Study Hub / CompTIA Cloud+ (CV0-004) / Domain 4.0
CompTIA Cloud+ (CV0-004) Domain 4.0: Security — Explained
Domain 4.0 is security in the cloud: identity as the perimeter, encryption everywhere it matters, network controls, and the compliance frameworks that decide what "secure enough" means. The shared-responsibility model underpins all of it.
Identity: the new perimeter
- IAM — users, groups, roles, and policies: who can do what to which resource. Roles (assumed temporarily) beat long-lived user credentials for services and cross-account access.
- Least privilege — grant only the permissions the task needs, nothing more. Every excessive permission is breach blast radius waiting to happen.
- MFA everywhere that matters — especially root/admin accounts and console access. A stolen password without the second factor is just a password.
- Federation and SSO — one corporate identity (SAML/OIDC) logging into cloud consoles — no separate cloud passwords to phish, centralized deprovisioning when people leave.
- Key management — KMS/HSM-backed keys, rotation policies, and envelope encryption. Know where keys live and who can use them — key sprawl is a breach vector.
Encryption and data protection
- At rest vs. in transit — encrypt stored data (EBS volumes, S3 objects, databases) and moving data (TLS everywhere). One without the other is half a control.
- Customer-managed keys — provider-managed encryption is the baseline; bringing your own keys (BYOK/HYOK) adds control for regulated data — and the responsibility of not losing them.
- Data classification — public, internal, confidential, restricted: classification drives which controls apply. You can't protect what you haven't classified.
- DLP and discovery — find sensitive data (it's always somewhere unexpected), then prevent its exfiltration. Classification without discovery is a label on a fraction of the data.
Network security and compliance
- Segmentation — public/private subnets, security groups (stateful, instance-level), NACLs (stateless, subnet-level). The database subnet has no route to the internet — by design, not accident.
- WAF and DDoS protection — WAF filters application attacks (SQLi, XSS) at the edge; provider DDoS shields absorb volumetric floods. Different layers, both needed for public apps.
- Compliance frameworks — SOC 2 (service trust), PCI DSS (card data), HIPAA (health data), GDPR (EU personal data), ISO 27001 (security management). Know which regulates what data.
- Shared responsibility, precisely — the provider secures the cloud (facilities, hypervisor); you secure what's in it (your data, identities, configs). Most cloud breaches are customer-side misconfigurations — the model working as documented.
- Auditing — cloud trail/audit logs recording every API call: who did what, when. Immutable, centralized, and reviewed — the detective control everything else leans on.
The must-memorize table: cloud security controls
Which control for which threat.
| Control | Protects against | Layer |
|---|---|---|
| MFA | Stolen/phished credentials | Identity |
| Encryption at rest | Stolen disks, breached storage | Data |
| TLS | Eavesdropping, MITM | Data in transit |
| Security groups | Unwanted instance traffic | Network (stateful) |
| WAF | App-layer attacks (SQLi, XSS) | Edge/application |
| Cloud audit logs | Undetected malicious admin actions | Detective |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. A company's developers share one IAM user with admin rights "for simplicity." What are the two core violations?
- A. A. None — sharing reduces license costs
- B. B. No individual accountability and massive violation of least privilege — use individual identities with scoped roles
- C. C. IAM users can't have admin rights
- D. D. Developers shouldn't use the cloud
Show answer & reasoning
B. Shared credentials destroy accountability (whose key did the damage?) and admin-for-everyone destroys least privilege (every compromised dev laptop = full environment). Individual identities + roles + MFA is the baseline to aim for. "Simplicity" here is shared liability.
2. Regulated health data must be encrypted with keys the company fully controls and can revoke, not provider-managed keys. What is required?
- A. A. TLS — that's sufficient
- B. B. Customer-managed keys (BYOK) via KMS/HSM, with rotation and revocation under company control
- C. C. Security groups
- D. D. A longer password policy
Show answer & reasoning
B. BYOK moves key control to the customer: the company generates, rotates, and can revoke keys independently of the provider — the compliance requirement behind "we control our encryption." TLS (A) protects transit, not storage; network controls (C) are a different layer entirely.
3. A database in a private subnet must be reachable by app servers but never directly from the internet. Which design enforces this?
- A. A. Put the database in a public subnet with a strong password
- B. B. Private subnet with no internet route + security groups allowing only app-tier traffic
- C. C. Encrypt the database and put it anywhere
- D. D. Use a public IP but block ping
Show answer & reasoning
B. Layered: the subnet has no internet path (architectural impossibility of direct access) and security groups permit only the app tier (least privilege at the instance level). Encryption (C) protects data, not access; a public subnet with a password (A) is one guess away from exposure.
4. After a suspected compromise of an admin account, which detective control shows exactly what the account did?
- A. A. The billing dashboard
- B. B. Cloud audit logs — the immutable record of every API call (who, what, when)
- C. C. The load balancer metrics
- D. D. DNS query logs only
Show answer & reasoning
B. CloudTrail-style audit logs record every API action with identity and timestamp — the authoritative timeline for "what did this account touch?" Billing (A) shows cost, not actions; DNS (D) shows lookups, not control-plane changes. First move in a cloud IR: pull the audit trail.
This was one domain. The simulator drills all 6.
This free preview covered Security (Domain 4.0, 19%). Not covered here: Operations (Domain 3.0, 17%); Troubleshooting (Domain 6.0, 12%). Cloud operations and scenario troubleshooting stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full Cloud+ Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy