CAS-004 Practice Test 1 — 10 Questions

Question 1

A security audit reveals that Docker containers are built with multiple unnecessary layers and utilities. Which practice reduces the attack surface of the container image?

Accepted Answer

Use a base image with only the required packages. Using a base image with only the required packages directly reduces the attack surface by eliminating unnecessary binaries, libraries, and services that could contain vulnerabilities. This practice aligns with the principle of minimalism in container security, where every extra package increases the potential for exploitation. Unlike multi-stage builds or RUN command consolidation, this approach targets the root cause: the contents of the image itself.

Answer

Use multi-stage builds

Answer

Combine multiple RUN commands into one

Answer

Delete the apt cache in the Dockerfile

Question 2

During a threat hunting exercise, a security analyst hypothesizes that adversaries may be using PowerShell to execute commands in memory. Which threat hunting methodology is being employed?

Accepted Answer

Hypothesis-driven hunting. Hypothesis-driven hunting starts with a hypothesis about potential adversary behavior, then searches for evidence. IoC-driven uses indicators of compromise, and TTP-driven focuses on tactics, techniques, and procedures.

Answer

Signature-based hunting

Answer

TTP-driven hunting

Answer

IoC-driven hunting

Question 3

A compliance officer is reviewing logs from a web application and finds multiple failed login attempts from a single IP address. Which type of control should be implemented to reduce the risk of brute-force attacks?

Accepted Answer

Account lockout policy. An account lockout policy is the correct control because it directly mitigates brute-force attacks by temporarily disabling the account after a predefined number of failed login attempts (e.g., 5 failures within 15 minutes). This prevents an attacker from continuously guessing passwords from a single IP address, as the account becomes unavailable for further attempts until the lockout period expires or an administrator intervenes.

Answer

Network firewall

Answer

Password hashing

Answer

Encryption of traffic

Question 4

A security analyst is collecting evidence from a compromised workstation. Which of the following should be collected first to preserve volatile data?

Accepted Answer

Memory dump. Volatile data such as memory contents, running processes, network connections, and encryption keys are lost when the system is powered off or rebooted. A memory dump must be collected first to preserve this evidence. Hard drive images, network captures, and event logs are either non-volatile or can be collected later without the same urgency.

Answer

Hard drive image

Answer

Network capture

Answer

Event logs

Question 5

A multinational organization is adopting a zero trust architecture and needs to align its network segmentation with regulatory requirements. The compliance team has identified that certain data must be isolated to meet PCI DSS scope reduction. Which of the following design approaches BEST supports both zero trust and PCI DSS compliance?

Accepted Answer

Implementing microsegmentation with software-defined networking. Microsegmentation with software-defined networking (SDN) enables granular, identity-aware isolation of workloads at the virtual network layer, which directly supports zero trust's 'never trust, always verify' principle by restricting lateral movement. For PCI DSS scope reduction, microsegmentation allows the organization to create a logical, auditable boundary around cardholder data environment (CDE) assets without relying on physical network topology, thereby reducing the scope of PCI DSS compliance assessments. This approach is superior because it provides dynamic, policy-driven segmentation that can adapt to regulatory changes while maintaining strict least-privilege access.

Answer

Deploying VLANs to separate cardholder data from other traffic

Answer

Using network access control (NAC) to enforce endpoint compliance

Answer

Placing all systems that process cardholder data in a DMZ

Question 6

Which of the following is the PRIMARY purpose of a business continuity plan (BCP)?

Accepted Answer

Ensure critical business functions continue during a disruption.. The primary purpose of a Business Continuity Plan (BCP) is to ensure that critical business functions can continue during and after a disruption, such as a natural disaster, cyberattack, or infrastructure failure. Unlike a Disaster Recovery Plan (DRP), which focuses on restoring IT systems and data, the BCP takes a broader organizational view, covering people, processes, facilities, and third-party dependencies to maintain minimum acceptable service levels. This aligns with the governance and compliance domain, where the BCP is a strategic document that addresses operational resilience rather than just technical recovery.

Answer

Assign roles for incident response.

Answer

Restore IT systems after a disaster.

Answer

Establish procedures for data backup.

Question 7

Refer to the exhibit. Which security issue does this cloud storage bucket policy present?

Accepted Answer

The bucket allows anonymous PUT operations from any source. The cloud storage bucket policy shown includes a `Principal: "*"` with `Action: "PutObject"` and no `Condition` block restricting the source IP or requiring authentication. This means any unauthenticated user on the internet can upload objects to the bucket, which is a classic data ingestion vulnerability. Option C correctly identifies this as allowing anonymous PUT operations from any source.

Answer

The bucket allows anonymous GET operations from any IP

Answer

The bucket policy is too restrictive

Answer

The bucket is not encrypted

Question 8

A healthtech startup is developing a mobile app that collects PHI. They plan to use a third-party cloud provider for data storage. What is the most critical compliance requirement before signing the contract?

Accepted Answer

Execute a Business Associate Agreement (BAA) with the provider. Under HIPAA, a Business Associate Agreement (BAA) is a mandatory contract that ensures the third-party cloud provider (a business associate) will safeguard Protected Health Information (PHI). Without a BAA, the startup would be in direct violation of HIPAA's Privacy and Security Rules, regardless of other security measures. This requirement is non-negotiable before any PHI is shared or stored by the provider.

Answer

Verify the provider's data center locations comply with data residency laws

Answer

Review the provider's SOC 2 Type II report

Answer

Ensure all data is encrypted at rest and in transit

Question 9

Which of the following is the correct order of the security policy hierarchy from highest to lowest?

Accepted Answer

Policy → Standard → Guideline → Procedure. The security policy hierarchy from highest to lowest is Policy, Standard, Guideline, Procedure. Policies are high-level statements of management intent. Standards are mandatory requirements that support policies. Guidelines are recommendations. Procedures are step-by-step instructions for implementing policies and standards. This order reflects the decreasing level of authority and increasing level of detail.

Answer

Standard → Policy → Guideline → Procedure

Answer

Policy → Guideline → Standard → Procedure

Answer

Procedure → Guideline → Standard → Policy

Question 10

A security architect needs to protect sensitive data in use within a server's memory from other processes. Which technology should be implemented?

Accepted Answer

Intel Software Guard Extensions (SGX). Intel Software Guard Extensions (SGX) is the correct choice because it creates hardware-enforced enclaves that isolate code and data in memory from other processes, including the operating system and hypervisor. This protects sensitive data in use by encrypting memory pages within the CPU package, ensuring that only the enclave code can access the plaintext data.

Answer

Secure Boot

Answer

Trusted Platform Module (TPM)

Answer

Hardware Security Module (HSM)