CompTIA CV0-004 Practice Test 69
Question 680
Before changing production at a regional health provider, an access key appears in a public code repository and cloud audit logs show unfamiliar resource creation. Which evidence should the engineer check first?
- Inspect handshake traces, client libraries and accepted cipher configuration.
- Inspect effective IAM policies, inherited roles, resource policies and public grants.
- Review assume-role trust, permission policies and activity logs.
- Inspect repository history, audit events, effective key permissions and resource changes.
Explanation
Correct Answer
D:Inspect repository history, audit events, effective key permissions and resource changes. This distinguishes the relevant dependency before changing cloud resources. Secrets disclosed in source must be treated as compromised even before misuse is fully proven.
Incorrect Answers
A:That approach would help when an updated cloud gateway rejects connections from a legacy service still negotiating obsolete cipher suites. Inspect repository history, audit events, effective key permissions and resource changes.
B:Inspect effective IAM policies, inherited roles, resource policies and public grants. The relevant cloud response here is: Inspect repository history, audit events, effective key permissions and resource changes.
C:Review assume-role trust, permission policies and activity logs. The relevant cloud response here is: Inspect repository history, audit events, effective key permissions and resource changes.
Question 681
The security administrator reviews a case where a workload role unexpectedly gains the right to change its own permissions and assume an administrator role. What should the team change first?
- Remove the escalation path and require separate approval for privilege delegation.
- Isolate the host, investigate installation provenance and restore an approved image.
- Revoke or rotate the key, investigate usage and replace it with scoped short-lived identity.
- Upgrade the client to supported TLS protocols and cipher suites without weakening the gateway.
Explanation
Correct Answer
A:Privilege escalation can result from indirect role-assumption chains, not only a visible administrator assignment. The change should be verified, not just applied: An attempted unauthorized role assumption fails while required workload actions succeed.
Incorrect Answers
B:That approach would help when a cloud VM unexpectedly runs a remote access agent not present in approved images and attempts outbound sessions. In this case, privilege escalation can result from indirect role-assumption chains, not only a visible administrator assignment.
C:Secrets disclosed in source must be treated as compromised even before misuse is fully proven. The relevant cloud response here is: Remove the escalation path and require separate approval for privilege delegation.
D:Modern endpoints reject deprecated cryptography to prevent known confidentiality and integrity risks. The relevant cloud response here is: Remove the escalation path and require separate approval for privilege delegation.
Question 682
A workload role unexpectedly gains the right to change its own permissions and assume an administrator role. What underlying cloud behavior should the engineer recognize?
- Unapproved agents can bypass intended management paths even when core OS services appear healthy.
- Privilege escalation can result from indirect role-assumption chains, not only a visible administrator assignment.
- Secrets disclosed in source must be treated as compromised even before misuse is fully proven.
- Authorization failures include excessive permission as well as denials, so effective policy must be evaluated.
Explanation
Correct Answer
B:The evidence of success is: An attempted unauthorized role assumption fails while required workload actions succeed.
Incorrect Answers
A:That approach would help when a cloud VM unexpectedly runs a remote access agent not present in approved images and attempts outbound sessions. Check the difference through: Review assume-role trust, permission policies and activity logs.
C:The alternative is aimed at a different condition: An access key appears in a public code repository and cloud audit logs show unfamiliar resource creation. It does not directly resolve the described failure. Privilege escalation can result from indirect role-assumption chains, not only a visible administrator assignment. Check the difference through: Review assume-role trust, permission policies and activity logs.
D:The proposed measure serves a related cloud task, but the present symptom calls for a more specific response. Privilege escalation can result from indirect role-assumption chains, not only a visible administrator assignment. Check the difference through: Review assume-role trust, permission policies and activity logs.
Question 683
During postchange validation at a global distribution company, a workload role unexpectedly gains the right to change its own permissions and assume an administrator role. What outcome would prove the intended safeguard works?
- The modernized client negotiates an approved cipher and vulnerable protocols remain disabled.
- The intern can access their assigned development objects but cannot list protected backups.
- An attempted unauthorized role assumption fails while required workload actions succeed.
- Running workloads use only allowlisted digests and rejected images generate audit events.
Explanation
Correct Answer
C:An attempted unauthorized role assumption fails while required workload actions succeed. This proves the service behavior rather than just showing a changed configuration. Privilege escalation can result from indirect role-assumption chains, not only a visible administrator assignment.
