CAS-004 Practice Test 1 — 10 Questions

Question 1

An organization is implementing a zero trust architecture (ZTA). The security architect proposes using a software-defined perimeter (SDP) to replace the traditional VPN for remote access. Which of the following best describes the primary security benefit of SDP over VPN in a zero trust model?

Accepted Answer

It prevents unauthorized users from discovering the application infrastructure.. In a zero trust architecture, the primary security benefit of a software-defined perimeter (SDP) over a traditional VPN is that it hides the application infrastructure from unauthorized users. SDP uses a controller-based model where devices must authenticate and be authorized before they can even see the application servers, effectively creating a 'black cloud' that prevents discovery and reduces the attack surface. This aligns with the zero trust principle of 'never trust, always verify' and eliminates the network-level visibility that VPNs inherently provide to any connected client.

Answer

It provides deep packet inspection to detect malicious traffic.

Answer

It enforces multi-factor authentication for every session.

Answer

It reduces latency by establishing direct peer-to-peer connections.

Question 2

A security architect is planning the migration of a legacy application to a containerized microservices architecture on Kubernetes. The architect must ensure that the architecture supports secrets management, service-to-service authentication, and encryption of data in transit between microservices. Which THREE components should the architect include in the design? (Choose three.)

Accepted Answer

Deploy a TLS termination gateway (e.g., NGINX ingress) with certificate management.. Option A is correct because a TLS termination gateway (e.g., NGINX ingress) with certificate management provides encryption of data in transit between external clients and the Kubernetes cluster, fulfilling the requirement for encryption of data in transit at the edge. It terminates TLS at the ingress point, allowing secure HTTPS connections and centralized certificate lifecycle management.

Answer

Apply Kubernetes network policies to restrict pod-to-pod communication.

Answer

Configure RPM package signing for all container images.

Question 3

An organization is deploying a new wireless network for employees and guests. The security policy requires that all wireless traffic be encrypted using AES-CCMP, and that clients must authenticate using 802.1X with EAP-TLS. Which of the following wireless security standards should be implemented?

Accepted Answer

WPA2-Enterprise. WPA2-Enterprise (D) is the correct choice because it supports AES-CCMP encryption and 802.1X authentication with EAP-TLS. WPA2-Enterprise uses a RADIUS server for centralized authentication, allowing per-user credentials via EAP methods, and mandates CCMP (AES-based) for data confidentiality and integrity, meeting all stated security policy requirements.

Answer

WPA2-Personal

Answer

WEP

Answer

WPA3-Enterprise

Question 4

A security architect is evaluating cloud security architectures. The company requires that all data at rest in a public cloud object storage bucket be encrypted with a key that is managed by the company's own hardware security module (HSM) on-premises. Which encryption approach should the architect recommend?

Accepted Answer

Use client-side encryption where the application encrypts data before sending it to the cloud.. Option D is correct because client-side encryption ensures the data is encrypted by the application before it is sent to the cloud, using a key managed by the company's own on-premises HSM. This approach guarantees that the cloud provider never has access to the encryption key or the plaintext data, meeting the requirement that all data at rest in the public cloud object storage bucket be encrypted with a key managed by the company's own HSM.

Answer

Use envelope encryption where a cloud KMS wraps a data key, and the data key is used to encrypt the data.

Answer

Use server-side encryption with customer-provided keys (SSE-C).

Answer

Use server-side encryption with cloud provider-managed keys (SSE-S3).

Question 5

A security architect is designing a zero-trust network architecture for a hybrid cloud environment. The company uses on-premises servers and AWS. Which of the following best implements the principle of least privilege for inter-component communication?

Accepted Answer

Implement micro-segmentation with stateful firewalls and explicit allow rules between each workload.. Option B is correct because micro-segmentation with stateful firewalls and explicit allow rules enforces least privilege at the workload level, ensuring that only explicitly permitted inter-component traffic is allowed. This approach is fundamental to zero-trust architectures, as it reduces the attack surface by preventing lateral movement, even within the same subnet or VPC.

Answer

Deploy an SD-WAN with dynamic path selection and encryption for all inter-site traffic.

