Security Incidents CV0-004 Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security audit reveals that a cloud environment has a large number of custom roles with overlapping permissions. This has led to confusion and some users having more permissions than intended. The organization wants to simplify access control and reduce the risk of privilege escalation. What is the BEST approach?

   • AConsolidate custom roles into a smaller number of well-defined roles based on job functions
   • BAssign all users the 'Owner' role to simplify management
   • CDelete all custom roles and use only built-in roles
   • DKeep the custom roles but add more documentation
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company has a policy that requires all cloud access to use multi-factor authentication (MFA). However, a legacy application does not support MFA. The application uses a service account with high privileges. What is the best way to mitigate the risk of credential leakage for this service account?

   • AStore the service account password in a shared spreadsheet for easy access
   • BRotate the service account password every year
   • CDisable the service account and use a user account with MFA
   • DRestrict the service account's permissions to the minimum required and use conditional access policies to limit where it can be used
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A security analyst is investigating a potential credential leak. A developer's API key was found in a public code repository. The key has permissions to read and write to a production database. The analyst also notices that the database has been accessed from an unknown IP address. The organization has a strict policy that production data must not be exposed. What is the MOST appropriate immediate action?

   • ADisable the developer's account and create a new one
   • BContact the developer to ask if they shared the key intentionally
   • CDelete the public repository and change the database password
   • DRevoke the API key, rotate the database credentials, and review database access logs
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which practice is MOST effective in improving access control policies to prevent privilege escalation?

   • ADisabling audit logs to reduce storage costs.
   • BConducting regular access reviews to remove unnecessary permissions.
   • CUsing the same password for all administrative accounts.
   • DGranting permanent administrative access to all users to avoid delays.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   During a security incident, a cloud administrator discovers that an attacker used leaked credentials to access a storage account and then used those credentials to create a new administrative account. According to incident response best practices, what should the administrator do after containing the incident?

   • AImmediately return to normal operations
   • BNotify the cloud provider of the incident
   • CDocument the incident, including the attack vector, actions taken, and lessons learned
   • DDelete the attacker's administrative account and restore the storage account
   Reveal Solution Discussion Select an answer first