Incorrect Answers
A:That approach would help when an updated cloud gateway rejects connections from a legacy service still negotiating obsolete cipher suites. The required acceptance result is: An attempted unauthorized role assumption fails while required workload actions succeed.
B:The intern can access their assigned development objects but cannot list protected backups. The relevant cloud response here is: An attempted unauthorized role assumption fails while required workload actions succeed.
D:Running workloads use only allowlisted digests and rejected images generate audit events. The relevant cloud response here is: An attempted unauthorized role assumption fails while required workload actions succeed.
Question 684
A review identifies this symptom: a workload role unexpectedly gains the right to change its own permissions and assume an administrator role. Which read-only investigation is most useful?
- Compare registry digest, signed provenance, admission records and deployment manifest.
- Inspect repository history, audit events, effective key permissions and resource changes.
- Inspect effective IAM policies, inherited roles, resource policies and public grants.
- Review assume-role trust, permission policies and activity logs.
Explanation
Correct Answer
D:Review assume-role trust, permission policies and activity logs. This distinguishes the relevant dependency before changing cloud resources. Privilege escalation can result from indirect role-assumption chains, not only a visible administrator assignment.
Incorrect Answers
A:That approach would help when an application suddenly runs a different image digest than the one approved in its deployment manifest. In this case, privilege escalation can result from indirect role-assumption chains, not only a visible administrator assignment.
B:Inspect repository history, audit events, effective key permissions and resource changes. The relevant cloud response here is: Review assume-role trust, permission policies and activity logs.
C:Inspect effective IAM policies, inherited roles, resource policies and public grants. The relevant cloud response here is: Review assume-role trust, permission policies and activity logs.
Question 685
At a global distribution company, an updated cloud gateway rejects connections from a legacy service still negotiating obsolete cipher suites. Which response most directly addresses this specific cloud challenge?
- Upgrade the client to supported TLS protocols and cipher suites without weakening the gateway.
- Isolate the host, investigate installation provenance and restore an approved image.
- Remove inherited excessive grants and scope access to the required bucket operations.
- Remove the escalation path and require separate approval for privilege delegation.
Explanation
Correct Answer
A:Modern endpoints reject deprecated cryptography to prevent known confidentiality and integrity risks. The change should be verified, not just applied: The modernized client negotiates an approved cipher and vulnerable protocols remain disabled.
Incorrect Answers
B:That approach would help when a cloud VM unexpectedly runs a remote access agent not present in approved images and attempts outbound sessions. In this case, modern endpoints reject deprecated cryptography to prevent known confidentiality and integrity risks.
C:Authorization failures include excessive permission as well as denials, so effective policy must be evaluated. The relevant cloud response here is: Upgrade the client to supported TLS protocols and cipher suites without weakening the gateway.
D:Privilege escalation can result from indirect role-assumption chains, not only a visible administrator assignment. The relevant cloud response here is: Upgrade the client to supported TLS protocols and cipher suites without weakening the gateway.
Question 686
In a technical review for a regional health provider, an updated cloud gateway rejects connections from a legacy service still negotiating obsolete cipher suites. Which cloud principle is most relevant?
- Privilege escalation can result from indirect role-assumption chains, not only a visible administrator assignment.
- Modern endpoints reject deprecated cryptography to prevent known confidentiality and integrity risks.
- Authorization failures include excessive permission as well as denials, so effective policy must be evaluated.
- Unapproved agents can bypass intended management paths even when core OS services appear healthy.
Explanation
Correct Answer
B:The evidence of success is: The modernized client negotiates an approved cipher and vulnerable protocols remain disabled.
Incorrect Answers
A:That approach would help when a workload role unexpectedly gains the right to change its own permissions and assume an administrator role. Check the difference through: Inspect handshake traces, client libraries and accepted cipher configuration.
C:The alternative is aimed at a different condition: An intern can list confidential cloud backups after being assigned a broad inherited storage role. Check the difference through: Inspect handshake traces, client libraries and accepted cipher configuration.
D:The proposed measure serves a related cloud task, but the present symptom calls for a more specific response. Modern endpoints reject deprecated cryptography to prevent known confidentiality and integrity risks. Check the difference through: Inspect handshake traces, client libraries and accepted cipher configuration.
Question 687
The incident responder has addressed this condition: an updated cloud gateway rejects connections from a legacy service still negotiating obsolete cipher suites. Which observation verifies the outcome?
- The rebuilt host contains only approved packages and unexpected egress stops.
- The intern can access their assigned development objects but cannot list protected backups.
