CAS-004 Practice Test 1 — 10 Questions

Question 1

Which TWO of the following are key elements of a data classification policy?

Accepted Answer

Handling and labeling procedures. Handling and labeling procedures (Option A) are a key element of a data classification policy because they define the operational steps for marking, storing, transmitting, and disposing of data based on its classification level. Without these procedures, classification categories have no enforceable controls, leading to inconsistent data protection. This aligns with NIST SP 800-53 and ISO 27001 requirements for data handling.

Answer

Acceptable use guidelines for company devices

Answer

Backup frequency and retention periods

Answer

Encryption algorithms and key lengths

Question 2

Which of the following is a primary purpose of using code signing for application deployment?

Accepted Answer

To verify the integrity and authenticity of the code. Code signing uses a digital signature (typically RSA or ECDSA) to bind the publisher's identity to the code. The primary purpose is to verify both the integrity (the code has not been tampered with) and the authenticity (the code comes from a trusted source) before deployment. This is achieved by hashing the code and signing the hash with the publisher's private key; the recipient verifies the signature using the publisher's public certificate.

Answer

To encrypt the application code

Answer

To prevent reverse engineering

Answer

To speed up application deployment

Question 3

A company requires a cryptographic hash function for integrity verification of large files. The solution must be resistant to length extension attacks and provide high performance. Which of the following is the best choice?

Accepted Answer

SHA-3. SHA-3 is not vulnerable to length extension attacks and offers good performance. SHA-256 is vulnerable to length extension. BLAKE3 is fast but less standardized. MD5 is broken and insecure.

Answer

BLAKE3

Answer

SHA-256

Answer

MD5

Question 4

Which of the following is a primary function of a Cloud Access Security Broker (CASB)?

Accepted Answer

Enforce security policies between users and cloud applications. A CASB acts as an intermediary between users and cloud services, enforcing security policies such as access control, data loss prevention, and visibility into cloud application usage.

Answer

Scan container images for vulnerabilities

Answer

Provide IAM for cloud infrastructure

Answer

Monitor network traffic at the packet level

Question 5

A multinational organization is adopting a zero trust architecture and needs to align its network segmentation with regulatory requirements. The compliance team has identified that certain data must be isolated to meet PCI DSS scope reduction. Which of the following design approaches BEST supports both zero trust and PCI DSS compliance?

Accepted Answer

Implementing microsegmentation with software-defined networking. Microsegmentation with software-defined networking (SDN) enables granular, identity-aware isolation of workloads at the virtual network layer, which directly supports zero trust's 'never trust, always verify' principle by restricting lateral movement. For PCI DSS scope reduction, microsegmentation allows the organization to create a logical, auditable boundary around cardholder data environment (CDE) assets without relying on physical network topology, thereby reducing the scope of PCI DSS compliance assessments. This approach is superior because it provides dynamic, policy-driven segmentation that can adapt to regulatory changes while maintaining strict least-privilege access.

Answer

Deploying VLANs to separate cardholder data from other traffic

Answer

Using network access control (NAC) to enforce endpoint compliance

Answer

Placing all systems that process cardholder data in a DMZ

Question 6

A company is implementing a hardware security module (HSM) to protect cryptographic keys. The security architect must ensure the solution meets FIPS 140-2 Level 3 requirements. Which TWO of the following features are required for Level 3?

Accepted Answer

Tamper-evident coatings and seals. FIPS 140-2 Level 3 requires tamper-evident coatings and seals (Option B) to provide physical evidence of tampering attempts. Additionally, identity-based authentication for operators (Option C) is mandated at Level 3, moving beyond simple role-based authentication to ensure each operator is uniquely identified and authenticated before accessing the HSM.

Answer

Role-based authentication only

Answer

Ability to export keys in plaintext

Answer

Tamper resistance with automatic zeroization

Question 7

An analyst wants to automate incident response tasks in a SOC environment. Which THREE scripting languages are commonly used for automation? (Choose three.)

Accepted Answer

Python. Python is correct because it is a versatile, high-level scripting language widely used in SOC automation for tasks such as parsing logs, interacting with REST APIs, and orchestrating incident response workflows. Its extensive libraries (e.g., requests, pandas, and boto3 for AWS) and cross-platform support make it ideal for automating repetitive security operations tasks.

Answer

Java

Answer

COBOL

Question 8

An application uses a relational database and constructs SQL queries by concatenating user input. Which secure coding practice should be implemented to mitigate SQL injection?

Accepted Answer

Implement parameterized queries / prepared statements. Parameterized queries (prepared statements) separate SQL logic from user data by using placeholders (e.g., `?` in MySQLi or `:param` in PDO). The database driver automatically escapes the input values, ensuring they are treated as data, not executable code. This directly prevents SQL injection because the query structure is fixed before user input is bound.

Answer

Use stored procedures exclusively

Answer

Escape all user input with a database-specific escaping function

Answer

Use an ORM (Object-Relational Mapping) framework

Question 9

Which TWO of the following are valid methods for securing REST APIs? (Select TWO.)

Accepted Answer

OAuth 2.0 tokens. OAuth 2.0 tokens (B) are a standard method for securing REST APIs by providing delegated, scoped access without exposing user credentials. The client presents a bearer token (typically a JSON Web Token) in the Authorization header, which the API server validates to authorize the request. This aligns with RFC 6749 and is widely adopted for stateless, scalable API security.

Answer

LDAP binds

Answer

SAML assertions

Answer

Kerberos tickets

Question 10

Refer to the exhibit. A web server is unable to connect to a local database socket. Which of the following actions would MOST likely resolve this issue?

Accepted Answer

Add an SELinux policy module to allow httpd_t to connectto unconfined_t. The web server (httpd_t) is denied access to the local database socket because SELinux enforces mandatory access controls. Adding an SELinux policy module that allows httpd_t to connect to unconfined_t (the domain of the database socket) grants the necessary permission without disabling security. This is the targeted fix that preserves SELinux protection while resolving the connectivity issue.

Answer

Disable SELinux entirely

Answer

Restart the httpd service

Answer

Change the SELinux enforcing mode to permissive