CAS-004 Security Architecture Practice Questions

Question 1

A security architect is designing a new DMZ for an e-commerce platform. The DMZ must host a web server, an API gateway, and a database server. The architect needs to minimize the attack surface while ensuring the web server can communicate with the API gateway, and the API gateway can communicate with the database. Which network segmentation approach best meets these requirements?

Accepted Answer

Create three separate DMZ subnets: one for the web server, one for the API gateway, and one for the database server, with firewall rules allowing only required traffic.. Option D is correct because it implements the principle of least privilege through network segmentation. By placing each service in its own DMZ subnet with firewall rules that allow only the required traffic (e.g., HTTP/HTTPS from web to API, SQL from API to database), the attack surface is minimized. This prevents lateral movement if one service is compromised, as an attacker cannot directly reach the database from the web server or the API gateway from the internet.

Answer

Place all three services in the same DMZ subnet and use host-based firewalls to restrict traffic.

Answer

Create two DMZ subnets: one for the web server and API gateway, and another for the database server.

Answer

Place the web server in a DMZ subnet, the API gateway in a separate DMZ subnet, and the database server on the internal network.

Question 2

An organization is implementing a zero trust architecture (ZTA). The security architect proposes using a software-defined perimeter (SDP) to replace the traditional VPN for remote access. Which of the following best describes the primary security benefit of SDP over VPN in a zero trust model?

Accepted Answer

It prevents unauthorized users from discovering the application infrastructure.. In a zero trust architecture, the primary security benefit of a software-defined perimeter (SDP) over a traditional VPN is that it hides the application infrastructure from unauthorized users. SDP uses a controller-based model where devices must authenticate and be authorized before they can even see the application servers, effectively creating a 'black cloud' that prevents discovery and reduces the attack surface. This aligns with the zero trust principle of 'never trust, always verify' and eliminates the network-level visibility that VPNs inherently provide to any connected client.

Answer

It provides deep packet inspection to detect malicious traffic.

Answer

It enforces multi-factor authentication for every session.

Answer

It reduces latency by establishing direct peer-to-peer connections.

Question 3

A security architect is evaluating cloud security architectures. The company requires that all data at rest in a public cloud object storage bucket be encrypted with a key that is managed by the company's own hardware security module (HSM) on-premises. Which encryption approach should the architect recommend?

Accepted Answer

Use client-side encryption where the application encrypts data before sending it to the cloud.. Option D is correct because client-side encryption ensures the data is encrypted by the application before it is sent to the cloud, using a key managed by the company's own on-premises HSM. This approach guarantees that the cloud provider never has access to the encryption key or the plaintext data, meeting the requirement that all data at rest in the public cloud object storage bucket be encrypted with a key managed by the company's own HSM.

Answer

Use envelope encryption where a cloud KMS wraps a data key, and the data key is used to encrypt the data.

Answer

Use server-side encryption with customer-provided keys (SSE-C).

Answer

Use server-side encryption with cloud provider-managed keys (SSE-S3).

Question 4

A security architect is designing a secure remote access solution for a global workforce. The company requires that all remote connections be authenticated using certificates issued by the company's internal PKI, and that the connection be encrypted and integrity-protected. Additionally, the solution must support IP-based network access control to restrict access to specific internal subnets based on the user's role. Which of the following should the architect recommend?

Accepted Answer

Deploy an IPsec VPN with certificate-based authentication and integrate with a RADIUS server for role-based access control.. Option D is correct because an IPsec VPN with certificate-based authentication satisfies the requirement for encrypted, integrity-protected connections using the company's internal PKI. Integrating with a RADIUS server enables role-based IP access control, allowing the VPN gateway to restrict access to specific internal subnets based on the user's role, which aligns with the need for IP-based network access control.

Answer

Deploy SSH tunneling with certificate-based authentication and configure iptables rules on the bastion host.

Answer

Deploy an SSL/TLS VPN using client certificates and rely on the VPN client to enforce access policies.

Answer

Deploy a RDP gateway with certificate authentication and restrict access via group policies.

Question 5

A security architect is reviewing the network architecture of a financial trading system. The system uses a time-sensitive order matching engine that must process trades with minimal latency. The architect is concerned about the risk of a DDoS attack on the matching engine. Which of the following architectural changes would best mitigate DDoS risk while preserving low latency?

Accepted Answer

Use a cloud-based DDoS scrubbing service that only forwards clean traffic to the on-premises matching engine.. A cloud-based DDoS scrubbing service (e.g., AWS Shield Advanced, Cloudflare Magic Transit) filters malicious traffic at the cloud edge before it reaches the on-premises matching engine. This preserves low latency because only clean, low-volume traffic is forwarded, and the scrubbing infrastructure is designed for high-throughput, low-latency processing without introducing inline inspection delays on the critical path.

