managed by the agency, not the cloud provider. They also need to ensure that data is encrypted at rest. Which solution should they use?

   • AUse the cloud provider's default encryption with provider-managed keys.
   • BRely on the cloud provider's physical security to protect the data.
   • CUse a customer-managed key (CMK) stored in a cloud KMS, and enable encryption on the storage service.
   • DEncrypt the data before uploading it, but do not enable encryption at rest.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which phase of the incident response process involves identifying the scope of a security incident?

   • ADetection and analysis
   • BContainment, eradication, and recovery
   • CPreparation
   • DPost-incident activity
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A financial services company is migrating its customer database to a public cloud. They must protect data both while it is being transmitted and while it is stored. The company also needs to meet PCI DSS requirements. Which combination of controls should they implement?

   • AUse a custom encryption algorithm for data at rest and disable TLS to improve performance.
   • BUse only a VPN for data in transit and rely on the cloud provider's physical security for data at rest.
   • CEncrypt data at rest only, because data in transit is not a concern in a public cloud.
   • DUse TLS 1.2 or higher for all data in transit and enable server-side encryption for data at rest using a cloud KMS.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company's SIEM generates a high volume of alerts, many of which are false positives. The security team is overwhelmed and may miss real incidents. They want to improve the effectiveness of their monitoring. What should they do FIRST?

   • ATune the SIEM rules to reduce false positives and prioritize alerts based on risk.
   • BIncrease the number of alerts by adding more data sources.
   • CDisable all alerts and rely on manual log reviews.
   • DHire more security analysts to review all alerts manually.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company's cloud environment has just experienced a ransomware attack that encrypted several VMs. The incident response team needs to contain the spread and begin recovery. Which action should they take FIRST?

   • AIsolate the affected VMs from the network to prevent lateral movement.
   • BImmediately restore all VMs from the latest backup without investigating the attack vector.
   • CPay the ransom to quickly regain access to the encrypted data.
   • DDelete all logs to remove any trace of the attacker's activity.
   Reveal Solution Discussion Select an answer first