CompTIA Cloud+ (CV0-004) — All Questions

Which principle states that a user or service should be granted only the permissions required to perform its function and nothing more?

• a.Defense in depth
• b.Separation of duties
• c.Least privilege✓
• d.Non-repudiation

Least privilege limits each identity to the minimum access needed, shrinking the attack surface if credentials are compromised. Defense in depth layers controls, separation of duties splits responsibilities, and non-repudiation ensures actions cannot be denied.

To protect data as it travels between a client and a cloud API endpoint, which control is most appropriate?

• a.Transport Layer Security (TLS) encryption in transit✓
• b.Full-disk encryption on the storage array
• c.A longer object retention policy
• d.Enabling verbose application logging

TLS encrypts data in transit so it cannot be read or tampered with as it crosses the network. Full-disk encryption protects data at rest, not in transit, and retention policies and logging do not provide confidentiality on the wire.

A cloud security team wants to require a second authentication factor for all administrative logins. Which control should they implement?

• a.Single sign-on with no additional factors
• b.Multi-factor authentication (MFA)✓
• c.A shared administrator password
• d.IP allow-listing only

Multi-factor authentication requires an additional factor beyond the password, greatly reducing the impact of stolen credentials. Shared passwords remove accountability, and IP allow-listing alone does not verify the identity of the person logging in.

Which service concept lets an organization centrally create, rotate, and control access to the cryptographic keys used to encrypt cloud data?

• a.A content delivery network
• b.A load balancer
• c.An object lifecycle policy
• d.A key management service (KMS)✓

A key management service centralizes creation, rotation, and access control for encryption keys, supporting compliance and separation of duties. CDNs, load balancers, and lifecycle policies serve delivery, distribution, and retention purposes, not key management.