Answer

Use network ACLs on the cloud VPC and on-premises routers to deny all traffic by default, then allow required ports.

Answer

Deploy a site-to-site VPN and route all inter-component traffic through a VPN concentrator.

Question 6

A security architect is reviewing the network security controls for a critical industrial control system (ICS) environment. The architect must select two controls that are most effective at preventing unauthorized access to the ICS network from the corporate IT network, while still allowing necessary monitoring traffic. Which TWO controls should be implemented? (Choose two.)

Accepted Answer

Deploy a unidirectional gateway (data diode) between the networks. A unidirectional gateway (data diode) physically enforces one-way data flow, ensuring that no traffic can originate from the corporate IT network into the ICS network. This prevents unauthorized access while allowing monitoring data (e.g., syslog, SNMP traps) to be sent out from the ICS side. It is the most effective control for preventing any inbound attack vectors while preserving outbound monitoring traffic.

Answer

Configure a site-to-site VPN from the corporate network to the ICS network

Answer

Implement a network-based intrusion prevention system (IPS) on the ICS network

Answer

Segment the networks using VLANs only

Question 7

A security architect is designing a secure remote access solution for a global workforce. The company requires that all remote connections be authenticated using certificates issued by the company's internal PKI, and that the connection be encrypted and integrity-protected. Additionally, the solution must support IP-based network access control to restrict access to specific internal subnets based on the user's role. Which of the following should the architect recommend?

Accepted Answer

Deploy an IPsec VPN with certificate-based authentication and integrate with a RADIUS server for role-based access control.. Option D is correct because an IPsec VPN with certificate-based authentication satisfies the requirement for encrypted, integrity-protected connections using the company's internal PKI. Integrating with a RADIUS server enables role-based IP access control, allowing the VPN gateway to restrict access to specific internal subnets based on the user's role, which aligns with the need for IP-based network access control.

Answer

Deploy SSH tunneling with certificate-based authentication and configure iptables rules on the bastion host.

Answer

Deploy an SSL/TLS VPN using client certificates and rely on the VPN client to enforce access policies.

Answer

Deploy a RDP gateway with certificate authentication and restrict access via group policies.

Question 8

Which of the following is the primary purpose of input validation in application security?

Accepted Answer

To prevent injection attacks by ensuring data conforms to expected formats. Input validation is a security control that ensures user-supplied data matches expected formats, types, lengths, and ranges before processing. By rejecting malformed input, it directly prevents injection attacks (e.g., SQL injection, XSS, command injection) where an attacker embeds malicious code within input fields. This aligns with OWASP's top application security risks and is a foundational defense-in-depth measure.

Answer

To improve application performance by filtering out large inputs

Answer

To encrypt user input before storing it in the database

Answer

To log all user input for auditing purposes

Question 9

A global financial firm must comply with GDPR and SOX. The CISO wants to consolidate controls across frameworks using a single set of controls. Which approach best addresses this requirement?

Accepted Answer

Adopt a unified control framework such as NIST SP 800-53. Adopting a unified control framework such as NIST SP 800-53 allows the firm to map controls from GDPR and SOX into a single, comprehensive set, reducing duplication and ensuring consistent compliance. This approach leverages the framework's catalog of controls, which can be tailored to meet the specific requirements of multiple regulations simultaneously, aligning with the CISO's goal of consolidation.

Answer

Focus only on the most stringent regulation

Answer

Implement automated GRC tools without changing controls

Answer

Maintain separate control sets for each regulation

Question 10

A multinational corporation is implementing a privacy program that must comply with both GDPR and CCPA. Which approach to privacy impact assessments (PIAs) is most appropriate?

Accepted Answer

Conduct a single PIA that covers both regulations' requirements. Option B is correct because conducting a single PIA that addresses both regulations is efficient. Option A is wrong because separate PIAs are redundant. Option C is wrong because PIAs should be conducted before processing. Option D is wrong because only high-risk processing is not sufficient for all processing.

Answer

Perform separate PIAs for GDPR and CCPA requirements

Answer

Skip PIAs for existing processing activities

Answer

Only perform PIAs when processing high-risk data