Security Incidents CV0-004 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which cloud activity is a common sign of privilege escalation?

   • AAn application suddenly attempting to access resources outside its normal scope.
   • BA user logging in from a new geographic location.
   • CA user receiving a 'password expired' notification.
   • DA user consistently accessing the same resources at the same time each day.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company is designing a new cloud environment and wants to implement strong controls to prevent privilege escalation. They have a mix of human users and automated services. The security team is concerned about a compromised service account being used to escalate privileges. Which combination of controls would be MOST effective?

   • AGrant all users 'Contributor' access and rely on audit logs
   • BUse strong passwords for service accounts and require MFA for all users
   • CUse managed identities for services, enforce conditional access policies, and implement just-in-time (JIT) access for administrative roles
   • DUse a single service account for all automated tasks and rotate its password monthly
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security analyst is configuring alerts for privilege escalation. The organization uses a cloud environment with many users and complex role assignments. The analyst wants to minimize false positives while still detecting real threats. Which alert configuration is BEST?

   • AAlert on any login from a new IP address
   • BAlert on any password change for a user with administrative privileges
   • CAlert on any access to a sensitive resource
   • DAlert on any change to a role assignment that grants administrative privileges, and require a secondary approval for such changes
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   A cloud administrator discovers that a service account's credentials were leaked in a public code repository. Which action is the MOST effective immediate mitigation to prevent unauthorized use of the leaked credentials?

   • AIncrease the permissions of the service account to monitor its activity.
   • BDelete the public repository that contains the credentials.
   • CRotate the service account's credentials immediately.
   • DAdd the repository URL to a blocklist in the cloud provider's firewall.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company is developing an incident response plan for security breaches. They want to ensure that the plan includes steps to detect and respond to leaked credentials and privilege escalation. Which component is essential for the plan?

   • AA schedule for quarterly security awareness training
   • BA clear chain of command and communication plan
   • CA backup of the production database
   • DA list of all employees' personal phone numbers
   Reveal Solution Discussion Select an answer first