Security

CV0-004 · 57 questions

• A county security team is defining vulnerability scan coverage for an internet-facing tax portal and a private admin VPC. What scanning approach fits the environments?
• A weekly vulnerability scan of the city's permitting API hosts reports several outdated application libraries. Which vulnerability-management activity does that report represent?
• A metro cloud security review produces dozens of findings on citizen services. How should the team decide what to fix first?
• After prioritizing vulnerabilities on a parks recreation API, what remediation outcomes are appropriate for the operations and security teams?
• A published advisory assigns an identifier to a known flaw in the firmware version running on the city's VPN concentrators. How should the security team track that flaw?
• A rushed admin wants to push every available patch to all county cloud hosts tonight without reviewing findings. Why is that approach poor vulnerability management?
• Agent-based vulnerability scanners miss several city-issued laptops that are powered off during the scan window. What does this illustrate about scan scope?
• Engineers patched a CVE on the water-billing API hosts. What should they do to confirm remediation?
• A European sister-city partnership stores resident records that law says must remain inside that country's borders. What constraint should guide cloud region selection?
• The city moves citizen service requests into a SaaS help-desk product. Who remains accountable for how that citizen data is classified and shared?
• A public-safety analytics contract requires all related datasets to remain within a named metropolitan area. Which placement requirement is that?
• Open park event photos and sealed juvenile justice records land in the same cloud account. Why must they be handled differently?
• A lawsuit against the transit authority triggers a litigation hold on related email and ticket logs that were otherwise due for deletion. What should happen to the retention schedule?
• A managed-security vendor contract requires the city to keep related audit logs for seven years. What obligation does that create?
• State records law mandates multi-year retention for certain permitting decisions regardless of the IT team's preferred storage tier. What type of requirement is that?
• A city portal that accepts credit cards for recreation fees must protect cardholder data. Which industry standard should the design align with?
• Leadership wants an annual independent report that shows stakeholders how the city's cloud security controls are designed and operating. Which approach fits that goal?
• Infrastructure automation must create municipal cloud resources without an operator clicking the web console each time. What IAM capability enables that?
• Cloud admins want to manage the city's subscriptions from a terminal with provider command-line tools and scripts. What must IAM provide?
• Day-to-day operators use the cloud provider's browser console, while emergency break-glass accounts are reserved for outages. How should IAM treat these paths?
• Linux engineers SSH to jump targets and Windows admins use RDP for city servers. What secure access practice should apply?
• Private admin subnets hold management interfaces with no direct public IPs. How should engineers reach those hosts?
• City Active Directory users need to sign into the cloud management console without maintaining a separate password for every provider account. What IAM approach enables that?
• A city cloud console requires staff to approve a push notification or enter a one-time code after their password before opening the management portal. Which control is the municipality enforcing?
• A county mobile permitting app obtains short-lived access tokens from an identity service instead of embedding long-lived passwords in the client binary. Which authentication pattern is the team applying?
• A municipal cloud team assigns permissions by job role—billing viewer, network admin, backup operator—rather than writing unique ACL entries for every individual user. Which access model are they implementing?
• A county IT department places staff into security groups such as PublicWorks-Admins and Finance-Readers so every member inherits the same cloud permissions. Which approach scales access management for the municipality?
• A citizen services app requests limited delegated access to a user's calendar-like scheduling resource using standard authorization flows without collecting the user's cloud password. Which protocol best fits this delegated authorization scenario?
• After a questionable change in the city's cloud management account, security needs to review who performed which actions last week. Which capability should they rely on?
• A municipal architecture board decides that no network location is trusted by default and that every request to cloud resources must be verified continuously. Which security approach are they adopting?
• A city wants recognized hardening guides to baseline operating system and cloud configuration settings before production cutover. Which reference source best matches that need?
• Besides general industry guides, the parks department's PaaS database offers a vendor-published security baseline tailored to that managed service. What should the operations team do?
• Before publishing golden images for citizen-facing VMs, a city removes unnecessary services, closes unused ports, and disables default accounts. What is the primary security goal of these steps?
• TLS protects citizen browser sessions to the permitting portal, while volume encryption protects data stored on attached disks. Which statement correctly contrasts these controls?
• Developers discover API keys and database passwords checked into a municipal Git repository. What is the recommended remediation pattern for ongoing secret handling?
• A city's public APIs must validate caller tokens, throttle abusive clients, and avoid error messages that reveal internal stack traces. Which set of practices does this describe?
• A short-term contractor supporting one GIS project is granted only the permissions required for that project instead of standing admin rights 'just in case.' Which principle is the city following?
• Containerized microservices for a 311 intake API should avoid running as root and should use tight filesystem permissions inside the image. Which hardening choice aligns with that goal?
• Object buckets holding citizen PII must block public ACLs, and municipal file shares must require authenticated access only. Which storage security stance is correct?
• Managed laptops used by staff who administer cloud control planes need malware protection and full-disk encryption. Which control category addresses those device requirements?
• Outbound email and file uploads that contain Social Security numbers from municipal systems should be blocked or alerted. Which security control primarily addresses that requirement?
• Network sensors in front of cloud workloads detect exploit traffic and can block matching attack patterns. Which controls fill those detect and block roles?
• A volumetric flood saturates links toward the city's public citizen portal. Which control is best positioned to absorb that attack at provider scale?
• Cloud IAM policies for the city deny wildcard administrator actions and require MFA before privileged roles can be assumed. What do these settings exemplify?
• Subnet-level rules in a municipal VPC allow only specific ports between the web, application, and data tiers. Which control operates at that subnet scope?
• HTTPS citizen applications need filtering against common Layer 7 web exploits such as injection and abusive bots. Which control is designed for that HTTP(S) application layer?
• Instance-level allow and deny rules restrict which peers can reach a virtual machine's network interface in a city VPC. Which control matches that description?
• A municipal security design stacks a WAF, network security groups, and IAM policies rather than depending on a single control. What principle does this architecture illustrate?
• A city IT team is hardening two workloads: a public static website for park permits and a private database holding citizen payment records. Which control pairing best matches exposure and data sensitivity?
• A county cloud operations desk wants early warning when audit API calls and VPC flow patterns look abnormal across multi-cloud accounts. Which approach best supports detecting suspicious activity?
• A municipal identity console shows a surge of successful logins at 3 a.m. from a country the city has never used for remote work, far above the normal overnight baseline. What detection idea does this illustrate?
• During a weekly cloud posture scan, a city engineer finds a security group that allows SSH from 0.0.0.0/0 to a management subnet. Why is this finding important for attack monitoring?
• A utility billing API in the city’s cloud is breached after scanners find a known flaw in an outdated third-party library that patching tickets had delayed for months. Which attack path does this describe?
• City employees receive urgent email messages claiming they must ‘reset your cloud password today’ via a link that does not match the official identity portal. What type of suspicious activity is this?
• A department file share synchronized to cloud object storage suddenly contains encrypted files and a ransom note demanding payment for decryption keys. Which malware impact scenario is this?
• Finance notices a sharp rise in compute spend on idle project accounts; investigation finds abandoned instances mining cryptocurrency after a compromised API key. What cloud-typical abuse does this illustrate?
• After a web application compromise, responders see outbound requests from the app tier to the instance metadata service collecting temporary cloud credentials. Which attack path should the city treat this as?