Vulnerability Management CV0-004 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a key consideration when applying patch management in a cloud environment?

   • APatches are automatically applied by the cloud provider to all customer VMs
   • BPatches should be applied immediately without testing to reduce risk
   • CPatching must be coordinated with the cloud provider's maintenance windows
   • DPatch management is not necessary in the cloud because the provider handles all security
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company wants to ensure that all cloud resources are tagged with the appropriate owner and cost center. The security team also wants to use these tags to enforce security policies. What should they implement?

   • AA cloud security posture management (CSPM) tool that only reports on security misconfigurations
   • BA tagging policy enforced through infrastructure-as-code templates
   • CA monitoring tool that alerts when tags are missing
   • DA manual tagging process that requires administrators to add tags after deployment
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security team needs to assess the vulnerability posture of a set of virtual machines (VMs) running in a private cloud. The VMs are not exposed to the internet, and the team wants to minimize network overhead. Which approach is most appropriate?

   • AConduct a manual review of the VM images in the golden image repository
   • BDeploy an agent-based vulnerability scanner on each VM
   • CUse a cloud-native configuration review tool that only checks VM templates
   • DPerform an external network scan from the corporate headquarters
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which technique is commonly used to assess vulnerabilities in a cloud environment without affecting production workloads?

   • ARunning a full port scan on all production IP addresses during business hours
   • BUsing a vulnerability scanner that only checks for known CVEs in installed software
   • CDisabling security groups and network ACLs to allow unrestricted scanning
   • DDeploying a separate scanning environment that mirrors the production configuration
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company that processes credit card data must ensure its cloud environment meets PCI DSS requirements. The security team needs to continuously monitor and report on compliance. What should they implement?

   • AA cloud security posture management (CSPM) tool with compliance packs for PCI DSS
   • BA vulnerability scanner that only checks for missing patches
   • CA manual audit performed annually by an external auditor
   • DA network firewall that restricts access to the cardholder data environment
   Reveal Solution Discussion Select an answer first