CAS-004 Cheat Sheet

#	Domain	Weight	Questions	Practice
1.0	Security Architecture Secure architecture questions test IAM policies, VPC security controls, encryption at rest and in transit, and the right AWS security service for a given threat.	—	76	Practice →
2.0	Security Operations Security Operations questions on this certification test your ability to deploy and manage security operations concepts in scenario-based situations.	—	65	Practice →

Domain

Weight

Questions

Practice

1.0

Security Architecture

Secure architecture questions test IAM policies, VPC security controls, encryption at rest and in transit, and the right AWS security service for a given threat.

—

Practice →

2.0

Security Operations

Security Operations questions on this certification test your ability to deploy and manage security operations concepts in scenario-based situations.

—

Practice →

Domain Quick Reference

1.0Security Architecture

Secure architecture questions test IAM policies, VPC security controls, encryption at rest and in transit, and the right AWS security service for a given threat.

Key concepts

✓IAM policies: identity-based, resource-based, permission boundaries.
✓VPC security: security groups vs NACLs, route tables, VPC endpoints.
✓Encryption: KMS, SSE-S3, SSE-KMS, client-side encryption.
✓AWS security services: GuardDuty, Inspector, Macie, Shield, WAF.

Watch out for

⚠Security groups are stateful; NACLs are stateless.
⚠KMS manages keys; it does not encrypt data directly.
⚠GuardDuty detects threats; Inspector assesses vulnerabilities; Macie finds sensitive data.
⚠A VPC endpoint keeps traffic off the public internet; it does not encrypt traffic.

2.0Security Operations

Security Operations questions on this certification test your ability to deploy and manage security operations concepts in scenario-based situations.

Key concepts

✓Core Security Operations concepts and how they apply in real-world cloud scenarios.
✓How to deploy security operations correctly and verify the outcome.
✓Troubleshooting security operations issues by interpreting error output and system state.
✓Cloud best practices and Security Operations design trade-offs tested by this certification.

Watch out for

⚠Selecting the most expensive service when a simpler managed option meets the requirement.
⚠Forgetting that cloud resources must be explicitly secured — defaults are rarely secure.
⚠Choosing a global service fix when the issue is region-specific.
⚠Overlooking cost implications of cross-region data transfer in architecture questions.

Exam Day Reminders

→Read every question stem fully — look for qualifiers like 'MOST likely,' 'BEST,' or 'EXCEPT.'

→Flag uncertain questions and come back — don't waste time on one question.

→Eliminate obviously wrong options first, then choose between remaining ones.

→Trust your first instinct unless you have a specific reason to change.

→For CAS-004, scenarios typically have one clearly best answer — look for the option that matches the specific constraints in the question.

#	Domain	Weight	Questions	Practice
1.0	Security Architecture Secure architecture questions test IAM policies, VPC security controls, encryption at rest and in transit, and the right AWS security service for a given threat.	—	76	Practice →
2.0	Security Operations Security Operations questions on this certification test your ability to deploy and manage security operations concepts in scenario-based situations.	—	65	Practice →

Domain

Weight

Questions

Practice

1.0

Security Architecture

Secure architecture questions test IAM policies, VPC security controls, encryption at rest and in transit, and the right AWS security service for a given threat.

—

Practice →

2.0

Security Operations

Security Operations questions on this certification test your ability to deploy and manage security operations concepts in scenario-based situations.

—

Practice →

Domain Quick Reference

1.0Security Architecture

Secure architecture questions test IAM policies, VPC security controls, encryption at rest and in transit, and the right AWS security service for a given threat.

Key concepts

✓IAM policies: identity-based, resource-based, permission boundaries.
✓VPC security: security groups vs NACLs, route tables, VPC endpoints.
✓Encryption: KMS, SSE-S3, SSE-KMS, client-side encryption.
✓AWS security services: GuardDuty, Inspector, Macie, Shield, WAF.

Watch out for

⚠Security groups are stateful; NACLs are stateless.
⚠KMS manages keys; it does not encrypt data directly.
⚠GuardDuty detects threats; Inspector assesses vulnerabilities; Macie finds sensitive data.
⚠A VPC endpoint keeps traffic off the public internet; it does not encrypt traffic.

2.0Security Operations

Security Operations questions on this certification test your ability to deploy and manage security operations concepts in scenario-based situations.

Key concepts

✓Core Security Operations concepts and how they apply in real-world cloud scenarios.
✓How to deploy security operations correctly and verify the outcome.
✓Troubleshooting security operations issues by interpreting error output and system state.
✓Cloud best practices and Security Operations design trade-offs tested by this certification.

Watch out for

⚠Selecting the most expensive service when a simpler managed option meets the requirement.
⚠Forgetting that cloud resources must be explicitly secured — defaults are rarely secure.
⚠Choosing a global service fix when the issue is region-specific.
⚠Overlooking cost implications of cross-region data transfer in architecture questions.

Exam Day Reminders

→Read every question stem fully — look for qualifiers like 'MOST likely,' 'BEST,' or 'EXCEPT.'

→Flag uncertain questions and come back — don't waste time on one question.

→Eliminate obviously wrong options first, then choose between remaining ones.

→Trust your first instinct unless you have a specific reason to change.

→For CAS-004, scenarios typically have one clearly best answer — look for the option that matches the specific constraints in the question.

CAS-004 Exam Blueprint — At a Glance

Domain Quick Reference

1.0Security Architecture

2.0Security Operations

Exam Day Reminders

More CAS-004 resources

CAS-004 Cheat Sheet

CAS-004 Exam Blueprint — At a Glance

Domain Quick Reference

1.0Security Architecture

2.0Security Operations

Exam Day Reminders

More CAS-004 resources