Security Incidents CV0-004 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security audit reveals that many users have 'Contributor' access to a production subscription, but their job roles only require read access to specific resources. The organization wants to improve its access control policies to reduce the risk of unauthorized changes. What is the best course of action?

   • AConduct a role review and reassign users to custom roles with only the permissions they need
   • BRemove all users from the subscription and grant access only when needed
   • CCreate a new subscription for each user
   • DKeep the current assignments but enable multi-factor authentication
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst is reviewing cloud activity logs and notices that a user account is logging in from a new geographic location at unusual hours, and the account has recently been granted administrative privileges. What is the MOST likely explanation?

   • AThe cloud provider performed a routine maintenance that changed the user's permissions
   • BThe account's credentials were leaked and are being used by an attacker who also escalated privileges
   • CThe user is traveling for work and requested the admin role for a project
   • DThe user's account was locked out and they used a backup account
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which measure is MOST effective in preventing privilege escalation in a cloud environment?

   • AUsing shared accounts for all administrators.
   • BImplementing the principle of least privilege.
   • CGranting all users administrative access to simplify management.
   • DDisabling security logging to reduce system overhead.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A security analyst notices that a standard user account has been added to the 'Domain Admins' group. Which type of security incident does this indicate?

   • AA privilege escalation attempt.
   • BA data exfiltration incident.
   • CA phishing attack.
   • DA denial-of-service attack.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An administrator is configuring alerts for potential privilege escalation. Which alert condition is MOST indicative of a privilege escalation attack?

   • AA user accesses a resource they have accessed before
   • BA user changes their password
   • CA user logs in from a new device
   • DA user account is added to an administrative group outside of normal business hours
   Reveal Solution Discussion Select an answer first