- The modernized client negotiates an approved cipher and vulnerable protocols remain disabled.
- An attempted unauthorized role assumption fails while required workload actions succeed.
Explanation
Correct Answer
C:The modernized client negotiates an approved cipher and vulnerable protocols remain disabled. This proves the service behavior rather than just showing a changed configuration. Modern endpoints reject deprecated cryptography to prevent known confidentiality and integrity risks.
Incorrect Answers
A:That approach would help when a cloud VM unexpectedly runs a remote access agent not present in approved images and attempts outbound sessions. The required acceptance result is: The modernized client negotiates an approved cipher and vulnerable protocols remain disabled.
B:The intern can access their assigned development objects but cannot list protected backups. The relevant cloud response here is: The modernized client negotiates an approved cipher and vulnerable protocols remain disabled.
D:An attempted unauthorized role assumption fails while required workload actions succeed. The relevant cloud response here is: The modernized client negotiates an approved cipher and vulnerable protocols remain disabled.
Question 688
During initial triage, an updated cloud gateway rejects connections from a legacy service still negotiating obsolete cipher suites. Which check best narrows down the cause?
- Review assume-role trust, permission policies and activity logs.
- Inspect repository history, audit events, effective key permissions and resource changes.
- Review process inventory, package signatures, startup persistence and egress logs.
- Inspect handshake traces, client libraries and accepted cipher configuration.
Explanation
Correct Answer
D:Inspect handshake traces, client libraries and accepted cipher configuration. This distinguishes the relevant dependency before changing cloud resources. Modern endpoints reject deprecated cryptography to prevent known confidentiality and integrity risks.
Incorrect Answers
A:That approach would help when a workload role unexpectedly gains the right to change its own permissions and assume an administrator role. Inspect handshake traces, client libraries and accepted cipher configuration.
B:Inspect repository history, audit events, effective key permissions and resource changes. The relevant cloud response here is: Inspect handshake traces, client libraries and accepted cipher configuration.
C:Review process inventory, package signatures, startup persistence and egress logs. The relevant cloud response here is: Inspect handshake traces, client libraries and accepted cipher configuration.
Question 689
For the affected cloud environment, a cloud VM unexpectedly runs a remote access agent not present in approved images and attempts outbound sessions. Which remedy best fits the requirement?
- Isolate the host, investigate installation provenance and restore an approved image.
- Remove the escalation path and require separate approval for privilege delegation.
- Block the unapproved digest and redeploy the verified image from a trusted registry.
- Remove inherited excessive grants and scope access to the required bucket operations.
Explanation
Correct Answer
A:Unapproved agents can bypass intended management paths even when core OS services appear healthy. The change should be verified, not just applied: The rebuilt host contains only approved packages and unexpected egress stops.
Incorrect Answers
B:That approach would help when a workload role unexpectedly gains the right to change its own permissions and assume an administrator role. In this case, unapproved agents can bypass intended management paths even when core OS services appear healthy.
C:Mutable tags and weak admission controls can permit supply-chain substitution at runtime. The relevant cloud response here is: Isolate the host, investigate installation provenance and restore an approved image.
D:Authorization failures include excessive permission as well as denials, so effective policy must be evaluated. The relevant cloud response here is: Isolate the host, investigate installation provenance and restore an approved image.
Question 690
The platform team at a regional health provider investigates this condition: a cloud VM unexpectedly runs a remote access agent not present in approved images and attempts outbound sessions. Which explanation best accounts for it?
- Secrets disclosed in source must be treated as compromised even before misuse is fully proven.
- Unapproved agents can bypass intended management paths even when core OS services appear healthy.
- Authorization failures include excessive permission as well as denials, so effective policy must be evaluated.
- Modern endpoints reject deprecated cryptography to prevent known confidentiality and integrity risks.
Explanation
Correct Answer
B:The evidence of success is: The rebuilt host contains only approved packages and unexpected egress stops.
Incorrect Answers
A:That approach would help when an access key appears in a public code repository and cloud audit logs show unfamiliar resource creation. Check the difference through: Review process inventory, package signatures, startup persistence and egress logs.
C:The alternative is aimed at a different condition: An intern can list confidential cloud backups after being assigned a broad inherited storage role. Unapproved agents can bypass intended management paths even when core OS services appear healthy.
D:The proposed measure serves a related cloud task, but the present symptom calls for a more specific response. Unapproved agents can bypass intended management paths even when core OS services appear healthy. Check the difference through: Review process inventory, package signatures, startup persistence and egress logs.