Answer

Deploy an intrusion prevention system (IPS) in inline mode in front of the matching engine.

Answer

Move the matching engine to a cloud provider with elastic scalability.

Answer

Implement a reverse proxy with rate limiting and IP blacklisting.

Question 6

A security architect is designing a hybrid cloud environment where a web application hosted in AWS needs to securely access an on-premises database. The architect wants to minimize exposure to the internet and ensure encryption in transit. Which TWO techniques should the architect consider? (Choose two.)

Accepted Answer

Establish an IPsec VPN tunnel between the AWS VPC and the on-premises network.. Option A is correct because an IPsec VPN tunnel creates an encrypted, site-to-site connection between the AWS VPC and the on-premises network, ensuring encryption in transit and minimizing internet exposure by using the VPN gateway as the endpoint. Option B is correct because AWS Direct Connect provides a dedicated, private network connection that bypasses the internet entirely, reducing exposure and supporting encryption via optional MACsec or IPsec, while maintaining low latency and consistent bandwidth.

Answer

Store database credentials in AWS Secrets Manager and retrieve them at runtime.

Answer

Configure VPC peering between the AWS VPC and the on-premises network.

Answer

Configure the web application to connect to the database using TLS encryption.

Question 7

A security architect is planning the migration of a legacy application to a containerized microservices architecture on Kubernetes. The architect must ensure that the architecture supports secrets management, service-to-service authentication, and encryption of data in transit between microservices. Which THREE components should the architect include in the design? (Choose three.)

Accepted Answer

Deploy a TLS termination gateway (e.g., NGINX ingress) with certificate management.. Option A is correct because a TLS termination gateway (e.g., NGINX ingress) with certificate management provides encryption of data in transit between external clients and the Kubernetes cluster, fulfilling the requirement for encryption of data in transit at the edge. It terminates TLS at the ingress point, allowing secure HTTPS connections and centralized certificate lifecycle management.

Answer

Apply Kubernetes network policies to restrict pod-to-pod communication.

Answer

Configure RPM package signing for all container images.

Question 8

A security architect is designing a zero-trust network architecture for a hybrid cloud environment. The company uses on-premises servers and AWS. Which of the following best implements the principle of least privilege for inter-component communication?

Accepted Answer

Implement micro-segmentation with stateful firewalls and explicit allow rules between each workload.. Option B is correct because micro-segmentation with stateful firewalls and explicit allow rules enforces least privilege at the workload level, ensuring that only explicitly permitted inter-component traffic is allowed. This approach is fundamental to zero-trust architectures, as it reduces the attack surface by preventing lateral movement, even within the same subnet or VPC.

Answer

Deploy an SD-WAN with dynamic path selection and encryption for all inter-site traffic.

Answer

Use network ACLs on the cloud VPC and on-premises routers to deny all traffic by default, then allow required ports.

Answer

Deploy a site-to-site VPN and route all inter-component traffic through a VPN concentrator.

Question 9

A company is migrating from a legacy three-tier architecture to a microservices architecture on Kubernetes. The security team wants to ensure that service-to-service communication is encrypted and mutually authenticated. Which approach best meets these requirements with minimal operational overhead?

Accepted Answer

Implement a service mesh with mutual TLS (mTLS) and automatic certificate management.. A service mesh with mutual TLS (mTLS) and automatic certificate management is the correct approach because it provides encrypted, mutually authenticated service-to-service communication with minimal operational overhead. The service mesh (e.g., Istio, Linkerd) transparently intercepts traffic via sidecar proxies, handles mTLS handshakes, and automates certificate issuance and rotation, eliminating the need for manual key distribution or application-level changes.

Answer

Deploy IPsec tunnels between each pair of services using pre-shared keys.

Answer

Establish a site-to-site VPN between the Kubernetes cluster and the legacy network, and route all service traffic through the VPN.

Answer

Configure each service to use TLS with self-signed certificates, and distribute the CA certificate to all services.

Question 10

A security administrator needs to secure remote access for employees using personal devices. The company requires that company data be encrypted and that the device be wiped if lost. Which solution best meets these requirements?

Accepted Answer

Deploy a mobile device management (MDM) solution that enforces device encryption and supports remote wipe.. Mobile device management (MDM) solutions are specifically designed to enforce security policies on personal devices, including mandatory device encryption (e.g., AES-256 for data at rest) and the ability to perform a remote wipe (factory reset) to destroy company data if the device is lost or stolen. This directly addresses the requirement to protect company data on unmanaged, employee-owned devices.

Answer

Use network access control (NAC) to allow only compliant devices onto the network.

Answer

Require employees to connect via a corporate VPN and use two-factor authentication.

Answer

Implement remote desktop protocol (RDP) gateways for all remote access.

Security Architecture

CAS-004 Security Architecture — Key Topics

Where candidates lose marks on Security Architecture